0738554f32c3ffae29e74ccb4ab0effe22bd995d6e18dc9d9a5143c5bb8c286b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 4.7MB
Sample260811-cptctayyft
SHA256 0738554f32c3ffae29e74ccb4ab0effe22bd995d6e18dc9d9a5143c5bb8c286b
MD5 d9285a2e46606977ef660d591c18cbed
SHA1 e8533dbd9b5243fbc35c44f884daa57e1e2aa1fe
SHA512 5d7fccf4074583a4393f43b0d05d8a498cd615662176bb2625df734c45a54ac4960a349b63a68ce1906b4ac0b26d12f178050c47c85ee9020a1e497aaca4d62b
SSDEEP 49152:U+Ea+Ea+Ea+Ea+Ea+Ea+Ea+Ea+E3KKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAq0:q/fh6ImzzJoDfuBcMv+A73XA+
TLSH
T123366B41FDDB94F5EA03563048ABE37F6330A6098336CBD3DA448F57E917AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
2904	svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe
4628	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAABACBBCCAABAABAABBCCABCACBBCACCCCBCCACACACBBACAABBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe"	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBAABACCCABBBAAABCCCABACACBACCCCCCCBCCBBBABBACCBBCCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe"	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4408	sc.exe
4492	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe
5720	cmd.exe
3028	cmd.exe
724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
680	schtasks.exe
2272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
4628	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
4628	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
2904	svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe
2904	svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
Token: SeDebugPrivilege	4628	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
Token: SeDebugPrivilege	2904	svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5600	2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	91
PID 5600 wrote to memory of 680	5600	cmd.exe	93
PID 3024 wrote to memory of 3388	3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe	94
PID 2884 wrote to memory of 5720	2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	97
PID 5720 wrote to memory of 4492	5720	cmd.exe	99
PID 2884 wrote to memory of 3028	2884	2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	100
PID 3028 wrote to memory of 4408	3028	cmd.exe	102
PID 3024 wrote to memory of 724	3024	svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe	105
PID 724 wrote to memory of 2272	724	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_d9285a2e46606977ef660d591c18cbed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBCCBBCACCABBCACBBBABACACCAACCBBBBACCCACBCBCACBBAAABBBBCCCBCABABBACBCBACCCCAACAACCAACCACBCAACBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBCCBBCACCABBCACBBBABACACCAACCBBBBACCCACBCBCACBBAAABBBBCCCBCABABBACBCBACCCCAACAACCAACCACBCAACBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABABAAAAAABBCACABACBABCCABAACAACAAABBABABACACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe" start= auto displayName= "UserDataSvc_AAABABAAAAAABBCACABACBABCCABAACAACAAABBABABACACBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABABAAAAAABBCACABACBABCCABAACAACAAABBABABACACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe" start= auto displayName= "UserDataSvc_AAABABAAAAAABBCACABACBABCCABAACAACAAABBABABACACBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABABAAAAAABBCACABACBABCCABAACAACAAABBABABACACBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABABAAAAAABBCACABACBABCCABAACAACAAABBABABACACBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBABBABAACBACCBBCABACBCBBCBBABCBBABAABCCBAAACABBABBBABCBCCAABBCCBCCBCABBCAAABAABABBCCAACAAABCCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBABBABAACBACCBBCABACBCBBCBBABCBBABAABCCBAAACABBABBBABCBCCAABBCCBCCBCABBCAAABAABABBCCAACAAABCCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCAABCBBAABABBACBBBACBBACAAACBBAAACACCCABBAAAAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 711bb7b6e28bcc838d4d781e444e3f9dd0c4ed6e429f5987134c7a3bc92f6429
