6374b0f92378659ad44cdd2f5423f22b341a0b1543289727e629097abbe8d9be

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 10.2MB
Sample260810-eblf6avtby
SHA256 6374b0f92378659ad44cdd2f5423f22b341a0b1543289727e629097abbe8d9be
MD5 ef28384abcbc8b60ce880187752abbfc
SHA1 ef6f5c57d0a2fcdb0eac70a84799c533dd28ecba
SHA512 aeae8985a36f9ce42e889b2889ba82d459a3bed45af229ee27a7273375ac9b3fb6e8e7b4af3395bf588e660956fa724888cd772c0f5d9ad6412212828c716332
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+Eg:R/fh6ImzzJoDfuBcMv+A73XAg
TLSH
T146B66C08FA9750F1D9274170489BD37F8630BE2583218BFFDB84DA7AE923BD15835A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
3092	svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe
4204	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACAACACABBBABACCACABACABBBBBACBCBABAABBBBAABABCBBAABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe"	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABBBABCCACBBCBCABACCCBAAAABACAAACCBCCBABACBABBBBBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe"	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4424	sc.exe
1660	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
3504	cmd.exe
2764	cmd.exe
4780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1176	schtasks.exe
5264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
4204	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
4204	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
3092	svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe
3092	svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
Token: SeDebugPrivilege	4204	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
Token: SeDebugPrivilege	3092	svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4908	1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	93
PID 4908 wrote to memory of 1176	4908	cmd.exe	95
PID 4408 wrote to memory of 2096	4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe	96
PID 1272 wrote to memory of 3504	1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 3504 wrote to memory of 4424	3504	cmd.exe	101
PID 1272 wrote to memory of 2764	1272	2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	102
PID 2764 wrote to memory of 1660	2764	cmd.exe	104
PID 4408 wrote to memory of 4780	4408	svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe	107
PID 4780 wrote to memory of 5264	4780	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ef28384abcbc8b60ce880187752abbfc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABBAAAABCACCCABAABABACBCBABCABBAABBCBBACAACAABCCAAAACBCBAACCBCCAABBBBBACCBCACBBABBCAABAABCCCAACAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABBAAAABCACCCABAABABACBCBABCABBAABBCBBACAACAABCCAAAACBCBAACCBCCAABBBBBACCBCACBBABBCAABAABCCCAACAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCAABBACBCCBBABABAACCCACACBBBBBAAABCABACCBCBACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe" start= auto displayName= "UserDataSvc_CCACCAABBACBCCBBABABAACCCACACBBBBBAAABCABACCBCBACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCAABBACBCCBBABABAACCCACACBBBBBAAABCABACCBCBACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe" start= auto displayName= "UserDataSvc_CCACCAABBACBCCBBABABAACCCACACBBBBBAAABCABACCBCBACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCAABBACBCCBBABABAACCCACACBBBBBAAABCABACCBCBACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCAABBACBCCBBABABAACCCACACBBBBBAAABCABACCBCBACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCACBBCABBABAAABCCCAAACCAAAACBCBAACBACAACBBCCCCAABAABBACBACCCAACBAACCABBCACABBABACCCBAABBACCBCBCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCACBBCABBABAAABCCCAAACCAAAACBCBAACBACAACBBCCCCAABAABBACBACCCAACBAACCABBCACABBABACCCBAABBACCBCBCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCACBACBAAACAAABAACABAAABCACACACCBABABABACBACBBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 95f12fb620662fd18fbf3b6ef2d0a5a0fb45e0c1c89e9cb85a46277f88f8fa1c
MD5 8c669624e0b947bda671a06c87391031
SHA1 29a1d2cbc0188c41f88a86366dd70be6e35914fd
