6f2419a1c672458f9bf1ab5870bc9cdb57380c4c3ad21805ccde47618aba5044

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 8.1MB
Sample260815-b5ec6axtft
SHA256 6f2419a1c672458f9bf1ab5870bc9cdb57380c4c3ad21805ccde47618aba5044
MD5 27c08d7beb037f2d284ba13cc7e59a2e
SHA1 415134c1722c44436f5d310ba21ce995cf466490
SHA512 c17d77040fbffeac258baca98e2d9670e46018ca5efeec24ad4c1aa328b81279530610590a40c9cf0b2ceecc33f0eb20e960f70ce3965085c5663a2cbf1cbd3e
SSDEEP 98304:SZZZZZZZk/fh6ImzzJoDfuBcMv+A73XAU:JHh6ImzD+FU
TLSH
T1D0867B05F6EB40F4E56356304976827F9632B8255731CADFD280CA7AEE23BC16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
5100	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
2704	svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBABCCBBACBAACBABAAABACAACACAACCBCACBBABCACACBCCBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe"	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCAABBACBACCBCBCABCACABBBCABBBBBCCAAABBBBCCBBCCBBAAABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe"	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2184	sc.exe
4080	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1680	cmd.exe
1692	cmd.exe
4472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
2704	svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe
2704	svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
Token: SeDebugPrivilege	2704	svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 1680	3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 1680 wrote to memory of 440	1680	cmd.exe	99
PID 5012 wrote to memory of 4896	5012	svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe	100
PID 4896 wrote to memory of 4812	4896	notepad.exe	101
PID 3576 wrote to memory of 1692	3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	103
PID 1692 wrote to memory of 2184	1692	cmd.exe	105
PID 3576 wrote to memory of 4472	3576	2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	106
PID 4472 wrote to memory of 4080	4472	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_27c08d7beb037f2d284ba13cc7e59a2e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBABCCBCBBBCBAAAAAACAABCCABAAAAABABBCBCCBBBAAAACABBACAAAAABCBACAAABBACACCABACABCAABCCCBCBCCABBCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBABCCBCBBBCBAAAAAACAABCCABAAAAABABBCBCCBBBAAAACABBACAAAAABCBACAAABBACACCABACABCAABCCCBCBCCABBCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACCBACBCCCCCCCCACAABAACACBBABABCCACCAABBBCCBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe" start= auto displayName= "UserDataSvc_BBAACCBACBCCCCCCCCACAABAACACBBABABCCACCAABBBCCBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACCBACBCCCCCCCCACAABAACACBBABABCCACCAABBBCCBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe" start= auto displayName= "UserDataSvc_BBAACCBACBCCCCCCCCACAABAACACBBABABCCACCAABBBCCBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACCBACBCCCCCCCCACAABAACACBBABABCCACCAABBBCCBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACCBACBCCCCCCCCACAABAACACBBABABCCACCAABBBCCBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAAACBCACABBCCACBCBBBBCABCCAAAABAABCCCCCACBCABABACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95c8a46eadf9f354e163abe919a3f460df126badebe03da171c26323546a83a8
MD5 eec1aa1131da835f5e94922e69496a9e
SHA1 28024573ec23f633fd0e5b47483c4dafc1f58c55
SHA512 cc5170fae7e152ce9af3820337a58dc774b8933fef2d653acbb8602ce330420420ac2b59dc583017f3b5acbd3cd056b5fb09051dd0809ec35972cab27284c51b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 97254acd7888ea9be73a97600ea091897890587e8c3bfa5421cda9024c0dd3d0
MD5 077f663e195443d69c945c61f435ed42
SHA1 c6631fcf3b91d5281c0b9db2fd4bfc0076f2a5f7
SHA512 706060cb21b30f514e6ba484bc9d22b7940c0fe5485bc960a6623f6025f5a3189a0948a633305fda2061655ecae6eda24753651afa252dc79513764cd738e23a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35e975e01aff62bb528fe97a424ab6cdf0738956deee282433065a6210b4e04b
MD5 db12e52d7a8c0cc87d486b49e160c93c
SHA1 449595004e836a2867ae7030b5e94f16b51ff98b
SHA512 7ac5268adcb467f44118760febdfc51093821f12c48e0c38986c3fdbc3607b068b5072797d5f25904eedbafcf0d8d23452156c0b435ceeb88c8dc56d56aedb19
MD5 SHA1 SHA512

Submit Download

UnblockStep.exe

Path C:\Users\Admin\Downloads\UnblockStep.exe
Size 49.3MB
SHA256 c1bae343d31edbfb02dd445d019f8538a200cca2fce0105edb7adc8eb7e4ba28
MD5 c83f47032ceb62f684e540f193c0eeba
SHA1 edb0c965e6772325d088bb52823777084ddd526a
SHA512 5ca6ee0a68bd7c379ef29c8f730cb9ff899521bd77fb2f8d6140ba69331a2a8d036fcb331d5fe426e9c47e891fd0fc7492e539285e8d2dde199f700fadea3363
SSDEEP 196608:JHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FJ5I:EWWWWWi6
TLSH
T1EFB77B05E6EB40F4E56356304976827F9632B8255731CADFD280CA7EEE23BC16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockStep.exe

