5b295cb2ac42a3edfefdae5574b2223e0dbb42f249832472ee4463f2c40d6cf4

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 7.8MB
Sample260814-c63mtatakd
SHA256 5b295cb2ac42a3edfefdae5574b2223e0dbb42f249832472ee4463f2c40d6cf4
MD5 fc720c7a9f3c9fde076098d4fa385e5e
SHA1 dadd38e339a8557972f9abcc7239541f16bb95a4
SHA512 5f0162f07c9963771e6f41dbb75bfc06e7a461a4ef7f7232a48d29ce2a80584b86846c2f8fc0fd30b7537d6b2a36d66ae93aaf62ff68f17d5975d77e2970cbd2
SSDEEP 49152:U+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+x:h/fh6ImzzJoDfuBcMv+A73XAC
TLSH
T14F866B01F98740F1E917557048DBE3BF9630BA158322CEE7EA488F5BF927BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
6048	svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
4164	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBCBACCAAACCCABACCBCBBCACCABBBACBCACCAAAAAAAAAACBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe"	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBAABAABABCAAACCAAAACABAACBCABACABABCCACCCABBBCCBABACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe"	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5784	sc.exe
3048	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5596	cmd.exe
4176	cmd.exe
2704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
6048	svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
6048	svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
4164	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
4164	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
Token: SeDebugPrivilege	6048	svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
Token: SeDebugPrivilege	4164	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 5596	5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 5596 wrote to memory of 4884	5596	cmd.exe	94
PID 2680 wrote to memory of 5256	2680	svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe	95
PID 5892 wrote to memory of 4176	5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 4176 wrote to memory of 5784	4176	cmd.exe	100
PID 5892 wrote to memory of 2704	5892	2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 2704 wrote to memory of 3048	2704	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fc720c7a9f3c9fde076098d4fa385e5e_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCACBCACACAAABAABCAACCACCAABBAACBBABCACBAACCABBAACAABCCACBAABCCCABBBACCBBACBACCCABAABBACABABABAACACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCACBCACACAAABAABCAACCACCAABBAACBBABCACBAACCABBAACAABCCACBAABCCCABBBACCBBACBACCCABAABBACABABABAACACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBACBCBCAACCBCABCAABBBABABACBCACCACCBAACAAAABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe" start= auto displayName= "UserDataSvc_CBACBACBCBCAACCBCABCAABBBABABACBCACCACCBAACAAAABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBACBCBCAACCBCABCAABBBABABACBCACCACCBAACAAAABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe" start= auto displayName= "UserDataSvc_CBACBACBCBCAACCBCABCAABBBABABACBCACCACCBAACAAAABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBACBCBCAACCBCABCAABBBABABACBCACCACCBAACAAAABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBACBCBCAACCBCABCAABBBABABACBCACCACCBAACAAAABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBAACAAAACBABBACBBBBCCBCCACBBCCBABBACBCCBCACACCACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7502a04a0fabcaf1a5fb6163bdbcd21fe4a499ddbe2a7003cef74f082ef146ac
MD5 6b92f3c6324c0b441a764a195d8f8650
SHA1 681e43fc79c6cfc9408dc6410b24549f72584733
SHA512 8763a2e4cad3da24328b69fab8f04b005514bf3f98c48254fd844abf34d2a2f2555855d7a02be58654c8a3d9f5bfff86fe8f4dfc916d4a6460ae20083027faa6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.5MB
SHA256 6b17809ffe91e49da08325aada4165aea364ec32c2a7032a0dedff146237dc9c
MD5 0f7e4a00b242d899dec6e47ef64a0f4d
SHA1 f9a6182ea393e617cc2dd01b9a4ad418c68c81f7
SHA512 e172ae6e68d7a3378c6894bcc6e4133e3837950a421b74e920b064be77bef7c8b39aee4d8f6a8150b3bd8c1f36087e2434285535444afb6c480bbbc62205db34
SSDEEP 49152:U+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+x:I
TLSH
T15C064B0AF94340B1D92B51B04DCFD2BF8A20BB2586128DF7FA4DCB5B7933BA16838555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\qap`g`v~dtlq
Size 10B
SHA256 c3d7559387384d227214661ecbfdd4827257721ee0f4da9be7461577d8570868
MD5 21dc7835b0ccaf91d00772c31f0447ee
SHA1 f7561cb3a71a3dd9c6bd1f35b865319229ded36e
SHA512 c897740cdde2bddd7d681b6b0de8bc35ba0380fec4fd2b882405cb8d767d5ee8eabaf1330b37ff2ea55e52bbcce0478ab6a825acb3530015f7e789a221c8e162
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a1e2adfe3c6c96e50572e26837b3eeae4da48e3e282158c109871c3cbf55703
MD5 217436fb445998d3a30e29c51e1135ac
SHA1 7de38784a478dd0a3fb8fdf7fabb2c66eb538e57
SHA512 23677bcf0b6af9b39c362a51e4e59bc3b025cb88b04466a2ba3b404a939058e5f52cf0615fe8132b8ac2589fa7795155e6989ce706261bc6b04fd5d32f824c4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79792c174f2baf0baaa4ed1578fc70f3afd50693f9ba49d46b5522fc33f170a8
MD5 a493909f47c94d307a4191a056862218
SHA1 8daa6a8c894847a44f2b13ec49b5aa706105d48a
SHA512 9d4c8e1ac5914329f31911039be0051fb45fa1af6a10b001915c25013c73419d943c28485f436e8e2d2786b4d303c95b877fc7ff59fb82c8ef90e88cefdac297
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c23f650c44d201eadb112bdf5aef5d286567a086c00245056ec9097a1bc476b2
MD5 bd566c958b048505958323be66a2df9c
SHA1 a5f1a4a82133876555e5e10fbbd6ed5f62974da5
SHA512 96f0c2a654983c7807122c069998cfb7a993357705f3b7ce9267bc507a7fd5494d3fd8a199704fc404d0a813b20e6f1856f3d535ad3ee35f9c114b2782e8da1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbdae4f014d70e62a5ae20015d0f9f8d9053f63901ae2faa8b16cb4958ddd362
MD5 e79cc86ba35b0383a3a27738a2c9c84d
SHA1 f28f2af79e7df616fcc671547fb25dfc1bfd51b0
SHA512 c55d4024d6c97b373ed564376359dd0aa91b11ccd62318eb08cdbd3cc0543f8e23684b84490205b5b3c209990202de5e92fe2d3736f3f562049d00a3983ecff8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c27d27ca64673af1a69e8be134a9d9051e253146473ffb860ffa4f9fe9652c6
MD5 d943bc00e326d60b68963f5055da3aeb
SHA1 913cfacc9760fa81a6ad0b093c8cd8094b6514be
SHA512 e329c875803c20935b3d11c946e556e9b20aa66948f0f3f74f5846aba2a04a8fea6f01e124bc20cc12bd263fc7658f559c95d17863e3eeb9fe5d9cda697446b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 665d41cb3a24f4a5a3a7af625cd9ec24d5b98aabb2039beb22344c4236b05c46
MD5 52bb57a3323f2e55e93d4553726a46bd
SHA1 878729ea95b03b733ebf3775314bd7c2e2fa1d54
SHA512 33376ffc8a83cb1785573a93a0ebf6f64e66fd07058a1ceb5680e7f02550a1b442247139b22b3ebfded2fd31829e2203b0562748d3a344be1c379b5a281a3a47
MD5 SHA1 SHA512