SHA512 72238615a7a53f0ca3904ace7338c033fa6c4f99ffaf3282fdeba06cf2b277f5d6e39ec79d7c6f6726f6622217a64d50de720da5f2ab532dd3d27824e51035fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\FAEF76FD-DFD5-4FF1-9BCF-4FEC3B576D71\x-none.16\qap`g`v~dtlq
Size 10B
SHA256 4994b565c05449d68d4280185f967429bbb9c0929fd4a9c1b9673225ff926596
MD5 9521997fbe5eb47ae6957c1287b12f84
SHA1 d9120f41fbbf6f918a09b1b787b75db64c0bf14f
SHA512 c246bc79bb376ff6afedbcdbe7c13337b11aed979230c3a0216a06de8c5aff4ce7aaa235e045334fb20ad640ee32f269d15c6f8f9d99c23e86a0be9c0b062cf9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Network\qap`g`v~dtlq
Size 10B
SHA256 16d9ae7fcf7f06b8102216c499fdb4378d64763459214830a32f454fe30690cb
MD5 79b68d657accd40af99a85fd154efede
SHA1 e413bbc34ae8d114776a5ef082e463132fa8b8f7
SHA512 ceda670fe33c3aed3798b1e9c5c70a9edb4061344de25a86bc8bed126d2b6a523cab9d135358dfeff11617f1e454eabd1342776adb732cd90030bd1e4f49e0c7
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.8MB
SHA256 711f078794ce9d3e38cc86247434fb77e5e67c9ecf48c085c6a8c4ecdbdbb7f2
MD5 d9f47e7530d083a398595950aefa85da
SHA1 990887fdbad433b4109f995019c4f1fc3754bafe
SHA512 f05f05e4df915389bc534aa365d091282b561e3923290f37701e8ea1724918f2d19910c0d7c0627a7ba142addf7651f63202c0ca4ee2348d94b39c850d26cb2d
SSDEEP 98304:R/fh6ImzzJoDfuBcMv+A73XAfgZ2Hb9t+2x4:RHh6ImzD+FfgZ2j4
TLSH
T105B66C08FA9750F1E9274170489BD37F8630BE2583218BFFD784DA7AE923BD15835A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 77def51d9025c740e1ee90f6d2951c2165a5e4766ccc8842fbbbf5be95292c1f
MD5 632c4b7b7410366c5312e9ee9e717397
SHA1 7fee5c410af7074b1aa3c54a414abc5b866025a1
SHA512 f0eb42b33a086b11bea318dd24c813aad2811b5acee8712e4491ce3a6d0832f09007f59025d352c57bb54feffc24de6c4ebba513499cfc94cc536f9d1779f3b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 93c03104140fc1694b08a356cade50551b2a9351a1338288229b62aa016a9099
MD5 ac0d1026d4976889911758e97e198bb4
SHA1 7d27db69b4936f6a369f713583fae37ec5c7b735
SHA512 8c4857435f241197fac187fe882f801ea62957d67cd1807c1a67729090ba32893e3d66d41c383fc045be1a3b4f6dbece0399bc47aadc72db0d10dd667199d169
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\qap`g`v~dtlq
Size 10B
SHA256 6d881b9b989b60b4afc03da0a9043bf8b1b9f4730fb86286e7b2dcba0b66f13d
MD5 c1c5a42c475ae0647e98e00604ef1b6b
SHA1 aedfffa199c05e421007f1e8821d1b1676779492
SHA512 b6a51ce9e20a06fe657507ceed9cd51204646fbbd02809c3270f39bf191a6679b82177a80f7531961e4e7bdef636346320a3435b78feda08c9627a74106a6d87
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 2b085baaf9321574d0c98bda7c3a5edfaf4350f5a3782614dce0e50f36834222
MD5 5885f22a6846878eb047098f9e9b95fe
SHA1 8dedbcf609cbff7ea96e75f22f648e750a433408
SHA512 ee8b12a7351aba35da4c3d90c7f4554d061ec9a76fedcd6242abea5acad6b5f2c959f5521319c973acf53783151c44e46b17dbe115a9f70d0319174c55c5ef7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zh-TW\qap`g`v~dtlq
Size 10B
SHA256 32ac5fe6e5ad79308c25c33278eeeb83ecea57d1da7adb7e57d496d528ef064e
MD5 e594af9be717b52760579d628980dced
SHA1 e7a8024e03b9006fe6e79f02f58262146fec9977
SHA512 4e8ac6eb2948806ee3fe0ecd28fdbd8693bd784a232640f74932c2c7cc6feba52461cac8fdd9ab9af34b47a12d214f3e482535ffee20075e249ffa7598c95df4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\qap`g`v~dtlq
Size 10B
SHA256 01b5fc189c92ecf6a9f7754b183b11dc44c97d4d29f7296c3f89d1f8e5456ddf
MD5 2ce905d365cd152befe2f58fb661a263
SHA1 9102ca0b696ab04332679a6859adf957d5261a29
SHA512 46338b87cd2c248f56fcdb899fa9cd6b277de3bb0a696d709a89e650c021ceac96b124dd2ae32e66501861f6e892f4fe6b5b46278e6309e0cd622b6e427b77de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 623035004ed554c17de96ea142a49812c8323873897b93143b8db5eb71fe71e0
MD5 71d12d4a981b6bf6510f736efd183cd6
SHA1 7a8d3f1adde392e30ed917eafa3d300193a545b4
SHA512 196f1f0defdc88363c47bb5b4b9ac4860e5667e7055059cef64cc4c47cb177292134700effdae1ec5cee46c3a716afdecd02d5dce1e6cf14156bc96f1fc55d23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd106727dbd6a12ea4f18906de0ad889db5d8d4c4067fa9f80abf0b3fe571813
MD5 1b654d77a311cbeece75e6dfec2d2c23
SHA1 653875703e66e9a6f048cd0a4af007f6893617d9
