690fcb1327aaa37b79ca6782416c72d606cc8fe794573537c3c8ee5965e298f3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.1MB
Sample260814-d7wrbsbr8x
SHA256 690fcb1327aaa37b79ca6782416c72d606cc8fe794573537c3c8ee5965e298f3
MD5 a0590356d23a905063c04bbb9befec21
SHA1 e0f27faa3b4b2a785ba8dcbe5f88d31cfe7e8af7
SHA512 f7d7a02f5caf2654e09a7a158fc08f5283b597c8c5602a0327c89c7c548d7785c78a507ba135ed233033945101164d5ba0ebb2033e6757a2d20d789e53454d66
SSDEEP 98304:rkkkkkkkC/fh6ImzzJoDfuBcMv+A73XAR:BHh6ImzD+FR
TLSH
T18CD67D41FA8780F2D9170170489BD3BF5730BA158B228ED7E7889B6FAD337D16A32255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
4552	svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
5812	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBCAABAAABCBABBACCAACCACCBAABCBBBBBCCBCABBBCCACCBABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe"	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABBBCACCBCABBBAABAAAAABCBAACCAACABCAABAABCBACABABBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe"	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5904	sc.exe
3228	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1976	cmd.exe
2052	cmd.exe
4532	cmd.exe
4448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5184	schtasks.exe
5056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
4552	svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
4552	svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
5812	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
5812	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
Token: SeDebugPrivilege	4552	svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
Token: SeDebugPrivilege	5812	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1976	3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 1976 wrote to memory of 5184	1976	cmd.exe	93
PID 4872 wrote to memory of 1776	4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe	94
PID 3368 wrote to memory of 2052	3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 2052 wrote to memory of 5904	2052	cmd.exe	99
PID 3368 wrote to memory of 4532	3368	2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	100
PID 4532 wrote to memory of 3228	4532	cmd.exe	102
PID 4872 wrote to memory of 4448	4872	svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe	105
PID 4448 wrote to memory of 5056	4448	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a0590356d23a905063c04bbb9befec21_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBABCCCBCACCBABCCABCCACCACCBBBCBBBBCCBBCCCCCAACCCBACAACABCCACBBBABCBCAACBCCABCACCACBACCAABCABCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBABCCCBCACCBABCCABCCACCACCBBBCBBBBCCBBCCCCCAACCCBACAACABCCACBBBABCBCAACBCCABCACCACBACCAABCABCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACABCCBABBBCBBCCCCBCACABBCABCBBCCBABABAAACAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe" start= auto displayName= "UserDataSvc_BCCACABCCBABBBCBBCCCCBCACABBCABCBBCCBABABAAACAACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCACABCCBABBBCBBCCCCBCACABBCABCBBCCBABABAAACAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe" start= auto displayName= "UserDataSvc_BCCACABCCBABBBCBBCCCCBCACABBCABCBBCCBABABAAACAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACABCCBABBBCBBCCCCBCACABBCABCBBCCBABABAAACAACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCACABCCBABBBCBBCCCCBCACABBCABCBBCCBABABAAACAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCCACBBACACCCBAAACAAAAABCBCBBBCBBBABCAAAAABCBCBBAACBAACBBBBACBCACCABCCCBCCACCCCAACBAACBABCCACCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCCACBBACACCCBAAACAAAAABCBCBBBCBBBABCAAAAABCBCBBAACBAACBBBBACBCACCABCCCBCCACCCCAACBAACBABCCACCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBACABCCBCACBBBCBCCABBBBBAACCCCACBCBBCBBABCCACCACAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d681298f709853e683987b9ee6b1bd74f499db427335faa483e9864f3c935cc7
