c981b107eec559a05e77f309e595124203fb42d3d703a8a31a49a33bb807e7a7

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Size 18.6MB
Sample260808-dj4f9sgn2y
SHA256 c981b107eec559a05e77f309e595124203fb42d3d703a8a31a49a33bb807e7a7
MD5 9ceb6f872e8a681c26a705d6ff8e8c00
SHA1 5e8fe487611aaa5462a026e0e49cf3b246a44fb0
SHA512 4b6767f3019b2f04f5cb066654034172373b54bd07b3ec6d1140bb6c3c9629fa61677646ae2f5e6b88e278b36043147cccba57c4a2e69d79267045e88524e843
SSDEEP 196608:anSunSunSunN7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:a111NahvQHrc8u3xXJ/f4uUWHM
TLSH
T18117BF17F64780E5C42AE2B48A8B8337D7B57C044331ABDB6695A71A2F33BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024217-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024217-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024217-20.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024217-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
368	svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe
4872	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCCACAABCCBBAABCCCABBCBAAAABCABCAABBABAABCABAAABCAAACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe"	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCABBACBCCCACABCABACCCCABACBBCABCBCCBBCABBCCAACACAACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe"	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3744	sc.exe
2588	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5004	cmd.exe
4116	cmd.exe
1668	cmd.exe
1648	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3932	schtasks.exe
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
368	svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe
368	svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Token: SeDebugPrivilege	1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
Token: SeDebugPrivilege	368	svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1052	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 5004	2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	98
PID 5004 wrote to memory of 2600	5004	cmd.exe	100
PID 1988 wrote to memory of 4244	1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe	102
PID 4244 wrote to memory of 4716	4244	notepad.exe	103
PID 2276 wrote to memory of 4116	2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	107
PID 4116 wrote to memory of 3744	4116	cmd.exe	110
PID 2276 wrote to memory of 1668	2276	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	111
PID 1668 wrote to memory of 2588	1668	cmd.exe	113
PID 1988 wrote to memory of 1648	1988	svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe	115
PID 1648 wrote to memory of 3932	1648	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAABABCBBACCBACABCCBABCAACBBAABACCACBAABBABCCAACABACCBCBBCACAACABBBABACAABCBCBCAACCCAAABCBBCBBBCABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAABABCBBACCBACABCCBABCAACBBAABACCACBAABBABCCAACABACCBCBBCACAACABBBABACAABCBCBCAACCCAAABCBBCBBBCABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABABCCCCAAABBCAAAACABBACACBACABABAACBCBAABABCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe" start= auto displayName= "UserDataSvc_ABABABCCCCAAABBCAAAACABBACACBACABABAACBCBAABABCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABABCCCCAAABBCAAAACABBACACBACABABAACBCBAABABCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe" start= auto displayName= "UserDataSvc_ABABABCCCCAAABBCAAAACABBACACBACABABAACBCBAABABCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABABCCCCAAABBCAAAACABBACACBACABABAACBCBAABABCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABABCCCCAAABBCAAAACABBACACBACABABAACBCBAABABCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCCCAACACABBCCBBAABCBACBABCAABCAAACBABBCACABBBCBCCBBCCABBCABCABCCCCAACACACBCABABBACCBCCBAACABABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCCCAACACABBCCBBAABCBACBABCAABCAAACBABBCACABBBCBCCBBCCABBCABCABCCCCAACACACBCABABBACCBCCBAACABABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBACABCCBCCBBCCBABAABCABCBBBCBBCBACACBACBCBCBACCACBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
1⤵
- Executes dropped EXE
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e8e05bfb95ce52c50ade3a8b652f8209fced2767722f47d79edaec5631fd20e
MD5 7a186eeae2cd85db9f705ee1ecbbed44
SHA1 e3ceea02f43185147cd1020529d0d635e522d09e
SHA512 b0b4ae2c609f7cd6f999d9d9a99d2be9e33a1049c86c65dd92eed7f0e54ff2a70d20d51c8000739153bc68700dbaf7530c3c59f7cf3468fad45113a0ff14654f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9b2444c24fabae8995c3f374375627c4435cca5feaa480948f40c82e47a88d3
MD5 ef03d2f4d6c07058be494b49e3f20350
SHA1 329a8cb86f50f8c45039373be7a5c60a0cd25f53
SHA512 749fdd38fe661d933fed9eb8026a4e2dc4f4c96c14f104ee64d66a32bf821017c6c7fced70a680d474102dcefb4307cb9fc096572e59ff6b114157d121d66afb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0e293b928f0cd9e2f3463002951350b1e72878be1ffbab707212a167a90a5a5
MD5 27b66fee3244979457e98c83e150b060
SHA1 f44c98f7443bfd6841ddc7af71b20a527a297450
SHA512 571056149d4d868ad141980438740d71f4441f066becd832f999e809e559c1b2b0f3474aa42da813ff11ed214c9b24453004ced0006da9ac1ea67bcdaa0f3d23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 089af9d89f808819f79cda56c04d6faa09eba49f58136299afe4196fad3ac2f9
MD5 cc3e99daa38b3fe16abf606b8096cb8d
SHA1 67ce61df89be6a6f66c73e1a990b94e9e5662daa
SHA512 7d91baa2e9ecd65ec05aaca969d0cbdf8a833074a33b6bc78172c1a71bc5efdedef08c24ba76abd5c57b6bfacb7797a06842f8ca3ab6e05c8e24cca46239d51c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 84d9d8f6d34204381161f9662a92309ee11c3a839a9a8e6fae0ed968e80cf19d
MD5 ee8dccc5b83a78d912c77987c37ee80e
SHA1 c1581eebd66120fd2ef27e1e63e4cffbad36318e
SHA512 69f2f4472ee603a77c48edcbea6a9c3766332bbcfae73d03cf8a7b0c147d98403eff37682586e5bfa8114d22b448eabfb5a572390ce76aa8392a7b9c2160fed0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 18d63d4c98f7b30bf2a9734b2a20a2f66fd253049d417634a38aea6dbf437ee1
MD5 c0a802f33f57300a08c11cd4a1341997
SHA1 fbbc72b644e19e7f5ba1975b445eafda4dd92cdf
SHA512 98bb6232ee2601c7b285575b9bf6bee1b47d191072d3b09a16705c89b6829bcad488a5e381547230e8cb076c2fba013d901d714bb9d8c784ae9ceee45019718e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9427911c3c2791f34c174bf4c58a3ed6601957d69599a0705e81c4ab20cf8cba
MD5 cfdf3f893d00df7edd73af05216406ea
SHA1 a109e4e11a936540413166235f390ae67cbf72b3
SHA512 c0d9f30d415623d1dbaa4f00dc270a8c9f2bd772a8e3b8afb04b94fca7580be9120452c238fc7a6e0fc8b697058de2603b081bd7a5d3c0e2da91801056bed31b
MD5 SHA1 SHA512

