8ee732dcd213e901486ee5a50c0ebbd0cc778b37ab8ae5cf7cda6822c163c41d

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Size 27.7MB
Sample260808-etclzatsay
SHA256 8ee732dcd213e901486ee5a50c0ebbd0cc778b37ab8ae5cf7cda6822c163c41d
MD5 06b17016bd07dfd3a3b18347aae6d4e8
SHA1 a0051156b8f761801fb5d254b9f061dfae5f3ad6
SHA512 c076e0f67f9149a8c6bdee2d7f1f6faae2f1a86a15845b2a3dcbd07f44490c19ba1f362e675130db1316aa329197bb683e716b906c4dbda761161aaaf25f2522
SSDEEP 196608:anSunSunSunXnSunSunSunXnSunSunSunXnSunSunSunXnSunSunSunXnSunSunJ:a111X111X111X111X111X111Y2
TLSH
T124577D09FD4744F1D92B61B00CDFE3BF8A707B25C4228EBAFA4ECB5B6923B215418655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c48f-19.dat	UPX
behavioral2/files/0x0008000000018296-395.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
2820	svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe
5636	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCACCCCABBACCAABCBBBBCBAACAACBCCCCABCBCBBBABCCABABACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe"	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBABCBBBAACBBCBAACBAABBBBACCACBBBABAACACCACBBBBACCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe"	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2996	sc.exe
5308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1324	cmd.exe
340	cmd.exe
5076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
5636	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
5636	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
2820	svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe
2820	svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
Token: SeDebugPrivilege	5636	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
Token: SeDebugPrivilege	2820	svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1324	1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	93
PID 1324 wrote to memory of 4252	1324	cmd.exe	95
PID 5788 wrote to memory of 6892	5788	svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe	96
PID 1692 wrote to memory of 340	1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	99
PID 340 wrote to memory of 2996	340	cmd.exe	101
PID 1692 wrote to memory of 5076	1692	2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	102
PID 5076 wrote to memory of 5308	5076	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_06b17016bd07dfd3a3b18347aae6d4e8_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCBABCAAABACCACBAAAACAABCCACBABCAACACABCCABABBBCCCBBAACABAACBCBBCAAACBCCBCBAACACABCCBCBCBBACACBCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCBABCAAABACCACBAAAACAABCCACBABCAACACABCCABABBBCCCBBAACABAACBCBBCAAACBCCBCBAACACABCCBCBCBBACACBCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABCACACCABCAACCAAABACBABAABBCCABAAAABCBBBAACCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe" start= auto displayName= "UserDataSvc_CACABCACACCABCAACCAAABACBABAABBCCABAAAABCBBBAACCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABCACACCABCAACCAAABACBABAABBCCABAAAABCBBBAACCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe" start= auto displayName= "UserDataSvc_CACABCACACCABCAACCAAABACBABAABBCCABAAAABCBBBAACCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABCACACCABCAACCAAABACBABAABBCCABAAAABCBBBAACCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABCACACCABCAACCAAABACBABAABBCCABAAAABCBBBAACCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACAAACBBCABAAABACCCCABABBCACCCCCCACABBCABCCACACCACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 400bcc33f58d79b7937969135bafe08a516f0f012b67651a2c0b94f49773ca34
MD5 148d573115946e69e4d57e729ec35d41
SHA1 95fbff97e3ebfe3bb6f88a8cb3ec8f504332cf71
SHA512 8a1fda663d9b0ffa11aaba19e378fef45e7ae6b5fa73ca4be15689f2fb665f7b04f4881cd8ab395f44d62b907ccda37b98920a9feb79623d2be66d3f74118202
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\qap`g`v~dtlq
Size 10B
SHA256 5a39aedc86a1cdac13de2a146f1b0bf553c635c33982e4a9025d03750d41bf90
MD5 c649845cc114698c256f0fd94c49b202
SHA1 02b0d6d367a611ece2c7aa5547866853bf65ebfa
SHA512 33e6c2984b7478db77a7692560a3dd9ca5d8645af872639b86c53705ab2aead0dfa7bb13f55b4db6026c108077ec346471e8c4dcff1565a4da8632248b1fdb82
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.1MB
SHA256 794b01bab4b7e43320ea986e11e0dc2c8d0f2fbf0b691ef393aa8f1016ef5d6c
MD5 799ad66aee2d8c74d052eeafbdb6c370
SHA1 0372f9f65ffa0dcb4afb09ecb60ce93241a73a59
SHA512 7203f2d2526af05b01bbe0ebde08c562f2ecc3e697ff79218c8def291329c6c580fa88aff2cb2d4d31ec3a9c73595454e132c029cd65cc34c83538294d62f2bf
SSDEEP 49152:W+Eg+Eg+Eg+Eg+Eg+Eg+Eg+Eg+Eqmnf4baczK+Eg+Eg+Eg+Eg+Eg+Eg+Eg+Eg+EB:an7Oun7Oun7Oun77n7O
TLSH
T1EF565C09FD4744F1D92B61B00CDBE3BF8A60BB26C4228EBAFA4ECB5B7523B21541C555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\qap`g`v~dtlq
Size 10B
SHA256 a28dff852aa9e8c6ba01f9694eb31ea864f84c167ad5b50a6a0f2c464fd11e8c
MD5 e1029da984c85a3a80c7617f9079533e
SHA1 e1a027db7f16d0a6986e0154f5d3bc68341530a4
SHA512 3d1b8d9c53f1e0e8edb8516a99ddee8bc42efa8abc1d23a4acba292bdce9d6524bd4407f08ee89f9387562cc83a8a9d547423e3376d05c188aaded439693e5bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d70fbde6e19bff4d26305db585702ecc6f9eaef7c07ae1a408aa8ac4fe25db37
MD5 f0b1681417e53755cebbc186feb67b64
SHA1 bd64814eaa18a98db6ae2b9ff1733d24c0e28c54
SHA512 6e1b617aab24f0d3a093945d0902be7b01aa04b4b5c36e0e92c965969e9ad74af4b9dbf755379a1bf846d8959c26bf64854599bf5757462a203e620212f9788e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a1ba889e37a9c947aa8f2e00c7d5b11407fb6556ecff001c436fd1649bcbf935
MD5 461c0800abafa8260516b390686f0724
SHA1 0e3ddcfacf7ce0fd4156325efdb8956b4352283a
SHA512 3a6821b35968fa7b4388b3d1f4a5f70bf0be51dd0f0c8d893cc6d2a5f208323f7714ee2f752e6c7ddfbdc6a09b552e83be3889f47f0efc99bead83d0dc775078
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 08ec2b616c10bb49be49a880b0c2608010a8c85672fda8762e09d89fe1f4c658
MD5 3cae1a999554ae474db6fbe0e61f77fd
SHA1 856199e1c4b7952e7d618aeadc5b87229918c113
SHA512 d6b61e03cca539e1d30c8e9ad23a2055537944e010276e2ef892faf9a24be9b163624ef23fa8a655b6f3567ecb3ec3ff498461c099ef1268fe21217adab8fb15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c356315179e47cfe1383c0b2ef2467035d1cde2507c94fd96f57fd81ae7d122
MD5 a06fe4353c0e5ba5fa3a750486161e31
SHA1 61dc94b441820be0ec96e6974a8d24ea27ad9cff
SHA512 212d9e500af31df3fb02916f36db0546348597a22664b48e0fa2b537412a69a63d90d5ae7297e3d2182238a91e46e787768d7de0dd5a1b5fa7b632f2e128b887
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6213b671d873fbf7b8a1bc2b8c3efe9d59cf9a3602def72627c18481a5a0e23d
MD5 4fafdb15611282f4904c8ddd08ea9af9
SHA1 ffcade566c544616f419fb25be0cf409cf0c0268
SHA512 5968721e047173a7893436719e0c4cc9bb637c5b7d8fd8e1c5e9cbadde2430743a39be607c0b832e225949e82f415b9305724f77e5fe8719a65bca9c30d81954
MD5 SHA1 SHA512

