dfbc482e07457eb85884baec4b8cc7af5f49b202d29f646649f1e77d76049741

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 4.3MB
Sample260815-1fep3avvbx
SHA256 dfbc482e07457eb85884baec4b8cc7af5f49b202d29f646649f1e77d76049741
MD5 6601bef9ffe530d2252516e051d7df79
SHA1 6c58121009e2ef27aa487bef26220d6a6017888e
SHA512 54dbfe931c5dae227094bdc0a02f9549480fc16de40f7786675ae6a07a78cf375ecb99a3a8ae45e3f6cdabe8901af8a3e0f29626982c2e435c1ecbe6f5a6ed0b
SSDEEP 49152:U+ES+EI+VKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gjg+A2deCMmwV/vJu1:x/fh6ImzzJoDfuBcMv+A73XA
TLSH
T129266A50FADB94F5EA034A3049A7A37F6330B6098735CBC3D6409F96E957AD21E33216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
108	svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
4184	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBACBCBABCBAAABBBCCBABACACCCCCBCCBAACBABBAAABBCBCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe"	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBCBBBACCBBACABCCCBBAACBBABABCBACABCCCACBCBABCBAAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe"	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5600	sc.exe
6940	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1008	cmd.exe
6400	cmd.exe
5512	cmd.exe
1548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5460	schtasks.exe
620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
108	svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
108	svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
4184	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
4184	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
Token: SeDebugPrivilege	108	svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
Token: SeDebugPrivilege	4184	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1008	3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	95
PID 1008 wrote to memory of 5460	1008	cmd.exe	97
PID 4512 wrote to memory of 4968	4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe	99
PID 3200 wrote to memory of 6400	3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	102
PID 6400 wrote to memory of 5600	6400	cmd.exe	104
PID 3200 wrote to memory of 5512	3200	2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	105
PID 5512 wrote to memory of 6940	5512	cmd.exe	107
PID 4512 wrote to memory of 1548	4512	svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe	110
PID 1548 wrote to memory of 620	1548	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_6601bef9ffe530d2252516e051d7df79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBBBABCBABBCAAACACCCABBCCCBBABACCAACCCCAACCACACACBBCCAAACCACBAABBABCCCBAAABBCBACCBABBCBCCCCABBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBBBABCBABBCAAACACCCABBCCCBBABACCAACCCCAACCACACACBBCCAAACCACBAABBABCCCBAAABBCBACCBABBCBCCCCABBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBACBABBAABBCBCAABACAAABBAAAABBBBCACCBCCAACBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe" start= auto displayName= "UserDataSvc_CBBCBACBABBAABBCBCAABACAAABBAAAABBBBCACCBCCAACBCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6400
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBACBABBAABBCBCAABACAAABBAAAABBBBCACCBCCAACBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe" start= auto displayName= "UserDataSvc_CBBCBACBABBAABBCBCAABACAAABBAAAABBBBCACCBCCAACBCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBACBABBAABBCBCAABACAAABBAAAABBBBCACCBCCAACBCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBACBABBAABBCBCAABACAAABBAAAABBBBCACCBCCAACBCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBCBAAAAACBAACABACACABBCBCBACBACABCAACCABABAAAAACCBBCABCBBBBBACABABCBBCCAAABACCAABCCBBABAAACCABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBCBAAAAACBAACABACACABBCBCBACBACABCAACCABABAAAAACCBBCABCBBBBBACABABCBBCCAAABACCAABCCBBABAAACCABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBABCACCACABAACBACBAAABCBCBCBABBCCCACAAAABCBBCBACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 375c2cdf2045d21e224aade3e200ba52a12fa457a1ed3037e33155ccf9a0dcaf