MD5 05998e80fdb642bf671c75914531a891
SHA1 58bb5728980b036f55d43866f57074d152c8b9e7
SHA512 626f62c825fa7aeee1c5de254db060f6a51b410b48a3381b951ad1ef10b665e52cc926acc237521dc143719f5e6fa8f66aa580ed6f21967a368095d7523bbf23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 da4c0e3889fb37f8d6737fc5489108a816aeff5c96203fa1c091683f83fea589
MD5 3399ea72e23cbd24075a1414be26aa14
SHA1 2df8eeff02694a17df1e2fd64f572bc8175788c3
SHA512 5d1ba84d8707cb1f13a64f3991660608098fd6a59906e3859ce8c8c8899fc2b7452a1ae4e247f0a0fbe1313d0c779019df4d7cce981f51d8c3707cfacb5eb0fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 485821a4ac62767a89147ae7f3e057706641679014f7da13313cf1a5d5af3ed0
MD5 f1f56b18fc34816c997729e435ca2f36
SHA1 9bda03f7d40ae6e52878bc2a99181aa08f9df1f9
SHA512 f26cc6b50b6be753eda21ef96473c15f99441ebe35a95913687e305986e1d587ed421cc8f078e672f191106576d77902cbd205213645685d7e90ab5a60dff283
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 4b554cfb8fec20984be912afb1883322e415297d6da2b87793cd14984fc8e270
MD5 e108013df57f27a5028cb3ed1e3e9c12
SHA1 192468ff4e80c6a5a97cedcf038fe65ef920f3d8
SHA512 1c83a55078e0621bdbb589db9743f5238a73c0ffb23133bd5c098bb94bf02938116e138c2d404079069f5de3e4da85751307096bb87fa4e8fa258cd7aca34d6e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.3MB
SHA256 50d76f1733bf87b1c08947dd4117906ca83dd3df465472d0f7b8c1a449ddcb68
MD5 6d9d3e306acc460ba55452d1016bd951
SHA1 8b2aa7bba356180feb9d80e36f581f3882bdf4ee
SHA512 6d9c90235ddd3dc6badeadcb6db90698a60d7e860554c16eaa49c98601a296460c9a649646222203d1ccdfbdec32df8ae3d578b93698813a8ad33a90fe5866b2
SSDEEP 98304:q/fh6ImzzJoDfuBcMv+A73XABgZ2Hb9t+2xc:qHh6ImzD+FBgZ2jc
TLSH
T112467C51F9DB44F1EA03063148ABE37F6730A6098335CAD3DB849F56F927AD21A37216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\qap`g`v~dtlq
Size 10B
SHA256 d426d70602a16a65cbd0ecc4aaf26bf61cbccc52c91c5e6c7d906f7202418c90
MD5 331a6727e6a2dd8a34ce4c5ec585d1e7
SHA1 da2458c872faa7c86df337b1b9f48d2890012424
SHA512 aa0544555d8c4b24e36bd0dea15487f57166658d96df72535c8ce8306d2223499185e33ff2971cd1292775ff9128c2b1b55e4512a7e5d5d1c1663eaead5fbb6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zh-CN\qap`g`v~dtlq
Size 10B
SHA256 51b34facea2b1c5f7544cbffde1cea94a5d48f4775d5b6cecf348b819d529442
MD5 200651195b131ae0d100f0dec847d83c
SHA1 30e5bbe62f64abf42467bc4c927aa701e3f91133
SHA512 e9000f6dfc97eeec79bbda86c2977049670b06f838b4a58ab6a401aaa0fd4988e1c67a4bfce288a4fcdc8047c8327cff3b67974df5bc9f4e072d97a4db1cb5bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 3a18aa08fb80889811d51e9366eb9b813a4635bfb119f22c2eef37be040e8c88
MD5 c37b4749b752eb13abb76ca8e78321a4
SHA1 0d1ae88da38899bf92a147773b14ab05c973eece
SHA512 74abd5870e2c299e5dd8630446ac3439ac7800d4a26f87b255ae4338f202e354038aca4c0a629a7d73465cadfac894a666082df8c8df7c008f75efa14570d856
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3b2d37fc5ad896a4d028f469795db6e2a13b925e5b317a7160086993f64f82c
MD5 0952afd9862163a0ff32168e3326b668
SHA1 d3b3213af24a147d3d305e74d73fd53860dc33e8
SHA512 3e681aa3fec6b3d2db99e06631265a03edc47d2bb9003bb28347fac1deac5ccc6070037cd7febe4e06a5ede3fa89f9e5b4e72a5f484cd646c0ad537b0a4bcfa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05b599436fd6d002e32d7079b93a340426189fe968e5aecfa6598fa61b15e77a
