50c351c98ded68970254ad345f9e9423240904e15d6f3a12b00a059996c46a87

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 4.9MB
Sample260814-c69fcstakg
SHA256 50c351c98ded68970254ad345f9e9423240904e15d6f3a12b00a059996c46a87
MD5 fbeb27c11bfc2644f4b2ac0726876ed9
SHA1 a780ca812a49c7f8b6ab69ac18455c701c097ff6
SHA512 40b0c2ca9ed9ddb4fb11f55b8b55ba50305fcd9fa6638a2f3c7fc0178ca8934efc11de129ecc6d92443546cb9c11349731ac259adfc39b25ce03f919681969df
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+EfKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqS:y/fh6ImzzJoDfuBcMv+A73XAw
TLSH
T11D365A40F9DB84F1EA075570489BE3BF5730A6098336CFD3DA448F97E927AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
5408	svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
4312	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACABABBACBACABBACACBBCBBCCBCCBBCCCACCCABCBBACCBACBCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe"	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAAABBACCCBBAACABCCBBABCCBCACABAAACCCBBBBCAAAABCAACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe"	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2716	sc.exe
6008	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4176	cmd.exe
5428	cmd.exe
5188	cmd.exe
252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5208	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
5408	svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
5408	svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
4312	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
4312	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
Token: SeDebugPrivilege	5408	svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
Token: SeDebugPrivilege	4312	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4176	4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	95
PID 4176 wrote to memory of 2096	4176	cmd.exe	97
PID 1104 wrote to memory of 5616	1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe	99
PID 4524 wrote to memory of 5428	4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	103
PID 5428 wrote to memory of 6008	5428	cmd.exe	105
PID 4524 wrote to memory of 5188	4524	2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	106
PID 5188 wrote to memory of 2716	5188	cmd.exe	108
PID 1104 wrote to memory of 252	1104	svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe	111
PID 252 wrote to memory of 5208	252	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fbeb27c11bfc2644f4b2ac0726876ed9_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBAACAABCBCACBBCCACCCAACCACBABACBBBCAAABBBCBABAAACBCABCACBACCABCCBAAABCABBBABCACBACABAABBCCBCBABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBAACAABCBCACBBCCACCCAACCACBABACBBBCAAABBBCBABAAACBCABCACBACCABCCBAAABCABBBABCACBACABAABBCCBCBABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBAAAABAACCBCCBBBCAACCBCCBABABCBBBCCCAAABABCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe" start= auto displayName= "UserDataSvc_BABBAAAABAACCBCCBBBCAACCBCCBABABCBBBCCCAAABABCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBAAAABAACCBCCBBBCAACCBCCBABABCBBBCCCAAABABCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe" start= auto