19faeb9bcd7b0831b234665198894282bd6f06bd7155485e9a60cbe64b43ada4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 8.9MB
Sample260814-dslb2stvat
SHA256 19faeb9bcd7b0831b234665198894282bd6f06bd7155485e9a60cbe64b43ada4
MD5 c5fb424234f9a0739d1cfe02338e5a7d
SHA1 b3395f3daf4a835fe8b8449ffd9b76be070c126d
SHA512 70aa2c438d763af359f9c32be98aeb5e1f464568c8ff376ddab26b4c00b0b5afefb56653401b61c54f9c8d6f32d78aa6cd821963549eb0d31505ed4c044d7224
SSDEEP 98304:15G5G5G5G5G5G5G5G5Y/fh6ImzzJoDfuBcMv+A73XAD:15G5G5G5G5G5G5G5G5YHh6ImzD+FD
TLSH
T155967C14FBEB1174F6735A7088B6C2BB6E317C108730CBDFD640BA19AD266D09936726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
5280	svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
752	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBACACCCABBAACCCBACACBABCCBBACCABBCBBBABCBBBABAABABBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe"	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACBCAACABAAABCBBAAAACBBBABBAABAAABBBAACABCCCAABCACBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe"	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
884	sc.exe
1748	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2372	cmd.exe
768	cmd.exe
4908	cmd.exe
5152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe
5116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
5280	svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
5280	svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
752	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
752	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
Token: SeDebugPrivilege	5280	svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
Token: SeDebugPrivilege	752	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4716	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2372	4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	95
PID 2372 wrote to memory of 2568	2372	cmd.exe	97
PID 5992 wrote to memory of 64	5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe	102
PID 64 wrote to memory of 1700	64	notepad.exe	103
PID 4808 wrote to memory of 768	4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	107
PID 768 wrote to memory of 884	768	cmd.exe	109
PID 4808 wrote to memory of 4908	4808	2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	110
PID 4908 wrote to memory of 1748	4908	cmd.exe	112
PID 5992 wrote to memory of 5152	5992	svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe	115
PID 5152 wrote to memory of 5116	5152	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c5fb424234f9a0739d1cfe02338e5a7d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCABCCCCCCBAABBABABCAACCBCACAAABABACACBBABAABCCACAACCBBACCACBCACCABBCACABBAABCCBBABAABBBBBBACBBAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCABCCCCCCBAABBABABCAACCBCACAAABABACACBBABAABCCACAACCBBACCACBCACCABBCACABBAABCCBBABAABBBBBBACBBAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACBBACCACCCAABCAACCABBCBABCABAACAAABABABCBACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe" start= auto displayName= "UserDataSvc_CACACBBACCACCCAABCAACCABBCBABCABAACAAABABABCBACACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACBBACCACCCAABCAACCABBCBABCABAACAAABABABCBACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe" start= auto displayName= "UserDataSvc_CACACBBACCACCCAABCAACCABBCBABCABAACAAABABABCBACACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACBBACCACCCAABCAACCABBCBABCABAACAAABABABCBACACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACBBACCACCCAABCAACCABBCBABCABAACAAABABABCBACACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABABBCCBABACACCABBCCCBBCACCBBCCBBACBABCBACABBBCCCBCCCBCBAABABAACCCABACCBBCACCCCACBBABCABBCACCBBAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABABBCCBABACACCABBCCCBBCACCBBCCBBACBABCBACABBBCCCBCCCBCBAABABAACCCABACCBBCACCCCACBBABCABBCACCBBAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABABAAAAABBBCAACCCCCCBCAABCACBCCCABBBAAABCCABCBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e1e522443e85c6df10fbdbb7bab6daa9e9cac5ff8ba9d7c639b019c7ea5cd01e
