92ce46b8067cbffb8d01a430014a1b6006ac519755fc11b3eb5fcbd55431963b

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 7.5MB
Sample260815-b4pgqsdj5x
SHA256 92ce46b8067cbffb8d01a430014a1b6006ac519755fc11b3eb5fcbd55431963b
MD5 2b73a7e3af040b96263c74bc3a772caa
SHA1 d7b53b6d7b9719b136f090840cd955a5884f6515
SHA512 ecbb09ecf92b4d82162850610a76a8be4e0b5ab60ff278cb653144cb57152a372cc4a1322d1cec439b245c7a0e8691788c8511b8a375b578f7f38385d15a64b5
SSDEEP 49152:U+ES+Ek+ES+ES+Ef+ES+Ek+ES+ES+Ef+ES+Ek+ES+ES+Ef+ES+Ek+ES+ES+Ef+En:N/fh6ImzzJoDfuBcMv+A73XAE
TLSH
T145765B05F98740F1EA1755B008DBE3BF5730AA158326CEE7EB488F57E923BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
2272	svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
4416	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCCABBCCBACCCACCAAACBBCAAACACCBACBAACBCBACBCCBBBACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe"	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBBBBACBACACAACABBCABCABCCCCAAACABCBCBCCBAABCCBACBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe"	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1292	sc.exe
5276	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1060	cmd.exe
5648	cmd.exe
2928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
2272	svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
2272	svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
4416	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
4416	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
Token: SeDebugPrivilege	2272	svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
Token: SeDebugPrivilege	4416	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1060	4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 1060 wrote to memory of 4400	1060	cmd.exe	94
PID 3940 wrote to memory of 5812	3940	svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe	95
PID 4900 wrote to memory of 5648	4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 5648 wrote to memory of 1292	5648	cmd.exe	100
PID 4900 wrote to memory of 2928	4900	2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 2928 wrote to memory of 5276	2928	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_2b73a7e3af040b96263c74bc3a772caa_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAACACBCACCAAACCBCBAABACAABBBAAABBCBBBCBCABACBCBCBABACBABCABBBABBBBBACAACCCBBAABCBABCBCCCBCAACCCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAACACBCACCAAACCBCBAABACAABBBAAABBCBBBCBCABACBCBCBABACBABCABBBABBBBBACAACCCBBAABCBABCBCCCBCAACCCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCACACCBBACACBAAAABACAACCCBCBBAABCCAACBCACCABABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe" start= auto displayName= "UserDataSvc_CBBCACACCBBACACBAAAABACAACCCBCBBAABCCAACBCACCABABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCACACCBBACACBAAAABACAACCCBCBBAABCCAACBCACCABABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe" start= auto displayName= "UserDataSvc_CBBCACACCBBACACBAAAABACAACCCBCBBAABCCAACBCACCABABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCACACCBBACACBAAAABACAACCCBCBBAABCCAACBCACCABABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCACACCBBACACBAAAABACAACCCBCBBAABCCAACBCACCABABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCBCCCBBBCCABBCCACBBBCAABCACAABACCCBABCACCCAACACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4d68e648ee59d9ee2c4f809a1b9593b03ccee56cf56f05f5213ca7976c579a2e
MD5 0a3182a6f97be5cf3d5f03d40e3e7f63
SHA1 8fe5fb2ca4b9849190464019e459271d190344ce
SHA512 46776eed2197fe4c2d6a609cfdc089f789eed5d38e5c28adc024f117e5570bbe8cd794c0f9b844827e39dd7b720a580c6e3b71a674e1984a1ce668523656aad4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 8.1MB
SHA256 78e404f8fde6c355ae5ba4f9bd703d77c08c536ff5b11d8239d4734003f6721d
MD5 c21e4d3510831d9b95ba087bb8e1ef32
SHA1 dac32d10f3805b9bde1d4c1f9e6b19a9dc92e137
SHA512 762a18b633cf6b9225d569520dff30ff56e368fb86f98e32866778cb8845b6fd00d9d808181da8f2263645806fd3c4f2b1881ff5dafef616b5e59be06c609115
SSDEEP 98304:N/fh6ImzzJoDfuBcMv+A73XAjgZ2Hb9t+2xy:NHh6ImzD+FjgZ2jy
TLSH
T156866C15F98740F1EA1711B048DBE3BF5630A6158326CEE7EB488F5BF923BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 84459c53af35910e20bb113167cf19405d0a767930a2c7969a447be67084c1af
MD5 bdef5d06a02e1b567d4a70d4a1314d58
SHA1 82740984ba54eece6ee53c99d0a2042230a11d21
SHA512 a8adad59e14c47220f061661c4218310f63e2a4a0a0e0f05d5670ab55a53e3c8008f34e61214e60dd6789a127415c6888af8ba680e7cc94657a08ddf0a499f05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6bcdfd3c8a062dba0b611268bb03b35a80be3a87f4873a4f6c606185c71cf34f
MD5 fa00a0bcbfff9e8c7503154000a1c3c1
SHA1 152876bedbd8b84a707cb18c2eec91e8a47ef3d1
SHA512 9c8576560438482dbb928c765ec930445f156fcf9bf2f0b08b944e09736e0c3fe17e2db73907c440786e061b725cb34c0cd469b271564c68764387f4eb2bef8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c36b9711bc948ff25d12003b6dcc4cd447bafb18a6d841d569c89869a7dfbb34
MD5 92510fa6616bc52f5a8ebc42e7d883fd
SHA1 0d7373d15944928a85c030d46524eb22a3bc94c1
SHA512 331e1ba24b047033f3d3d2c153f6e0c493be398a7fe2c40a7ce63f28c3dde52bcadeada7b8f33bead4967c9ec5ae562fd03d5c5296e8501c68dddc3e5814d1b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a6bae9d341333ca9f403e2bce344bded156ff3ce201453a17cac58d3fca5e71
MD5 8c883ed2bb54b6e823c56e14606bb56c
SHA1 f7ef0c5909d7ad087eeb5ca3ac302eccbaa75698
SHA512 c4a7b4c8e5655a7b58a94bf3d2fd12d5790a96771c40c87bd46988dac00901280a77ed133a9d87c17830a613651882dfe4d1fdb92671d7251a61865d95c129c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6fa455a1d3ca0a2f3fe5830fc7c6801dc01a99a8dd5dc3c8cb5c25033a4364d
MD5 597e6069b250af2f1a68a8a0f2209cef
SHA1 bcb58c8238fcd6dce103579e31a3e278babbb3e1
SHA512 a6791283cbb16d1f45769fc7e14135b807e2f17c58857a47dc0a5f863c5955c35eeda7c49e5d3ee250cc3b0cdbd0238259b027ef5e367389ec828bdb88270335
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c5840005cbadb16d1030996e095b5977414d2facb2f2cd4fd2eba37e843cf2a
MD5 36d20b37b68428ff6a69ff26a8484b6f
SHA1 4bd70a531c05ab77c5019061e484bacc1684acce
SHA512 6d06ada3b5ab778a7d06f8679e6b1b672e1f7ebcf0ac87b5e17adc1abda49f787b27fc557a8418753a4429cf0480c74c0997002b349c2e941a43a37c363f769e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e7231da9fcd0b18346f21ed53eac93d0d0cb31f844317f98246f8afc14d4f07e
MD5 5615898592a34ea700b270f2b94e39a5
SHA1 3115372b9a96296d863cf0316a30cf5661de4211
SHA512 c9f75aa7c73a84b8e39f5167683650b3025078b4051c77e51bff9ba13a2172d89882509ca806ad56b6dd838193ae2f66931b3fc5b8e99e52b3e11afc83e9d61b
MD5 SHA1 SHA512