MD5 2d574632352e33e169721ff9725fdf7e
SHA1 6b4994ded44d7bc95a3c9787ec79277970e0d0ca
SHA512 aaa06b6b978e9736dae9f042fc1068594444752fd7981b65fbeeb65a527935ec8a98c80e4123fdb724d6f1ba642a384fba4bddcffc3157171360544ef4463ab6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a9c214323f0cb2388b3ce7c7fb082eb71711b4b276eaa9b4720b535f433fcdf4
MD5 e31529591628a1ed8576e747f8caed9d
SHA1 f8fb9b2402e71a81d5cbf809202e4958118d9445
SHA512 0633c7081c81004074e66978ce7e7c1fc94cb4d62ee44bbe201fb1e5be49659db051beedad0826b06db88f390c5d1e74b56db17ea70930b865a44b5b3cecc53d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\qap`g`v~dtlq
Size 10B
SHA256 ff1ae7361dd69333e4b6390a10a627b2adfc6b69941d64ecf56384cb3909a1d8
MD5 47330720e535943fbec79fa333f8ca90
SHA1 40e59bd91edc950d7e8716ae079dd52260d292a2
SHA512 e976ce4b5cf413ceb83517352303620ff4b91c1b109b3f82740cf0aeeaf1179bea2fc6df85d9d6fb22ae1e4f52892930222efcf241629702d7cc67c42588f1be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdgeDevToolsClient_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 06a96457d9f1c4a055a978431e7c6f605dc27388df3cc8f418f0c269a796d87b
MD5 ebd298d5fed159beb3a56939122be9da
SHA1 20efee2c68945142ee72dc84b2f3d9785d28f644
SHA512 4ce2b40c6a3e0278cbdf081ad709e4f4260470965cbc48e6438e2509d509fe8f25a4b9b572dd7a4209f4b222591a86b459b21af4fb7e41352ade68b4289cead5
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 12.7MB
SHA256 719cc4604ba7906acb902f7d140c75daa905efd5f3fffea63bc91088dacd866a
MD5 7cb6698f2bf37e70381a4417dd330554
SHA1 ee89a3089d16a6e99aaaf122ddbd79b52574b63a
SHA512 490c554b11ca5502097e2b9df977578e2ef630445edd2bdc780b0800073657aa757544f8e86bb15b31555b8e1eeb66be82c9a6135f39cf9a4849bf6d1770048a
SSDEEP 98304:rkkkkkkkC/fh6ImzzJoDfuBcMv+A73XAwgZ2Hb9t+2x7:BHh6ImzD+FwgZ2j7
TLSH
T1D7D68D41FA8780B2D9170170489BD3BF5B30BA158B22CED7E7889B6FAD337D16632255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 f73244e5523dd3d23e79fe889fec8ac991594e800054d4e79701a68745855d21
MD5 c1783aa94a8a7fc249160905a00e7596
SHA1 c776407e1967ff1828fc7eff5ea48e6dad7bdf6e
SHA512 afb5d67dfc844c9f3090d248553ce47ff08776393d3ba54886ae47d2a4ec03e2cec156ad33870ca2cd6df77540c29f690a151f67461940fabdc067b7028e2c5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 39d8ceb9bcf78cb5ece6ceb93056a04d64dc3d8017376688ea51b648e8514ad5
MD5 ea9dd17423a119379cb91df3466abdf7
SHA1 dda4b1908c0771ead71094d4fc3cca6a91ac8b2d
SHA512 8210a66bac55673d5be519b6ad53f77998ad39c1978100ce2fdbabc00d3a0c71da0be33ca55d08bb81fa081583db81076a632f8eb90d9ed86cf13e1bee26adbf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\qap`g`v~dtlq
Size 10B
SHA256 ec245820033c94d4e4596e66275155c5601e9325cadf1355197be36527c9074e
MD5 aa44f285813a5636628e5adff31655ed
SHA1 6e70d737f9ba3708a4df5c21bd776a7dcc4ba04b
SHA512 27581bffd5851c7bf8d30fcbb686112d426cea173a0a9c480584feb8110870f0c7baf7945b0a66fea679e707abb5c9158dab88a122fa3b568dde082fa93b219d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 cbbba031c033b7ce5885eeef28e0670358e510d73292c1e4668f85b474225592
MD5 199b6dfcbb4c89abd68386aee7d7d720
SHA1 15d6c6560c9989f9ca98fee72d8120c86a3d7ae1
SHA512 c8722ac5a57098ce0b3c39f0b196f9de370a3eef973cec091a0fce440e558bb8c14743da7e643953f221caa7a108beea28a4f0ccb4056191dd9e75c01043f090