MD5 0618d3668742466f2f2b09cc54474821
SHA1 f68861f400d25172cb5e9162775b10be1b20a349
SHA512 3b7d5d1c40c90b7b7d222d81f64de76af12c1049bb8da0cbbd3bf616fc19da9ed98e946a80e9d170f5720f3b3dbffcfce505054664af4856b15cbf167987d18f
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 9.4MB
SHA256 8fcb90838845a639d8f31bd6798b592360375ebf2f64816283b1834b0ef9871b
MD5 194bc98c630faf1896f90c1ab231e1cf
SHA1 a42636d86c80d1057ce37bb92bb9f6e52673a7b5
SHA512 cfcb3c756624b0deb0bb81b63b40b26b9771d195fc9e44da5d88cc687ee98c2a6b8a0f91892a59a69bdd82f22f5ed6c2923c27e5fc9c494fae766dacab0e5389
SSDEEP 98304:15G5G5G5G5G5G5G5G5Y/fh6ImzzJoDfuBcMv+A73XA4pit:15G5G5G5G5G5G5G5G5YHh6ImzD+F/
TLSH
T122A66B14F7EB5174F6B35A7088B6C2BB6E317C108730C7DFD640BA19AD22AD09936726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 d23eceff4262d19fef028a5b97637f31db2fd79b88a3338707b8523b14f1727c
MD5 a307431b50fda7023898866ce0427007
SHA1 adaef57f66b06c6e7e13082641eba2ec70cde318
SHA512 607d758c9eec78b0152b07503fee8bffb0bba6ced355e9bdf7c8597aa6898a55745bd8a5be9373283d94d30122e69c01e2a8705404be11d87636359423c5c6ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 5e7db3e3468e1b1ed82a502db804a92aa0b10e5ae11110d95e58c753de7eb9dc
MD5 136d7737a6a2bae992cfe0f001a6af49
SHA1 ce9c247b4cfa4deb9dea39801bb5b79112b3e74a
SHA512 35e29bdf9b83d22dbe2ef91a4c62d0f6fa8d9eed7e76f19f4aff8eeab7fa92616974e5ca6ab0884a0ce665aeec3df95926852299bc4d73c307b4ae3ed3b4d800
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nso-ZA\qap`g`v~dtlq
Size 10B
SHA256 3a99a7283b43c52cf7319bf7e54ab75966440935e4ee742cc0730cb2f6402a5d
MD5 1574593964746844e3ad6baf06de7f9c
SHA1 9b1bb6c40d143e904453d9cb4057d31a43648934
SHA512 685ca563a5da8e5e4d61193f2b93cd596c2066b892506be9a4f0fc19715acdecd045f1a0382eb93cedaeac2b490e692661f11a579ad801d07304b01b22d6038a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 e0ce4f3929f45b669d35bbee0859b2be1f65180c4f3804789eea4425ad115ddf
MD5 9f8a3b88bb1c5e8560768f32afc3858f
SHA1 f66e1951092796ee194ba723591717a4dfc2fc1b
SHA512 704b975ed3f0458c7ffee18e0c3758faa3500efe8213a4da295c704520970b8f694e1394823e94b0ec7e24bebefd89fa0bf06bed65ac4c4b26c4b9b6cc917f99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 b56c816282edc0dd9e803049edadd441314b3a1e8cee2eb5ab3d406e3fc16b20
MD5 af27721ff985bd7b603a1e9f0bc38607
SHA1 636128dcf3b27b2ecd4160ea1e271e01056f3e9e
SHA512 f92b2e369e3395453bee6b69274d7074e8bfed9399fe2aa0792501722a4ff42fe70c80d9d543dcba95df2b949c1ad40e2fda6f6b92d9dbb5c2f472bf7f8f6a4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e46c6f8ffa1220004a75e3f36810313953f17e8ad676169f0c603e7726eab376
MD5 b56eb84f8aae84e8029e0ca761b3b428
SHA1 7d98dc75b4c9dd09cf231c2efe4c0f602db84c6c
SHA512 89b3aa960d69ea6aeceaaa1333a85e5b298de884320e98093c9ca451832eeee9886e36c5596723fe46af3e3f24b406cc2658f95f8805e70bf3072cc940f32a9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9c427c31b518b7c14e2f4067b9cb9020254ca8d132c7cf1f99740c3132f941e
MD5 549022813f110943788c36c1952d3aa8
SHA1 b24a2ebcb46cf982dd6ac73962432fd4593841f7
SHA512 3224b8200a66fad8fecaddc5229aa10857c512e6b2d7e16953f6b43237930f6f964cf996ea43e48ea03ada38d18a2b9c1cb0e9745e7ebc8f0e3d2d7ebaf234f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 508e78eb3b2dab56f88af228d6282444a17b4d4760ae5fe407206c2a3161b35e
MD5 78d31cc2a71d498597f0f95c30eb4116
SHA1 736248734ed55a7490627124fe921065d3a6a503
SHA512 928c362f4c434cd7cd471179f87fbbaeee9e1a524aec7a9e6f8ace336a47bfcb709f21f45d073bc931bc897835017701f5211c99232a4eacf7b71d2faded2c7b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98e7cd424b54cc9e09acf67a97e6fe203a7884549efc99c61c0ee6aac0447bfa
MD5 09e239268d8cabb5f09b92f85aff2687
SHA1 9c9f1af77a12ff46838bb7e937d2402f3c37f959
