256a79da9b76a334296cddb760656fff6b1cb17786417ef780e08ebc9f9b8986

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Size 10.3MB
Sample260818-dbbfhsvbqh
SHA256 256a79da9b76a334296cddb760656fff6b1cb17786417ef780e08ebc9f9b8986
MD5 cffcd1775547f247f5c2835c5f2fb3c1
SHA1 b7a7b84a5ee6a0797618c1381623cd160b317423
SHA512 65663e68dd5639cb52ad00982b4eb286d4d471f6cb07eabca39b1a32649a14721fb1f93e7144e1b9433ee1416fb813ec25afd8bb9acd2c8b9654bd7464a505c5
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+EU:5Bxp7X
TLSH
T103B65B09F94340B1D92B10B04DDBD2BF8A70BA2587128EEBF68DDB1B7933BE16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
4404	svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe
5932	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAACBBBACCBABBBBCBCBACACCAAACBACBBACBCACCCBCBBAACBBACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe"	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBAAAACCBCAABCBBCABBBAAAACACBCBCCBCBCBBAABCCCAAACCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe"	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2912	sc.exe
5472	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4004	cmd.exe
4100	cmd.exe
5460	cmd.exe
4580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1124	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
5932	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
5932	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
4404	svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe
4404	svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Token: SeDebugPrivilege	3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
Token: SeDebugPrivilege	5932	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
Token: SeDebugPrivilege	4404	svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5556	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4004	3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe	112
PID 4004 wrote to memory of 1124	4004	cmd.exe	114
PID 3192 wrote to memory of 4472	3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe	115
PID 4472 wrote to memory of 4336	4472	notepad.exe	116
PID 3116 wrote to memory of 4100	3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe	120
PID 4100 wrote to memory of 5472	4100	cmd.exe	122
PID 3116 wrote to memory of 5460	3116	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe	123
PID 5460 wrote to memory of 2912	5460	cmd.exe	125
PID 3192 wrote to memory of 4580	3192	svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe	128
PID 4580 wrote to memory of 1628	4580	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBACCBBBABABAACBBACCAACCACBCBAACAACCCBABCCCABCBBBACCAACACBAACBBBABBBBABAAACBBABBACBABAAABBCABACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBACCBBBABABAACBBACCAACCACBCBAACAACCCBABCCCABCBBBACCAACACBAACBBBABBBBABAAACBBABBACBABAAABBCABACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe" start= auto displayName= "UserDataSvc_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe" start= auto displayName= "UserDataSvc_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABBABABCCACACCCBABBAAABABBBABBCCBACBBBCCCABBCAAACCBCAAACAAABAABBCAABBCCBABABCBACBBCCBBCBAAAAACABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABBABABCCACACCCBABBAAABABBBABBCCBACBBBCCCABBCAAACCBCAAACAAABAABBCAABBCCBABABCBACBBCCBBCBAAAAACABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCBBCBABBACCCCCCAABACBBBACACAABAAABBCBCCBACAAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e873fb04a905f9b4cbd2868c2c1c951949e71ff874ebf729d9d2a7472367e3d1
MD5 2513e2d7dd28623e06266d7c89bf99d5
SHA1 326a3ce33a2897c117a15682d504fe88ba9b67b8
SHA512 69c46c5f6201aeec1ca1f51691a961e00790f3873ddd74832f13a5160749961c49213c964604b991ad256c94093e9bc42827236ba8732ca8045d38d82e6abad2
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.8MB
SHA256 648c899675c46fa53663f016dbc3b7f944e602755b0c9b97d7ff925ddc2576e4
MD5 51f22ba312925a7f5090775e854e787d
SHA1 d9fdfdf152f18b9d41267305f7139938a6e63ec1
SHA512 a1add10ad2c9f94944c67b68c2c63b5a8e854238b68d91605fdd11c059ee6cabd09abced6d92e07d355b9f5e0f79fbf6870c2c3408a8c4a14880f8d35fdd789b
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Eh:5Bxp7cpiA
TLSH
