2b9400279146be8bded8bcb6921f3d8d07c39f9c721d0973b89dd5157af2da3f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 17.5MB
Sample260802-beg2cs1ekf
SHA256 2b9400279146be8bded8bcb6921f3d8d07c39f9c721d0973b89dd5157af2da3f
MD5 314aab04a5a86471b4b2e29b0393ac45
SHA1 fbdd7e3eea4accd41f956a28554208a478ef5543
SHA512 4429017b51a2ee514136fb822610285a564dde518debeea9dbab887f5f50e8c086f20ddce724f4bcf62dcee7cae7b63af546a3b8efb074915419fae99a6f5bb6
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIyB:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUB
TLSH
T15007E146FD8A40B0DC7A60304CE7E2374936BE3AC125CA8BB9CA77067F37EA1541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118fa-11.dat	UPX
behavioral2/files/0x000c00000001c5e2-34.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
2912	svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe
1912	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBCBCACABCBBAACAACAABAAAACBCCAAAAACCBBBCCBAABBBBBBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe"	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBBBAAABACBACCCCCCCBBBABCAABACCCCBBCBABCACCCCCCAAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe"	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5544	sc.exe
3716	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
752	cmd.exe
3460	cmd.exe
4796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
2912	svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe
2912	svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
Token: SeDebugPrivilege	2912	svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 752	1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	94
PID 752 wrote to memory of 3348	752	cmd.exe	96
PID 5956 wrote to memory of 2408	5956	svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe	98
PID 1820 wrote to memory of 3460	1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	102
PID 3460 wrote to memory of 5544	3460	cmd.exe	104
PID 1820 wrote to memory of 4796	1820	2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	105
PID 4796 wrote to memory of 3716	4796	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_314aab04a5a86471b4b2e29b0393ac45_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCBCBABBBAACAABBACAACACAACBCCBABCCBABBAAABCCABBBCCACCBCBACACCCBCBACBBBCCBBBABACBACACABBCBCBBAABCBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCBCBABBBAACAABBACAACACAACBCCBABCCBABBAAABCCABBBCCACCBCBACACCCBCBACBBBCCBBBABACBACACABBCBCBBAABCBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBCBCAABBBBAABCCCCAAAACCAABAACACAACBCACBCBBBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe" start= auto displayName= "UserDataSvc_BACCBCBCAABBBBAABCCCCAAAACCAABAACACAACBCACBCBBBCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBCBCAABBBBAABCCCCAAAACCAABAACACAACBCACBCBBBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe" start= auto displayName= "UserDataSvc_BACCBCBCAABBBBAABCCCCAAAACCAABAACACAACBCACBCBBBCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBCBCAABBBBAABCCCCAAAACCAABAACACAACBCACBCBBBCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBCBCAABBBBAABCCCCAAAACCAABAACACAACBCACBCBBBCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABAABAAAABBAACBBCCACBABBBBCACACAABCCABCBBCACCCABCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
1⤵
- Executes dropped EXE
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 35.6MB
SHA256 3d18deb24cf9f43eee711fdf7e610a507b217b3bc9d469f5713571d234055bd6
MD5 4247a7615001469804df2b89d058a2d6
SHA1 75d181a01658df828cf597ab23c710b3d5e31691
SHA512 edf333d743f9b4497b26b07871f8409db89064765bab41299a0c818d7a831b2f71009c7ef7b8893f348f6d8eb4f7fa7219c5714a86a153732b05d0e25c67c804
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUqFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUgZ:i33333333sc33333333s7o
TLSH
T15187E146FD8A40B0DC7A60304CE7E2374936BE3AC125CA8BB9CA77067F37EA1541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3286801bdf1d5ec422006da15e288e3550428b0a4986cf2b5e76cac56c36d62c
MD5 b1d7619030afb419c6572e94d3e4c0bb
SHA1 b2aedf3eba3fd8df24af02094ecdaccb719a7ebf
SHA512 319624b8bdc08a5d648ae8ba177a7a4f52283a4b24ae1e1329ecc9c857e346cbc178296d48ef6b57c2e273472344b35f5a91e4fe34b78a0a28a67b6e93939493
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92fccf9e34362474af50f1848dd39496deb3aa95bf5160958b91feb25b196b83
MD5 13c39892bdb0e9f90391220aa584d50d
SHA1 540825f1655acd995ee395a0184d458696d9fb9b
SHA512 8afa9e68f39df2200e8c47a8244797e3b007956a2ded095583734c3e8822bfefc213aa67f26823883957cbda1f606a5f6e0c975fbaa64608e5175cfbfda8f525
