138f2fe3d50bb6940bcfdf533cf8a5911ea714580a5dbe1a567acaff3195da68

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 10.4MB
Sample260810-ekltaa1ard
SHA256 138f2fe3d50bb6940bcfdf533cf8a5911ea714580a5dbe1a567acaff3195da68
MD5 cb8595fa48687ee280584100fa9c2c9f
SHA1 97469ff9d2ab3e7938406fe4bc4161861aa52ced
SHA512 89b2b4c7aa42bb0ce135fa8c6b83bb6bfaabaef48626cce6a572f151db926c368353f3bb9a4936290afc09942931d5fe70d8ed0f1b21618de2463d89ee0d5b9f
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2s+E7+ES+ES+ES+EFiw2s+E7+ES+ES+ES+EFiw2s+E7+EB:w/fh6ImzzJoDfuBcMv+A73XAG
TLSH
T1F1B66B04FADB44B0E967617048E7D37F8631B9118732CADBE6448B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
540	svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
4704	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABACBBCCBCCCBCBABBCBACABABACBCACACCCCBCCBCACCCCBCAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe"	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCBABCCBCBBBACAAACBBCABAACBAACBBBCBBBACCACCBCCAACBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe"	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5524	sc.exe
5112	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1792	cmd.exe
1744	cmd.exe
3324	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
540	svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
540	svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
4704	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
4704	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
Token: SeDebugPrivilege	540	svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
Token: SeDebugPrivilege	4704	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 1792	6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 1792 wrote to memory of 876	1792	cmd.exe	94
PID 3852 wrote to memory of 5420	3852	svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe	95
PID 6072 wrote to memory of 1744	6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 1744 wrote to memory of 5524	1744	cmd.exe	100
PID 6072 wrote to memory of 3324	6072	2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 3324 wrote to memory of 5112	3324	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_cb8595fa48687ee280584100fa9c2c9f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACACCCAABBAABBAACBAACACCCBBCCBAABBACCABBCBCCCCBACCABACABBBCBCBCAABBBBBABABAACCACCBBACBBBABBBABCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACACCCAABBAABBAACBAACACCCBBCCBAABBACCABBCBCCCCBACCABACABBBCBCBCAABBBBBABABAACCACCBBACBBBABBBABCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACCACCCABAAAABBCCCBCABBCCABBAAABBCAAACAABAACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe" start= auto displayName= "UserDataSvc_CBAACCACCCABAAAABBCCCBCABBCCABBAAABBCAAACAABAACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACCACCCABAAAABBCCCBCABBCCABBAAABBCAAACAABAACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe" start= auto displayName= "UserDataSvc_CBAACCACCCABAAAABBCCCBCABBCCABBAAABBCAAACAABAACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACCACCCABAAAABBCCCBCABBCCABBAAABBCAAACAABAACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACCACCCABAAAABBCCCBCABBCCABBAAABBCAAACAABAACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBBBCAACAAABACBCCAAABCACCCAAACABBCABCBCACCCBABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9c5646b78da1d57bcba793a6da7e2a021d53ab7c61ab1a2b47ec46a86c03bc0e
MD5 6da0b7f7d7d530ca36c4e5567211875f
SHA1 d6cf7a78593561976b0e3250e693ef1f9d53ab6e
SHA512 7baab3e35a4834a23de5aa9aecd0d42ff813345d5b214617e3c8315560330072f0d18b1b7c6dda0b0abc758466c51885e95d7fa6fadb6e88115ce8990c63145a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 11.0MB
SHA256 fc659451c589033d5fe0c361fa9bc52cc999507f8271400b28b852fe9ba01d08
MD5 2355daa5af863fb04fab133fc639568b
SHA1 af89863a6e63b622d0737292fd5a2ce46490d7e4
SHA512 abdd8e925057fcc2516f83df1a344755c5022398e767a6eb46c7eade3e3a11fd7485061b4d66a717fd9f6b804060cb92d0c7abcec32fda3663e76a50098c7060
SSDEEP 98304:w/fh6ImzzJoDfuBcMv+A73XAJgZ2Hb9t+2xZ:wHh6ImzD+FJgZ2jZ
TLSH
T1B3C67C04FADB44B0E967617048A7D37F9631B9108732CEDBD6848B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 46e440c6b5fc9b224ef0adc9145c5ac245f3c5eae1a1f6e1d0b5c952bc7a3523
MD5 57addb46929ca72aee3f871cd14517c6
SHA1 c2e35a6fc0355e80dbfe2cf0e3d586a8ae41c8e8
SHA512 ea79a35a0d20779df06cc2ad9be15bf20d83f579afe5a2d0bdc2aabe29470b35396e1b36a7b8b0dc18f293d895aa7d93562686f3e39ead6e8d017e4bccf83aa7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VisualCompanion\qap`g`v~dtlq
Size 10B
SHA256 2689f158fff3bf1f70a538ddb5586c408c47ff8774e0befb55943daaa2d6888a
MD5 f62776126f57adb1111081d745eada21
SHA1 67913acfb895d80964a6a5f187720bccddb80c3c
SHA512 6c193614e065f0de0c05f3af0c625f8171bdbf408dc348c09a4714ec3d165e1233c7f8110fc4964305f93bdba6c03e47abcc9a0cb1bd8ec3e34556aac673e5e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf80df1004ae86dfe16a618a859daf70519dea84a0ee3f575f85c1bc04ffb56c
MD5 bd6a255cd7d3cbbf387c0f8113a48bf1
SHA1 0d2e49ec3c6873c92b43fe98954146db1487458a
SHA512 94a3a560f6261b004c39a299302c366acda09671021e851842387a47b7da41cddaa8c338ab6446478f4bf685f453d3aed3c9bcdea8524d73caf64c1199f0b06f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e1e46faa33cbc734cd7d03c58b5b4611a8cafa734531049f654d3b59c0ba053
MD5 e445326d335645771166b7aa2a96af6c
SHA1 85f1a70ec2209a2ebcde5d68cd1019b7cd392d01
SHA512 c1ca61df8d5c4a6afd412fdd58127832f4879de44b7fe1e97604721aef5772e2871847002cba2ab9716c8ad441440f857567cd66cd7ed171f6fd198fdd5e0f00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96e3beec16b46c83e31905004a3366e1b52b3a1ac4c740fcb96ba7e18a940545
MD5 24981046def7532f0a451564953967d4
SHA1 5a0e6644914a144067b49a84a481c8506d62472c
SHA512 d71ac9f0a9697ec58b7eea7bb8a826bba4af28bf4de9a96aba82f5ad239933e5283f1211f8adc628859276d2517740e20a1fb166325e7ae596b9757141fc5b9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cbf98aacef28bec73ff269e7599580129bb38426280e17814843044d708416d4
MD5 6965edcbc8a66cb26c8cb1be4f59c74f
SHA1 1db41c653ecba43a9b1b59545bd0a7a467ed476c
SHA512 817def8b1e935f76ccdfa111a85bf307685d2a3301192489b58aad8d593349d0a5664e50fb47ad509b738d37e344ea2a00b12991d3d6d94addfe6f941709beba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 34296c25eb3aa9ba6e4c5f6326ab7a950eb7df697954334c9d0ac2a028b37fd2
MD5 a1cb9ae9c0781be1de895b001a555180
SHA1 46a1d7813b6a1f7e277d255000caf8e687fcbd7a
SHA512 726b8542906d89e23c0c0e727f9e380c0501cb1b87d6af43cc4caf1d3b2e07a5ec12e7638b60d538251201a1e648028b426a433dda98dbe6ba280be874d4fa91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1bc627370223712f9770c9600c47c1de6d9df1b3b253e50657a322a8a327e0a0
MD5 bfba747aed36a02ef4799f82f67785f5
SHA1 0319626192f555f68ae2607aa21da4ebdbe869bd
SHA512 80e14487e579585b3253d3df228d4431d67bf50eafab497fbcf4928e666bf949c5a35d14af3b70f65a63a6f798493f5dff1db22e73c3df2ae470d84b500fa4d6
MD5 SHA1 SHA512