T1E6B65B09F98340B1D93B11B04DDBD2BF8A70BA2187228EEBF68DD71F6932BD16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Vault\qap`g`v~dtlq
Size 10B
SHA256 6d3ec90472837a44bf2302c06f28f40213ca6b6336a5a3a6f735d3707e6f4718
MD5 9aa458dde677732bb2cb29285ca8cde1
SHA1 263dff303485306a877d45dba771c4ad0f4276d9
SHA512 9424774cd86e8575eb40660ea59ac4971299eb5a05150f440b5315c234c0dd25d4b333e7e30189fcacbe6139fbebd91f5ac6a98f10dca81ce88ab71c062aa3c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 34377917b72a65a8fe9805c20d2af3caec7db50fe845ed6e414b845717132b8b
MD5 125b19ba25ab5751208aa8fb8410cbcd
SHA1 e26ab87d905ca3f5699b700a46b16d38841c47c8
SHA512 5387dcee516d6bee4ad7c12481aa8b5d7342de782bfceaf7a6c5729362dde32c79f26fb4b61ccd114076c39499b2aafb551ba4b62ba7e634bf263448e126f9b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\qap`g`v~dtlq
Size 10B
SHA256 c24f593072f249de5d671d364ea358e8a8a7ca8ae9e78b7ad3120bd6fb11c84d
MD5 93d7c89493fba4205db184e153f2df04
SHA1 962944b177581129b3c5215fb93aae3d6e53461e
SHA512 fdc468989d3fa9edfcac1b2a8ca993f52ad24904da902157b26b707fabf59cce7067bdbfff662f7332aacfc6a81729ba0d098b591bbb0d87b2dff769817f6df0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ml-IN\qap`g`v~dtlq
Size 10B
SHA256 4107c545771b41065fc1fe953adaa951128f1c880b8b0b903ad79aa61fa8ca29
MD5 1a4c5ac7a954aa61c71bf747bcd7dc49
SHA1 bac8f05139d1ea8912eaf4f490f014c0f3726d1f
SHA512 c8ed99e5957b3fd1bc2c6ac557707406c45377498f0d7fb0125007fb6d8dec7beaef1d5b7c044fd390f79567b3fc0e0a5c0d61c9e0c73ea58fc275d6e53041cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 13dbbac133dff4bd3a8ecd63581f4bf0f7412728ec1538a69c676c17e156444e
MD5 f61d3119e35eaf8993bd3804139f5d16
SHA1 0505e69d9f5d6ef4c03a14fa967feba99b1c3bc0
SHA512 e34f0581e9f6eae5d142d3832420c33e17f48f9857c5b01c87c05f961e9e15d1fae1a245ec5221651910223d40aeae5e5e0069de120b7436cdcc7ce12cf9e9f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 3fe5c589ca9cf136b74e6013a1f483a492c2017369522b195d8215f8b1a1b89d
MD5 4db519a8b10eb9bc6ec8f91306a64211
SHA1 385835650a2fe381a3de001b4f7fbcdba0c56b83
SHA512 59b0268bf9f23a86137eba83b9335f476418296d6a30e7c8d2497b2a84a955640cd19891cba97027254a813555d1c06d594c43eb406d7c6cb147ff71e20dc446
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 742eb210d66d02a1be831da05f840ffe16c6bc9f5e32c631743d04e425e91977
MD5 1f27e52a90c282eda20b95cfa9b00f7f
SHA1 d5b4ecc0dc82547bc9999b401a9134494efea11d
SHA512 d359b75a126f354160933f59fa76651120fbe2a71127fc2ac40dcfd0b901a0780a320193c79bf50653a99af85f1f7b7bf499c73316beb235e812d30743a9e6c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 589dda9dad5dec2200512f7d07e11bb04e9042b800d55dd57045ee102de00055
MD5 3decaa2ffe802d88c09c16e5f7f26e25
SHA1 7c405b38df4ea44d518f7e01d6a61b74132d28fe
SHA512 8e720c1c53f4cca942ce31661f510aeac0a69ee6b489b3deb67d02a9c9bcce8deb1b449a4bc77cfd8faf7f9a0e765e0c48103ab6db0a0e1060a5300913f3256b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5f7effaf110ef4b9a0824735deabfe2aa61c2cba37cb92c5e35e549afa2593f
MD5 b47926f17c225f80b08b89e988377fb7
SHA1 464fb62c0d2e1e29bcf61c09d5c20025a0407caf
SHA512 ab116034a493b4065a0245d5ff3409bf676ee8a06432a82d310193c46ba806f80c29b2fbe9ac78b5c2f957d22466e64c77e3fe4715f91677b879de0c646e577d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f954fc19bd5b08e5843cd411a24b5b678d64b09aa1430e59198a2b7b7e6b7c96
MD5 360df3a86fed198bab8687e901380e60
SHA1 2946eb861fac67cbef35fab303840edb99abc44c
SHA512 562c5f227e7ade7487e7612b663e7d8fe7ae8db052b7400246ed3d20d92d4d088dc6affea1ba872922543fbc1bad136c356d7d9cc2c7b2a93194c9437da75361
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9ec426cf51d6bc825fd51f753069bbb2fd74e9c7ca747d03414cc5851d36d491
MD5 7bdce5daadc643647084909d1e943e7b
SHA1 cf8a128e1919e934e18a24e28996c4a0497b42b0
SHA512 67b6bea0858e533668bb003cc2e944e51710e06003319850f6760ebe769eb21e99b5a13edb57d214b404733b7550fc5eb363ec29f0e655e2f7a49aabd247a2a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3de1f5b00b7c084d0e9b72eecffdb07afb7b2c6d74b5ea4b5922f08c915b5c46
MD5 405156bd81181042abbde0377b0e3e16
SHA1 8863d8dc175ae74348475c2248c4c3bd8f75b39d
SHA512 8e27ea9f111a2eabd211e442730f4d0a02949da455c981d6bb5ca4e293a6c9d41f47b259327c01d5cc2b998abed4c44d519904ddb9f47da6138e177cc2cac86e
MD5 SHA1 SHA512

