8d4eb59a355accd99ec28dbabd28cf7d86bf467c9043b5f3accbb74aa3b6444d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 10.8MB
Sample260909-b82mvsae87
SHA256 8d4eb59a355accd99ec28dbabd28cf7d86bf467c9043b5f3accbb74aa3b6444d
MD5 50179b0117ae2948d43a7689dc497ae3
SHA1 a42663e21a34e21f60077570f3262438a3892867
SHA512 07f119949bc776636d6b8094a15620dc31b8e45d241c38f92bab494f2c98709a2389927f574255c39589c461fab3b63716a031f91f40cb4e4e68fcf61cb92264
SSDEEP 49152:U+ES+ES+E2+ES+ES+Ey+ES+Ed+ES+ES+E2+ES+ES+Ey+ES+Ed+ES+ES+E2+ES+EY:h/fh6ImzzJoDfuBcMv+A73XA9
TLSH
T155B65B05FD8744B1D91B51B04DCBE3BF8630BA1583228EE7EB4DCB5BE923BE15825216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
2972	svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
4260	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCBCCBCBBAACCACACCBBACCAABBCCAACCABAAAAABCCCAACBCBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe"	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABBBCBCCBABABABACBBBCAAABCCBBCCBBCCBBABBAAABBABAABCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe"	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2844	sc.exe
3476	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
228	cmd.exe
3996	cmd.exe
400	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
2972	svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
2972	svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
4260	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
4260	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
Token: SeDebugPrivilege	2972	svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
Token: SeDebugPrivilege	4260	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3568	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 228	5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	107
PID 228 wrote to memory of 748	228	cmd.exe	109
PID 2284 wrote to memory of 2068	2284	svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe	110
PID 2068 wrote to memory of 1108	2068	notepad.exe	111
PID 5048 wrote to memory of 3996	5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	115
PID 3996 wrote to memory of 2844	3996	cmd.exe	117
PID 5048 wrote to memory of 400	5048	2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	118
PID 400 wrote to memory of 3476	400	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_50179b0117ae2948d43a7689dc497ae3_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCABCCACCBCCACBBCCABCBABBACBBBACBBACCCABABCBBAACABAAAACCBACCCBCBAACACCBABACAAABCCCCCCCAACAABCACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCABCCACCBCCACBBCCABCBABBACBBBACBBACCCABABCBBAACABAAAACCBACCCBCBAACACCBABACAAABCCCCCCCAACAABCACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAABCAAABCBBCCBCBCAAABCCAACABBAABBCCBABBACCABBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe" start= auto displayName= "UserDataSvc_AACAABCAAABCBBCCBCBCAAABCCAACABBAABBCCBABBACCABBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAABCAAABCBBCCBCBCAAABCCAACABBAABBCCBABBACCABBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe" start= auto displayName= "UserDataSvc_AACAABCAAABCBBCCBCBCAAABCCAACABBAABBCCBABBACCABBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAABCAAABCBBCCBCBCAAABCCAACABBAABBCCBABBACCABBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAABCAAABCBBCCBCBCAAABCCAACABBAABBCCBABBACCABBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBBACCABBABCACBCBBCBABAAABBBCACACBCAABCCBBCCCACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e922d5bc3172e909801b472e8a755c1d1903e4ffb7c998743bd35882a1de9fcb
MD5 de43657eb82aec1eb5780101012eec91
SHA1 f10f7c4440f689ee8d61eb81f274c3cae3a77289
SHA512 fabd292655ccdf817e0664856cdd0f14e212d7dbf78cc3433784d03c81c079c9e5f4f819faa13d6247d6ba3d276c7392234e4ab3fa41b031f587681f618c7bac
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.2MB
SHA256 b8c0d71b8dace60fb228a0729ddb5eaef774d7af698d17d1d9e475b82659449f
MD5 cffda233090316fcaefebe4ab81c5a8e
SHA1 f8ffcae022f3fbc10a2df8e4d7e42a94d2fa59db
SHA512 1972b5f591cf428efd66a1d3581530845fcd8133e699ae0dae59ef9e95d96cb5420df3ceb5a359fb84e1a9b584ac7ff8fe799ac58d9f139a20b874ad913e10a8
SSDEEP 49152:U+ES+ES+E2+ES+ES+Ey+ES+Ed+ES+ES+E2+ES+ES+Ey+ES+Ed+ES+ES+E2+ES+EK:h/fh6ImzzJoDfuBcMv+A73XAapid
TLSH
T194C66C05F98740B1E91751B04DDBE3BF8630BA158322CEE7EB4D8B5BE923BE15835216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\updates\0\qap`g`v~dtlq
