f0b030ac2d049e3d5c3d9c2361a12be8d309d6cf5b9c886c3d579a3f5dc3701c

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 17.0MB
Sample260728-af667sdh77
SHA256 f0b030ac2d049e3d5c3d9c2361a12be8d309d6cf5b9c886c3d579a3f5dc3701c
MD5 ae2a32972f7168ff360c6ba40bb286f6
SHA1 cdd234bd8489d8b76744dceed1116af471ef8b36
SHA512 152d834abb732a26e8e81411f2ccf4b4888f2dc5331a3ce28608579895ba6a2566bb39a4b3f721a787020fc19c4b5ec6ea7b867adaa1964a35fec31569c9b73c
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIy2:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU2
TLSH
T1F107E147FC8690B0DC3A64704CEBE2774936BE3AC0168A59F9CA7B067B37E61540F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c559-19.dat	UPX
behavioral2/files/0x00080000000182b2-395.dat	UPX

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
6012	svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
4996	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBBBCBCCCACCBBBAAAAABAABCABBACBCBAACACAACCBBBBBAACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe"	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCCBBBBCACBACBBCACCCBACBACBCBABBAABACCCACCCBCAACACCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe"	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3228	sc.exe
2724	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2804	cmd.exe
2104	cmd.exe
3544	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
6012	svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
6012	svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
4996	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
4996	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
Token: SeDebugPrivilege	6012	svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
Token: SeDebugPrivilege	4996	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2804	4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	92
PID 2804 wrote to memory of 3440	2804	cmd.exe	94
PID 4520 wrote to memory of 2896	4520	svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe	95
PID 4232 wrote to memory of 2104	4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	98
PID 2104 wrote to memory of 3228	2104	cmd.exe	100
PID 4232 wrote to memory of 3544	4232	2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	101
PID 3544 wrote to memory of 2724	3544	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ae2a32972f7168ff360c6ba40bb286f6_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBACBABACACBCCCCCCAABACBCCBCACBBAACAAACCCACACACCBAACCABBABCACBCCCBACCBCCABBABCCAAAABBACCCACABCCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBACBABACACBCCCCCCAABACBCCBCACBBAACAAACCCACACACCBAACCABBABCACBCCCBACCBCCABBABCCAAAABBACCCACABCCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACBBAAAAABAABCCCCAAABCCBACCACBCBACABCBBBAAAABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe" start= auto displayName= "UserDataSvc_AACACBBAAAAABAABCCCCAAABCCBACCACBCBACABCBBBAAAABABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACBBAAAAABAABCCCCAAABCCBACCACBCBACABCBBBAAAABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe" start= auto displayName= "UserDataSvc_AACACBBAAAAABAABCCCCAAABCCBACCACBCBACABCBBBAAAABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACBBAAAAABAABCCCCAAABCCBACCACBCBACABCBBBAAAABABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACBBAAAAABAABCCCCAAABCCBACCACBCBACABCBBBAAAABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBBABAABCCBAACAAACAABABCAABCABBCACACCACCBCABCCABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 19f08bf4517639126124ade7abe96187886aa4e93e6621d17534069823186f30
MD5 5152aa741fbd65a9a0b8882d34190708
SHA1 7cee3f8146da1c66b2c7414934e64e3d15dd093c
SHA512 d2726f18a359a7ed4bca6d14174d8a119e65801ef8660de97bf4062b6b4d372b8f1af7da0cf91af4eb0942a11d626d3de96185c8c9d0444df37e38c347cea481
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.5MB
SHA256 84aa43c73389a2dffdcac4ff07e9e9e95fcf57b5bcad45a10a5147b3d6196dbb
MD5 aae1eebfe600c5f82761bc2b7c3d98e9
SHA1 83e419ae9c805acc609a84d64c7dc0b95dfbca73
SHA512 89e3acbd20158c55a2a3f6ac5d7914bc575a6063d3b9cfe95c734e8004491712d241fb257475e8563652c29765b10f5ba44c3dfa921b5999f382242b25592e09
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU5gZ2jf:i33333333sw27
TLSH
T1C707E147FC8680B0DD7A24704CEBE2374936BE3AC0158A9AF9CA7B067B37E61541F456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 8284617db958c1329ace97fa9bf32407b041fefd3c6876a1b34b09a01754c6cc
MD5 816352a625b0f8f889601c285ee0facc
SHA1 fb17d9b106b002ec91f4e151c433d19a0c2c9644
SHA512 f2008ee6d26855195253a9fedf25a12be3f5fd057c34fcd4bb6823e176c6ace8443438849e240c85108551dc66283382b0adb1b0c0e67bda212c5ed00dfdb2c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\hu\qap`g`v~dtlq
Size 10B
SHA256 28578ddb62c5b08af9eefd9bb574c15b4f1fd87e9b860495a159003a5dbde336
MD5 9d57843ed5538d68b9cb19e1608723c5
SHA1 a3f170e2582890526a032d8fc7d14e3e55fb8122
SHA512 512eed1b6d34355d9b115c360cfc77a9e332973af18c2254b6ce1a20bcf1d8fd3f356927095776e32db96d4e7a34a9e92b6e27badda1cbd2b46c131b7505876a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\qap`g`v~dtlq
Size 10B
SHA256 3e4fe2ae58052eb6110242a8e1db868cb1947cbba3a84c883539413426a2c60a
MD5 2e2d945b54f61f6f4f6dc1ceec690940
SHA1 9adc08584f484d750c399f7776af79420557a2ad
SHA512 94225c3dd13b032e3dd5f7977e35db5a0d7c50f9317d331af35ca0f225be6d4ca855c8401f8244d9f62e89ba7734563f90efd239e4b2c0ab144d307fda92e86e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95b4f954b3c6ce019a42fc25d9d89cdaee542cf875f1ba2926156fdfef6f633c
MD5 f3e0fe539f1a7580bb037a5a28495865
SHA1 ef3086123e3065f1859082c080891bc1f087ba1a
SHA512 d5cebcd0b41dd3bf1678747225a6b7fb294b47c420804530723b8b7e17651e613bd1d14c269bedf4573c60dab3f1745161d7aba8be7c01e53cdadff78c443fa2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b135825cbb801354a7819f80f8f43cb9a05c9f7cf5673b1cddefa7ca6be66538
MD5 357facdc16febb7dd9be71b4851c2ca9
SHA1 be6b989318d0b78f6a06ecbd9d583fef02b4f3d6
SHA512 8a6dfed75016f66dd16d184139cfafa907badec0ecff6cf6db5ffa87d1035f6a644dfadf448f155cc7bd4d52b9989e4ae2e6877c2d8f3f0e8915e7b3e2c652ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81252b73b75e13af196235e5beeac538627e95dfa8d3a3744c6525a1d41e505c
MD5 5dfda766e7554ed21cb12e4e2de06b08
SHA1 5c1ae6a22e47af0ef803e6d966abd877fec5fad8
SHA512 557754cf1825d52078befa2791a5f03e7cbc3759b5a6a4cf1dd80e606e944294bd731d363661cc47cfeca17bddf58eaba59222516f3d4e36ea9e75c900733c1a
MD5 SHA1 SHA512

