f39a5ea47688e7545dddc7aec3e253768f029d95d76fd539dab0759ce243594b

Analysis

max time kernel
147s
max time network
70s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 4.8MB
Sample260814-c895nstanb
SHA256 f39a5ea47688e7545dddc7aec3e253768f029d95d76fd539dab0759ce243594b
MD5 f3a6642708c2ca1df6dd8eaaea55923f
SHA1 8f5a977b57c147c39d1bcab1ecd7eed5fd31c04a
SHA512 4c7d37fef955fbfdd4179c3eb97ad373ab45d4ad1052a00a4190525edb904c19a92fe17d25c34f764c642070b6c4139e731925514a846c1917255850155b24cc
SSDEEP 49152:U+E9+E9+E9+E9+E9+E9+E9+E9+EoKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqK:x/fh6ImzzJoDfuBcMv+A73XAk
TLSH
T193366B40FDDB94F5EA03553049ABE37F6330A6098335CBD3DB448F96E917AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
4120	svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
3728	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBAABCABBACCBCBCBCBBCBBABBABBCCABABABCACABABACACBBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe"	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABCBCCABAACBCACBBCCCCABBBCAABACACCABBCCACCCACBCBBACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe"	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1108	sc.exe
1808	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3220	cmd.exe
3768	cmd.exe
2924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
4120	svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
4120	svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
3728	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
3728	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
Token: SeDebugPrivilege	4120	svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
Token: SeDebugPrivilege	3728	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3768	2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 3768 wrote to memory of 4836	3768	cmd.exe	94
PID 3284 wrote to memory of 5028	3284	svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe	95
PID 2064 wrote to memory of 2924	2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 2924 wrote to memory of 1108	2924	cmd.exe	100
PID 2064 wrote to memory of 3220	2064	2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 3220 wrote to memory of 1808	3220	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f3a6642708c2ca1df6dd8eaaea55923f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABCCBCBBCABCBACBBCCCABCBBCCBBCBCACBCBCCAACCCCBCAABBCBCBCABBCCBABBABBACBBBACCACBBBABCCCBABCACACAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABCCBCBBCABCBACBBCCCABCBBCCBBCBCACBCBCCAACCCCBCAABBCBCBCABBCCBABBABBACBBBACCACBBBABCCCBABCACACAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACCCBACBBCCBCACCCABCCABBBCBABBBCABBBBCCABCABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe" start= auto displayName= "UserDataSvc_BCAACCCBACBBCCBCACCCABCCABBBCBABBBCABBBBCCABCABBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACCCBACBBCCBCACCCABCCABBBCBABBBCABBBBCCABCABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe" start= auto displayName= "UserDataSvc_BCAACCCBACBBCCBCACCCABCCABBBCBABBBCABBBBCCABCABBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACCCBACBBCCBCACCCABCCABBBCBABBBCABBBBCCABCABBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACCCBACBBCCBCACCCABCCABBBCBABBBCABBBBCCABCABBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCAACCBBABAAAABBBCCCCABAABBABAABCAAACCBCCACCAABBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f7f876989c8d586e69833c491454934540dc56eedffce4a3ba63a786182337b9
MD5 ef30ac2a04c1baa2b67c7222d2c90148
SHA1 aef3ec97153325cd67dcd1be03e8bb5495818885