Submit Download

svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBACCBBCCBACCCBCCCBCAAAAAAAACABBAABCBBCBABCABACABC.exe
Size 7.5MB
SHA256 92ce46b8067cbffb8d01a430014a1b6006ac519755fc11b3eb5fcbd55431963b
MD5 2b73a7e3af040b96263c74bc3a772caa
SHA1 d7b53b6d7b9719b136f090840cd955a5884f6515
SHA512 ecbb09ecf92b4d82162850610a76a8be4e0b5ab60ff278cb653144cb57152a372cc4a1322d1cec439b245c7a0e8691788c8511b8a375b578f7f38385d15a64b5
SSDEEP 49152:U+ES+Ek+ES+ES+Ef+ES+Ek+ES+ES+Ef+ES+Ek+ES+ES+Ef+ES+Ek+ES+ES+Ef+En:N/fh6ImzzJoDfuBcMv+A73XAE
TLSH
T145765B05F98740F1EA1755B008DBE3BF5730AA158326CEE7EB488F57E923BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3f0fe27a0619788571e273df361096e024af5d10a481a13b644dbf7b6f866eef
MD5 8b4798117ffd70f18e26b0579d0f323c
SHA1 210fe88afa4af4d0e7bb59094594f9e8df4a124c
SHA512 d73f3cdae1a2b01fede87fcb35cc80983ba2e939805f40a7f8330c8ae2032d3ab07534f1e5a32fed2143f518a5d7905dd9805bf18a4a4d63f3bf654bd4d7800f
TLSH
T18811A771D4F5DC67F93368DFA939EB524CF03BDB58986E54230D82186799C328E190D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d65cce939dde76325c3d589f51c2fcb2ea28083d5b0974ef893de95b00fb07a1
MD5 5fc4a99ac408a1223f82f54e38984fa8
SHA1 ddf2184f5a1e68d2687c2aac5e1c063cd04b8a06
SHA512 6c757e87073d584daaba456fe8ab318dfae8e31176219142f4403d6b61488c1df2b9b28a223958e93a7fb11ad6b97bdd3afee14c9c787a9329d7fdb3af4abad1
TLSH
T1AB21C671D4F5DC27F93268DFA939EB924CF03B9B68986E54230C81186799C328E190D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2272-69-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3940-31-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4416-385-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4900-0-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/4900-7-0x0000000000220000-0x0000000000241000-memory.dmp

Download