b608ad7948265ec251b4672782ea0ba5b9dbe6edd0c5ef9d76661ef8102d160c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 6.7MB
Sample260828-m9fbsshk3w
SHA256 b608ad7948265ec251b4672782ea0ba5b9dbe6edd0c5ef9d76661ef8102d160c
MD5 9e925e87e4d295e147065bf77127b7ec
SHA1 a640109f55c68304d0fdafc2fccac776b257f2d0
SHA512 cf095878287b868d8cf77cbd73402b8d405aeb94385d890bbad8de17347e212cb93ae660eb10f48bed4f8f5e68771460544a7b0d886e3bd5277bcfb7290555e2
SSDEEP 49152:U+EB+ES+ES+ETqatgluu+EB+ES+ES+ETqatgluu+EB+ES+ES+ETqatgluu+EB+Eo:Urarararararararar/n7OO
TLSH
T158667B49F98244F2D96741714CCBD2BBC670BE214F128BABF658831F6E33B90A939751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024760-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1128	svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe
4112	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBABCCAABAAAABCBABABBBBCCABABCACABCABCBCACBCACCABCAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe"	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABCBACAABBBAABBCCCBCCCCAACBCABAAACBCBACABCCCABABCCCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe"	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3728	sc.exe
4888	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1044	cmd.exe
2000	cmd.exe
1260	cmd.exe
2704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2172	schtasks.exe
4580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1128	svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe
1128	svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
Token: SeDebugPrivilege	1128	svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4472	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1260	1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	97
PID 1260 wrote to memory of 2172	1260	cmd.exe	99
PID 1636 wrote to memory of 4748	1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe	101
PID 4748 wrote to memory of 3768	4748	notepad.exe	102
PID 1612 wrote to memory of 2704	1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	106
PID 2704 wrote to memory of 3728	2704	cmd.exe	108
PID 1612 wrote to memory of 1044	1612	2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	109
PID 1044 wrote to memory of 4888	1044	cmd.exe	111
PID 1636 wrote to memory of 2000	1636	svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe	113
PID 2000 wrote to memory of 4580	2000	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_9e925e87e4d295e147065bf77127b7ec_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCBACABBCBABBCCAACACACABCCCBAACABCCCCBCBACBBBABBACBBCCBCBABAAAACCCBABCBCBCABCACCBCABCCCBABCCBABAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCBACABBCBABBCCAACACACABCCCBAACABCCCCBCBACBBBABBACBBCCBCBABAAAACCCBABCBCBCABCACCBCABCCCBABCCBABAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABACBCBCABCBCCBACABCACAABCCBBACBCACAAACCCBABBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe" start= auto displayName= "UserDataSvc_AABABACBCBCABCBCCBACABCACAABCCBBACBCACAAACCCBABBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABACBCBCABCBCCBACABCACAABCCBBACBCACAAACCCBABBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe" start= auto displayName= "UserDataSvc_AABABACBCBCABCBCCBACABCACAABCCBBACBCACAAACCCBABBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABACBCBCABCBCCBACABCACAABCCBBACBCACAAACCCBABBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABACBCBCABCBCCBACABCACAABCCBBACBCACAAACCCBABBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCAAACAABCCACBBABACBCACCBACBCABBBAACBBBBBCACBBBCCBACCCBBBBACBCCCCBBBABCBAAACCABBBBCACBCBCBBAACAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCAAACAABCCACBBABACBCACCBACBCABBBAACBBBBBCACBBBCCBACCCBBBBACBCCCCBBBABCBAAACCABBBBCACBCBCBBAACAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAACAACCBBBBCCAABAAACCBCCACAABBACBABCBAABAAAAACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
1⤵
- Executes dropped EXE
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2aed1df599cc5b8a9c842fcf12c97cdee544fbe709c8f8b6ad05722820d691c3
MD5 9e5473a403c4f97c7ab7eb6a92575b36