Size 10B
SHA256 df883b2d18ee4a0b68eaf36854ca8bf2ecad030256926db90d7531755c0b128d
MD5 36cf298eb4653d343801a4c89d14ee86
SHA1 08785e724e641be92019280397f23778095afc63
SHA512 92df774604a48e6089d8272a3a26e2b7623a0baf6d57109514a3fe603bd1c2eaef40eb5e0c33ef99d5e721bd3336eb0396aac36507a27098cb1dd54c6ed4d782
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 50104126de453fbf09759fb4727d1556dec04292c9f1391ad660e39ddbe7e784
MD5 352e43d1cc87d8ae662fb4d42318ee84
SHA1 35b1ddb6508db59ac29df9da174061d2ce80d0ac
SHA512 840a24b91b32df7dd1fd69bf84190860328dd67952bb4354d38f5dd3ddbe15f60c1a45978ec0b78de08602227b76c8b79734eda5f2fdaf304fdbed98651e6d1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed3ea66d2e2884bf79c29043b96b2296f4aa63a9cf26b0faf0373b392b985315
MD5 ae5cfe51fbb90435eef38468d9257c6a
SHA1 bdcaf62246662188635627e9c03b8abe84df3b3f
SHA512 8a450bb98fc0c145861bd0bbf04fbfdd0ae3d6f18706107c812b8700ad052035369007466defdb74101c466f012c48b9e16cdbf06ebe71004f9fdfdfe029ea50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64ebbf2d4655fc7f28a55562f476c5b41a19803a8b17806d507c9684f2143aec
MD5 7b4296b5c87d140f40c5c987a62ac501
SHA1 ad15f458bbc6bd21ca8ceb7d8a442143663a8dc9
SHA512 adc60c1561fcd2076ed4b5f5d08ac06ecb9746edd08ed5d94c5947ac513f4bcd426b378a85b38142d15b815aff6842dacaaacee13b835a1247e5f7b57fd39a7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d471e8a50e2a618aa2cabbb0f16d24336e2f6537828c9553ea895090e4c9d070
MD5 d00b71df80274caa9004cf104a5926b2
SHA1 d037ae855b3ce4eb0305453b4662a6c845fde130
SHA512 b7ad329f61d9fb3e6117bc0bfbe7c684c79a9496d7cac5af5f5c31ecdafd0f30abe06e5341c42b2398b9b4257fcb0173180381e7e2666f79497e7ea10e25d742
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 863fcdd169da136b43ac48650fb3b0bc29de92fbd69ad39e4870a286052832d0
MD5 91cd26aecb5d7decafd67e1049b8d708
SHA1 0a4aad5531f621ae4ea4a8a2694bfebee5a96113
SHA512 b8b88d7f23bc4750dcb5849d191a98446a566d09df6bfb7fca41b4553643c505b1dfc4b3289b395df44d1f15bbab6e280b1f5e8aaf131bbc3043d5fb7f6595b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0f9b9aa0e8debabd6b7f51690e89543ad40384f9bc4c78eca984fe3ee1a8df1
MD5 2853e6d39a89dec040da5d73e1c0dec1
SHA1 9675cefa129f8e248c786aae144da08a3b344673
SHA512 641f23ff88ac92c9f95280d0c31f605566de4d835f95e2063cf94c919268c9e813839d0ca2db5d570f95a1b9488fe325ef4322b79ce7bddb193a83c7a68975b6
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBBBCCAABBBCABCABABBAAACCCBBBABBBBBBCBBAACACABACAB.exe
Size 10.8MB
SHA256 8d4eb59a355accd99ec28dbabd28cf7d86bf467c9043b5f3accbb74aa3b6444d
MD5 50179b0117ae2948d43a7689dc497ae3
SHA1 a42663e21a34e21f60077570f3262438a3892867
SHA512 07f119949bc776636d6b8094a15620dc31b8e45d241c38f92bab494f2c98709a2389927f574255c39589c461fab3b63716a031f91f40cb4e4e68fcf61cb92264
SSDEEP 49152:U+ES+ES+E2+ES+ES+Ey+ES+Ed+ES+ES+E2+ES+ES+Ey+ES+Ed+ES+ES+E2+ES+EY:h/fh6ImzzJoDfuBcMv+A73XA9
TLSH
T155B65B05FD8744B1D91B51B04DCBE3BF8630BA1583228EE7EB4DCB5BE923BE15825216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 880d67b709a5466e545de9e91e164a039f45334616dcdf4e7d755deb5b21e882
MD5 78ce9d07df70ece0ac79a5fe97361234
SHA1 6494df2b5f3c69d974e0ba0cc0c878caaefa9f16
SHA512 eaeb7da02258b6b07be3ce36a85525a8abed3537a21ec1690e450d40cb3d084aecb7b031b24f48f250e696845b420173c8a8d624a670a8acb3bb4207ba50ca27
TLSH
T199110810F0B5A843D031F88B661DDBDF4CA93FCB2898AB04134AC108A789C758D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0fdf724c78e4c297f5d817e991bdbbf33966f768895f2bb3d1468f0ff957806a
MD5 c17bd00808c0b003c2b2883314e91901
SHA1 189a57a83e53f3ef24a35d8042bfb87d50235c96
SHA512 830af6e644800a3f2f8331a2764c7bcb4e487eb95643118adc0a07ad76d5450b02965b65011c12554b717ee3e2bd7cb81acdcf19b32ad6f6b73b26e70e4de972
TLSH
T11E21D450F0B5E853E032F88BA31DDBDF4CAD3F8B6898AB44134A8118A799C75CD190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2068-58-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/2284-36-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2284-26-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2972-78-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2972-123-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/4260-89-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5048-0-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/5048-7-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download