8faa5beee1b8bbeb2852060d6bcfcc71fec91758fceca0573436a73095e4d0f8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 13.2MB
Sample260910-c45dmadl2w
SHA256 8faa5beee1b8bbeb2852060d6bcfcc71fec91758fceca0573436a73095e4d0f8
MD5 cdd691f46a0b62f778411fef911754f4
SHA1 a2f1b47b40958abe0bd7463d050bbe4f697261b5
SHA512 60caa4f32f86239ebdada5d184a93c609b88b9d002acea02a92d7d944002426ee2bb9c239c93902b2251da7af2a6b082b0dc70d4559be8be51c7f9454fc50519
SSDEEP 49152:U+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21k:N/fh6ImzzJoDfuBcMv+A73XAX
TLSH
T107E65C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
3484	svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
3692	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCABCBCACCCBBAABCBBAABBABABBBABABAAAAAAAABCACCAABABCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe"	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAAABABCCBCBCBBACABAACCAABACBBBACABCCBBABBCBAAAABCCACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe"	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3632	sc.exe
2812	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5108	cmd.exe
3700	cmd.exe
1240	cmd.exe
4776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3352	schtasks.exe
4688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
3484	svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
3484	svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
3692	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
3692	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
Token: SeDebugPrivilege	3484	svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
Token: SeDebugPrivilege	3692	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3380	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 5108	1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	108
PID 5108 wrote to memory of 3352	5108	cmd.exe	110
PID 1724 wrote to memory of 4560	1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe	114
PID 4560 wrote to memory of 4624	4560	notepad.exe	115
PID 1732 wrote to memory of 3700	1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	120
PID 3700 wrote to memory of 3632	3700	cmd.exe	122
PID 1732 wrote to memory of 1240	1732	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	123
PID 1240 wrote to memory of 2812	1240	cmd.exe	125
PID 1724 wrote to memory of 4776	1724	svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe	128
PID 4776 wrote to memory of 4688	4776	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBBBCCBABBBBCACCBCCCCAACABCBBCCACBCAAACBABBCCBBCBBBABCCBACACBACBBCACCCCBACABBCCBBBCBACBABBBCBCABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBBBCCBABBBBCACCBCCCCAACABCBBCCACBCAAACBABBCCBBCBBBABCCBACACBACBBCACCCCBACABBCCBBBCBACBABBBCBCABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBABCBCCBACBBBBABBCACCCAACACBBABCBACCCCACBBCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe" start= auto displayName= "UserDataSvc_BACCBABCBCCBACBBBBABBCACCCAACACBBABCBACCCCACBBCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBABCBCCBACBBBBABBCACCCAACACBBABCBACCCCACBBCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe" start= auto displayName= "UserDataSvc_BACCBABCBCCBACBBBBABBCACCCAACACBBABCBACCCCACBBCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBABCBCCBACBBBBABBCACCCAACACBBABCBACCCCACBBCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBABCBCCBACBBBBABBCACCCAACACBBABCBACCCCACBBCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABCABCAABACAACBABCAABCBBCBCCCACAABCCCCAABCAACBBCACACCAABCBBACABCABCCBABBBBAACAACBCABCCBACBBBBAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABCABCAABACAACBABCAABCBBCBCCCACAABCCCCAABCAACBBCACACCAABCBBACABCABCCBABBBBAACAACBCABCCBACBBBBAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABBBBBABBABBBBCCCBCABACABCBCBCBACBBCCBABCCAABAACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b8dbbcd868d5852eaf9edf3900461058af3ce6170b88a308e94c0c15cf63bfd8
MD5 902c8df966344f3059682d35d93a1a2a
SHA1 c762f786148e672d4bdd55951fc5a266ad8d31e5
SHA512 e3812a3b25812cc230451d25554c314afcf8119f029935d4532d1d3850ba576380269f3c3b7b83962fa3c4f6eb3fed3d896e566974a2d4c3ff96e0118a8843df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 2596fa17e8ace2794c3e89d76e43a6c93e10ce34d75e476184d44947ddfe782b
MD5 690060c9e8ad8a17d421bd6a81ad3d5b
SHA1 61292f3c3b1801ca2143696bef05bc7e3476f374
SHA512 2e07f34dd64fb364ff9b63f99c4d2c8755d8a092025f583b5bd9d64d5a8f782d8bed87ef7f977df967e875d2f38914f852f5d215cf90e8313b6d4dd0f6385359
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 c14993dda829e79fb1a9c5e889ea5da53100ac4ed5df8d90b82f3315599b07ed
MD5 7f1b4649968f096b1288bb217e428128
SHA1 26518fef3384367de0859965e3b5751ad23add4f
SHA512 adbdcb431998e1a2c03066f1e6d5a6468ac72856c71b27722f09d52dff8d6fde26ed6c0a187344ec32cfeb4bb650bd6af0c7511962af665a923908bc7c30cb1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\qap`g`v~dtlq
Size 10B
SHA256 f2987ed8eeddf936f179a1755ba15fc120e55fded4ba98cb5820398ccb69733a
MD5 4101599600f4467e7496e537acf0cd0b
SHA1 28ceff9c46193decdaf2b3d3f9f8b5462e62125e
SHA512 835740d38f928e903476d32c8a6e75914ea5b0788a00982187f7a49d9ff07872f15988a745420c8f6f9d37751c187ad944a0c010c6f14f2b480ce05a3747ac21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\qap`g`v~dtlq
Size 10B
SHA256 28c9eaed135b201485d19391c0d117cb588d0d8148d56387f6db8b76daf9766a
MD5 95e8d2fb94dad02ca3930d75159a9923
SHA1 a52a157bffe4c780582b7787f141fc6a1c0d7289
SHA512 2637117182753492fc6df1358e63cc83493bca1cf2b58f2e7d62de3c9c5b74037249ea4b1de78d4f761878085e7a2fcb993734e7d905003b3da2ba7cbb19b592
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g0qrwjy6.Admin\qap`g`v~dtlq
Size 10B
SHA256 f8b550c80187a1ea3754254edd41b478bd6b3d4ce55d4d136410d033489e1bac
MD5 31b69f90c0a8851330d03dee8deb98cd
SHA1 222036ab2b3ddbf8a62f83d293fa27e7b6ae139b
SHA512 f08edf05370f82fa35cb08fc845921b74fdee43c8b047a64905bcac1d36821e16a875c45ca2010a18ccd412054ab15acd249b88afbaf810273bb8487d7e3ad31
MD5 SHA1 SHA512