Submit Download

svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABCABACAACABABACCCBCBBAACACCCAACBBBCBCACBABCBABBBB.exe
Size 10.3MB
SHA256 256a79da9b76a334296cddb760656fff6b1cb17786417ef780e08ebc9f9b8986
MD5 cffcd1775547f247f5c2835c5f2fb3c1
SHA1 b7a7b84a5ee6a0797618c1381623cd160b317423
SHA512 65663e68dd5639cb52ad00982b4eb286d4d471f6cb07eabca39b1a32649a14721fb1f93e7144e1b9433ee1416fb813ec25afd8bb9acd2c8b9654bd7464a505c5
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+EU:5Bxp7X
TLSH
T103B65B09F94340B1D92B10B04DDBD2BF8A70BA2587128EEBF68DDB1B7933BE16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2945a997a516da6a5f8d283283aff48c5357b8d81ebea50a753da6520880869a
MD5 57d84f160c0c2c0b1a14a26f348992d3
SHA1 53ba0ed3ec42aab82d55e742b58547747cfee3fd
SHA512 d77bd61c3b3088e6a8563d20a021ac68a5cd45bdd51afe6c0eabc211775308aa64ded2667fafc0de89980907ddfe014f6b0824a16e3a55f4028b23916d5a1676
TLSH
T1C221D160E4EBCC53E93265CBA219ABC24CE9369BAC587A002309921C7FD9C31CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bfa123fe0e6b55823faa8631e82f4aba63557bc3bf03a21c1e0bb970a4cad573
MD5 850e07a661660f62cfc50ffd0d5e7f6b
SHA1 49955b1ded4f21b29cacb4f2eb701701b18537fe
SHA512 a78192bd1cad20583614a3d6b842b61614d5ad7397f8cc540c92c05d0cf32d6819d8853bbfab689af10703a96c7b0cb5db0fbb3ab0322941419d9afed3fd54ec
TLSH
T12221A670E4E7CC53EA32A5CB9219EBC24C99369BAC5C6A40130E9618BFD9C31CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 4391e08a50b41ad35bb39340b04f6078df0c71c806f57496db4efd44201228e4
MD5 d06170778394c6dc72a4f0a4b926dee6
SHA1 6f9b48962b4c80838f16c7ad040c65194a118de0
SHA512 8bf84cade1975ac896ffd9f1d44ee109c79a232d5f63f36f12d2982d6767c302a1a20c1947cc00a227c79b6c26bd0cf4d5a8d71ce2ee674a70adbb8ccb4227c9
TLSH
T14F11E760E4E7DC53E93275CB9219ABC24CE9369BAC587A041309921D7FD5C31CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3116-6-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3192-36-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/4404-71-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/4404-2915-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/4472-59-0x0000000005390000-0x0000000005391000-memory.dmp

Download

memory/5932-82-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download