620ff0fb034b6cff5841fbd3c99f26afab95c7e0d77609a706f5d958438422cc

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
Size 5.2MB
Sample260905-2mmvpatfra
SHA256 620ff0fb034b6cff5841fbd3c99f26afab95c7e0d77609a706f5d958438422cc
MD5 95c7d774c1604141f2ccf7bbac91035b
SHA1 41e3dd8c6f23965fc57c00d8f6195b0e5c391154
SHA512 3d12514230930b9f291913cb7e665860a564483523fb292d1f256622be8c79e2b0406dff2d8bacc70b9cb0e59a33568d8a8d720f30dd51faf13f82e971f01b85
SSDEEP 49152:U+Ek3+ES+ES+Ek+ES/C55+EkqKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gr:r45kq/fh6ImzzJoDfuBcMv+A73XA
TLSH
T1FE463940FA9B54B5EA03493048A7A27F6730B904C727CED7D6409EDEFB93AD11936236
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
908	svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe
3840	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAACBABCCAACABABCABAACCBACACBBBABAABCCACCBCBBBBBAAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe"	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBACBABABAABABCAACACCBCBABABCCBAAACCBCCACCCACACBBBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe"	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5016	sc.exe
5216	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3788	cmd.exe
2596	cmd.exe
6016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
3840	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
3840	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
908	svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe
908	svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
Token: SeDebugPrivilege	5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
Token: SeDebugPrivilege	3840	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
Token: SeDebugPrivilege	908	svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2596	4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe	93
PID 2596 wrote to memory of 3440	2596	cmd.exe	95
PID 5880 wrote to memory of 3484	5880	svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe	96
PID 4828 wrote to memory of 6016	4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe	99
PID 6016 wrote to memory of 5016	6016	cmd.exe	101
PID 4828 wrote to memory of 3788	4828	2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe	102
PID 3788 wrote to memory of 5216	3788	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_95c7d774c1604141f2ccf7bbac91035b_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBBBBCCBAABBCAACBCCABAACCBAABBBBBBABBCBAACCBBAABAAACCABBABCBCAACCAAAACAACCBABCABCBCCBBAABCCCAACAABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBBBBCCBAABBCAACBCCABAACCBAABBBBBBABBCBAACCBBAABAAACCABBABCBCAACCAAAACAACCBABCABCBCCBBAABCCCAACAABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCACBACCABBCCCCABAAAACCABBCBACCBAAAAAABCAACACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe" start= auto displayName= "UserDataSvc_BBBCACBACCABBCCCCABAAAACCABBCBACCBAAAAAABCAACACCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCACBACCABBCCCCABAAAACCABBCBACCBAAAAAABCAACACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe" start= auto displayName= "UserDataSvc_BBBCACBACCABBCCCCABAAAACCABBCBACCBAAAAAABCAACACCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCACBACCABBCCCCABAAAACCABBCBACCBAAAAAABCAACACCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCACBACCABBCCCCABAAAACCABBCBACCBAAAAAABCAACACCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCBABCBABBBBBBCCABACCCAABBBCAACABCCBCCCAAAAAACAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b7e2d2a5a3d28f20ce06d3f7bc9a11eda27a5fc54023b3aa86dce4e445055c2b
MD5 96c09b15b220096ba930eb7dd815b104
SHA1 ba583c83e79cc06e2f5d7acdae3cc1513ca9b80b
SHA512 5792a9829583446e15359d6dec831cfb739ce74459c60a3957b916847f8e3877334949c54c3b103cb52c671a465c5814043f0a4c0ba5f4ced25334245743fa1f
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.8MB
SHA256 83e8d09743e3d803c771ebe9e3ca734406091e1ad37ed076d0b7668319c881eb
MD5 f446697486ebfbd03a42a1c3c9ee9f0d
SHA1 bd8770bcf3e6d4c2e337063cf40cb206576a97ee
SHA512 fba5c0b83634e59638d854eb7d97c1834e80c58eb408e278f115b0d4e01d78a90d012f3fffbec2a12d1d50b21a66170e975c88501b5ae437a155dd7c2bbbc8cb
SSDEEP 98304:r45kq/fh6ImzzJoDfuBcMv+A73XA6gZ2Hb9t+2xb:r45kqHh6ImzD+F6gZ2jb
TLSH
T19C565B51FA9B40B1EA03453048A6A27F6730B504C737CED7D6409EDEFBA7AD11A36236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\qap`g`v~dtlq
Size 10B
SHA256 39f28b18acea2970638e0a32ca7b434837556ff96156b2aa08e221092416531d
MD5 f868ba4d05d6526c9e3a3e77703bae5c
SHA1 3286073e7d631eebce87eb0ea06e6da159d14647
SHA512 9166af36efdf40e60ad6e10f3b849c22af7bc3e2a7ed7c1f8639c5ff88722899c3ea15c8b1a849aa3de3a444647a0288a2a479a49402205cc25e2cb1d739e85e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 a975b22f6bce882ebafc7d2ac0dedc352984302c2f69720dffaac19c02704a13
MD5 4fb97533137f01d6a5872a97130e5ee7
SHA1 1e3d755490de134ec932e9719900b01e414239e7
SHA512 df82a7d828246426d0d0b599217282d92d56d8f5065a9ec9e877043cb3cc6c1c1bc040b2e3240a8a0d8f1e3f240b95fc2861cd58b07064b89aefd601d639eb10
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 165d455c4e48ae7f57b9bdebaf8e2e9efbf57846d3a0e408233677d0f77e329b
MD5 7e9fbf2ebcc4a4fb8d60c50cd4649477
SHA1 a221226822fcf7bd20240f989a190377f379391b
SHA512 b02846a2c41a7fa02a3202219e2e683c757ea301b09b477ca466d708d9af001551003a7654fe846345b4366f4b5a88f6bbf3ef3b78187dd86ac468512911a55b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8086bb7411ae4263cb49d95f46f54d93323960d1f6aeb87198f710973b9e687
MD5 7a090b00673f9b7429ddfce5ad1440bc
SHA1 0f826e3ebb8164375e3a42ff638488dbaaa9cc55
SHA512 3ca6fbc57b5c8c7f286c5841a20458d92eae163cb77db4d60a75ab62af095cda3f7cf12deff13ae4d2062a5c6e89eb79574b9b808a358851894b0ff673187f1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2548980a2f89491fc8956c39211642727bc95bd15eea9170cfcfe4b391094cd0
MD5 b402e4c8d4f39135e947832486ea1565
SHA1 9de3bda1bc3d7ff8d2f93cbbc78e1680b1cb428a
SHA512 9be083365c9763d6b568d9bba70e55485a1bda15bddcf13487e287dd5d3a117cb2c331a752f0a23bdb00bc3479a73e5a26b90760f8986d1ab582b39b45e0a4bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32c5769a0d3b1670ddf551573b37a16104803d02ad90aa1e03410b0764d96f56
MD5 94cf16bf7d4fa69c086b7bd8eac02f9a
SHA1 7282510ca3151fb1e884aad3fd89e64601fc970c
SHA512 399c16c0f2af73d76c8433e81fa75ce15dc2bc03291b8a6ebe46320c587e470b361b9726762934320bd0f6000ffad010508fb7a5b422a6a8f3bb79b67ca105b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a382fe6179d0150bbbd2ed46ce7f92f1171adb3edf28e0a1fdd587ae74600da
MD5 5f872a7ab17b04a18180742d4cbefc44
SHA1 110b4752f4d7b33ce17d198cec787216583a08ad
SHA512 12739f5971352b996bae7394c8b9352c56b9164cc02187dcc68e86e3561fc7f8f03177a5d42d2a8f0a62840dbe750b67da858890ba07d27ce39e8bfb78a3646a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 778326ce7915d7abc659a39f09ab3a94bf55202dc725c1b4ffb92faf4ea1e80d
MD5 b9f64637289bec746c79832d40926d41
SHA1 c079b13ffa3cb0a2381efd207fdf52ade6e33342
SHA512 3bb2644a7cfe3bbca20214d621e3ca6a344bc3195ef7d09abe7d5c2ab865e332857a688fcf63c6591325e9f18d2cd55c73a20151c0dd4219d3ac44b1ad0930d3
MD5 SHA1 SHA512

