938e60991c5d72d106045a3a73c9e0e85d3f7ffd2a494a777100fbcec6d57423

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 10.4MB
Sample260814-eghmfstzax
SHA256 938e60991c5d72d106045a3a73c9e0e85d3f7ffd2a494a777100fbcec6d57423
MD5 87b54e6bddef1c6c80e1f52ca9cff358
SHA1 b4d7721378f87ba5c37e0394e67d3ffcd3e5e436
SHA512 404fd7cec6fb1a7d2880035d67a75c2940180dba6f8fbd61b0d76aefb4842a5d19f5d3c8395d97454bfeaf39cd6ff7b3dd23ab2e57438a504c0c485c25f37d2a
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+Ek:i/fh6ImzzJoDfuBcMv+A73XAd
TLSH
T152B66B04FADB44B0E967617048E7D37F8631B9118732CADBE6448B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
1832	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
5096	svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABBACBABAAACABBCCABBAACBACBCBBBCCACACCBBABBCBBBABABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe"	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAABAAABCBCABCCAABABABBABABABABAACBBACBBABBAABACCACBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe"	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3748	sc.exe
3448	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
752	cmd.exe
2548	cmd.exe
2260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
1832	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
1832	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
5096	svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe
5096	svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
Token: SeDebugPrivilege	1832	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
Token: SeDebugPrivilege	5096	svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 752	4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 752 wrote to memory of 5028	752	cmd.exe	93
PID 4384 wrote to memory of 2548	4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	94
PID 2548 wrote to memory of 3748	2548	cmd.exe	96
PID 4384 wrote to memory of 2260	4384	2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 2260 wrote to memory of 3448	2260	cmd.exe	99
PID 5124 wrote to memory of 1328	5124	svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_87b54e6bddef1c6c80e1f52ca9cff358_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACACACCACCABACAACACCCBABBBBABCBBABABCAACBCCBBCBCAACABCBBBCCBCABCACBACBCCBBCCACAACCACBCBACCCACBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACACACCACCABACAACACCCBABBBBABCBBABABCAACBCCBBCBCAACABCBBBCCBCABCACBACBCCBBCCACAACCACBCBACCCACBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBABACCACBABCCBCACBCCCCACBBBCAABBABCCCCAACACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe" start= auto displayName= "UserDataSvc_BBCBBABACCACBABCCBCACBCCCCACBBBCAABBABCCCCAACACCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBBABACCACBABCCBCACBCCCCACBBBCAABBABCCCCAACACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe" start= auto displayName= "UserDataSvc_BBCBBABACCACBABCCBCACBCCCCACBBBCAABBABCCCCAACACCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBABACCACBABCCBCACBCCCCACBBBCAABBABCCCCAACACCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBBABACCACBABCCBCACBCCCCACBBBCAABBABCCCCAACACCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAAAACCBAACACABBBBBBABBBBBBCBACCCAABBAACCCBBCCCBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 98ea5d459fdd867dfa6c9d2853a3233736a769be9fe86b2e84abcb22ce56090d
