938e60991c5d72d106045a3a73c9e0e85d3f7ffd2a494a777100fbcec6d57423

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 10.4MB
Sample260814-eghmfstzax
SHA256 938e60991c5d72d106045a3a73c9e0e85d3f7ffd2a494a777100fbcec6d57423
MD5 87b54e6bddef1c6c80e1f52ca9cff358
SHA1 b4d7721378f87ba5c37e0394e67d3ffcd3e5e436
SHA512 404fd7cec6fb1a7d2880035d67a75c2940180dba6f8fbd61b0d76aefb4842a5d19f5d3c8395d97454bfeaf39cd6ff7b3dd23ab2e57438a504c0c485c25f37d2a
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+Ek:i/fh6ImzzJoDfuBcMv+A73XAd
TLSH
T152B66B04FADB44B0E967617048E7D37F8631B9118732CADBE6448B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
4904	svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
2400	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABBCAABACCBCBBCCABACBABACBACCABBACBAABAAACCBCBCBABCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe"	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBAABACACAACBCABBABAACABCCBBCAAACCBACBBACCBABCBBACAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe"	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1796	sc.exe
1524	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
628	cmd.exe
3256	cmd.exe
5092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
4904	svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
4904	svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
2400	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
2400	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
Token: SeDebugPrivilege	4904	svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
Token: SeDebugPrivilege	2400	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4344	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 628	5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 628 wrote to memory of 2084	628	cmd.exe	103
PID 4996 wrote to memory of 3584	4996	svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe	104
PID 3584 wrote to memory of 2712	3584	notepad.exe	105
PID 5084 wrote to memory of 3256	5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	109
PID 3256 wrote to memory of 1796	3256	cmd.exe	111
PID 5084 wrote to memory of 5092	5084	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	112
PID 5092 wrote to memory of 1524	5092	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAAABBCBACCBBABACBCABACBBABBBCCBABCAABABCACACABBABAAAACCAABBBABAABBABCCCCCAAACAACBACCCACBBBBBCCABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAAABBCBACCBBABACBCABACBBABBBCCBABCAABABCACACABBABAAAACCAABBBABAABBABCCCCCAAACAACBACCCACBBBBBCCABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCCCCBCABABCCCCACBBCCAACCCBCACBBBCCCBACCAABCBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe" start= auto displayName= "UserDataSvc_CAABCCCCBCABABCCCCACBBCCAACCCBCACBBBCCCBACCAABCBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCCCCBCABABCCCCACBBCCAACCCBCACBBBCCCBACCAABCBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe" start= auto displayName= "UserDataSvc_CAABCCCCBCABABCCCCACBBCCAACCCBCACBBBCCCBACCAABCBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCCCCBCABABCCCCACBBCCAACCCBCACBBBCCCBACCAABCBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCCCCBCABABCCCCACBBCCAACCCBCACBBBCCCBACCAABCBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCCCCBCACBBBAAACBAABACACCACBACACBACABABBCCACABBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8133a31acf06d0f452ab4159895231fe48aeebb267584f4d87656ba51d0cf852
MD5 17c9ca7292f02b051e778d41fc3911e2
SHA1 839ae5600dcccd9833ba5cab94fd1b28ecc92000
SHA512 7f4b649f719b11033ddd099ec18038f9dc92c1b13f6bd5a67871a92d0f1eff4b5fcb60d5523b559db67007ac66399c35506c8df1e15cc89d4201a9b12a0b1c3f
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.8MB
SHA256 9e687b500a34abebfe0079f87f9ef72f1658cae8b81e41d3e317505e9a979b57
MD5 748a30c935c0f2a815324f2f751b87c2
SHA1 41a2d86bedf81f218a1edcfc4d55d3bf2f682374
SHA512 15dfa2cc3121ca7ce66a3d91ab86780e583328bf539d7987ae72f0bae4d7ba4fd52082c431f0378acee9d4206a50760b7715c54eb0a9a24d01401c04dd1a9b7f
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+EH:i/fh6ImzzJoDfuBcMv+A73XA6piY
TLSH
T167B67B05FADB44B0E967617048A7D37F8631B9118732CADBE2448B2FAD33BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 b2f105d86636d8a3d366f05526abed22b030226c058f902e64103f30b66b650c
MD5 484d1123e1f0b1cff4d1669e84a214af
SHA1 c4002df6262e48b1a0726576f53601236daf2ffe
SHA512 e1693ecd1f3393f05fbbde5671bffeaee8b45ea029123e3c20dcecee30cd0856fef87cfb66017c6bcd89fb7ea1bedff636b98e6ec8eecb0a7ca25d65e4048cab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\qap`g`v~dtlq
Size 10B
SHA256 19d803d015dfdabf1455de7a14a6706e2ef50835c7e35c877f9be48073085f2b
MD5 a1d531077e38b25191931c96ce0776fc
SHA1 dbb5dacf03cfd716f8ff3ef377161236d1387522
SHA512 e54b8656811dff17883b855635373fc9ae166d3445cc17939386b003acf3948c7a55e39f4a88452335804b702c74562e4e23c145479e147b2827265aedb1eb3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\qap`g`v~dtlq
Size 10B
SHA256 d2922f9fd7a036dd4dac0245410fdd6f5b285baf3500e26b7b09533cba5839ad
MD5 7ecfb1430e0105e841a03d92a6e337f7
SHA1 e6c339348cfeebe0d364f8a5741673037ec0963b
SHA512 e622d9c42e92edc653e2fbe9ddb4d13375ffc0675425b6bc020ca6e8b7356377b9c88fcdf9c493377c9038e3d2e01bf7bf053a1798ea3d0397e9a531a122f913
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6aaf504400c436dc810e985892dd67d076e71c3b9b00b677875e2ffe7750fb93
MD5 4649cb934d396b661787a85643dbec6e
SHA1 4efb46a23ae64381c5f7ace43e4203f54c128981
SHA512 3f434d7e4c0ec12f7a25c28e533c0bb10adc6fd8d8c117602a9908415df282bfeec65706eafd5c3900824732082de3bd326a197420ed08e71fadb61584245344
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 d373b4437674fbdadf53076f23dc4e1fc9614da90281043604f08817c0e0bec5
MD5 143f69a93ec3299444e15e4447bcaae5
SHA1 b2f58617e87c407173f3bb6a717cfdcafad9bb5a
SHA512 7b9a301ae9cd0ffac6fd2fb733d140d9981de1412167645f7d011df79eb7920fb3f843ed7c249551d4a8fc236e4062eaea201586cea5ae01df2d990af9db6969
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 144c27c76ab3f29fade0330a7b0889ffe5b70e41e94ad86e409436e7d06741e1
MD5 eea764bb0f5ba48111e8765399652486
SHA1 cd0423a158e193b355ee5b8231bbe01e54ae8bb2
SHA512 3b2251ac03f7c4d92a4aea7fa5dcb6c6c4620f3caac97aec70a99e7fa02744260309e08da2f1d91fbd609a0cd2c36015f57246009e9c7142c0da7fd64a4b665d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a00188ed8f2d0d2b3735113c9c0d61fcc6477ec379bfa4eb74dd0c3f0f142f9c
MD5 a2926d8c733a2d61becc222becda8e01
SHA1 2f3f16002b39550d45c74999d675ed5e4ac9a965
SHA512 d40714f3e42a390f92d4809968e492419d232f4602a7ee50c95f427cd7204e66c450bb9fb73b7c9ecdc0220d846dd8b01ec08371f80ef9c535ef281130a42b8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3d6255b6e478c1d2f324e982ac54919c1e4590a998124f11b4657b1e3dfab06a
MD5 25bc91d9ca45d139191100b5e6b4d142
SHA1 3a09bfecb19f2b23c363a27bd6fe58a6c4600ae7
SHA512 1a0c193844fd2b422539f82a24a1f70585dcb55758eb617df30f4a10f307f0de064cd24a971cc93aac26270be66e564dd6fe96290ec0014648dbeb250639768f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 18f8a40b359d0548b2d59fe876a379223dd8502faaaeba1c00ef2226bdcec943
MD5 e81b80b7478e7159b7b9081c903e7cd2
SHA1 21eacd995e038ba7eee316730568d0377aab5192
SHA512 0a8f6a51a3e446a6732aeb527704b22ea426dda70ccd3fa2852af28ccbd56a724541a8980d99b04e7cfc0c3a59a02c4523f9579a3da3570665cef4e729b7903f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98ea5d459fdd867dfa6c9d2853a3233736a769be9fe86b2e84abcb22ce56090d
MD5 b9f84bfcb712b862f0dbd9c80d7a44eb
SHA1 3b17d27330690b343d46f84618116d05c05ddcce
SHA512 0fd60644e67514e8050905e9fae432861a74a07207553a3c585be44e273f11b29826e0bb28061254cdf68a47364fb8f22de1f7bf6ef79d11327ea842b85aa74c
MD5 SHA1 SHA512