MD5 21c3be104c41048387ec799553d3ef6a
SHA1 29681301d943736c890b78af980db6cfeede782a
SHA512 77a8c64e1b4cce51ad37503d0b51d90d725771471ba0548d0bcd88b83599ef19cfc42def33e75d5ac8cdd9609eec06c6c56ebc8655c417dbc26c0c6131092ef1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 043ca7873e7c87e40440ede1b3c88e7cc2349432fdc9116030839a189d2f147a
MD5 edc0702411d6c879d5e5c3075dc31ba7
SHA1 59a3963d54db1a6face622329edfebceb7a997bd
SHA512 c0bf8aa0298c3ea9eefed321347bc64ce0516502973428e07e18324f72abf7301e458c734008ce1ec0fb3e61b0a372c7b038ae574c8d3bc18010067f817abeae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\ClipSVC\Import\qap`g`v~dtlq
Size 10B
SHA256 1469ec9e9e0d0c44cc7784e944c9b546b30e08eaa991c26adba48005f6ba8bc7
MD5 41128bf7a89873f332bcea49aa217ebf
SHA1 c3188b0221b5b0f87c500f931210c411aff95ea9
SHA512 2c517e7e024cac68ee452ef7e5b894e300704e9fdb80f93981ddb7a61cb512cb8930870a153597542f15fb4fd8e1d9017e3b8324ed471cee73eaae3fa653aa25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\qap`g`v~dtlq
Size 10B
SHA256 a87a9766b27cc268ece8c45e46966d3fe59d431f1277a7585203b5145993d841
MD5 302f46e0e87f0a22de1cf479841c078b
SHA1 d7225e086773ce95f4d8d4db4727669cf688cf13
SHA512 6bfdc87410a90ac5762e4c1e315c049c300b2f590803de02fba8c5a58fba1b6d367be71322ec9474e9c38af39d51f674c76d6ed6ed7653676a35cbe68b7057eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 3bd78e962d7572e65189f096ed2538421527be45f6cee1dea39d69e03cd46b40
MD5 41e30505cc878e8c0bac5da94f7eacbd
SHA1 8b30e815a40b630974834d6964c8e3227a076264
SHA512 a3fd16ea61e0a60bef7166a0ff9a43eae8aaa5f6cfc4016447e9c5408e58cccc6beef788eaa470a7fd5df46ee5b1a96a2561998d36d39c0b92a4f5d352688a81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\qap`g`v~dtlq
Size 10B
SHA256 85eac583f68da8c7494227be62bef46441b3e531f4efaa95dd6470aafe84862f
MD5 ae9850817869b9c0c0c4415382bf9e1a
SHA1 7064c34b0d564f6491d02e35a28562c6e945ca22
SHA512 857599cc48cf4dbcea6f015aacd2cb09a63ae7d0dddd236a55706cf03e4e806824c95097178e565cdef21147dbfbabd3ef494b882c426daa38f6117ae42d1155
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\ca\qap`g`v~dtlq
Size 10B
SHA256 b4ea627815cd3267d834a43622c8b12229164811c6bf52a65a090f4f68583393
MD5 e3966c9de04d61706c59e8b413f7f569
SHA1 3fb9eab96ae86efac83fb0e04eecb037f912ce13
SHA512 b9a6994c6e380e0c5838e586d94e26ad7f06164061a2426cd79452c736fb7a5df51d397de69a7c10dbc51a981760a38fd83e36e8594ada24d5c6d8b71101aee6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 14ea867b7e6f574b0253f7d1a7bafc6964782c806dbf30edb12445e465a17662
MD5 89fec91ee6266d2ddc2fcc39f313df85
SHA1 be73904ff2ff117239f2b96e51ab54391e382280
SHA512 0c5973898bc09fd98a6968e8e89f8b5f405a6173fbcb345fc410ed12148502e00087592db8f96264828e18e796e291e706e20226629a6df53a8dde9d04a7f032
MD5 SHA1 SHA512

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 13.1MB
SHA256 ea168c0624999b73dea7b82af4b9f10fcb6af41241fa69b425d31002cf68c1b9
MD5 1322c0f9dea9da138ff5e767eae6930b
SHA1 6e6c490a08e55749c6d23496858355e9fcf61dbb
SHA512 47198a026327daf41aa43bee5e13de76dd17ccfde6d8d4762455d16ac66561290bc7ecad18ee2ff818047377ab9e76049295f648129490217004428f92ddef30