Submit Download

svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBAACBBBBAACCCBACABAACCBABBBCBCABCCBBAAACCAAABBCCB.exe
Size 17.0MB
SHA256 f0b030ac2d049e3d5c3d9c2361a12be8d309d6cf5b9c886c3d579a3f5dc3701c
MD5 ae2a32972f7168ff360c6ba40bb286f6
SHA1 cdd234bd8489d8b76744dceed1116af471ef8b36
SHA512 152d834abb732a26e8e81411f2ccf4b4888f2dc5331a3ce28608579895ba6a2566bb39a4b3f721a787020fc19c4b5ec6ea7b867adaa1964a35fec31569c9b73c
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIy2:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU2
TLSH
T1F107E147FC8690B0DC3A64704CEBE2774936BE3AC0168A59F9CA7B067B37E61540F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6a872a93d489f1f0d3d130e2d7b4725fd018637e38845afb272b38726acbb4b2
MD5 a46ae6d1bc196730256591a8a37379a7
SHA1 ab8dae52fe16b15090e25e1ec146675c007f2194
SHA512 97fe676c6bab15a35ca6127132bc1f2bdb4a68968596d348f111b8295daad3ac8b0c9a56f7252cb2ff1515d2968238189252ffb694f7faf5d1877daf3bb0df66
TLSH
T17C11C864A0B6D823E0312CC76525EE829CF4769F58A86A14530D0218AB268329F795F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 72186c745e5e1e2c125885d61538eb81be9be7b07b6a0cadcf39fbf2c392c747
MD5 41371ed8107860533f8c6f2574983e48
SHA1 2d367d2a5cdc700329440228a2a36c0e81663111
SHA512 62893909931d1ad73c9fa75527968cbab1e96d37bc9524eb28c87c11f6d637e79419e05c3b01a12d9060ac2030581ae325b330a48ec98d42596f7080b68c1e96
TLSH
T19221D464A0B6D827E0312CC7A625EE828CF4769F5CA86A14530C0218BB26832DF7D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4232-0-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/4232-7-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/4520-33-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4996-720-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/6012-80-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download