SHA512 e647a93c63e69a9eb3721348179cc3e822706bf4584cabb8ae328c46f58974fe958249bb9e3d1087eb157ce1b0e0e5db2181feba3a86f1a79addd750aea3154c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 31f41ee9ae42e5c61d924c3940d3001cdb6d3f8e7f42a5a8bd8e3a5e27f04585
MD5 6772e81a503ca06b526c588888560838
SHA1 7a04d394c19434d75a5469a8eded5a2de6e3e3ba
SHA512 fc025b317340cc53d68a4535ddc21f01e9ec8bcb75b14aa10d2ffcb5bda54f7f0c1106b9cd480eb7413a22de18965235c47271dba65f384c4f2513a85a98559d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 e77fdbc46aa7d573038a508771e287201fedaa170778fc8b184375033887a657
MD5 fd26b00408d18121bb3f9a1d89f66651
SHA1 589dd6821804d657b71b41e0b3f8bb7f1cd1163c
SHA512 51fad3bfca150f489d6d3cf22d32c90052c8327707edf66539424378c172b27cce4029f4502b9bcde4c716a6711521a8415bed0ea5fa0ff50fc73564fcb7147b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 16aada8e803b9b9f46f57382fed101d434979d8af86923c738e4b1cf9c3735ab
MD5 0d8770f6a78cd7ac435576ee0f6fe717
SHA1 b69a5d09eca77e69ec0fb3c9ec4352777cc0f450
SHA512 7ba648b35c9833f8f71915e8bd8e4d20a884e955615c576f8f62c27367308efbd5e0f144d8fe79fff3908c00af42033e07729756ccf3a9eb69fa2cbd995ef388
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\qap`g`v~dtlq
Size 10B
SHA256 d910314a1fbe90e0375c8433000dad145f3d1a653cd1abc727264ab081eaab90
MD5 7b01fca892c7099da27f07efd0739f06
SHA1 0d42b20fb32bba450e1c952cfb108978f7ed7363
SHA512 1a0c2ac30c6b45c94797e229b50655e1dad7aba8c98e1f24f25008ad6a83ef5733860559325cbb309a597baccf69d27244fe8c19c461fe766f7984bac076a4bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f4646a7d7faf81a3ad60abf0874c95b9308cd246663209c336656746c5ead1d
MD5 d17cdcd10c174d85ca8d42634bf0ce1c
SHA1 94ddaf13a8d0d2a5fa54febaf018d066140ef818
SHA512 882493f55eeb373f7fe7267778a879fcea8236b6cc7a7068406d521c2d3b0f2a05b30cea569a963095ce2b8de60423770754e1f762546b99f934d5751ca36353
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5763526f51fd147931ac404f51d90697e2fe6ff9b390fc1f285fa00c1209032e
MD5 4b1c42f4250defb016dce2179ff28ad1
SHA1 4e696e10681bb6051055ceb1fd24b7b64c40414b
SHA512 97ad6ec3d9f99e9a7c70dc2a345d4f1c4a9b16c857302ea9fc69a06ca0658a177c56639523ed7d308e3df241fdbe7aaace4a35484f7534e4771da436b5893212
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01cb16dacbc2c0ebd39d7df48a747d0326c207f7545ad4d6f6f45a713a5e88cc
MD5 9c63968b31cdef5897a7e5e14ba96caa
SHA1 2875979fd23bac547fe82069c98e1a8c185e824f
SHA512 788d4eb963740383dc3f6ab94e8d4e6625b3776fb3e34030fdada4d3733afc3fcfa5cc75899a35ccc979edec41e3632903fc34f04353a7d18e1d8a796296fede
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 946747bf026205a2d4906581d704d4dd1bf95aa6a0c3704bc15929b4f60b5ef5
MD5 ac26a6455ede69b2c9fa28bcae3bf122
SHA1 5ab3c1846458e37dca5b827f89a3c8ad5fb3362a
SHA512 13d9c9192cbf1472a85212ff4e8e02eaae7bc578c1c6506154ac6d38563a0954d5f73932e6599fff889d204f22386e89d0fe48eaefd054776091f6fd2338ab0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23e9fa7f3b0f519212164ebb450027808dc4c4178a9e8cdd7735869e31b57a70
MD5 c957a75ef6dd82bfb4690524fcab3ffd
SHA1 375c5fe8c065104ad3c3125450ec81b99f21227d
SHA512 1221dedd3e53f883f1894558bbe11598f85889b2f6a34cca6670453e435618f6d2037841f91330a958589ead8aebb42696eca564f6764a6fbc424fdcfb421dae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec1f19472f8b3aa2258df85adc86104734ee6a8bd515eed8a9431de4f26d35a7
MD5 acde097a97df392b86af6b67387df63e
SHA1 5928b3edfbff074a78e8475b9f6dc169dc821964
SHA512 e5a753d006a64f2be7e8b0cccd47e94bd41758f8dd3fb58aed7500125830662c62115729a165a3b0b3aff93aba5b49744986aa44b00dd7a30530e90f24d4181c
MD5 SHA1 SHA512