displayName= "UserDataSvc_BABBAAAABAACCBCCBBBCAACCBCCBABABCBBBCCCAAABABCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBAAAABAACCBCCBBBCAACCBCCBABABCBBBCCCAAABABCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBAAAABAACCBCCBBBCAACCBCCBABABCBBBCCCAAABABCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBACBACACACCCCABBAAABCCAACAABABCBBCCABABBAAABBCBCCBACBCCBCCACCBBABCBBBCBCBACAACACBBAACCACBCBCBAAAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBACBACACACCCCABBAAABCCAACAABABCBBCCABABBAAABBCBCCBACBCCBCCACCBBABCBBBCBCBACAACACBBAACCACBCBCBAAAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBCAACBBCAABBBCABCACCCBBACAAAACCBBCCBBAABAAABAACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d708601d59c306da426972b8a3d75742c7977d3f8425bec1e58d35d3028a7dd4
MD5 623ca54210e7eb4c3a12aa17136e0d7a
SHA1 570027dae8203d4545a164b80a8e2850eab0b6da
SHA512 1625e81909aaa9c29d018347537335b6126e3966057e16d24c91061185095d4aebc64ccbf8ba2318bcb64f09bb1b653bf726690193cbfa90174cfa18fb10b1d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft OneDrive\setup\qap`g`v~dtlq
Size 10B
SHA256 7070883d099de4406d6f69a6fc003d3a696158b8e0669da3722498a2cb396b81
MD5 ea661442c74be1c23eccf70af93dbf68
SHA1 e6a399655e897d63251dbee5cc29379c4ef07582
SHA512 0837f129d54419f42c282d0341d32881aae8c3934f82593c9993e3fc6157a64a9922626c099a333798511ae48f36635197e054fe0df94f85ace7d0c90119e88e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 170db24abdde38c08f9410094dfd459cfa3266f77b615faba2e6f1efa563affe
MD5 1ee45d201c3a61b9ff3bf9522739ff20
SHA1 e66c7b8b020d7ff987ea8d18622ba1a8c1db801a
SHA512 102e5d4e5c8f2860aac20fee82e99979d909ccd97446af5ce086a386c8edf4c755997d595cbd7972647f066f963d2fc4d4a34b2f8667ff65635136cad8efeaac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\WSXPacks\qap`g`v~dtlq
Size 10B
SHA256 1bcc0a1fb27dbbe124b8ef2fcdf570196cb8983ffe843ce017f6fe4ee57908fb
MD5 20cff2edad8c1eb21e47085fc2904e45
SHA1 77c648ad472704efdf50f80668d7721ccf07ee7d
SHA512 71a5987ccd7c8c4e39151aca0e0a594a76e1998aa5bd70976208b1afccf7b750133d1a03c667cfb0a8593fb6d2973196945a22566963fd033b20263b50a8ce4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 eb6effe7166c5529f45c37038f88c48d71f832084e909b82a79680e382ea2244
MD5 0cdb1a85b9e4b1b92a1958c7fdc5291f
SHA1 329f77a7599af4a507a50b7b37c4abfecb80a582
SHA512 8c9ee51d86a03a3e5f649e69de1d6d2486dbcef41f90ea765de0ddaefde11f52dd4f0f933a3fdeb97fe77f8cb596cf63e4e4cf274e0de6a087a7836ae4082007
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 da14ec2d92fa42c1baa84070b5cce44eaeb64d69ed6a36036975c10eb3e40718
MD5 ae1b32fa372fde42e321bbef5483bb94
SHA1 cae8a6e477da663906e1eb914fbf2869b7f2fe5e
SHA512 0b6745eb33863ab0ccfafb541a51c337c2fc763d68fc7e25086e488dd3f72da777a858bab77e83aa54be93a6d0c1ca16b3ee51991088b78006e831d719b71ba5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 3cb6b7d10ef8094aff6e472806cd8664f442eaa7834c6127c223abcfdf0264a7
MD5 243386c89fd5b6f7a5c7fc1b46076f96
SHA1 fde295ec549a4f51aad9ad61366ce1d9ae9e4adc
SHA512 4ac95319ff09e6369380ec7756c3bb899fc99ae17e2eb24aac8159a20f850da8e29e5ce2666f33af6c1d5d9c9def444806b103da5c4f742b649508081149e4e3
MD5 SHA1 SHA512

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 15.1MB
SHA256 770632ac48c70c99836d2d74f9395db8f92656bd198bdb9fa07136eeb1f7ede2
MD5 538acf98bdb15e5de0d7d968817fafac
SHA1 cce9da556a7921c2bd77e2e1e498a7d1fdad3acd
SHA512 87d4992c05febe160c8b553c279a78188cd62522582e6fac9886a3b01d9f14d84bd9581479a5e8ff3e280bdc693b08e12258a5ff74d53aa7d8a5e6b205062803