Submit Download

CompressUse.exe

Path C:\Users\Admin\Desktop\CompressUse.exe
Size 79.7MB
SHA256 cacb4c45772fb264d326e53a5de11c872cdf31d0fb53b6803090f07e70bb1c44
MD5 8b201a6ce2cd125feb59d000510a4b1d
SHA1 895e52e0da09639614f43e01b304d1f948720093
SHA512 378b3b517a4d2320044090347c0e6462c839148ea9fe3d70966e8a0389cb3a72b461623588e35d91f884b8a89e6dae75676f739bf37e7433e4cc04eae9c177fd
SSDEEP 196608:NHh6ImzD+FdHh6ImzD+FdHh6ImzD+FdHh6ImzD+FdHh6ImzD+FdHh6ImzD+FY:gnnnnn7
TLSH
T11D085C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressUse.exe

Path C:\Users\Admin\Desktop\CompressUse.exe
Size 26.7MB
SHA256 df5335e8876bc61ca5f2ff5f8280b37d41f76c4680fe26551992b496864c9d2c
MD5 d8957db2ca9bb963ee5e94da92c715d2
SHA1 39a396b726c8f6e2509245b8b9a3a36397ef8862
SHA512 85c4aa2b80e0f27dfa052f464b487cc107437ec893731afc1a6f934beb3962c5e02c9206bdd59db7960c44b0a510fd4d378a5089bb03ee45c41decedfe9fc7c3
SSDEEP 98304:N/fh6ImzzJoDfuBcMv+A73XAd/fh6ImzzJoDfuBcMv+A73XA9:NHh6ImzD+FdHh6ImzD+F9
TLSH
T1B9575C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartEdit.exe