Submit Download

svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBACCCCCCCABCCCACBBBACBBAABAACBABABAACCBABBABBBABCB.exe
Size 18.6MB
SHA256 c981b107eec559a05e77f309e595124203fb42d3d703a8a31a49a33bb807e7a7
MD5 9ceb6f872e8a681c26a705d6ff8e8c00
SHA1 5e8fe487611aaa5462a026e0e49cf3b246a44fb0
SHA512 4b6767f3019b2f04f5cb066654034172373b54bd07b3ec6d1140bb6c3c9629fa61677646ae2f5e6b88e278b36043147cccba57c4a2e69d79267045e88524e843
SSDEEP 196608:anSunSunSunN7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:a111NahvQHrc8u3xXJ/f4uUWHM
TLSH
T18117BF17F64780E5C42AE2B48A8B8337D7B57C044331ABDB6695A71A2F33BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 faddbc2cda6b45ea030391796cc6949ea13a1906287ce2f870bcb859645abb62
MD5 bb2843c519682ee1e50100dfd6cf7cfc
SHA1 b64e57be53bb267fdb14f6b52308878b522cbba6
SHA512 87b026e6a802d91c2ef735d4c67012c8de3748206a5d1f2ae197f2e513db2a9677c5a5a7916ebd5b8abb503f97eeb16f5aa20825cc5544dee0eb2c1bf5fe15da
TLSH
T180110120F1F9DC53E43268CF9B119BC348A8768AAC5C6E25A31D8109A7488734E67CE6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 18afd6490a49c3e4a61121427fa544d4da38b257e7626a3a6fc8f0c5d79f94e5
MD5 4c588bb13987219aa1ce9be6a92c8d4f
SHA1 f979229e5a58d90a1341a3399bc0838c3e2fc707
SHA512 ba461736a2f49853c95b106be1ceef23039402d009ba056818c3ded53f9a84f720ba15e90552fa41df727f3b8bf70f27f99cb914d90e6119ba02c1708a387059
TLSH
T109110B20F1F9CC63E432A4CF5B15DBD348A8739A9C5C5E25E31D8109A7988738E57CE5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/368-71-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/368-95-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/1988-35-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/2276-6-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4244-59-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4872-82-0x00000000006F0000-0x0000000000711000-memory.dmp

Download