SSDEEP 98304:y/fh6ImzzJoDfuBcMv+A73XAh/fh6ImzzJoDfuBcMv+A73XAh/fh6ImzzJoDfuBA:yHh6ImzD+FhHh6ImzD+FhHh6ImzD+FP
TLSH
T177F66B40F9DB84F1EA075570489BE3BF5730A6098336CED3DA448F97F927AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 29.8MB
SHA256 2235c8e7f86374b0777dc2d83b11f1b0db8e8fb68a444c7e79621a77049b0487
MD5 2bfa9b68d44dcba40004d7346cf9cbe7
SHA1 8f90113deb406f560af6bd44a9acf99227c84425
SHA512 8b34b555ef047c2f7b7b9d838810d31acdfb4fcfef66dac525860915e1005622e4f04367fd5f2b770188fa84771b9944d47e2a26a1b603e3deeba7c4c8f34514
SSDEEP 196608:yHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHh6ImzD+Fk:xNNNNNR
TLSH
T138676B40F9DB84F1EA075570489BE3BF5730A6098336CFD3DA448F97E927AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 2.6MB
SHA256 2ee4a9e5db744f3040bea67bc2d0f3f3483e752cddce0dcdffe36efe66adc551
MD5 9b94b1e584085b8130dc2442a210ff02
SHA1 910ef4b0e74ab69fa35b850a67350a9137a80e37
SHA512 2441b92a28ba79df3964f82fa9e9e752396315f1720d52a9170a59addab917ce7c5229ca6301a3e7036162b8af50a19f07eb881eb4a6c9c019853a26472b470a
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+EfKKfHPZ6IVMv76K8ocsCGzzJ7UDv70:y/fh6ImzzJoDA
TLSH
T186D51994F9DB40F5E90798B0499BA37F86316B098738CED7D7880F43E527EE2143652A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 39.6MB
SHA256 c7a2a688d281244fdb90d7ade74733ab4db4ac0b109ba38294a48aa6e91bff0a
MD5 5c7a1f1e73ad424c027064937c87c623
SHA1 d6d9c91803740b101dcfe20b693108a7c0a3240f
SHA512 98d25ccca09a13efbdc93ee210074d5c3a6dfa8f05a131325027fbb2d01c7fea4d3dfcfad69868fa964c7d72ec133c5dd1f2ba3dd32852a7426d876cb8fb17fc
SSDEEP 196608:yHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHh6ImzD+FhHhx:xNNNNNNNk
TLSH
T13A976B40F9DB84F1EA075570489BE3BF5730A6098336CFD3DA448F97E927AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 2.1MB
SHA256 b8f2a0f087b5368705f3f651f1abcd8069fcd7e82eb3debcabcb524f2f4331ca
MD5 e2c86e743c2a8d73d61ac4d51e7a79ac
SHA1 69a86d836d02b34e5965fd2f6eaf341d66851e65
SHA512 f1324d2170eeb7c8380ccf029b7b21287ffdea1dc6e30497bf2a5258b96e271891bdb266331580de737a9ca4ec014c983e611b122546f8be49fb7547adbd168b
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+EfKKfHPZ6IVMv76K8ocsCGzzJ7U9:y/fh6ImzzJo9
TLSH
T133A51754F9DB40F1D90B58B0498BE37F86307B098739CED7EA884E43E567EE2143652A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 4.1MB
SHA256 295b4814e2a4f2dfe69fdc91b60781261a61c971529cb46d203927dbfc5a07d3
MD5 89369708ddfa773bd6c5a45f871e9111
SHA1 4f2704141be965d5d57c7f640efde39a7648b221
SHA512 593447316858cbb7e0f9e0f55d279eba5c1456307713924673ffa5135a8cd128860daf7c8736c23bee4f2314fa6cfaadc58a57073a124f9ebe1f5bce74216657
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+EfKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAql:y/fh6ImzzJoDfuBcMv+Aw
TLSH
T131163950FADB84F1EA074570489BE37F5730AA098335CED3DB480F57E927AE21936626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 563e0fe051b9ce1ef02dc700c27232bb37da7a985a89c2f0e2d697b77f27ad80
MD5 d90796e7f28ed29d4e3265217eaecd44
SHA1 bd52a198ab42a5095b544238e7fda1a305e2ac69
SHA512 b14dd925712089655f75009e4602f649971b821c2c9f76f6308aa98fa6ff8e5bf9e15d20f1198813064c329d6c20c3b0a9e2fb315632d4ce21cbe8fdb7bbdefa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17024bb2ca2294802a57107b39054945c08e36b18948359447895c493f531660
MD5 a2251b9e0a0860c6c8fb6f2382fb903b
SHA1 38e217cd4db830b743de683fd83da3f88b5c29c8