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 502117d9da13dbde752714f5543c5638ca44ce70341639e1154a05f61c7d16cc
MD5 8cb260027c684f80dc451144e5f2f2ea
SHA1 c8238cb0b7a5c575c0c0c80b5f5a997c4017ad85
SHA512 4162962a37e6a5cc877a668f7cc589a77a31527dab6b401b5f929e8f44958794eec6e645eab121f40b669392515af7c299b08c23f769f0c1fcb5333a5b603f2e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca0e876f5636a454df7494f58985171f450ed6cc87f5142c1276ab5eac890019
MD5 6a50cac90b1b0f18ac70fb5a85b17e19
SHA1 368431b3819008ffca61d382bdde16314372383a
SHA512 e40db4e3e97ab392efbfce5ecf5aaf0b227671ba7c27f2a8aad88b3fb26e396bf894c0a70b3fdfebb961dbca3b41e68e7f79976d194267f7675dab17a1024457
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18e7cc1310b64ba7906b912ac603b3efe40d4eb82b218591f03cef7f9d0f1362
MD5 ebd48c542d09688879ef06c549118c71
SHA1 81606b4e9e42432034bdd29c0a64388c224ec92e
SHA512 09142932615a9a659d0fef02a1130fe990d10861d0f8d6cd95356eb3a3cdac2ba03dae7d0e06ff560c84195e23a3ed47464c254df0f1349c402b7fbd99107181
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fe9c2e7051b18e7152f524f733a4a832144a21fd30343dfacd9392630c4de7b
MD5 84b7ca77e0f03bf89e8c36455b33035d
SHA1 2fbb4e4d80209043a30202348782682b68c0c1e8
SHA512 c3853e4f875d4574e9adb454bf549ebc8863601e1d772bafc59051f0a490418eae852361e5e76af18534ab433e888f4b52eb55aa4e2a5d20147bc60f440b72b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 722170a4de3ff3bed6c9327c890b717534c61dc5a85be6bad92114186c956cc7
MD5 aad9328f9b0c74e8974ebd12313bf627
SHA1 b018f76852e4c4a363debfcd1237f91d3f6305d8
SHA512 4805ad0dcbb945d6d8fe68c62e41992802794ff15ebb88b381b79e85ad62383a1e30584f61be67a692756013b54d84291889bd0d8f3968ce93a06f7d0905efee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 01a3ffe5bc36c47ad63903cc196c613ca803af040a004125067b8f39edd7e666
MD5 8c5f74b03af9899bb1867b012effde16
SHA1 22f2b4d813c2bbbfe8a3358d35877710dcbbb1f8
SHA512 2f5d22959cede2e09d256c1f67115272c200b1394305cfda870d933cf8cd21f0fc53b714027fca03c17e209fde002035e04611d0db770635d08fe68e8803c244
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8484c30f695342ab6a08c32d656d8d6c54cc7db17d08ed2f878ca0ac111257ff
MD5 438917b97d6775cf58491b14d281930b
SHA1 9f475f0e37c1c5bdaf8d8216daff8997425e6c73
SHA512 ab4299523054a195727b73bf8a23d67c76f56a26732d6b4bc4618d89c1a3e4113d64eb3673555a79c04eaca3f67f095b4662e9ac817f59017565aab4a06eb862
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e6969ce114329432887135314c49bddbff645d0d7ee10b3b70d263990c2a2559
MD5 40fada4d2f4d20bc5963c1499d23c8fb
SHA1 58bf7ac21ce401869700b3ea780a1a0915d645b7
SHA512 b2fd7bdef4cdc7b2a2da8985a6907e3bd78245feaaf76f0fd2a842b50c113043466a259bb688ed75304637098883f7e3618266321986cc28ddbd0bdbff4f7e51
MD5 SHA1 SHA512

Submit Download

svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCBBBCCCACCBBBBACBCABAACBAABCCCCCABABCCBCCCACACBA.exe
Size 17.5MB
SHA256 2b9400279146be8bded8bcb6921f3d8d07c39f9c721d0973b89dd5157af2da3f
MD5 314aab04a5a86471b4b2e29b0393ac45
SHA1 fbdd7e3eea4accd41f956a28554208a478ef5543
SHA512 4429017b51a2ee514136fb822610285a564dde518debeea9dbab887f5f50e8c086f20ddce724f4bcf62dcee7cae7b63af546a3b8efb074915419fae99a6f5bb6
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIyB:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUB
TLSH
T15007E146FD8A40B0DC7A60304CE7E2374936BE3AC125CA8BB9CA77067F37EA1541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 47ab9a310c3be4abda51ab7ffd00122db9d9a2da729e730b2a4f692f60ff3643
MD5 f0ddf8b594223adb20745b51f18460d0
SHA1 aab4084232a5f66506b29c67383212c861b24267
SHA512 d9846777f2f25fb6159987e5de8c7a2c987f2b5c2297a919dc7bb936fcf6d0baeb1b8f3a93035ac615ee2153e4fb5ff14b0ff8daaad21e682414fc1621c87475
TLSH
T1BE11573194F9C863E433248E5ABDEA5B5CC9378B6CAC6A10634C4218FBE5C318D15CF6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1820-89-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1820-0-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1820-63-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1820-30-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1820-16-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/2912-99-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/2912-136-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5956-80-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/5956-108-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/5956-61-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download