b474fa51db9269202add29001d3442fbea0c8bf7bf3964afd041fe8de1ea7e8e

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 4.7MB
Sample260818-antabasfkh
SHA256 b474fa51db9269202add29001d3442fbea0c8bf7bf3964afd041fe8de1ea7e8e
MD5 62cca906b310b831a0dc54ca127fa4ab
SHA1 d034ab905792d3e7942fb719d8f04ce74203d5f1
SHA512 0192b095c5ee147dc8911597ddfbd40a9bf435eeef81cc98249016d9332a5136669d9d3fe3e793316e57e6ac640f8eda5bd4f05bb8a52f76acaaefcb3269673d
SSDEEP 49152:U+EC+EC+EC+EC+EC+EC+EC+EC+EPKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqg:W/fh6ImzzJoDfuBcMv+A73XAa
TLSH
T123365A41F9DB94F1EA035570489BE37F6330A6098336CFD3DA448F57E927AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
5664	svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
5820	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBBBBBCCBCACBBBACBAACBAACBBABACBABABCCABBCABBBBCCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe"	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBACCBCACCBCCBBBBABACCBCCAACCACBAAAABBBCACBBCAACBABCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe"	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4296	sc.exe
5912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1852	cmd.exe
3580	cmd.exe
5812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
5664	svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
5664	svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
5820	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
5820	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
Token: SeDebugPrivilege	5664	svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
Token: SeDebugPrivilege	5820	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1852	4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 1852 wrote to memory of 1872	1852	cmd.exe	94
PID 5904 wrote to memory of 2124	5904	svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe	95
PID 4652 wrote to memory of 3580	4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 3580 wrote to memory of 4296	3580	cmd.exe	100
PID 4652 wrote to memory of 5812	4652	2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 5812 wrote to memory of 5912	5812	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_62cca906b310b831a0dc54ca127fa4ab_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBABBBABACACAABBCCCACAACABACACBCCABCABBAAABBBBCCCBBBBBBABAABAACABACBBABCCBCACBABCCCAAACBBCCBACCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBABBBABACACAABBCCCACAACABACACBCCABCABBAAABBBBCCCBBBBBBABAABAACABACBBABCCBCACBABCCCAAACBBCCBACCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCCCCABBBABCCCCCCBBBBBBBAACCABAABCCCCCBBAABBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe" start= auto displayName= "UserDataSvc_CACBCCCCABBBABCCCCCCBBBBBBBAACCABAABCCCCCBBAABBCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCCCCABBBABCCCCCCBBBBBBBAACCABAABCCCCCBBAABBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe" start= auto displayName= "UserDataSvc_CACBCCCCABBBABCCCCCCBBBBBBBAACCABAABCCCCCBBAABBCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCCCCABBBABCCCCCCBBBBBBBAACCABAABCCCCCBBAABBCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCCCCABBBABCCCCCCBBBBBBBAACCABAABCCCCCBBAABBCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAABBABCABCCCBCCCCAABACBBACBBCACCCABBBBBABCAAAAAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 803116537c25efcd4d4f9f251c518a18f36a7c5fd57022e4a8a2855327b684e9
MD5 ae1f328ee92daf1159b48261a303aac7
SHA1 764788be08db7b2dcc2191d4216517fb4933716b
SHA512 065b3312ca2129d0bc431f8a933b3f87e609504704cfc721c7b6e89d8e33f144ecbadc1ca8a2bf3070542ac93c2ca7cdd41d0ea148c76448dcf8bc20b70138b4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.3MB
SHA256 e4a6aaa2e8a93cc7fbbe67686898ccf5a6b90c090cf836dc0c12d65ac285e0c9
MD5 447ef44b6f0cdbd5c455a2f29ca7b599
SHA1 e74f3ca6d1b7841fc7046092afc73fb46dac6541
SHA512 c120ba3c6f00c63d76e3a4cbc48580a55c213445436e8c9bdc5cfd5a9fa2cacbc5d7b1fd08a2a9dc80d9762a22e4fd056b954ad0595b7c885f9fb0f7f9bc14d0
SSDEEP 98304:W/fh6ImzzJoDfuBcMv+A73XAdgZ2Hb9t+2xD:WHh6ImzD+FdgZ2jD
TLSH
T180466B51F99B40F1EA03067048ABE37F6730A6098335CED3DB849E57F967AD21A37216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 4d40c84b3bfb883107fe86d1994910890443f50e7874d0e4fed98262285da1d3
MD5 53e21ad6bb531283075d0f31ebd02de2
SHA1 a4095c8ecc8c019327b8f6ec344bf169a9dfd202
SHA512 8d0729cb3be7d2a2941d2e8d5cefd71ad4d7f50c2083d0e10b4a69a7633250ec4254d22dbe403031ec2399e1847b80b9401bb9cc48acf61bd0b7860b5f195f8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 50d80e8f235daa7f757ed01c16720539b6db799481b83aff3aeef93caf192e15
MD5 7c53a0a1ac9a724e62cd9ef6b0b5c5a4
SHA1 811320a0b83a83d84c1c665f69cedd23e457b7d4
SHA512 3c6cc5e661d70070cfcee02529953cf35808204a237e716243214ca8ddfab71a191f8e325a8047f611162d2915063ca6331f806cb22836ac51cf5013bff2e4e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\qap`g`v~dtlq
Size 10B
SHA256 cac1a36a4697389ab2135c55781386c282675f0cb0a8a88b40a6c052c91a5809
MD5 c456aae7d0dc8a60374f5d9d2daf9053
SHA1 bab96b481be6ef93a2c4f7567f94a712f8a47526
SHA512 48fa53e9e2d602d2448a00b3c82362a389d01cdccb021699ff2653dacd5053ffb075a1f6b3456c65836efbdcec8fea915a501397269b1c39199930d54f2c8b08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba6cc1c5af38c3c52bde20c888f92a09b8e32f4c575c7a2c9e822ee521387003
MD5 88f01efb726d23c8b9a7fd7095556c19
SHA1 24e3217d32e59c9f12888b04db55815699cae5c5
SHA512 40eff86ad257e62f334800615f2c051760e57306d251a3a782fd751542e9acc6368997abdbf434688146df50e567c1f8869b909a8f313d05c6ae6a32614cf612
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f24bd1e4ee374996f8fc53ea1f04c77af65fe5b8d261dde81a79c41dcf6bc79
MD5 70f67f753594cd0802fef302bd54fd6c
SHA1 780da46fa77e208a71e2349ef747ac755f54cf79
SHA512 326a500b71b181db7b24dc87114e7366f2ef42604179879e7f78fdcea3133a7a4cf0f53d93f616ed403bfdaf584265f90c5db486a4b5150d3d1cf46a9a6b77ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d8ce8475a83f18214c0d729d24a3a8cfb7cbc35d5316e37720192ce587caf506
MD5 49f74557990e7ebfb36af93923f011c5
SHA1 69df99944e056a90cb5c9f1e4737cde4e8feec32
SHA512 a139e09db97e5355e08bf7b19114260ed4c1647b013aaa9ecc58fac09ea992f9e3a21d7ea847900404914d272e0f92caddd94cd9ffbd73500e929948161f6d21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 27e2cb4e47ccd1e2087db735cca2f09ad42d56c07cd1db1cc52ca600b11cf501
MD5 81babbcbed6717b0fb46934aeb10983b
SHA1 65a7d0738eb2ff8acfd87bfc97c53d4c043e35b2
SHA512 033f5053599d4fefb9a4db14996bdefe709a19338e30559de7b2404ccf64fb829dded996eb8f6ff485061499f69e5b9c751304f7fb05fe20a03ae51d7142d877
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8b948e7199efa94401b4892404964704019d34b22b1e01f67f7aa3758a0a64d4
MD5 30b98f46f9e6cd1899e31897154bde66
SHA1 94076e2fd0adb69102ac848febdb94753e1f1569
SHA512 4531f1e63b6682e2ad128e24a209e99d0171728dbdf75ee87a480506e7336151aa99f2f74e89f05036b567cb120524c86d94323af982dac81de74833c943aa4a
MD5 SHA1 SHA512