Submit Download

svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABCACBCBBCABABACACCCACCAACCCAACABBBCCBBCCCCBCBAC.exe
Size 10.4MB
SHA256 938e60991c5d72d106045a3a73c9e0e85d3f7ffd2a494a777100fbcec6d57423
MD5 87b54e6bddef1c6c80e1f52ca9cff358
SHA1 b4d7721378f87ba5c37e0394e67d3ffcd3e5e436
SHA512 404fd7cec6fb1a7d2880035d67a75c2940180dba6f8fbd61b0d76aefb4842a5d19f5d3c8395d97454bfeaf39cd6ff7b3dd23ab2e57438a504c0c485c25f37d2a
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+Ek:i/fh6ImzzJoDfuBcMv+A73XAd
TLSH
T152B66B04FADB44B0E967617048E7D37F8631B9118732CADBE6448B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1bf01a425dc7b2f6271017beffa11932f24c7b1fa9ab572f9e7ee22373604df3
MD5 3e919807504bc3b6dbaf3d6a341ba51b
SHA1 17a3163dcced7914f70d987ec5775f6c2e4f1eee
SHA512 7ab6a218d4b8b211f580e90d8b26778e569ca8a083483c64dc88871e5620b05fadf33caa5a8462544d45a0bdf7a6c35d36a54c3db3265b2b4d93cfac90504a88
TLSH
T100110A51D4E5D853E93369CBE61B5B820CF4775BEC5C6A2623498229BF44C33CD198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4d28062a0c8729142d7600e0f0f988782855eaad78037d66d61c3a5bd2f3b40e
MD5 aca6c20ba6dd3c95cb1f825fd118e961
SHA1 55fafdae2653fff0d4fc2c5fa3a53fb79d4f8362
SHA512 342557c547399ab618dedf736e171a7f4214022583fe15c6b86ca5c2921ac75cc192c32e524e8bcd7ef2cd89f3d77e4ddd02599c0dc80ce0f23a684a494439de
TLSH
T1B1210B51D4E5C863E93369CBE61B9BC20CF4775BEC5C5A2623498229BF44C33CD194E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2400-1173-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/3584-58-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/4904-86-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4996-34-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/5084-0-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/5084-7-0x0000000000690000-0x00000000006B1000-memory.dmp

Download