a613e1c7932f42da38098de74079bf2af04434d449e80e0567a6e12f52c0dcdd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Size 9.5MB
Sample260826-gz3fpasfle
SHA256 a613e1c7932f42da38098de74079bf2af04434d449e80e0567a6e12f52c0dcdd
MD5 dc57fc153c815a8a0c5058378ad0415d
SHA1 03f2beaacf042582c0ec5b2fc8f439a684d6cdfc
SHA512 bd2a649c214a4bf057958d48ed4e8e8f1abf3693a60cbeddf4fcce331f68a6775bb8fd9606045bf28f05f0da75937377f95dae1cadc1a63b866fa67106cb5536
SSDEEP 98304:QUP/fh6ImzzJoDfuBcMv+A73XA5UP/fh6ImzzJoDfuBcMv+A73XAcp7C:LHh6ImzD+F8Hh6ImzD+FiC
TLSH
T197A67C40FADB84F5EA03563045A7A37F6331B5098735CBC7D6808FAAE917AD21A33716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
3412	svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
1596	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCBAABCCCCACBACBAABCAABBAAACACBCCCAABBCBBCBBBCBBACCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe"	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCAABABABBBABCBCCABCCCCBACACCCBBBABBABAABACACAAABCBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe"	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2124	sc.exe
4836	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4100	cmd.exe
4704	cmd.exe
3220	cmd.exe
4500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5100	schtasks.exe
4396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
3412	svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
3412	svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
1596	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
1596	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Token: SeDebugPrivilege	3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
Token: SeDebugPrivilege	3412	svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
Token: SeDebugPrivilege	1596	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
392	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3220	1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	101
PID 3220 wrote to memory of 5100	3220	cmd.exe	103
PID 3960 wrote to memory of 1232	3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe	104
PID 1232 wrote to memory of 4216	1232	notepad.exe	105
PID 1984 wrote to memory of 4500	1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	109
PID 4500 wrote to memory of 2124	4500	cmd.exe	111
PID 1984 wrote to memory of 4100	1984	2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	112
PID 4100 wrote to memory of 4836	4100	cmd.exe	114
PID 3960 wrote to memory of 4704	3960	svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe	118
PID 4704 wrote to memory of 4396	4704	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_dc57fc153c815a8a0c5058378ad0415d_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABCCACBBBBBBBAACCCCBABBCCCAAAAABCCBABBAACCCBCABBAABCABBBCAAACCBCAACBCCAABCAAABAABCCACAABBBABBBBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABCCACBBBBBBBAACCCCBABBCCCAAAAABCCBABBAACCCBCABBAABCABBBCAAACCBCAACBCCAABCAAABAABCCACAABBBABBBBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBACCCAABBCBACBBABBCBCCBBCCCCBABBCCCAABAAAACACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe" start= auto displayName= "UserDataSvc_CBBBACCCAABBCBACBBABBCBCCBBCCCCBABBCCCAABAAAACACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBACCCAABBCBACBBABBCBCCBBCCCCBABBCCCAABAAAACACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe" start= auto displayName= "UserDataSvc_CBBBACCCAABBCBACBBABBCBCCBBCCCCBABBCCCAABAAAACACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBACCCAABBCBACBBABBCBCCBBCCCCBABBCCCAABAAAACACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBACCCAABBCBACBBABBCBCCBBCCCCBABBCCCAABAAAACACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACABCACCCAACCCBABAAABAACCACCCBACBBBBBBACAAACABAABCBACCCACBACAAAACBAAAAABBBBABCAACBCABBCAAACCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACABCACCCAACCCBABAAABAACCACCCBACBBBBBBACAAACABAABCBACCCACBACAAAACBAAAAABBBBABCAACBCABBCAAACCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCCBCBBBBACBAACCCCCCBCACCACABBABCCBBACCBAABCBBCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 184f1eb7b071d1a9eb876136905cdcfa2caca013b578cd142b559d7a99cbff89