Submit Download

svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCCABACBBCACCACBCBCAABABBAACAABAABBBCBAABBBBBBBAAA.exe
Size 4.7MB
SHA256 b474fa51db9269202add29001d3442fbea0c8bf7bf3964afd041fe8de1ea7e8e
MD5 62cca906b310b831a0dc54ca127fa4ab
SHA1 d034ab905792d3e7942fb719d8f04ce74203d5f1
SHA512 0192b095c5ee147dc8911597ddfbd40a9bf435eeef81cc98249016d9332a5136669d9d3fe3e793316e57e6ac640f8eda5bd4f05bb8a52f76acaaefcb3269673d
SSDEEP 49152:U+EC+EC+EC+EC+EC+EC+EC+EC+EPKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqg:W/fh6ImzzJoDfuBcMv+A73XAa
TLSH
T123365A41F9DB94F1EA035570489BE37F6330A6098336CFD3DA448F57E927AE21A36216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b5702215eb075884d95f262ce3dc287c74c8dc23af4fe9ee41a515c016f73e51
MD5 ea7d8398945113be015e1d03a8fc2583
SHA1 b9d1fd2bcfdc724e99542825e3b8b732673436ad
SHA512 9c5a31d285481638db5d08869209b957e590bbd7c93e7d82537a97ea7384a10b2baa2321ea3a67ae37952157e4f0368b612c38a84c964f3197d1dbc413597772
TLSH
T1B9113A30E4AEEC83E832244F6B2DEAD34EE9369B585C6A96931D0118A798C314D1D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 945410650599a7cc965cf42d968ca2bd715d9e48a0bce6b0c1f5f2162cc10aa0
MD5 7ab7f9f04e546e8f9d229ce2ee08e22a
SHA1 e3f7f255bc4ed8afaf0e94322ada3f68877a9fe3
SHA512 8d66799ab408ae8cf58af95f4297b2feb5538e795d89e5e219c7689df683b15cba147ebe8e001709edf39351e7485d2fbdc4e025ee7edacc46412836bf53a664
TLSH
T121213B70E4EEEC83E832644F6B1DEAD34EA9365B985C6A96A31D0118A698C314D0D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 f95c0e0e9cd17337bda3a8c9ea3399460151cffd8389bfe8330ccfcf6a9acc60
MD5 b082732de0d7006a5b3ae2fb6edcf5f5
SHA1 eccf6a34921e3cd3d465d513af971e1f2eadca38
SHA512 62f174c314b029b167420947612ac956459ce605bae49cbe5223a73b99b546d74e38c95942341f077b121a9a83264a3b22a9502586913458fadbdf4f6a96d964
MD5 SHA1 SHA512

Submit Download

memory/4652-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4652-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5664-78-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5820-1379-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5904-31-0x0000000000400000-0x0000000000421000-memory.dmp

Download