SHA1 1b48c3b8db5051e216f7a3e965d463af1683a8dc
SHA512 e70aa68165cc124bf3cb8f20f324f30d6c15b3a76476837f414ca692f473f7bfe4c37b29f83285b55f85a1d2571edcc3a33d13f157545598da0bb71ae2d68646
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6426db352025ca6a72b894e8644980fc9f771f6cb5d7bb584fffb0a38dfd2115
MD5 36715e6c5f1b23492304810d72b956ff
SHA1 ceacb4078803559c88aea30b7950e9ea5c0d29ab
SHA512 a5e856240863b58f553a8ca36f4d41cb5708a91b8ac7cf29dcc3edd6f2c13aa587493fc19e8e54e440982b37b239da362c1612a3397e940f599dff2d998c8f3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8c6bab4023b46f06acd95a020b2fa80a3019fb35e6090ff61ef8d67c96bb7e8
MD5 7d5dba234224c60400633bb5568dcb78
SHA1 00ea58a3da5c62bcb7cec12806fa5b4b5e8a3534
SHA512 9073a05350e1f48570ecec4d3c9c0bb79420ca361ff4b594258c6351133f5e15b9cbaf458163511916c5c6a95378a124b7cbb8cd9446bcd90137a9d78fdf61be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 97cd766a123baf517531d7e20873005712d9fbcf1c2cddf8caf14003332b2c8b
MD5 584a02f208b33a61c85ffdbb8019dbec
SHA1 7ebea851c0e4a39e24861027ff85d042be33777e
SHA512 4924bf0745b1d151e3829f1e275d58fa717baa032ab76256eb79d2a8baab102a329855af99b2d4b0103694102e8d9634819631e0b00ce8e12cf85d38ca128da9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 39b0c4f4a47f5d500a251ece2d871b058131c5d4d048c8f0d80132af5708b15a
MD5 605817cf2da75f540be6c9a0e3e57033
SHA1 19c99032629ad4371867bca99aee0ed209b3cb08
SHA512 6450aa198e6fd71b89a952fb3aef21bb355221d0b0d385120721f2ed9de30868294b9ea1476760ad061f91a13f42161b541ce6839e56e427e2e16d1431a8cfa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 def920eba927b4acb3301f3ae98655a3be4c07d15f137cf16661bd18c5a79083
MD5 5bf94207f534cf8ddd7ceb1d420c9340
SHA1 3f3daeb03fc8a3135a888a746da536c810030231
SHA512 c33121bfbfe354bae0a4b3075f8e6f939155cf0a51bd9163348f6653cfb1a8ae05308f3bbf9aba360399ac9c5fd829d528d7772dc5ec12bf61de52a27e5f7b90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e22ead217b0d7ba15f30c0c1b99ecba11d8a25f89a566b3c9266e0f6bcce18f9
MD5 9fe79a30f1e31dbed7df69a20b94c84d
SHA1 b74a0ce537ea3eb685d0d027c5bc577bb79151c4
SHA512 43eae2d0b4287fc26b2d43cc776104b1d367f3a3c97e092b1397eb8366c56d28f7de4a81edf96098ff468968330f54d301078360b3a61b1c819274cfbc65b6d5
MD5 SHA1 SHA512

Submit Download

svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCBACCCCCCAABCBAACCCABCCCBBCAABBAABBBABCCBBCA.exe
Size 6.7MB
SHA256 b608ad7948265ec251b4672782ea0ba5b9dbe6edd0c5ef9d76661ef8102d160c
MD5 9e925e87e4d295e147065bf77127b7ec
SHA1 a640109f55c68304d0fdafc2fccac776b257f2d0
SHA512 cf095878287b868d8cf77cbd73402b8d405aeb94385d890bbad8de17347e212cb93ae660eb10f48bed4f8f5e68771460544a7b0d886e3bd5277bcfb7290555e2
SSDEEP 49152:U+EB+ES+ES+ETqatgluu+EB+ES+ES+ETqatgluu+EB+ES+ES+ETqatgluu+EB+Eo:Urarararararararar/n7OO
TLSH
T158667B49F98244F2D96741714CCBD2BBC670BE214F128BABF658831F6E33B90A939751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 50fa79f345536263bb62a552188741e3c3d73842131dd16e387358327fbb7cb2
MD5 bb78b744366fed4c44852a7fec462da0
SHA1 b1965fd608b756f0ff251460f5723c93992a7e56
SHA512 43a486583547920154bd887264f2ab3e6e51270761a438b9182dfe7a6ceeacc47ebb4f23d2141d4bae20438df6406ce6cab3b3984351b3344083ebdcfe7ef0e5
TLSH
T1F2110431E4F5D463F9737CDF9125DE826CE036CFA89C6A25230582087B59C218E55CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f5aed7737e051b68a61ada5c058060a34cb56396f34e1027320347ab723a5618
MD5 ef8ca3ac1f9fbade34d43913bf00a474
SHA1 4ccd9622b6576ac388ef7a000b0a94a79a69b373
SHA512 3319028338a4bc5c18a54e9f08724349f3f49b89ea31b1edeef83469500eb759c1135e88eb68abbbf4c39f2d980d2ddc5c2c8409119c6427eeb071a1d570694b
TLSH
T16911F332F4F4D863F972BCDFA129DA826CA437DF989C5A1513098208BB69C314E19CE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1128-71-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/1128-89-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/1612-6-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1636-35-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/4112-91-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/4748-59-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download