9b797d549b62e2eeac36a93b2a7c3424e40ea22cf3722b8139a58838cba79d03

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 9.0MB
Sample260816-e45eqszzex
SHA256 9b797d549b62e2eeac36a93b2a7c3424e40ea22cf3722b8139a58838cba79d03
MD5 5bf6ccf6fcc3229b035f152ffdc61ca3
SHA1 0ce128d79d2e502a59659267a23a62a5fd2ffeed
SHA512 4cc4ff683796e35ff3c56c86505e328a7a520033ff9f16f878d77a0c7e8a25d686e1601c15ac5d871b82ce48977238f477d298981826cbb22bb82b65dc8e85fb
SSDEEP 49152:U+ES+EN+ES+EN+ES+EN+ES+E9+ES+EN+ES+EN+ES+EN+ES+E9+ES+EN+ES+EN+Ey://fh6ImzzJoDfuBcMv+A73XAH
TLSH
T1CB964B05F98740F1D91B15B008CBE3BF8630AB158726CEE7EB48CB57F927BE15829256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
1800	svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe
2508	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBABCBACBAABAABBBCABAABBCABCBACBCCAAAABAAAACBCBCCACABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe"	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABBBBABBCACABABBBABCCACCBCAAACCCAACBACABCBABBBBCCACCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe"	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4204	sc.exe
1020	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe
1708	cmd.exe
4368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
2508	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
2508	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
1800	svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe
1800	svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
Token: SeDebugPrivilege	2508	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
Token: SeDebugPrivilege	1800	svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2632	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4928	2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 4928 wrote to memory of 1104	4928	cmd.exe	100
PID 3408 wrote to memory of 1600	3408	svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe	101
PID 1600 wrote to memory of 1252	1600	notepad.exe	102
PID 2176 wrote to memory of 1708	2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	106
PID 1708 wrote to memory of 4204	1708	cmd.exe	108
PID 2176 wrote to memory of 4368	2176	2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	109
PID 4368 wrote to memory of 1020	4368	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5bf6ccf6fcc3229b035f152ffdc61ca3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCACBAAABBCCCBBAAACAAACBCBACCCABBAAAABABABAAABABBACCAABBABABBBBBAACCBBCABCBBCBCACBAACAABCACACBAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCACBAAABBCCCBBAAACAAACBCBACCCABBAAAABABABAAABABBACCAABBABABBBBBAACCBBCABCBBCBCACBAACAABCACACBAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABABABAACBBBCCCABBBAAAACCBCCCABCABCCBCCBCBCCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe" start= auto displayName= "UserDataSvc_CBCABABABAACBBBCCCABBBAAAACCBCCCABCABCCBCCBCBCCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABABABAACBBBCCCABBBAAAACCBCCCABCABCCBCCBCBCCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe" start= auto displayName= "UserDataSvc_CBCABABABAACBBBCCCABBBAAAACCBCCCABCABCCBCCBCBCCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABABABAACBBBCCCABBBAAAACCBCCCABCABCCBCCBCBCCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABABABAACBBBCCCABBBAAAACCBCCCABCABCCBCCBCBCCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAAAACBBABACAACBCBACCCACBABCCCABAAACCBBACBBABBCCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 02a705ed4095b835d96b77af0a44a8eb66b9d7d03f9407a33bd3cefaa600b978