Submit Download

svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBAACAACCAAABCBBAAABCBACBAAACCABCBCABBBACCBAABBCBC.exe
Size 5.2MB
SHA256 620ff0fb034b6cff5841fbd3c99f26afab95c7e0d77609a706f5d958438422cc
MD5 95c7d774c1604141f2ccf7bbac91035b
SHA1 41e3dd8c6f23965fc57c00d8f6195b0e5c391154
SHA512 3d12514230930b9f291913cb7e665860a564483523fb292d1f256622be8c79e2b0406dff2d8bacc70b9cb0e59a33568d8a8d720f30dd51faf13f82e971f01b85
SSDEEP 49152:U+Ek3+ES+ES+Ek+ES/C55+EkqKKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gr:r45kq/fh6ImzzJoDfuBcMv+A73XA
TLSH
T1FE463940FA9B54B5EA03493048A7A27F6730B904C727CED7D6409EDEFB93AD11936236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cbb7afb05051b32e1019f0cfd9b827fe9ae9caf54d4be2b9b73ac87c18c83466
MD5 ffb5b9ce54aced5e305309c6533b78f0
SHA1 99c262583732b5d65e84c0f04040f065d531ebd0
SHA512 fda4b82079ad17e4dd07c31b5fcfdba84b86199f2407f85fa70e79ec46256fba1ccc9f24be23f0734a8fd084b6d26e2c93b806598b77f4cf2a411e284f274176
TLSH
T11521F270B0B4C853F1322C87632AEA870CE82F5F5858AB88230C91186759C7D9E09CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 25e0e7e44cd601e23bf157aa0da0cc8e2ef79a26e87d12f47253680e6a88010b
MD5 69bef1c664ad7ffac3471eb91fff7866
SHA1 3e2c11f84ef7e2c27879588b90a4ca8804e361b4
SHA512 4d8a83205a1255f7c23fab1682e9a4874c00cac4270fbef2e2ef3f317484eb033d888269a39b6fafbf3c881a84552f04a16eb06f0f3c41c1e56e7abd0d40a9cb
TLSH
T16711E670F0B5D853F1322C876329EA870CE82F9F5C58AB88230C921C7355C7D9E158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-64-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/3840-75-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/4828-0-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/4828-7-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/5880-33-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download