Submit Download

svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABBACCCCBABACACBCBAABCBBCBACBBAABCBCCBACBCAABBBBBB.exe
Size 10.4MB
SHA256 138f2fe3d50bb6940bcfdf533cf8a5911ea714580a5dbe1a567acaff3195da68
MD5 cb8595fa48687ee280584100fa9c2c9f
SHA1 97469ff9d2ab3e7938406fe4bc4161861aa52ced
SHA512 89b2b4c7aa42bb0ce135fa8c6b83bb6bfaabaef48626cce6a572f151db926c368353f3bb9a4936290afc09942931d5fe70d8ed0f1b21618de2463d89ee0d5b9f
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2s+E7+ES+ES+ES+EFiw2s+E7+ES+ES+ES+EFiw2s+E7+EB:w/fh6ImzzJoDfuBcMv+A73XAG
TLSH
T1F1B66B04FADB44B0E967617048E7D37F8631B9118732CADBE6448B2FAD23BE16835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 94bb37c0c8faa0e29d235741e2bdbc0a692925c42f10e2cbea1dacb06da7ad35
MD5 8a790867961aca29dfe689080f3c10e8
SHA1 e4d7593bbe96767a588a32842722442098de57d7
SHA512 559d4f506e8c73d0f8178a9e7fc1c1674c038d0d8ae8e6d855f0458c0b57374edcc16a8f88f4f6082112d6388fd2bb6abfc6613cd9b478bb7ef12ce3c920ff80
TLSH
T16411C46268E9D853EC3268CB561DDBF30CE836DF6C5C6B54134C4218AB95D30CD998A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8cc3268a98f232f2ba9d2c8638e6303f20d94141ff8143b43785d77cc96c266c
MD5 675cf97dd737efe2a8a904ff7c7e80e9
SHA1 0dd5967a3855f4276cacd8fdc4e81ce80551140a
SHA512 62c0609ad99ef5ca6fb15f8b9cf15f6f698d234d0aca289763f968c0272d34c36bea7dbf1761abe904dd98641911b3e22a4fe8ed47e41ce90d92515be885b923
TLSH
T1C021F9666CE9D857EC3268CB921DDBF30CE837DF6C1C6B54134C4118AB95D30CD998A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/540-70-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/3852-31-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/4704-442-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/6072-0-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/6072-7-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download