MD5 9b9776c91e4e6ecd284cf36cc8cad4c7
SHA1 6f62ade5ff5ae85906a44983fa779e5d13c3b97a
SHA512 11cc28cbb09a29b1132baf950b1e1f750d6c682598215af003c7a430ab534baa0c8fb0a51c42ffe0449a9a746d82b11ebb3a71e87460c5ba5538138af86ca449
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 9.4MB
SHA256 351df5d038e6e9fe9cff6dcfdbe896f413eed792fb49e65a2d5298754d4c7c8e
MD5 ac0ee1bec50dcbd5e0ac5abe305212cc
SHA1 361fbff237141413ed7a3f56ae937bf18f750e0f
SHA512 d64de91fa601c11a59f80d03c5589797a20d2d781cd917dcf4a62a9accfe12be9dec97de335e90b8888f09fde88397391689d03fe1a7183fa4e7748508f9b10f
SSDEEP 49152:U+ES+EN+ES+EN+ES+EN+ES+E9+ES+EN+ES+EN+ES+EN+ES+E9+ES+EN+ES+EN+Ex://fh6ImzzJoDfuBcMv+A73XAMpig
TLSH
T188A65B05F98740F1E91B15B00CDBE3BF8630BB158726CEE7E748CB5BE923BA15825256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 aee1c0a2074ed7cd29b76da90c1a60da9f571a2cd99bbc8de4397843ac4770c2
MD5 774643888a51ef1d0af0fc436ae38e1f
SHA1 3968d237a88b5b662141b95ff1830edeba524433
SHA512 478c0857dec36abfac9b3ee3837529282d54ffdc2186e6044c0038b347e7e441102ce57c4e2024f1876c89f71d4b3b7ff67ca74ac828e29bfe65259eb5c61012
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 9ea0ffe9a0e8e03970e0f2475baef4d2c10151600c6e43a10b54ce6fccdb7692
MD5 a76f71cabaa08933c6d8a00b7d74f162
SHA1 4f3d1a174ca6a59607dac85e87e00468553336d6
SHA512 9b80189a65455605f4806201597837f74bd3a7d14dcd0c243eb6887ed998cbc738d573862e64c2a41ae8afb1b76fc1dfc8df6211edcca253065651f002ff4711
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 9f92143f105431f048368cc345e209d53acd69f0b524348d4edcf583fb3285ce
MD5 f0e0b66d2de83f7c8453a08f188f790a
SHA1 ae7f88d8526a1f94a626a73459e3bcaae832021a
SHA512 59ee96c5c8a3660f06d9ee632b6eebf38bba7cc024cef70db825928745f448f07f28f7220e2effd71b510d5a60cbf9019471ac57f849ab1a47bba1916a58c1b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en\qap`g`v~dtlq
Size 10B
SHA256 362b61cb9e817991c14c84781fa5efb58ff8b20d4a3474f6e67c5db30fc6458b
MD5 466c9486dd86ae989440312ce077d6ce
SHA1 06165da3021924dabbc66cb6f0c1d9c045a94ac5
SHA512 cb0ae5900693d0d323a5276d16b1a7c973bf67f456063b7bbaaaf3d4c31c86979498e3bf5feef10cdf45e2ed5379041bb2c5c898db43babd588feae0a6ba9ee3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\si-LK\qap`g`v~dtlq
Size 10B
SHA256 1c4f340ec87926214e9f0b7056fbc29e6b3a12529fb339553826f3eee7d9e4e9
MD5 ce5607ef5947d42ed76a3202e6b010f2
SHA1 cc3e234983f83bc0a8319d2f71073d33d79b5b7e
SHA512 f4df9eead7cba617dfdd3a22164eff078bf67a6cce73f02953acf3eaf7999dac9c88a26c837dd4bb903223fabba46289d6218d73438ab7a39f72a6ae13b2400d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 fa3a1c24c3f8f3355bb2b9325d513c9dd11e7ff1481a820c4dfd4d308ade0500
MD5 f3e9128767cd27a5d3b16c61b50b8726
SHA1 dcebdd64388c344dd598863c1c3001a617e784e6
SHA512 b77c13545938e1ceab1292399b6b71c1c7a1c6e7d359b03bdd774c56550fbc3eca00e7b1b49221067f25f631eb54632965624b3d17fdd7b22cb5e8b632cd63c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d559b469289eee453e11bfab7c4f219a291fd0b0ecd24f67cc065ce5e1b10dc
MD5 d08bb2e892546c3e61eecd2896ee4a48
SHA1 370b104f01902d6f7209dacb02f2c58faff30d25