SHA512 92d79c7fbd7ac6f079286741debacc4bb942dfae626118735cd9fb51df241cc59fd20be874b0220ec1e476bb73f0e7ae746ac8c66db7373680cb86b5d110516a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f71f315f6cbb2739f538ba3f6573faa765feccff2db81237f993fb6576c95fe
MD5 2d85d34de20efc6c2b947bd290138b37
SHA1 c047b6959e8c8727c37dc9a7ce41fab7a9b7109c
SHA512 09adb9249b4072980508e4aaf28bf8944461e5966efd23f3c7a8084319ba0810d5cdab3e1be816946ed9890cb8ae6b260fad1b3423e52d99ca3832312a239dbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f70fb89d30312b9c523d10a9467a47504ffc341c2fbd26cdcbf122286f2356cd
MD5 1f647ee14b819b60a62a73d34b309822
SHA1 bbc7ce13846a4c6335bd4a06773f48aadce8348b
SHA512 7f77f0d6bde013154c40906962bf9cb5b289f8d35a7d13cba03090e34c43d43b0c7226e57772ba75839e9777e67a9a7bb63e5aca0a6af49ad8e00954de08e1a3
MD5 SHA1 SHA512

Submit Download

svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABABABAACAACCCBCCCBBABCACBABBCCBBAACABCCAAAAAACABC.exe
Size 4.9MB
SHA256 50c351c98ded68970254ad345f9e9423240904e15d6f3a12b00a059996c46a87
MD5 fbeb27c11bfc2644f4b2ac0726876ed9
SHA1 a780ca812a49c7f8b6ab69ac18455c701c097ff6
SHA512 40b0c2ca9ed9ddb4fb11f55b8b55ba50305fcd9fa6638a2f3c7fc0178ca8934efc11de129ecc6d92443546cb9c11349731ac259adfc39b25ce03f919681969df
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+EfKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqS:y/fh6ImzzJoDfuBcMv+A73XAw
TLSH
T11D365A40F9DB84F1EA075570489BE3BF5730A6098336CFD3DA448F97E927AE21936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f4de45153be8f71d5f4b2ef2e676a67f4f53e6b2e022b79b6b82ecee0c9cdf60
MD5 c1b12e87cec6b5d875940c2509bdacd9
SHA1 8490ff06ced16b48a6b4126abf017f1723f5c7d6
SHA512 9e25f8d9741fcdcf4f3ae4180d109c0384a887f5d742f4eb37e8f37da72db613581b86f6d696ecc3773911ff0b915381d7bf9173656eeb51f28715199f8be61b
TLSH
T18521C670C5F5C813B922A89F9935EFA70CF4768BAC9CAE1453054228AFD9C61CE194E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0bd6477419c2e566744b5b3a14a30798186191b762f7673cff2ca0f31bcce9a1
MD5 bd00a4d50dbc43b1dc0aaece85769ff5
SHA1 b446ec5e17f16aa7b67ef21030475286b29953d2
SHA512 5c685a0114e0159e1ccee9900bc51122cea38e905448a8fa0310284551c3de1d99fb26a0c37e45a3db0f051a83cb6ced689c2391a101194a2e3f208ec3b81042
TLSH
T18421A671D4F5C813BA22A8DF9939EBE20CB4779BDC5C990453098228AFE9C32CD194E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b1061d2e0d0efc7102041401b35ae543180aaca0a99e4651cb4dc10094f32bd6
MD5 4c0364358de9f3ad23f24d1e27326508
SHA1 996a3708188da71ceb3aa15b839b6e2e0f4d8c61
SHA512 9c4f79a0582447adc32d53c945f4a643dfe7d3c1caafcc5c4aade7fa8d08e84eeba6ac47e0e534b160de53b6dee344e4939455f3bf71792722c583a3146986be
TLSH
T1B4110A7085F5D803B923E89F8935EFA30CF4768BDC98AE1453094228AFD5C61CE194F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1104-69-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1104-105-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1104-47-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4312-2342-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4312-3963-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4524-68-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4524-46-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4524-21-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4524-10-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/5408-102-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download