MD5 fd030efbd0ec424123b7484af474c34b
SHA1 21c7f8f8319756cb998ed5a29799bb331acc1005
SHA512 d3f45df84e76d2efb60931ce11a9542e12d04516562f59e267c065d9a64381829f70414673b69012cfe8eaeb1283696eb25724fd9c2194a4a5c99766a7ff9369
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.0MB
SHA256 833764e788fd46a3906dfeebb6c327063ba07553e8651dc9f8951c0fc8a78ba2
MD5 38b5d11b555dc5a4a17160a6418a3dd3
SHA1 d9870d271fba567d8008db1409239c7348db363f
SHA512 f5f2a2c772c4d3f79912ca3404527d3544f6e375556d4fec0b8f56dfd5595863507ac605b627996000cc3325ee090e369117d481a119acca8b6d5c0b34525ebe
SSDEEP 98304:QUP/fh6ImzzJoDfuBcMv+A73XA5UP/fh6ImzzJoDfuBcMv+A73XAcp79pik:LHh6ImzD+F8Hh6ImzD+Fih
TLSH
T142B67C40FADB90F5EA03563049A7937F6331B9058735CBC7D7808E6AE963AD21A32717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 64c5b451bd5a4debe58b976b827b58d26f7939f00c98f6dc19455684d91dfb74
MD5 258ad7095d03ad40e61fa35d98ae9fb9
SHA1 d9337de988cd4d178fb201d03594a4abad156476
SHA512 53b92b887b97bfbfc052961e56098d08d186ce89f57e6938929220bc7a1b47db957d808ed4134d498e8305f0e77c9fe0519f64c1eb47a460d397392fbeb75283
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 5d38759649cc0cb40b5de30b71da51abeb6e7bde2395793759f2e6d1e91690ff
MD5 19917acdbdc37953a318238b390ed8a4
SHA1 4ba78574531284d1dfb5d4d0809e92e686227879
SHA512 75aa48941d39baea5638f9a73102187e30c35c79258fc2ec07a24ee95ddf8ed494a1ab5bcbb7263f1732ab1852ccbd618dca533f4a0fd00ed17d747a7b2fe785
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 059bbec2d58e19ce8880aaa937bdc079deadc09be3cea5d3f55a9565eecec801
MD5 9f6b2106788ef33c7362cd9409e64c50
SHA1 d415cfbef7d90bda54ca2bc52f16ac49ffe6728a
SHA512 d76403155adc428a5014d949727635b3e45c27d9aae7ad3f48f13e6d32520531c3c73d09489641e34b742a06aa4c7bed9112eed380fb43f8d56c25d91d8abd2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\PlayReady\qap`g`v~dtlq
Size 10B
SHA256 2e1dd7387f578b9de77471297af73f4f552c4fd7d6da0373c76a027aa1e941a4
MD5 2241cb73735eb899ee342d1c0a818d80
SHA1 da4a9fa57a35bc54bc2fc336ef8bd07f72813e8f
SHA512 f156928df1fb7ccb57aa31689fc81face8ede69a984fa5d74087eb19115aec5fe5bd702e18c8bcce6277771a5dbc61c2b51fb0c10e459642952f1c14c53df43a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 dd55a994af51aac47424ad268e7304f02715f02e05cee5ce9be14ce4d2c7fb0d
MD5 634b35d17837e54199dc14578c7bc3e8
SHA1 d0bf0ce99d3594cf7a17456cfa5f91cef4fd9147
SHA512 61f26f694f46c4908b6d44eb6bd912eba5835b9250ea6ab28923aad137fd14a2db7a8862fdc5556af44e0bcdcc71055ca8c34861de228615c3c53c7337ce3e94
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 03bec79a14de43735038fc620bb520ffdb8beff8530d2d147c33d0bc55cde6d4
MD5 3690b111947689ad4f9fd469dbc90690
SHA1 65a9f82ad820768593622eeebc71e00d7f141c6b
SHA512 41edef7e648e879c97a2321ba5632a41075fb6812945fb1ac0799370ffe71960363eae09d1c423f82189de72f288f98dfa0c79b55b0919762ccda6a9adacb6bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 494b6a54bc7a561314fa84916c950fbd60317beb6ba3f1e2ca3253f9cd43a8a9
MD5 bdf4934cf7c4ab3d63a6bdae01a0cb1b
SHA1 326af0e433e2d701516aa41631241daa697db374
SHA512 f8e999162f5ef8d03649b17c05390677dee8e9ee9a6546490645d24d0a30c49ff6ab376a92f8e7a5bcba01b422ef54382178bc6883431747ed5108c592b2426c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c951338b7998d8753e77c0bfc73cc034d44455561a222b607ae89376a352f03
MD5 9016dcc61385551148514ab86f64f580
SHA1 2c62bc8ad5cc63ed7dde40eb9e7e8a15184f4544