SHA512 405f8be33361b596967948ccc24637f4858a6046a0e8df3b6108b0401a9f7dd2e75516bdea4ac384a8e42ba37e28354e3ac66d6b4f3c9df037dba58d23677593
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 deb05dd46245cdc2b0203709b530b47c6e8b60dc345e9e4939320e74a87415f9
MD5 b572b9bdacdb079e45f70832544e21ef
SHA1 ad7d22149fba51d0bb1eb31d49d3fd4bc2c60dd4
SHA512 184634c217fc347ba005c90e7e4c6d9303b5202d218aeaf36e35cf4299176259fcc9b4da10d92bef498fe5aa9f140a73df2589450becb2893c7321823db32c68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 151c779cc8de2b980a69e844e9fc214ddc7b8971db570aac0e8592d76c3c0892
MD5 c9f2db686e79a7f1c696db83b373221d
SHA1 154cd79689f5aabe7bc75c6e0355b246befab5c5
SHA512 f1db1d7d3f24d7c683721eb27d764c5212d1ac34e798a91ac5644401ace52c65fca6908064ec4555211e3a64dc4013f4e800707cee50f151800a45bec23eff25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0135fa482c372ae0843bb2f9d67f277bdec6037e7c39274d31dbf9502dfd5c79
MD5 21a61a0c06037a0fac375f3edd8deebd
SHA1 22ae69a366a4d4979936bce6537d4bcc1acb4365
SHA512 a5329f2677d7026ab300af3604cb99f5e6a282acf2f9aaec2b2606ae5f506d989490f84fc70290871bb7e407c53e57d580f86db1284c24d647b5769f937e37fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a28fdb870360392662959824314f43630ff90a71a3f668c8c60c2bc81485d272
MD5 147c650b54c25e5c174387d89608b7e5
SHA1 80a6ec0306498a33a41bac251cf5e7a5e1f09bf8
SHA512 d91d604f7d245ee38e9a655af8ac591620aa1afeb8a0636b9c7e0d653dc0908c6e028f9961b0d63c93e01652156609ec23d8db09f885ae033ccf5c1570fda264
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBCABABBBCABBBABBCCBACBAAABBCBBCBBBBABBABCBBCACBC.exe
Size 9.0MB
SHA256 9b797d549b62e2eeac36a93b2a7c3424e40ea22cf3722b8139a58838cba79d03
MD5 5bf6ccf6fcc3229b035f152ffdc61ca3
SHA1 0ce128d79d2e502a59659267a23a62a5fd2ffeed
SHA512 4cc4ff683796e35ff3c56c86505e328a7a520033ff9f16f878d77a0c7e8a25d686e1601c15ac5d871b82ce48977238f477d298981826cbb22bb82b65dc8e85fb
SSDEEP 49152:U+ES+EN+ES+EN+ES+EN+ES+E9+ES+EN+ES+EN+ES+EN+ES+E9+ES+EN+ES+EN+Ey://fh6ImzzJoDfuBcMv+A73XAH
TLSH
T1CB964B05F98740F1D91B15B008CBE3BF8630AB158726CEE7EB48CB57F927BE15829256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ffbe58f7258ad70a648af3d36e60cf65acd14b1e5b9e4a5847f1bcb30222642b
MD5 5e05a6ec22e2bcf36240bd740d869fc1
SHA1 fbf86c57f5f2d47f7c05df47cebc600847261b9c
SHA512 525f3829a692448404bb40d74d9aaac443b8b41398666dd5e1ca2a68b3df9deaaecb7dab27ccefe08ab30705a64f2d3c41c1ecd8dc112766df2ae4ed24ceca1f
TLSH
T1EE21FC54ECE5CC63FB3368CB931FAEC20CD937DB6858AA54230A8219EBD8D308D594D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 91d189d6ec4c91759247ecc30df27adaa66446eaf017ecb96eb136d7878380b6
MD5 dc357b68012c740e4f1154945b36d3b8
SHA1 965dbdfd69740a8433118bd40b83fd6aa4acf8e7
SHA512 e8d325fc8914bd0a210bdb0d0d20fb9a578e7d6a3791352899194c9986a4e1481daba9c17329bc95cd05f41bc9b2cf8c29f0921f6a6cecba6880e0b1da3b32e1
TLSH
T16B01DB549CE5DC63EB3368DB571E5EC20CD977DB78589A0423058219E7E4D308E554D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1600-57-0x0000000005760000-0x0000000005761000-memory.dmp

Download

memory/1800-77-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2176-6-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/2508-129-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/3408-36-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/3408-26-0x0000000000420000-0x0000000000441000-memory.dmp

Download