194207b112709335dcac9695ed176e0858a83655f1b3bdff7d766196ff72d5b1

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 10.8MB
Sample260814-dht67stcjg
SHA256 194207b112709335dcac9695ed176e0858a83655f1b3bdff7d766196ff72d5b1
MD5 e06864ec3269e08fab09ff1cf9080dd2
SHA1 695887acc0332e2f8ac47f02aaa7462e73d71382
SHA512 2c4e39a627f31753b35c37b35a54d6f7492c3f2cc248f1ac1ab1e3db4cacccbd18ea50838ad2129ca28af0102433a6b9c70eeb2b412f7d61fdf2b2c8597c6913
SSDEEP 49152:U+ES+ES+EK+ES+ES+ES+ES+ES+EF+ES+ES+EK+ES+ES+ES+ES+ES+EF+ES+ES+Ev:t/fh6ImzzJoDfuBcMv+A73XAg
TLSH
T1DAB65B05FD8744B1D91B51B048DBE3BF8630BB1583228EE7EB4DCB5BE923BA15835216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
4144	svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
3772	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBACCBABCBBAAACBBCBBABAACBABBBCCABCAACBBBCCAACABBBCBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe"	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBCCCBBBACBBABCCACAACCCBCBCBBAACBCCBCBBBCBBCCACCABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe"	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1764	sc.exe
4980	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3388	cmd.exe
1660	cmd.exe
1172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
4144	svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
4144	svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
3772	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
3772	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
Token: SeDebugPrivilege	4144	svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
Token: SeDebugPrivilege	3772	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 3388	5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 3388 wrote to memory of 1908	3388	cmd.exe	94
PID 5560 wrote to memory of 5180	5560	svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe	95
PID 5644 wrote to memory of 1660	5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 1660 wrote to memory of 1764	1660	cmd.exe	100
PID 5644 wrote to memory of 1172	5644	2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 1172 wrote to memory of 4980	1172	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e06864ec3269e08fab09ff1cf9080dd2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABBAAAACBCABBBCCCBCCBBACABBCCBAABACAACAABABABABAAACBCACCAABBABCBACCCABAAABBABCABCCBAAABBACABABBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABBAAAACBCABBBCCCBCCBBACABBCCBAABACAACAABABABABAAACBCACCAABBABCBACCCABAAABBABCABCCBAAABBACABABBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCAAABAACCCCACBBCACBCCBABCCABCABCACBBBBCBACBBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe" start= auto displayName= "UserDataSvc_BABCAAABAACCCCACBBCACBCCBABCCABCABCACBBBBCBACBBCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCAAABAACCCCACBBCACBCCBABCCABCABCACBBBBCBACBBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe" start= auto displayName= "UserDataSvc_BABCAAABAACCCCACBBCACBCCBABCCABCABCACBBBBCBACBBCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCAAABAACCCCACBBCACBCCBABCCABCABCACBBBBCBACBBCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCAAABAACCCCACBBCACBCCBABCCABCABCACBBBBCBACBBCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBAACACBCCCBCBCCAAACBBCBABCCACBBCBACACCBCACBAABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1ff729f7c57a017c54379629721ebb288caee0df2d45a4a22951b0c68997ff27
MD5 a5c8bab7e2d41d7457af314c81a12c91
SHA1 4ce92f62c4e47de048396ca9ca4aad9e7ff89618
SHA512 e3151d16075ffc4d73ea355aaf5eab4ff7ce28228c6cb6094d906c60931feccd42321b97f5f604cf0587f15835485b0a1e820a49ba00a2bb790497640a990e45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdgeDevToolsClient_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 9964d4df76b1255a4b58cc56016bc1e44c5e21b90154385eb380e85ce6730132
MD5 f65023cbd111dc015cb7fbd077571893
SHA1 0d9c00ccde1cc723a8e981d984f307f71edda968
SHA512 63b43148b30c9ef807d69e5af55890a4ac6ba260a15897a8ed50c8f9fcb7666be846c7e311cb4a5470da9b31588a73b1770a14ff172836fbbc33fbc14c2e0324
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.4MB
SHA256 9cd4f4baf7dcad9ed205c7fc19d573b4540b907a245fc942dddea8f3f58f2633
MD5 2c362b45127711164f2cc780454cacc1
SHA1 fed7f9c21d5a5de53d8000e714105fd70a440370
SHA512 739c8fd160fe8d86e51be5b37e7a8dc202cf252ed299e97edf5712216a0fe20f24f6d391cc745cfb8a127bad5df467642f4f71f70ece79318aebe296d6e56c74
SSDEEP 49152:U+ES+ES+EK+ES+ES+ES+ES+ES+EF+ES+ES+EK+ES+ES+ES+ES+ES+EF+ES+ES+E+:7
TLSH
T1E1462B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04f1c479ae4fe1485f75e6097913635d0a88323c72515e7f7d798d6f9d137716
MD5 85ac79e529300726f678b9d77a3f6eb3
SHA1 90daf9b9d48406048d066a6c6f6a23d7e3e8c48b
SHA512 e4833d91f937cbdcca1053303aa8d4ef22c413401d2d3230c483ef222a8c601515983ab47f73029dfe6d5f91fdfc848c4b64c512ea28ff4ad3508d1141a06e1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af66689701e69a7b738ef234bc31a4f82e7c61d387ae39bd1ca728715e64a4ac
MD5 d57508ebcc147d3768c9150815d602e8
SHA1 1e2386721b6eb2a0cb00f70626eec29a7b6a01b0
SHA512 cc60a39b7d63469d08f99fbb3e58357dc285b594e868514ac9ef490348d92c96c2b4ac448245272d191c0b7c62d918ffa5da4fb7bd0a27985aa085920ec41199
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d11ee8096f6766b154f6eb28bfef83c9021069bfe3478a1bb0631dbb8ff8085f
MD5 a8d0dc541ee6c33b74ba5189dc49086f
SHA1 5e62d5dcb5c79dbb63264e7ff92ce61f59cbd0c6
SHA512 f0b1d0e3c5a55bf7abc4c21d4c17c460e4056e494167a55adfe9621ecfc7922caac70ce12e6187632ebada01632a4ebf4e5090b8d53aeadcb94692904269e69d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f2fcfaa034552c37a2e18fa380da473d93c40d10ab5916b7cf322689a0b591f6
MD5 6f26496a32763bcba0ddcf59f6bd3663
SHA1 34cdb8e22adae27991d90a1cedc92ca65d98cb73
SHA512 0369109eb417bbdfc345d0e826617cde0535c517d46af16106436eed27698af94ec272e46d0d63be03e1ba64820d7d7bc777cc5f36348601be60de551bd40e8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2ffefed9d3c493220b4d988221f138ddb8478a4184fde45d13613f31839f90c5
MD5 20da9d00266243eecbf54433632f8107
SHA1 2ea7e83f05c840bde46e524a4bd3136736c021d3
SHA512 912d5c26e14333312048b1e1cccb97d965f74cf3416d0f7e702baa7acd82b2e09e45f048f99d3f902d1cc64db497c5de01d4cb5b66c89484577603da05714595
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8928195e8189286301da3e8ea13e2634a7af5b89954e8665b804d77817955d6e
MD5 85c5e569d6721e86a1d2736c4f0d1e72
SHA1 7a2399299b91de981983f3d857f3b3d78030bc9f
SHA512 cc703d97b1404e8a6e57945d21bd2a9ed38734004ffddf180ba68bdb51d26a198ca96f8b637dd19f2a15facf017f6fe9b6f2ba3ff9dc20615edaaef8ba270510
MD5 SHA1 SHA512