Submit Download

RequestRepair.exe

Path C:\Users\Admin\Downloads\RequestRepair.exe
Size 29.2MB
SHA256 a1cb605d0ef483c9087b797d6c1198be30fdecb4a243c3c4b1b12e7a2be08a09
MD5 fca9ba6599e8208e99fb84e580da60b5
SHA1 d88b88ac1207e0fa8f7ba0b63a9acc55776de37d
SHA512 d0e581aa2518db0bc708d68297dfccee4635d15318fa468347cc654eb194cbd6868a9a26e18b0cfd5112705da024eced612c37706a61dd99e94f64270601aa11
SSDEEP 196608:xHh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+Fi:sSSSSSn
TLSH
T1C4676B40FDCB94F5EA03557049ABE37F6330A6098336CBD3DB448F56E917AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestRepair.exe

Path C:\Users\Admin\Downloads\RequestRepair.exe
Size 448KB
SHA256 6b7b332ec5ab8b97b6debc44bf1733fc14f04a3cd722de54ad57576e981617e5
MD5 858d669588b41082b72931833cf2ad8f
SHA1 3d9c2e5e6a0ee9ae1da7b440a9b41dededdb8048
SHA512 da283b3f180b03fc65a488cdc79a68f7cce1f71e588831924c5c05428ac91cec82646989339d949e35f8cb3e228bbd746f31a07e6e90369d5f8e09198cd78204
SSDEEP 12288:mgUFgEsnojAegUFgEsnojAegUFgEsnojAegUFgEsnojAegUFgEsnoo:m9+EM0B9+EM0B9+EM0B9+EM0B9+EM5
TLSH
T1A7A43B09F84354B1D92B50F04DCFE2BF8A60BB25C6128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestRepair.exe

Path C:\Users\Admin\Downloads\RequestRepair.exe
Size 29.0MB
SHA256 4a68be8cccb57dee1d86fe5e79d31822574b44de427169ef7d9992764c06db75
MD5 65973584aedf5b33822b73709ba786a8
SHA1 781a35b2b443e5d858a1af4a5463287a1beebd8a
SHA512 0a6694bd19a2cfda5472096df5f9cd71ab4c42f87f066065801d030af0130be40bca95269bb232bb060396abd47ad4f7257dff2efc5ac595c5e167e65432d75f
SSDEEP 196608:xHh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+FNs:sSSSSS8s
TLSH
T1CA676B40FDDB94F5EA03553049ABE37F6330A6098335CBD3DB448F96E917AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestRepair.exe

Path C:\Users\Admin\Downloads\RequestRepair.exe
Size 320KB
SHA256 7943a1b59cfb4ab3a1a2cffccc4b910c42bce9ffe22fe8e2ea17ed649159d7ae
MD5 20770c16f50262a9506906292226ee76
SHA1 a138e10c7096a40ea93203103c9f58a07d8cdf3e
SHA512 b6c0cb6b5f4455ea976b93ab1215ea43d73201f7d34355d147077a19ff821acadd06c35d77a0b56b72113191159c4396de295b89c3afa6b7dd93fd984f279c34
SSDEEP 6144:m+dTTUFgEs3XojAdA+dTTUFgEs3XojAdA+dTTUFgEs3XojAdA+dTTUq:mgUFgEsnojAegUFgEsnojAegUFgEsnoS
TLSH
T1E0643B09F84354B1D92B50F04DCFD3BF8A60BB25C6128DFBFB4D8B5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestRepair.exe

Path C:\Users\Admin\Downloads\RequestRepair.exe
Size 38.5MB
SHA256 dae1fbef7cdc97200a59cd1c02f57d2a5fd0128d9fb26830724f68ae8864201a
MD5 1980d5622e18deee12b1bedd1ecac905
SHA1 bd7668ba2ca782c4f177442efa643244bc28f95a
SHA512 ac383c760f52f8a0497620dd1527dc8477b032a2074cd12861bd1e3481d954c5dea5f51e29a87ce8bc97b499d01b1fe4c88abdeee3978e8a6a511f2d36c31ca0
SSDEEP 196608:xHh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6Hh6ImzD+F6HhD:sSSSSSSS84
TLSH
T158976B40FDDB94F5EA03553049ABE37F6330A6098335CBD3DB448F96E917AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestRepair.exe