MD5 a9e6caa2ce14143d04914e85a16c3399
SHA1 a777fd8e2d1c07fff0d910d2fa9565ad58626ef0
SHA512 e0121fb8e454b71ba50afe070912e24dd78868e66706ba94a6d2185b9776c26846c28bfbcec078c37b35dd26007429921325cea0ab8c71e7bbd259b07466b038
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de4fbfdb3a923df83c6db26a667f5089f2d2a0167201bc9800997b29ecfde46f
MD5 961f4d62f28747a365dac55dfdceb61e
SHA1 4ab2ba892094a2df2fc90da99c9a620337766e61
SHA512 31f7c520f358f56ed06357a8fd125f4106ddd9357a9e8d2a50cabd64b29a5109b6bc5e6bd191342b5a4d0c947d87ad1e83efe8394ee16b8aeecd930164305238
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 608480033edcc411f46317cba4029df30d3452dcb11bf2639cac7d288a43de05
MD5 d2ace383624c73892f0ca11e445102fc
SHA1 ccbaae50b8ed441876f14a5161435d99c19ee4b5
SHA512 5c50739ae81c01583f6dced8fe1196c372dc7f41504f7429ef4a4aef6f1f2534b14e5a0255d9f4169718d7617af1730f9c073a1aab7669899a063d177c97f10b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\qap`g`v~dtlq
Size 10B
SHA256 cc07dae81905fc13f46f6a5c0dbddd946a09de513657a68dc03f5db1b41550ad
MD5 61b309c60be69b4fbc6d68117bd82ab0
SHA1 b048f7e036550c70056788155f2b6c1b36f182d2
SHA512 cd8e3315f68b305e9a9c9fad11f47385e6db531ae7706fe91c9345c57328d22a0696c2958c6fd4ca1efbe630a57abd480148ac3ac50c015e1bef8a927be64842
MD5 SHA1 SHA512

Submit Download

svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABBCACABCAAAACBCABACBCABBBCCCBAAAABCCBCBABACBAAAAC.exe
Size 4.7MB
SHA256 0738554f32c3ffae29e74ccb4ab0effe22bd995d6e18dc9d9a5143c5bb8c286b
MD5 d9285a2e46606977ef660d591c18cbed
SHA1 e8533dbd9b5243fbc35c44f884daa57e1e2aa1fe
SHA512 5d7fccf4074583a4393f43b0d05d8a498cd615662176bb2625df734c45a54ac4960a349b63a68ce1906b4ac0b26d12f178050c47c85ee9020a1e497aaca4d62b
SSDEEP 49152:U+Ea+Ea+Ea+Ea+Ea+Ea+Ea+Ea+E3KKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAq0:q/fh6ImzzJoDfuBcMv+A73XA+
TLSH
T123366B41FDDB94F5EA03563048ABE37F6330A6098336CBD3DA448F57E917AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a8bc613c5945a4767c41f52aac75c37654a93d98d8e6b6de98f3cb7b6f40f9f0
MD5 c638e0d9d0c6b3f49c74b6926eb045dd
SHA1 8c035457791a2cdf623f7bf7e096c553a1bd02c3
SHA512 9e8e0ef7a51c0307f1473f6625c84eee11f07f02977333ce2317ff118067c7927602f2664f698ac1be241077f4fd31f92e1fec46edadeb03ac25d41baebebd87
TLSH
T143119272E4F5CC5BE923A8CBD6299AD30CA433EB987C5A0426198218A7C5C32CF194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4aeb048b54e5c0cd63b67948037290b977959e7495c8ab431e1d180c93c0b86f
MD5 6fa0e3678c599b7b328fad9fc38fb252
SHA1 d4b382ca7f58e822157d87c151de42397b750e90
SHA512 46a0aca33fe4705cd2cf769ed80fe621f925171e67dcf7f21b9f13fe3b86c0c06fd078840e7b5f267153bf8d1e782f751d6d4e0629fc43ca95c1564ce8e14a2e
TLSH
T1E221B472E4F5CC5BED23ACCBD629DAD31CA432DB987C6A0022598318A7C5C32CF194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8c7f2ecb1c915dc6cb1f35fb8be79d8db7a3ecb318f9795b38be1bff33615657
MD5 7d524d41823a5dc1bd18d9e281057f41
SHA1 7053ad20ac8b84ed995e91f8a2b1aacfb2cd9247
SHA512 4109682d39101cb497eddd505b6fc746731b0e69bf1680f3646a64f85eca3ad646f0c7f3a86bf330736c8015bb19254f6851cec334118d84f69690c0affdebd2
TLSH
T13311C172E4F5D81BE923ACCBD639AAD30CE436DBA87C6B1423154318A785C328F154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2884-6-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/2904-3920-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/2904-70-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3024-32-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/4628-1868-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/4628-3922-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download