SSDEEP 98304:x/fh6ImzzJoDfuBcMv+A73XAR/fh6ImzzJoDfuBcMv+A73XAR/fh6ImzzJoDfuBk:xHh6ImzD+FRHh6ImzD+FRHh6ImzD+Fl
TLSH
T145D66A50FADB94F5EA034A3049A7A37F6330B6098735CBC3D6409F96E957AD21E33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 26.0MB
SHA256 4e358d71b62bf7df1afa49d69858e96f3d346e2e07115fa37bf3fc26a48e0298
MD5 b858202760a3010e0517c47d73292707
SHA1 74d4d7352273990a494b49609518ef24d919c9dc
SHA512 590cb5b7ba5e79840676ad43d1670df7de5219bf53db55beede167dbdab7ce9a2d2db3f0e4ab6429c6055778028bd0c8cc73692ca1851edcabe3156d4e258de6
SSDEEP 196608:xHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+F1:sxxxxxE
TLSH
T123576A50FADB94F5EA034A3049A7A37F6330B6098735CBC3D6409F96E957AD21E33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 1.4MB
SHA256 c88ae4db651ead78a97beaafdc7c8f39ab538044efc0674f0204a0e7b689d187
MD5 3a9ca7999fa5b4f8cd57813702f4b57e
SHA1 6d7b9e177dacfcc1a3e783da392cad8ece5832ae
SHA512 04fafac52d09bcd56dba5033921c9ccd588e60e59a879b955599d042edb3ab6b035cbbc9e9b682ba1cbd982de717a2b021cd105419463e1e3dc9fd6ce1c8669f
SSDEEP 24576:m9+EM0q9+Eiya+Tm9aZP4K8BEks5M47HP+TPJja3z6IgOvMQGZ7yFxK8ohAYQv0u:U+ES+EI+VKKfHPZ6IVMv76K8ocsCGzzA
TLSH
T114652AA0E9EF50F4EA039870596BA23F523137098B38DDDBD6840F42E567FE25533626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 256KB
SHA256 ec544883c5792469856dea3648f7739e5d1f3d8dd458b42113e160ea6acfdee6
MD5 0dcf0177d00dc5ba0e2877c92757f191
SHA1 5984346d58a551c021860636d70002224ad4a2fe
SHA512 9373e4afb2172d4a06f07cdf6d9d3c61f045d18b0b856aebd545e28e21d3b99b2daf227c7b8851bc76c5911a48093d437dea6aaebf58cf1d9cecf435e20e8c27
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEsNLwLwNVo:mgUFgEsnojA9gUFgEsNLwLIS
TLSH
T1D9443A05FACB50B5E57B41B04DAB92BE9530BE258701CDFFF689821B5C72F90A935322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 23.1MB
SHA256 2fc49592147ca6b2095807565de68b2a5ccd404c8354538f73bf68fcf12e8c73
MD5 191f651c3fb5edc1d3c8199038b94312
SHA1 1059922742047d6d29ca55630db08e6d8b6845f2
SHA512 43793dda79186ba443cdfe3566bacf930f3819e0b2079e95f97ff1e97c98bedaeb2afbd7d38d0f2f86eb10aa94ac8f72380f6bcb1f3b21a7e707002676ae57f6
SSDEEP 196608:xHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzR:sxxxxv
TLSH
T1AA376B50FEDB94F5EA034A3049A7A37F6330B6098735CBC3D6405F96E967AD21A33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 51.9MB
SHA256 dc8b4f7380704524b709fa4d7939ae6f2b61b625e97e2a64f2b2a8f686bd7230
MD5 bcb667d39ed7c927c3d17859c6a46166
SHA1 5523fcfd980a2974b7b0e006d3179758d820c243
SHA512 a441b26d0800aab60f2a45c40992daf2ed627b07d2a582a1740a11357326a4c45a6e14ebc25e351f090c63b6f72e8202d1fe4948d78c64bbdd8b0060b326e2bb
SSDEEP 196608:xHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh6ImzD+FRHh8:sxxxxxxxxxxxx
TLSH
T123C76A50FADB94F5EA034A3049A7A37F6330B6098735CBC3D6409F96E957AD21E33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b550ff068e51b0308bb5aa856fa3c7d3a82544c730c569820974df1aa93b8eef
MD5 27bf22d506aa00464398a2b9e01a5482
SHA1 645c94df69385afb1cc0f7c7af0c7dac2222ab86
SHA512 cea31674548bfb3b756fffc029674b9bfb4f58bbdc1ab2a40e9dbec9a4ae377c24e47b0331b44567156d8e7f23bb104c3267895a1e7e666fcbbca79173483071
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e32d14c704dada406f9b67a6a235c1a3adc862f2bbb9966a6bf4b04e14e707e
MD5 c0d1eaa0da35feef7e6bf0c65cdedd32
SHA1 1eafeb1a616cc56780f3c55318dc74fe0fbab100
SHA512 96b058dbc41a5a9f40ff6f942505a7f0cc38c0b505a81e8edb659cf8282c3fab8ff44b495137e8df5915fb7de51923285141ef05c8dda2b9783d931032a3bad8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd22142094831d4e2c2503e5b015d5660d361c438da5294c04d7f73bedadc977