Path C:\Users\Admin\Desktop\RestartEdit.exe
Size 79.8MB
SHA256 4a1c17b9bf50b35aa1d08d11b7260f7d5a5329944d6cf3f73b014d099de3fbb3
MD5 13576de244ff93a380048ec7af808ff2
SHA1 0d05e8347a1411b1a0a39e6304b63e7d0489ca8d
SHA512 d2bf9c852702971896976f98c4dd83fb7690ecb2d3d2d6a9b35a7fd4b478b98838b8e54e24225153c367c8094b1c322bb222fe123251f8e061379bfae7c449e7
SSDEEP 196608:NHh6ImzD+FdHh6ImzD+FdHh6ImzD+FdHh6ImzD+FdHh6ImzD+FdHh6ImzD+Fg2CY:gnnnnn92CY
TLSH
T109085C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02df5d0a9342be7fc337a8bae7166c82011ae2ba18f8dcb502c7fb40c8460b2d
MD5 173bab16c97cd6263f8e6be11b37a1dd
SHA1 2fc6b2788171c7a28114100986f8efd3c87cdc59
SHA512 d40d8f5bbf173a7f5c6090abfcd55ec1e3d892459495040ca3bfd215569cc794674a957957e84605567162bf380010d493ec6583585addde62bf0241040950e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcac9b033280063a55ea4cb6a495085b9f0ec7f8f07372971ef14d9901375411
MD5 b439706636cfd3f0fdd7d3483a86bb37
SHA1 41f7df612fe6e6222edc7eafb8d09f97fc7bab56
SHA512 8923357b929adb0f258a317c3626a9372adace6ea0c40ecd1cb9ab495006a52b6173e73f34bbafaa255610f780c8ddc1a1b8ca4a02199599047e52be292159ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7f1f6f1d7f056905e456b14442c186baa7c9f46de971a8c704e6b5e3c5e78df
MD5 405a106e197cfba96b855b77bd08979d
SHA1 999b1bede6aa288826730edc76ebf03ef9a8a220
SHA512 973f6fb678b09b7c1c7c57abfed7c32afc5a163bdc39bd24f0225d74a6aca934762b99d4c9e787fdf48eafc745db76f50f3d157d087ea2501db27194908c6d50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef6e90674003a19606aa004a7fefb61d29d4dfb9526164fa8261d1ad42b1f97f
MD5 9331c5b4130696d57b00535561491e79
SHA1 7629912b0ed1658feaae631380879120a04d77eb
SHA512 31f89364529076eb18473cf1db49d15b2a6f746cd5b8e5eb726dc5af937892d727bd347d1513e41fd11f3199b39d2b1b29a052ba7de99a6f4c412ffe02c6352c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4485a4996b9b89b35aea7db54a67987f70e1e3b494d7bb1292f06350ba8e128e
MD5 1867a065e4758000222a3bc1cd78b596
SHA1 31f1d4015b383b3304c6f9f8fdb91b6b878401c5
SHA512 66a9027893fbc0e980013a04bf25de7d173df4459f4ab824b7151985c7fb33a01dccaf5a5c9d94d2f2bc23c6efafb6d81c04692b975a3be82343b02495d59ce1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf5ec3316e3e3f587414a21f6f22fa0932d35766e8c04f8ec38624b5ea4c4def
MD5 1d8edfb794e6659a6920faea7e6eb702
SHA1 ce2f24fb0d570074b4adf74bc62a4c7005cd2d30
SHA512 14f73dcb18a4a8356c41ab3f4a5d21d30fb0f4e7b4fc99b0845c59a2b22d7b0a1f909d423b04d6c5c0545953d89986965cda35e6ab49c0b33c5ac4fb2c69fe77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a49e87dd5c6da4fd7062ced5bfbb509a62f20feff55bb4a879cd0ddd9a35141c
MD5 75ff16301a44cf6347a5c4c4fd1dd219
SHA1 36fffc99dbf9f3efa22fd23024a5c0368dedc9ac
SHA512 66405fa6a978f4dcb2054fd071cbf670b001a66446517930d0bec3189875ab283e2c66f8e778c85cd5452217ede0bf8a7a30c98e6ccd691cf0cc2cfa8e7e3c6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 fdfdc863f3c7fa345f76cdefe1705c385b115eb1160541ee3c0a654a01f83ca5
MD5 7e8d7705050b14464faf0607140aaa15
SHA1 84dc56451adf1c1db3dd0ca9dd454168e37e6f6d
SHA512 238d2bc5cfd61f49ab75844bab4bcfe73ad170754f74df9d4a28bce077cb51f191c447fbf6b5cf175eee5a2c74d6ba1b7e2b0468927a545ca432b0d0e5a00647
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48a96afd1bcca54f6a2c804674fdfd5117409554e9c573bf91d601830d60cfb7
MD5 a0ffb78760c763f7440410ba2e410274
SHA1 eb8327d874354205807feb18939f4daf5f704628
SHA512 b39a40bbe1b950f296f52e4cefc61088f2ad1c7f584a35001648e80b55eb9998a068f72a81111307de5567f0ecb1c30d3e4f10183c0c0118cb337cc598f4285f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7e345279e713a39c3be48760441e2d640890067287c2b27fe288a3de8c50205
MD5 8ded81cc1a71923d0ce7dd94e500ed9b
SHA1 b08c6664c48539d03e7c72c4c212d139cd46b789
SHA512 d91c6dfd2ce9381310103d3cdaedee827640e6eaee4fc680c432b4ae5d23f271d346d098d53fe677b49c6f576e7430cc721567980c8a4e38288a6421114678ee
MD5 SHA1 SHA512