MD5 b9f84bfcb712b862f0dbd9c80d7a44eb
SHA1 3b17d27330690b343d46f84618116d05c05ddcce
SHA512 0fd60644e67514e8050905e9fae432861a74a07207553a3c585be44e273f11b29826e0bb28061254cdf68a47364fb8f22de1f7bf6ef79d11327ea842b85aa74c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 b568b9497ade96936d4e8ccf7d5385b4f6eeb3e1130bb09ccbffc075ff30e5b3
MD5 60e3199270bce95ef475d1c30f595702
SHA1 bb4e6c816c255b94761774ae936e30847e955eb2
SHA512 80f4b9eff4c96ad1e10acefad69f29e6bbf223c0f8c80a952efe459bbfb514ba20b87132d87d0542a3f8488dc54723d362cba335b146982a7f611777d5ffb993
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 b2f105d86636d8a3d366f05526abed22b030226c058f902e64103f30b66b650c
MD5 484d1123e1f0b1cff4d1669e84a214af
SHA1 c4002df6262e48b1a0726576f53601236daf2ffe
SHA512 e1693ecd1f3393f05fbbde5671bffeaee8b45ea029123e3c20dcecee30cd0856fef87cfb66017c6bcd89fb7ea1bedff636b98e6ec8eecb0a7ca25d65e4048cab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\UEV\qap`g`v~dtlq
Size 10B
SHA256 b85ac7f3c3ac8aab509317a2f11abfcb78efa3b2811da730a218d4b391028c45
MD5 a5f456e2fff24e97a3db923fb9e29d1d
SHA1 17747d7d19b4cb1b9eec359bbdf375a0d6748692
SHA512 c6b82922b34398c900735b55fcb4f3a3735fc4cbdad09c60bc0e6886beb1d26d6d2f297d15f16161b9ce342dd22d869ac7c590eeb56c79566be276df946860ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\qap`g`v~dtlq
Size 10B
SHA256 d2922f9fd7a036dd4dac0245410fdd6f5b285baf3500e26b7b09533cba5839ad
MD5 7ecfb1430e0105e841a03d92a6e337f7
SHA1 e6c339348cfeebe0d364f8a5741673037ec0963b
SHA512 e622d9c42e92edc653e2fbe9ddb4d13375ffc0675425b6bc020ca6e8b7356377b9c88fcdf9c493377c9038e3d2e01bf7bf053a1798ea3d0397e9a531a122f913
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 11.0MB
SHA256 35a69aad79c3538ea3f14ef47e7d05100c9df4a3d96b41ef4bdf6401db35038c
MD5 47e0183e5f55db5b92750c7e138e4be2
SHA1 0c12a5fce41fd0ed5f39cdf37267cc638e2bf576
SHA512 b41a00788dac2377263ecb3d29a9b61e8c4fdb831162f2455518f9f0480178f3a440f34a3d56a5c91dc810c9e5001b0e8a8da44a7eba01e5fb0989da5ed67a25
SSDEEP 98304:i/fh6ImzzJoDfuBcMv+A73XAMgZ2Hb9t+2xg:iHh6ImzD+FMgZ2jg
TLSH
T1AEC67C04FADB44B0E967617048A7D37F9631B9108732CEDBD6848B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 46b91db55b5c31cee3eb3e82fad1d216d7d7d7317e23d995d9e522da48de1fd6
MD5 355b083816aa355fdb8ef7028ae826eb
SHA1 b558d011e0e50b68660e66da89621cd6d24d5618
SHA512 2eedd9b6edefbaef61c55c2cf1b2154e7b51e3f018722f487211be02a8ab0fa762dcfeb37a159b8b1f9a67d07439fa90d5e91bb6e1f34ae437c0e445b0faf91f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 8133a31acf06d0f452ab4159895231fe48aeebb267584f4d87656ba51d0cf852
MD5 17c9ca7292f02b051e778d41fc3911e2
SHA1 839ae5600dcccd9833ba5cab94fd1b28ecc92000
SHA512 7f4b649f719b11033ddd099ec18038f9dc92c1b13f6bd5a67871a92d0f1eff4b5fcb60d5523b559db67007ac66399c35506c8df1e15cc89d4201a9b12a0b1c3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 614d0b76042eafaa1a820022ae21884282c15a7017b1e300e93116d3e5faac61