Submit Download

svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAACACCBACAACABBBCABBCBCBACACABCCAACABBBBBABBBACABC.exe
Size 27.7MB
SHA256 8ee732dcd213e901486ee5a50c0ebbd0cc778b37ab8ae5cf7cda6822c163c41d
MD5 06b17016bd07dfd3a3b18347aae6d4e8
SHA1 a0051156b8f761801fb5d254b9f061dfae5f3ad6
SHA512 c076e0f67f9149a8c6bdee2d7f1f6faae2f1a86a15845b2a3dcbd07f44490c19ba1f362e675130db1316aa329197bb683e716b906c4dbda761161aaaf25f2522
SSDEEP 196608:anSunSunSunXnSunSunSunXnSunSunSunXnSunSunSunXnSunSunSunXnSunSunJ:a111X111X111X111X111X111Y2
TLSH
T124577D09FD4744F1D92B61B00CDFE3BF8A707B25C4228EBAFA4ECB5B6923B215418655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2e5079fa4eed6b8439aa5450f350b5c974ffb4327c406d767749120a97045d24
MD5 a4ac117c0f5b992056092314ac756d29
SHA1 fd5cd12b5ee308e27b9a0fb1dc27b6d7fc0e2b90
SHA512 ecf313b469cbc3ff99c849f75af513deaa4a6762d600363bc8e227bf9300e2d233a09f4d46d419d00a1ed5292e62d1d957535395dd5b135ccfc1aa4175375b30
TLSH
T1A1212661E4E8C823E53264CE9629AFC349E43AAFEC646E49A344431C7FC5C32CE55C96
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 aee02bddaa117f54b077443d67ceb869128d02b6c32a0cdef4e1a2c85dbd84f4
MD5 0f6f28f9ea06270a209de0eefd94bf05
SHA1 9ef2a70041e1847ff8bebc17431c17310acb4f36
SHA512 699efd7dca34a904631cc4a477848c669f7a1aac3bac457000e82abc49f11a291434093d4021a34380f481585bbba20e53c77a6cccc3fc5ff0b552289fef1dac
TLSH
T1BB112721E4E9C823E53264CE9615AFC349E43AAFEC686E4DA344431CBFC5C32CE55C96
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1692-0-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1692-7-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/2820-70-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5636-72-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/5788-33-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/5788-23-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download