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 759ea1221983bffe37735b9fcf510a07763ff26fa3300d9466e588a0334dccac
MD5 4cfe1859a1c91b429ed1a4384fff52be
SHA1 af1108a7e7bab7c07489349a1db3595f08fd303f
SHA512 243526c9ee93475cf246b64248593b751a282b4ce289819dac9974adec5bea72329f8147da23eb968eefb320f565686636f183dc46f44018cf1cdd03a0ce1d51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 881dba8c75dfa88552932e87045c7d064fd7a2d82a0d763ac8fe95db590fe8af
MD5 7a391dae098da2e67fd3d931dce74b31
SHA1 c981e9703b6b0b3fdb81e03a880e250ac605bd28
SHA512 c4b5c873a0d771cd37e85861dd4a39e87b6d685c7c303dbc0aebdeca92457cc756c46636b1d8b051500686c862dba3760512195a31ab93c674b44e2244557c7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a90a069f2d8fadb0b1a0e8730cdfa1e2cbb0865afabcec9e55fd7137a48dbc7
MD5 02370555bd2d8359d3473c889dd93bc5
SHA1 8f9f2ebd9c53448338367d219e6f6c84a2f9a8ca
SHA512 c26036ab9900fa3fe30576173d997ae315cb697ae51f6dd6bd1bfa88fb6d94868bccee2b72054ad74bc693f67507e819aebdbaafbbeec9b2787d9ee80ceede2e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f6aa29a205cb48b36e001a0f7019817f48727f24cf35fea8d6edc2c557e945cc
MD5 796595f13e481262fae85d4e8cd4baf7
SHA1 e689e3c620845545f8e474e569952a6b0c87df8b
SHA512 b67a3060aacd00f0d3405897f5f18fa7e048351b7aeec3ab5a0387775dfdf4550f7807189b7ce2a4ac44598c10967af1248b122f08988fdfd9aa62450bdb13c8
MD5 SHA1 SHA512

Submit Download

svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBCCCCBACBBBCABCACBCAAAABBCCCBCCABBBCACABCAABAABCC.exe
Size 12.1MB
SHA256 690fcb1327aaa37b79ca6782416c72d606cc8fe794573537c3c8ee5965e298f3
MD5 a0590356d23a905063c04bbb9befec21
SHA1 e0f27faa3b4b2a785ba8dcbe5f88d31cfe7e8af7
SHA512 f7d7a02f5caf2654e09a7a158fc08f5283b597c8c5602a0327c89c7c548d7785c78a507ba135ed233033945101164d5ba0ebb2033e6757a2d20d789e53454d66
SSDEEP 98304:rkkkkkkkC/fh6ImzzJoDfuBcMv+A73XAR:BHh6ImzD+FR
TLSH
T18CD67D41FA8780F2D9170170489BD3BF5730BA158B228ED7E7889B6FAD337D16A32255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0919f56c316cc8ce4e4097c7e2ee83c95a18831f79e7562d7bdcda2e6c1b6f53
MD5 df52a14a8fc03209ce09daafab4ff772
SHA1 cf260647be82969ab1077558384fec6b8a993d3e
SHA512 a48f253be77a16dda6e3514ab35460211d8fe8f876e77e3b53195752fe26d832322a7d9fc6faaf11d674a1665b5ef986f48e4cd7012b5b2cfc3911634db99d19
TLSH
T1C221B760E4E5CC63E832689F562EDFE21CB87B9FEC58592513084628BFD5C338D194E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 615dbc25b482a7f90187738156285a83441142cba30d2e7550c2a0db7a422b67
MD5 1fa5f95600caa4b35879252b3362aa2f
SHA1 5e2db09a19f39a12d1c3ee6ebea8ea6b01775a53
SHA512 5bace48671de1d8b3bc55c76a908c38f0e77ed5136337efeca95f1500ff0603b8522f857b287ccaba60ef845dec4bdb0e954beaf106f892e8d73e43d53bbfe6a
TLSH
T1A2112750E4E5CC63E832289F522ECFD21CB97B9FE8546A25130806287F95C339E294D6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 245bf2cc28c740f8ef073278aa63d38a7796a661e920b16772d2e09e17299b3b
MD5 225a8705021d5dbc9d587fc7d401ea4e
SHA1 6b8c33e1ab9d4d2b05f3d4f824bd6f615142616a
SHA512 cc15288d17272cb7a45252d56bbce7d8d690810b89549d5f5a7967e51242da6ed359b8a1c80e72d7e023715799a576a98e46229ea2ec6c58c96c0e769ec53852
TLSH
T1DA21F960E4E5CC53E832689E522ECFD21CB97B9FEC586A25130805286F85C338E294D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3368-6-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/4552-80-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4872-33-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/5812-2309-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download