MD5 2e54df0f1d10369c18937d13268e5c07
SHA1 091988b8ddf47bb29f828cdc9ea0df6e728af1eb
SHA512 505837aad21ca53e628142d12fac215637b6cd920cf9cef17eb5b46a08632c5d207ff1ff7bc3b610bd530f640de0b0cca370bafbf9d054394bbf4415aa0e4217
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\qap`g`v~dtlq
Size 10B
SHA256 6aaf504400c436dc810e985892dd67d076e71c3b9b00b677875e2ffe7750fb93
MD5 4649cb934d396b661787a85643dbec6e
SHA1 4efb46a23ae64381c5f7ace43e4203f54c128981
SHA512 3f434d7e4c0ec12f7a25c28e533c0bb10adc6fd8d8c117602a9908415df282bfeec65706eafd5c3900824732082de3bd326a197420ed08e71fadb61584245344
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\qap`g`v~dtlq
Size 10B
SHA256 82e733a846fc06c99dfa96d4b27ae7c283fa747f24707904928ff05cce440c12
MD5 9ed29bc48d16bd984d71d6f40ff5891d
SHA1 180d88f70c9224442e76dfb10bccc2a52e27ce9f
SHA512 eeb32fa1174f9b2f9d03dec5d7ece8199d563c60d6e56fa53a2adef0ed4e42576e76f612591a1d260fcb7c430dfd368e69128085406fc75da05892d53f435577
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ESE\qap`g`v~dtlq
Size 10B
SHA256 d373b4437674fbdadf53076f23dc4e1fc9614da90281043604f08817c0e0bec5
MD5 143f69a93ec3299444e15e4447bcaae5
SHA1 b2f58617e87c407173f3bb6a717cfdcafad9bb5a
SHA512 7b9a301ae9cd0ffac6fd2fb733d140d9981de1412167645f7d011df79eb7920fb3f843ed7c249551d4a8fc236e4062eaea201586cea5ae01df2d990af9db6969
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Low\qap`g`v~dtlq
Size 10B
SHA256 5f55d307311d590044524b64437bf60e542d2617e5b6dc6dcba66aee079d401e
MD5 d0da067bd4baf8cec26c3867626f4e61
SHA1 8b6da7c8cf60bab6738e1c769d2316d435ff2f17
SHA512 d9d3d8bc1b2adf7d38b9aaa150072f76a9eb091164936a7cbed37c61a69078a31372a0c7c64a2beff95303221513c00ee696c654a2dcecb5884b1c4836d16304
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\qap`g`v~dtlq
Size 10B
SHA256 19bbecd30d82f3f65012a2e96bf6298fd63a89326457f76e23d447f1920b3c51
MD5 6cdf3e31b700cc84991c3c6279e44ff5
SHA1 62898efa72de245b83d1e58d688c664cc74f7011
SHA512 f2f90c9f48a3038cdb0598fae72f96364e40b0c6045577c3100b03a2876be86b5f9b8c6697606f7f9f2439b6031734399dbedc59a7ba4b4a14bf6ccfc7111185
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b87b8edacfdeebc9bf9d31e2a4418759ec01ca5a723ea0e905c751a6aea1afdd
MD5 4ddcbf0edc2842b405c1d3fffd924be0
SHA1 50c2fc157533010c7cc9909f19a681b5df615f99
SHA512 51e2dcb6a5acf4cb96063e969e2103bddcbf024ef8190d7dbe80f9058e3295a433377fadaf812195efcce49758d7c92b361a3b8556cee16fc9840e38c282dd4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7228c82f60d3c7645af2775e810c280c7aa792f899f016ed10f43293eacb0803
MD5 32e38d494c0d9dff13128d8632a7cde2
SHA1 f8dadb7e8e86f31881019c39a2c56e052d45afb3
SHA512 136f8aa18ce79a9cadd86fd3fc6c7327cf606e54c8ea2ab6992eef5c89b7f455d6a60922a1754bcc696dbc6f9e998a7b8cafeb5558a328982902560b7647bb2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 66611b10fb7981cf23f3177ed170b0d181c95f5c5e937c7e499fa7b42074f7db
MD5 c2a84ef8d0e363e5dbc5df85e2c1fe30
SHA1 8fdbad9b8c17fca2f479c5a40d5e7dd23ff7aae7
SHA512 be45229c81af0551815bc864b109abb8917ec104b8c425816188e89a10b2ab24498291c393998bab76b6b2ec364b1f463e4eb097c04c1c87c8a8eb97b38569ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e3ed9cf1f615cd1ffda3acd331b2df0c068859cbe4c71723549c5a68cc8f2d3d