SHA512 bd6fee1d061dbae7f5f3259adbf9d3e4a7da10213b44a08d2784c1fc6061d97558159fe4baa405a605f4f4fa950c0b717791cedd39223abf5ae17d7204ee44cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4cbf44d605f9043cbcaefbd92b749aff7a348422779beee03d092840a3f640d
MD5 34624846024fba4aab5bb2d496b9a4a2
SHA1 94d90ece99028f7f134a9dbb20db87c3fbe706cc
SHA512 73d02d3bf6006eeb07dca5d0f20b00d38140db49ba767d99913c2f6395e6319c9528e68b2f8453669a22d38a305cf3022386fd1299394befa93adc3a7b6e57ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f0eacee0e7332555189f1f9d6e50184f1ab8f9f945dcd55f0e58b63c476b48be
MD5 0e230a631fb5e8a9f08605fa3a036415
SHA1 095c03473d01dc753af1b3eb50f923e2a47cc05c
SHA512 4d32fc78eb30de439d4871e31b1ca7c55f28d55b3277cf92a2b639f868ea415ff7f8bdc0ef0dbe14462ca4d764d147be5cf40b2e95dee36f3939a86b620023c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3552b3868a7e260773766ea5e50f0958e7b3d7024fcb22f80f282256dc2cfca7
MD5 2cd660f53464d8d237d9a0deab674ff7
SHA1 b5d95dfb2a6fb3badc76c73eb3d7f7fa6d123483
SHA512 a734de335b1b5d9d258a05dd38c1e3a2741952d0d415c7aabd8e86dce72dcb1f3ae5edd22e245b5896ecc7a61e7f823a0370304c7fff853a12b340669fe005e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9a18a681baf20d718cc68b04cb5cf059697a67c58bcc11445c5defc41589039
MD5 d7e3b4ab3e2bd58c481aea17d021f74a
SHA1 6a6c701ba9c5dc8c740eede6925cfa3772eeb0b6
SHA512 9d3f308115f30bf591421a3beeffb092c77e05406b8f83a5c4159fed9087b65944fe3f34b503892381b2e142e7ac5d20a5b9926ae563e005e54df98d27d170c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 addbd0bd4391639cf8f04ae0d19ae220e9f6c63afcd3389700aa8c6db6c671a2
MD5 e42259c77c641b3eb8e4835bbcdac317
SHA1 39fdd7ed6117b04da13be1cfdedc338485e3c66b
SHA512 22febe9bac278915ec436020296a31bfeed76f9db12f94f455cbea50bfc44ea6c98f6ab788228a39b672fd5f40b02c82953d2b5b60e3a5f5a39c0ea78cb600b3
MD5 SHA1 SHA512

Submit Download

svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCACCACAAACBACBCABCBBBBCAABBCCAACAAACACACBCBCBBBCB.exe
Size 10.2MB
SHA256 6374b0f92378659ad44cdd2f5423f22b341a0b1543289727e629097abbe8d9be
MD5 ef28384abcbc8b60ce880187752abbfc
SHA1 ef6f5c57d0a2fcdb0eac70a84799c533dd28ecba
SHA512 aeae8985a36f9ce42e889b2889ba82d459a3bed45af229ee27a7273375ac9b3fb6e8e7b4af3395bf588e660956fa724888cd772c0f5d9ad6412212828c716332
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+Eg:R/fh6ImzzJoDfuBcMv+A73XAg
TLSH
T146B66C08FA9750F1D9274170489BD37F8630BE2583218BFFDB84DA7AE923BD15835A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bbe062b7aadaa72016c321f77c245e3e02f62641e6c1735501f3aa6b406c845b
MD5 89ad5e6af182815fe09078caa8ea15a3
SHA1 88ce11479aae4e2407a84e32c1887e4cbe496fe2
SHA512 404cb4ba2c5126519737fc907dbcfd09c69409f2c397c212e48cd34fb630b5e151e72d958e3281c98929641a4fefdc0b2fb76f6d19ee13716716bc73cf9c79da
TLSH
T160210BA064E9CC53FD3378CB960A9BA20CF8399FB8587E64220587187ADDC31CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 88ca7e1b36e5941a4c1bb570c70c90da3db99f127cf546942adddec17161db9c
MD5 1b9d017af17db987724f464c3f4a0cfd
SHA1 fe2bd00ca313c928f2eb51a9e04a1bf3763fbc0b
SHA512 6b66b17e65200aaedb66dbc03641f3fed25a8dacf34ff0141935d4aefdd6a277e6fc1bfd7ff25137f5e3305c98b1c195f39fff60fefec8c8b20028ab87410d4c
TLSH
T10521BC6174E9CC57F93378CB961A9BA20CB83A9FF85C6D5012058718ABD9C31CD554E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c502ea9ff4440fd0fbe93f3bf39401cfdba824a0530b42651f6c9b5565d63d4d
MD5 5f5e13cfa1471221057be0db124f5fbe
SHA1 1bea80e0b0543e8a463c6b99d5c996b910699ee6
SHA512 f4e1517a2a6c041e3ab1f33d88b5d561beead7fa18e470bee0805449b09061972b1fde7c5d64b8145811e11f39d9f040b653ac9b09241132bba9cac19c3d43aa
TLSH
T12C11EBA064E9DC53FD3378C7961A9BA20CF8399FB8586E642205871C6AD9C31CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-0-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1272-7-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/3092-63-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/3092-4078-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4204-2388-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/4408-33-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download