Path C:\Users\Admin\Downloads\UnblockStep.exe
Size 57.4MB
SHA256 e8f8fe2b35a4e72ebfb034eae02948c9ab42580353dff16b5a8220d846be5941
MD5 dd2cc2fddd7db019399a1ec22dcef088
SHA1 d47c056f1bde4f1c16a04a5c3371bb37c44e50dd
SHA512 310deb20dd02a662ffc097b64c368fd33b7a762bc8608ff20a88c7d95e487c15480162c7024d119c12e0b74e5c1470933babc42962732816e094b85f8c6d5442
SSDEEP 196608:JHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHhd:EWWWWWWin
TLSH
T14DD77B05E6EB40F4E56356304976827F9632B8255731CADFD280CA7EEE23BC16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockStep.exe

Path C:\Users\Admin\Downloads\UnblockStep.exe
Size 73.7MB
SHA256 de6d41bc26f801dd3e617ec9d5583dabff2bc3da1f45985358815757ce04c103
MD5 ce113bd6740819beed76e4d180a1d9a3
SHA1 6d2898be24df82c6e6383d64721f8d40cf62fbed
SHA512 73ea3e31d2b0e82e8689fc0cc368a593ecdc7a8f6a07cc04effbae89e86a5ce18de16bac536a0319b163302911b5e229e62d41780adb40d885a8ec024660cea7
SSDEEP 196608:JHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHh6ImzD+FuHhl:EWWWWWWWWiH
TLSH
T163087B05E6EB40F4E56356304976827F9632B8255731CADFD280CA7EEE23BC16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 85815280c87622807259ea6a92b9f0aac910464bca9354e781d38eaf7ddd1ca1
MD5 28b92dbbfe6a1d8738bc286c9f6f2ae9
SHA1 f2b43ad6ca9ea4d6ab815bed16c22c79c7ba2a2a
SHA512 d1adf72418af0fbb80e03822b924e2200c604c9b8ffd5d1fc514e4aa50b78252ec306f46da8b19378256fe02c250e5218d7a597ec15367f034fbb44d36c59da3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 67375cdb988d7b4ca98f353b51db9104410146d7a92e8b2de02a406af830ddd6
MD5 b223d6659a1e81051b97f39719d8d246
SHA1 f9378689d86367ad607e79f66af5c1e5733e5e49
SHA512 2fb38707fec2e0aa1b3ee00629d45a8ec81602472aebd744e8e2d00c1df2cc58e77df2ed07c87f11c66127a8295ab947d17feea27bb07b21f981b913f51bbb3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a68cf2e9ef298a9b9d7987a2488ff4720b88bfca941061454f3efe4f00deeb9f
MD5 a79464cf2254145f43f97780ff0ccb33
SHA1 c66e2e1f4a4649ecc25cba60b7bcc16d0792daa0
SHA512 d2bc6854550e01ae662c80c658aa72fd2ead409cc2b14c64fe5beef8ede0c3a41c635928d55007036ff83d19670a19fac3b8f984d8fae83c39e16d33e23288a1
MD5 SHA1 SHA512

Submit Download

svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABABAABBACABBACABBBACABCBCBAAAACBABCACBCCACAABBCBBA.exe
Size 8.1MB
SHA256 6f2419a1c672458f9bf1ab5870bc9cdb57380c4c3ad21805ccde47618aba5044
MD5 27c08d7beb037f2d284ba13cc7e59a2e
SHA1 415134c1722c44436f5d310ba21ce995cf466490
SHA512 c17d77040fbffeac258baca98e2d9670e46018ca5efeec24ad4c1aa328b81279530610590a40c9cf0b2ceecc33f0eb20e960f70ce3965085c5663a2cbf1cbd3e
SSDEEP 98304:SZZZZZZZk/fh6ImzzJoDfuBcMv+A73XAU:JHh6ImzD+FU
TLSH
T1D0867B05F6EB40F4E56356304976827F9632B8255731CADFD280CA7AEE23BC16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 8e98a67a005af32cf494329684f58f0631ba0f5396b8ab56fbedc5cea35a2291
MD5 7307630604e07146ec89653fdb102c7f
SHA1 64c51df64b18b7018eec8854e5498d85e39552af
SHA512 252d78d9ec23dfe6d0c4b7bfba6fd72862abcb1dcce9ff5f92e60f6bbaa44296d0d58a864158760908e6e37f301de501222e997521e3cbb148c04b7bf085f053
TLSH
T17A119452A4E5DC43F832788BEE0ADF824CE43BDB689C6E54330D86197B89D31CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2704-117-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/3576-37-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3576-63-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3576-11-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3576-0-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3576-24-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3576-94-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4896-79-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/5012-36-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/5012-77-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/5012-54-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/5100-96-0x0000000000750000-0x0000000000771000-memory.dmp

Download