Path C:\Users\Admin\Downloads\RequestRepair.exe
Size 832KB
SHA256 00cd09d464c0f05f3b41f42a3ca3ff618b55c938c7cb246c9752ae112e4c1e69
MD5 bd37584f6e7bfe33ee1a848c394cf253
SHA1 200d48aacbab86a2dcdc1c67083ae96ed7f85d23
SHA512 973b118436bfd0b034d729cebec601953a5e430b3584a1fa47aaa477ba1879ca3336866a23f50749e1bd7e42609d21a85b72b78b1211b6abd9dd04964e11d5aa
SSDEEP 24576:m9+EM0B9+EM0B9+EM0B9+EM0B9+EM0B9+EM0B9+EM0B9+EM0B9+EMV:U+E9+E9+E9+E9+E9+E9+E9+E9+E6
TLSH
T16D053B09FC4354B1D92B50F04DCFD2BF8A60BB2586128DF7FB4ECB5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\qap`g`v~dtlq
Size 10B
SHA256 492c4a087bf972775b4cc0e5421e3eb84a82b81b2777e2670f2e84f7868a6701
MD5 e45cf9e5c6eef1d271543f3050e7f0e8
SHA1 1315389f5dfd17fed3c6730d3ab7d9204bfc94f3
SHA512 469b3db95267db9b37474980d5cfbe48a14e46d724204824500fcdab6fd8bd2d5f3be317c7113fa440496fcfe633db02f85359ffbb91c4dcf034a627440d894d
MD5 SHA1 SHA512

Submit Download

svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCCCBACABBCAACACBBABBCAACCAACAACABCABCCAACBACCCCC.exe
Size 4.8MB
SHA256 f39a5ea47688e7545dddc7aec3e253768f029d95d76fd539dab0759ce243594b
MD5 f3a6642708c2ca1df6dd8eaaea55923f
SHA1 8f5a977b57c147c39d1bcab1ecd7eed5fd31c04a
SHA512 4c7d37fef955fbfdd4179c3eb97ad373ab45d4ad1052a00a4190525edb904c19a92fe17d25c34f764c642070b6c4139e731925514a846c1917255850155b24cc
SSDEEP 49152:U+E9+E9+E9+E9+E9+E9+E9+E9+EoKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqK:x/fh6ImzzJoDfuBcMv+A73XAk
TLSH
T193366B40FDDB94F5EA03553049ABE37F6330A6098335CBD3DB448F96E917AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 893463a42ce1c389b12c15eac8b94835e0179435e603a6addc737a9378ddbd5c
MD5 32bb9635bdb8dbfc0124dfce0a23cc48
SHA1 6d4b61dc3784a46f717fb6e78c7b071e1f330ad0
SHA512 0a2ebbda3c8102171ab8ca5b6e9be850b5a5539e5402d4c12106241f2c544f342227e56f78fec3791c3fd3c75a8e2a12b9ae3a9076dcf8c46f1c2d4b9cbef304
TLSH
T11421D452D4F5D873F832AC9F921E9B520CF4769FDC6CAA1463054128AF85C319E294E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1153592a34a83d328b386499d8a727bbe807db71b991d857d64481f405cc6734
MD5 ded26c088989ff46ea3e991aba6f3b6d
SHA1 b3ddbd9b5263b01c5b16d9739a2ceb4459ec03d0
SHA512 cb7738f7de325e8c8d8145f374e479f6cf5c34025e1b14005bba62b35274d2763e00938b973e3c3264031c07622f3af9dc6819ffe74ae1e8e9e95983ef206b5c
TLSH
T1A011C452D4F5D8B3F832AC9F822E9B520CF4768FDC6CAA14A305452DABC5C319E194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2064-102-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2064-0-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2064-69-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2064-11-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2064-22-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2064-47-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/3284-46-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3284-1955-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3284-68-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3728-1956-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4120-101-0x0000000000930000-0x0000000000951000-memory.dmp

Download