Submit Download

svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAACABACCAABBCBBABBCCBABCBACACBBABACAAAACACBCABC.exe
Size 13.2MB
SHA256 8faa5beee1b8bbeb2852060d6bcfcc71fec91758fceca0573436a73095e4d0f8
MD5 cdd691f46a0b62f778411fef911754f4
SHA1 a2f1b47b40958abe0bd7463d050bbe4f697261b5
SHA512 60caa4f32f86239ebdada5d184a93c609b88b9d002acea02a92d7d944002426ee2bb9c239c93902b2251da7af2a6b082b0dc70d4559be8be51c7f9454fc50519
SSDEEP 49152:U+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21k:N/fh6ImzzJoDfuBcMv+A73XAX
TLSH
T107E65C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 e201d2f7a22b9b00a75f5f2fc0cc1444841a640031cde514ab89392b8166f731
MD5 cb02036c710124dd4c246c08f6cd2d56
SHA1 f372abf2990e8221991709de661f2a7a2636a1bd
SHA512 2c45d438459ed575b14d454bed06da74c1d6fc309fb6e432d32413ef965acc8b8332a1b4be59f038b828ca44c4b93a7147f73b46fe9e4f87ee9dc92c8424db02
TLSH
T19B01F960B0B5E817F132A8D753118FEA0CD9779778589F5823155218EF19C39CD150D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 74b1a0c75ce9982ef533a8731add173f30d453840033113d44b73353489da821
MD5 ff33cb348988a5b43195a076e9b121cd
SHA1 c6b93546ce5e1e956aba4e37697b9b93ef34ea45
SHA512 841ca9078931a5d68129b73d5bdcbb9a7600ae900e6d41ead2d61f5cbc25c9f51550fad2a7d55ffd35325138684d57d3010a32e3bc2d1ab0470d4640039aa331
TLSH
T1BE11E760B0B5D857F132E8D7A3118FEB0CD9775BB858AF58230A9118EF19C39CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e9dc37e6561ffd2ab13914ba0cb09545d6ee9ce638a666adfbdd8395685d5ed5
MD5 f16806f109d8dbbf9ef0024a514cd7fc
SHA1 e574a5804764a262c55c4d85bf9071059a638ca2
SHA512 6001a7d193b79187c194416a92bb06748fc3f34ffeefe2b49a6df9f6ceb8950105d4d2683c1babed96bd1b38d120d2140e2534bb7fa92ccc0b021e3163508d68
TLSH
T1FE21B130B0A4DC63F232A8D7A315DBEA08E9779BBC589F54230A8208EF59C35CD194D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1724-92-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1724-64-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1724-134-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1732-14-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1732-91-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1732-63-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1732-2420-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1732-30-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3484-127-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/3692-2422-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4560-95-0x00000000050A0000-0x00000000050A1000-memory.dmp

Download