Submit Download

svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBABAABCBAABBCCAACABABCCACBCACABCBCACBBBCACCACAABC.exe
Size 10.8MB
SHA256 194207b112709335dcac9695ed176e0858a83655f1b3bdff7d766196ff72d5b1
MD5 e06864ec3269e08fab09ff1cf9080dd2
SHA1 695887acc0332e2f8ac47f02aaa7462e73d71382
SHA512 2c4e39a627f31753b35c37b35a54d6f7492c3f2cc248f1ac1ab1e3db4cacccbd18ea50838ad2129ca28af0102433a6b9c70eeb2b412f7d61fdf2b2c8597c6913
SSDEEP 49152:U+ES+ES+EK+ES+ES+ES+ES+ES+EF+ES+ES+EK+ES+ES+ES+ES+ES+EF+ES+ES+Ev:t/fh6ImzzJoDfuBcMv+A73XAg
TLSH
T1DAB65B05FD8744B1D91B51B048DBE3BF8630BB1583228EE7EB4DCB5BE923BA15835216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 557efbfc0891f8d6614e22a91d065c0cf942b15c94b7dc3c5164d1989ec1ceed
MD5 7024ae05532c41df752103a94a80bb4d
SHA1 55acfbeb71bfd6c33d3d7cbfe80fc354c3725109
SHA512 6db92a2f65602a9ed861a43b95400a66d6d94a9ac770d58466335db471a3ffca1e9f076687cae4a3b0d653e29f5b7db05f752f06f3fc1c0695a57f628bb316d9
TLSH
T1BF11081174E5D823E83269CB511EEBA708B0B39F9C58AE29134C8128BF95C328D194EA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0ccd67ca09f011f58f790b11f11cbc092a231a75d884df3031409c0be22a838f
MD5 90f788f35160e44548272021a1e2a421
SHA1 725587136669f4d6312ff3eb267fb2d514f449c3
SHA512 57c1c38f646e19e2c2a4e9963a29cfcbd64ff62814bf4b9eea2ce86aac7985ddf74927f6892f6c87643a7c983ff6824705e86340dbcea8c29142eb0cd94ca39a
TLSH
T103210A5174D4D823E83269CB611EEBA308B0B79F9C5CAE25134C8128BF89C32CD194EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3772-239-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4144-70-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/5560-31-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5644-0-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/5644-7-0x00000000000F0000-0x0000000000111000-memory.dmp

Download