MD5 e83f8902b3f1279660709510d9b2d28e
SHA1 1f3244f99cbfdb3abd2446635dc8103f752aa4f1
SHA512 fa85f18a24f1e0856b2138caf52661c07ef4999f582f517f3d65b4f17155d4383095adf52d150e63fee669b03419f85ab9b333a42f71e8a178ed313d460ce80b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e17f7721f0a568f290bf305f06ae7296a04defc0b1657a7c1cc468d5d1cf5204
MD5 1c5a77d7abefd40c5b11198772e743fb
SHA1 8ecfe253f49ed0bcfafc1c6f06cf93f17beda738
SHA512 3625bdcc7f5c28f596e0164054a7d47dc5ce714660ca6a6eaca754de94aca189dfad55c5a7e198893fdfc07c83db3e75d5e53173fb9110d4dd611b310e1f7310
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9b6696ba64334b320328e4b7085868c1fe9a6ea840604bc4c03b1ab0e56004de
MD5 a44ea93694c0ae5c303a7be4dffe937e
SHA1 2e91441182c48ae70fdc5a57402036eecbb31da4
SHA512 32c33bfb621e96f9b3256ed1ec9020a710ab412751a4d8ec8acf3d22a0dbafe2b5a52de5ff3f13c3f0236914f0a71157f16fd869fe8bdbc81e6f5d89ff265154
MD5 SHA1 SHA512

Submit Download

svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABCBCCCBBCCBCABACCBCCBCCBCCBCCBBCCBCCACCACBAAABCB.exe
Size 4.3MB
SHA256 dfbc482e07457eb85884baec4b8cc7af5f49b202d29f646649f1e77d76049741
MD5 6601bef9ffe530d2252516e051d7df79
SHA1 6c58121009e2ef27aa487bef26220d6a6017888e
SHA512 54dbfe931c5dae227094bdc0a02f9549480fc16de40f7786675ae6a07a78cf375ecb99a3a8ae45e3f6cdabe8901af8a3e0f29626982c2e435c1ecbe6f5a6ed0b
SSDEEP 49152:U+ES+EI+VKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gjg+A2deCMmwV/vJu1:x/fh6ImzzJoDfuBcMv+A73XA
TLSH
T129266A50FADB94F5EA034A3049A7A37F6330B6098735CBC3D6409F96E957AD21E33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a98bfed0f5f64cdc2d5dfb5a6dc5d9e897544d8e37af62b128f423f420b65b8f
MD5 d798fd6fdeb994348ffda5d1ae86ffb0
SHA1 0774711c1785492b0182fe8cd86a961818c0316f
SHA512 0284cd13ca693cbea484cdf98f9ab35e275567aff2558d8f72673255219982cc3fbf077cfa3ecec9aef3938ef8d504e2a65293f0eb8dbf2c9ae4e5f6e1ddf540
TLSH
T184219554F4A68CA7EE3368CF451DEBD29CB43B879854AE14130D9218A785C33DD154E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d0c5d9f0ecd8f736d79ab2c7c66c5074175a0c171d0b7e8c5bd19db7fc4a7895
MD5 160e2d33c6a84ec1d9b45d39b75aa9d7
SHA1 35ebdcd8a1df292402b75c60e9c459f7b61487ec
SHA512 73f818e013703000883340f568702d72b131b5a0f7766c4b7c59cc80998d01865eda0275c19e8c8711ff3d04ded537d76413e4d6c59027c6b90fc4f3eb26963c
TLSH
T19521B154F4A68CA7EA3368CF852DEBD28CB43B9BD8989E04130D821867D5833CD194E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fe6efcd6647d2cd888725cbc12cdbaee754b030e1678765c5c7d40575d52fb31
MD5 fbcfa5cc16898c2527e8949e39f4ab55
SHA1 f0464a6b70a221a23d86d30d11ba86898a84b4d8
SHA512 ddd226fa30f913c87445586dc10511d44d7ff47ed580425da332c71a6bc9c5acabddc9263efb98569ad0486d7d0381e84ba54b9af9ed25b882f661fcdb53739d
TLSH
T13E11C854B4A69CA3EE3368CF451DEBD29CB43BC79858AE14130D8218A7D5C33DD154E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-2055-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/108-91-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3200-68-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/3200-10-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/3200-46-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/3200-92-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/3200-21-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/4184-2056-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4184-4049-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4512-69-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4512-47-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4512-93-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download