SHA512 1d14f1043878958f56e1cb10f2c89ceda14efd2b5238f771354a3a71a8f660c21dc6c512cc2afbaf6900bd11f00d6ae8ddcf0b5aa96be832252d9e817f90443e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05715d786ef025b4a2b57a34f216971afe2e26a6500a5aa9646de83d6d2287ac
MD5 b7cda6e1fdf14f7c6aee884e49cdee3f
SHA1 d39615c1b29e885f164a4a8662d1cd204bc264fd
SHA512 314391d041969837b795ff24ec25ba792965fb73d6d8a0a0efbffec3f73197165a9dc462c85eeff1447b9cc909d5882f2cde92e40864949b78ebc491cc30a41b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdd1579a80f306b2442327b4611563b3e8f0f050cdb2cc76ab667ea65a7d2578
MD5 a5ec2ab29f9d6462fbe703449371eedf
SHA1 667e1dd2cc76f2d9a7420b60f01dfed834fe5c79
SHA512 c70616db88a2bf7b329d753148c1d5fbf09ac0d48e720918283c113e01cd32dd9fe3724007e8758cc824cd1c5248487a5cc2a9e072d9f440c4b8425656843334
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84c6cc62963353efcd437039f6ea7c711402690862e1ad632833cb6746b76d79
MD5 a677c8cf182b20625ad8e927fe3d8d44
SHA1 8125db662383c82466704f87ead57607e4ad7a11
SHA512 4b0880088ef598c344c36fd323e5d6450317c6a8fb603c3a233fc1ffb12021e555cdfc8e04d1a9091f192da9c9b65e46fe47bbc243f30e6fd1957344acd25616
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 155e661662a9257cec195e9e6cfbe4a3febac7e280b8c02069c5b63b27991e75
MD5 361ec77feeec76ab518f17930e6d9cc7
SHA1 3091c75c0f9a69239dcfd0ddee95aa2504f9c6d1
SHA512 2cf60c7c1a697db149c2fa521ddcbe820613cc6d5290644f022cc3ff3a0aff918692a0a4bbcfc40b1b6a291dc0e72fdeee67723092dbf425875908fd5f17b588
MD5 SHA1 SHA512

Submit Download

svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAABAAAABBCAACCBCCCBBCBCCBABCBABABABACCABCAAABABAAB.exe
Size 9.5MB
SHA256 a613e1c7932f42da38098de74079bf2af04434d449e80e0567a6e12f52c0dcdd
MD5 dc57fc153c815a8a0c5058378ad0415d
SHA1 03f2beaacf042582c0ec5b2fc8f439a684d6cdfc
SHA512 bd2a649c214a4bf057958d48ed4e8e8f1abf3693a60cbeddf4fcce331f68a6775bb8fd9606045bf28f05f0da75937377f95dae1cadc1a63b866fa67106cb5536
SSDEEP 98304:QUP/fh6ImzzJoDfuBcMv+A73XA5UP/fh6ImzzJoDfuBcMv+A73XAcp7C:LHh6ImzD+F8Hh6ImzD+FiC
TLSH
T197A67C40FADB84F5EA03563045A7A37F6331B5098735CBC7D6808FAAE917AD21A33716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5a35e8da1a90235b3c5360bdda6150d0fd395998d3a4eb2c935333ea80f4f04f
MD5 f473579c0c817880bc659faffb1d029b
SHA1 c89fff1b9557ffbbb45bab91220639d0ec6c8237
SHA512 1b60df1c58087009943b15578e7bfe468e8185c70da64433fbe59b9b4d68a57860f434f998ea90db4f603f596696177cd0098142ea7b3c589ef687c5dad2f763
TLSH
T17021DBB1D0F4CC23E5335CCF9629CEC21CA5379F986C5614520E8308A79BC35CE559E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 19c46203a503459106f30b996477b82da250a578bc6be7f7ab30390f7b1e6448
MD5 ddc93ffbdd229c6b0f4a1c6a5fe53ebf
SHA1 c4a7306a85ae534d8f18554c5cad3155202e730c
SHA512 10c863d8942eaab3ff32cec64e6e3f051bff0ca85be4071302e99b7b54a9ab6bc7ffd8191ed9b48c5048131bb0db4b5a1d99d5b11f3311521e2b2e720bc5ec11
TLSH
T12511C8A0D0F5DC13E5336CCF5629CEC21CA6379BA8AC5A24120E8318B35BC36CE556E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4eedfd0081713edcb6ec966d0040eb4a9d6a729a8f70cd1e602fe1c5b3a488f8
MD5 1769cb2c5841acf06eaa432b8147e08c
SHA1 0309faaf6e643f3c5cad07df55191f42f1c3d70e
SHA512 4997ce3c1110608349f906cb30ddff9d9e6d23336302a828bcf2a1aedb07c80035b1841fb5fd911e1a00d6116ad278a11f8f6219be7590aa0f26f4ed2a981148
TLSH
T18421AAA1D0F5DC13D43268CF5129CDD21CA6375BA86C5A24120E9318B39BC36CF556E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1232-59-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/1596-92-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/1984-6-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3412-71-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3412-1552-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3960-36-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download