MD5 dd0bad5cfa8fef3495af019e51df3bfb
SHA1 0e5fe9b5e52c5bede91b631ec2c9e58c5d883dd8
SHA512 eb1adf114b605df3f17a5eb1506127c8e3173da3e419a8e2a359389d8bcd1c38f6ad6dacb55db0d142b5885daa5c640ee5be524c251a44d2de893581b5a4a03d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af27151f384d4293800c1e8dc4b4715c13f35ab3878f434f874b00bef3730e30
MD5 1debfcaa23aeeefabfdb4c41c068be7a
SHA1 100485f91bbb9482d14c510bfdf4919f5d667e37
SHA512 7baf0e2af7f8375024d35059547f41299b598e04668869dd49f197a9e8853fa1174f6da8fd41e1810c40f74c2445a1b69f53ce50ff01661045a39ec3ffa0f04b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 19d803d015dfdabf1455de7a14a6706e2ef50835c7e35c877f9be48073085f2b
MD5 a1d531077e38b25191931c96ce0776fc
SHA1 dbb5dacf03cfd716f8ff3ef377161236d1387522
SHA512 e54b8656811dff17883b855635373fc9ae166d3445cc17939386b003acf3948c7a55e39f4a88452335804b702c74562e4e23c145479e147b2827265aedb1eb3e
MD5 SHA1 SHA512

Submit Download

svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAAABBCBCCBBACBAAAACCCBCABBACCCABAACBABACBAAAAABCBBA.exe
Size 10.4MB
SHA256 938e60991c5d72d106045a3a73c9e0e85d3f7ffd2a494a777100fbcec6d57423
MD5 87b54e6bddef1c6c80e1f52ca9cff358
SHA1 b4d7721378f87ba5c37e0394e67d3ffcd3e5e436
SHA512 404fd7cec6fb1a7d2880035d67a75c2940180dba6f8fbd61b0d76aefb4842a5d19f5d3c8395d97454bfeaf39cd6ff7b3dd23ab2e57438a504c0c485c25f37d2a
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+ES+ES+ES+EFiw2e+E7+Ek:i/fh6ImzzJoDfuBcMv+A73XAd
TLSH
T152B66B04FADB44B0E967617048E7D37F8631B9118732CADBE6448B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f88cb2364875d9101341089ea6b0839506a57549f8b4e95ef384ee1d54f25929
MD5 3188e16639aa51807732f4df75e46948
SHA1 935099c348ec06468439094c0729cff2447c2b97
SHA512 5123c64b4d8e1d5e0743467b6ab0860013b71c59b4b11135a87f833b9f237d8ba72ea990f32f05593d48f6220f47f03c5ade2b509e750cf19877c8455682d0bc
TLSH
T13521C97184E5DC93ED3329CB572ADFC20CFC764B645C6A2513498228B7A5C338D158E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 834B
SHA256 7a66553533f6cd3b28d6c44c20d54d7009ff5698f3ec8b0e7cb5b6c28f1ef00e
MD5 fb95573c43a3c40032e769147967fd73
SHA1 db57ba78c31d85f31bb1b346691f46c6a81962bc
SHA512 43eaee5dd4d723aeb0181be66a96ba93ff5772089dd2e4c886e9411fcfe4b1b9aff5d93997d9a249daec2234dd199f27e038bac917e2f87777a23f4ad181af92
TLSH
T14D01697184E5DC93ED3329C79B26DBC30CE8768B645C6A2113498229B7A5C338E158F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 787B
SHA256 7e868a9b06cf37e92a024379104184da7272154dbdaeec7ea132eb6e3a6140c8
MD5 1defecc0edc39046ad55370e0f813518
SHA1 4bfb1a2c364dca3ce0532601b68d57d7d219c834
SHA512 00073bca7f2ed295e309ebe4cca5e5ddcb1e18c4200fbc1214acd0828d3df6ba0336ada371f86da3869dd3850842944960a9b5b737c4793894efb07c82f59cf9
TLSH
T193014871C4E5DC93E93329C79726DBC70CE8668B645C6A211349C229B795C338E158E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1832-1653-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/4384-6-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/5124-35-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/5124-22-0x0000000000740000-0x0000000000761000-memory.dmp

Download