Submit Download

svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABBBBACBBBCCBACBABACAAACAAAABBBBCBBCCBBCABCACAAACA.exe
Size 7.8MB
SHA256 5b295cb2ac42a3edfefdae5574b2223e0dbb42f249832472ee4463f2c40d6cf4
MD5 fc720c7a9f3c9fde076098d4fa385e5e
SHA1 dadd38e339a8557972f9abcc7239541f16bb95a4
SHA512 5f0162f07c9963771e6f41dbb75bfc06e7a461a4ef7f7232a48d29ce2a80584b86846c2f8fc0fd30b7537d6b2a36d66ae93aaf62ff68f17d5975d77e2970cbd2
SSDEEP 49152:U+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+EeT+EQ+EQ+EQ+x:h/fh6ImzzJoDfuBcMv+A73XAC
TLSH
T14F866B01F98740F1E917557048DBE3BF9630BA158322CEE7EA488F5BF927BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e484e00f2e77fee09e8348bc90ecd03ff4f89c2ccc0056c204887970408e5e28
MD5 bb974e5af94388617e32120176a02ff6
SHA1 be9430853ad32b2f69ec199c8e2865f81c008133
SHA512 eaf213233d1d54a8f8e79554764112eab35382ce13916e50965b3904bef80812817ca706aaf946c270a36381c5cc974ee4dce995972c67d1dc16b88110a3ec55
TLSH
T14011C661B4F5DC57F932A8DB5A19EBE20CF8B78FDC5CAE54220D8228BB85C318D114D6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 eb23221be591884053be3f5770ea3dfe0dbec1c0d37662e7e41c79caf161020b
MD5 b354ae7836f88d3aac2ce2f502d9006a
SHA1 72da479ce1d31a3162648e57e28d8a5bdba77b3f
SHA512 54debf377458ada91bf8f781dd996882538ab8063165d430eed0d4c8068deeab1713df2e232e05195ceb43786003799270a01a1dc27ea4cd5e7d8059031ddc99
TLSH
T1C821C961A4F5CC57E832A8DB5A19DBD20CF8B74FD85CAE54120D8228BA85C318E118D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2680-33-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/2680-23-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/4164-81-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/5892-0-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/5892-7-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/6048-78-0x0000000000160000-0x0000000000181000-memory.dmp

Download