SHA512 2fb4f88b2ed2e00723cb22fab0e3c3b013933bbf53c893d014c9119cbb9155ee061d6d2868212bbf4fe347a3dbe16ea8e97688fed0127c035a1774bb72aa32e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 862335ccb3d91a818e39088ee5afe9e30262f692dda07508d86d5a894193d12a
MD5 9051699e527a9f2e2339e150f54bfa20
SHA1 cff71839893b5aec082878504c7fa81fac7cdbee
SHA512 021b14094437da38f8b580121bc7678be378bb759e6a8efe17965fa72a5749a42d1f75ff1a3e581aa4faf1a93f47b573a328e086ad66a66046f88f7fd9b2d85e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f4f8c4077c9b4b4ee3f0a5ed5895a3e4ab404137c1244d2ddde5365d17943a5
MD5 62702525b0ae12c6e3a70d61089967d6
SHA1 9d901cd47fe1161339b73caa0e92d8f8618c1006
SHA512 05e7b0dd792d593d037bf3adcb0adad2a4ba7799c3143f7c85ae812a24bb9e11f52ffcb1f58197650f0e030c7a6e98b0e0b441ffd59e2968d6f49fc862303fba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8d69a47e1dfc63835ea3128b594f32b8911a8684d05d8c20990fa81505fb534f
MD5 1d607244d9c1077f4bd00738cee9c38f
SHA1 19d577574e92c241a837ff1fd6c9bbe36b94dd41
SHA512 3c29c1d5cb9a1a071ba39249d4d85d08c42cc7bfb58ceff87026fd6bc7b1820067ee77b714bb292b62e54b766be6727d62bfa2648d4eae934b52e5a115fa72c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\qap`g`v~dtlq
Size 10B
SHA256 86c0178c01bc4ebd747b9aa15f9dfc29932ad109cb03f222f32ec77bac52da73
MD5 6b874076efab527be974515c8fa1e1ed
SHA1 4a4de91c00296c4769ee9bf6a9296ff9ba70d441
SHA512 5bcdfd4580726399706194b845c8c7ddb69cbc6aab2c93f0c9c3fc336b80202daf32a92da020cbf4cd7a8408e5ed58eec329ffc32c3b90e184781b7b6aeee62d
MD5 SHA1 SHA512

Submit Download

svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACACCCBCBACAAACBAABAAABCAACBBBCABAACBACAACACCCCCBAAA.exe
Size 8.9MB
SHA256 19faeb9bcd7b0831b234665198894282bd6f06bd7155485e9a60cbe64b43ada4
MD5 c5fb424234f9a0739d1cfe02338e5a7d
SHA1 b3395f3daf4a835fe8b8449ffd9b76be070c126d
SHA512 70aa2c438d763af359f9c32be98aeb5e1f464568c8ff376ddab26b4c00b0b5afefb56653401b61c54f9c8d6f32d78aa6cd821963549eb0d31505ed4c044d7224
SSDEEP 98304:15G5G5G5G5G5G5G5G5Y/fh6ImzzJoDfuBcMv+A73XAD:15G5G5G5G5G5G5G5G5YHh6ImzD+FD
TLSH
T155967C14FBEB1174F6735A7088B6C2BB6E317C108730CBDFD640BA19AD266D09936726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 708c9f0d9a49e39ef942c4df9d91f88879623e6ba775454efec52dc7a0dcebdf
MD5 3ab758144b0b9205398a2010ca6f2112
SHA1 58f034278b978cc0687893be8e4080c8556db056
SHA512 3a9a6ad2cbe2f0c179859a36664f38ec92ecfb0ee25e7ed1cb9fdad9e69362ef48ad043fbf8480273763d2a3678bf7747c015b6ab10f8ac5439fa7a82028b310
TLSH
T1A821DB60D4D5C467FD2368DFD53ADB920CB0779BAC686A15230D4129BFD9C328F094E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 4fd521fa24f4083b2c47bd2873ef1fa53ee92a63acf57cdbf672f15b64f0a88b
MD5 ec5d87927c48d23db0767f46c719c57c
SHA1 d419c5057a5b69426c8159028411a20e6ff127f4
SHA512 4b1fe169d0ac8d6329a05eb00d0744314d2dc104a37cd4baa9cafb35a46cebee9b33eb13ee1d7b651a726a4c2c43abb0c59f9f5b0e0fd8172bd6c48a1da1ed1e
TLSH
T17611AB60D8D5D063ED2368DF923ACB470CF476976C686A2923084129BEC9C318F194E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1d0c5f7a268081432fbf88fa68e1a27fc2ea96ee60b281873f137998fb6322a8
MD5 2752f48ad5c6033afd18c643f39347c2
SHA1 086bf0eb1be8895cf40efc6c0f3fb219aa7f3e17
SHA512 2654b467a29bc0cee0e1fdbd23116d2c6ecece1dd9e3e6ede336fcd6a0675943d3e7b7184771c32d6e6017f8a6e35d4cc980ffd6ff60ee26e355eaf2aa68a1af
TLSH
T19721CC60D8D5D467FD2328DFD53ADB420CB0769BAC686A2523084129BEC9C318F194E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/64-59-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download

memory/752-83-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4808-0-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/4808-7-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/5280-1864-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/5280-71-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/5992-36-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download