8faa5beee1b8bbeb2852060d6bcfcc71fec91758fceca0573436a73095e4d0f8

Analysis

max time kernel
149s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 13.2MB
Sample260910-c45dmadl2w
SHA256 8faa5beee1b8bbeb2852060d6bcfcc71fec91758fceca0573436a73095e4d0f8
MD5 cdd691f46a0b62f778411fef911754f4
SHA1 a2f1b47b40958abe0bd7463d050bbe4f697261b5
SHA512 60caa4f32f86239ebdada5d184a93c609b88b9d002acea02a92d7d944002426ee2bb9c239c93902b2251da7af2a6b082b0dc70d4559be8be51c7f9454fc50519
SSDEEP 49152:U+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21k:N/fh6ImzzJoDfuBcMv+A73XAX
TLSH
T107E65C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
2744	svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
260	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCBACACCCAABBCABBBAAAAAAAABAACCAAACCCBCACBCBBCCBACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe"	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAABACCBBBCCBCCBBCBBBBCBCBBCBABACACBABABABCCCBCCBBCBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe"	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1672	sc.exe
264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1096	cmd.exe
1612	cmd.exe
1712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
2744	svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
2744	svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
260	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
260	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
Token: SeDebugPrivilege	2744	svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
Token: SeDebugPrivilege	260	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1096	3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	93
PID 1096 wrote to memory of 2848	1096	cmd.exe	95
PID 4076 wrote to memory of 6992	4076	svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe	96
PID 3756 wrote to memory of 1612	3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 1612 wrote to memory of 1672	1612	cmd.exe	101
PID 3756 wrote to memory of 1712	3756	2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	102
PID 1712 wrote to memory of 264	1712	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_cdd691f46a0b62f778411fef911754f4_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACCACCBCCBCACBBCBCCCCACBBAAACAACACCCCABBBCBCCBBBAABCACACACCABAABAAABABBABCACBABCACAAAABBCCBBABACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACCACCBCCBCACBBCBCCCCACBBAAACAACACCCCABBBCBCCBBBAABCACACACCABAABAAABABBABCACBABCACAAAABBCCBBABACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAAACCACCCBACCACAABBAACBCBCAABCAAACABBABAAABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe" start= auto displayName= "UserDataSvc_ABBAAACCACCCBACCACAABBAACBCBCAABCAAACABBABAAABBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAAACCACCCBACCACAABBAACBCBCAABCAAACABBABAAABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe" start= auto displayName= "UserDataSvc_ABBAAACCACCCBACCACAABBAACBCBCAABCAAACABBABAAABBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAAACCACCCBACCACAABBAACBCBCAABCAAACABBABAAABBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAAACCACCCBACCACAABBAACBCBCAABCAAACABBABAAABBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCAABCBCACBBBCACBBAACCBACCBAACABCACCCCBACABCCCAAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 74e6b4a50b08d27285238d1238804e029ba79e50d7e6ddc8625159285475d73f
MD5 aafab80fdd4140acca89d89f24163462
SHA1 194802d15535e07a2092cdef09d9001435eaf744
SHA512 c9e57f691bf1be8344a23850580b5fdd60c53139301a1d07e55f84f28601dd00e062c6e987d5ab81b44c683336adf60e17ea6701e2d48d70c28287b838103fb7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\MF\qap`g`v~dtlq
Size 10B
SHA256 0bdca0f72f01cdfb4ff540bad7a4ebe93888794d81347d49e637231fd6f16f1d
MD5 32c55146c1c7aa4fcd3b55598b53905b
SHA1 5f8e36d839574dee4b4ec6ad2349413799f55455
SHA512 c5e95ab849e82969f95e831df0ad5f753530ba4ece7ee387b4cca7e84352bb62caa7da1889c646168de5d86542fecdd351a9c96d536e6264aabeb03d499dfaaa
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.8MB
SHA256 f180d8a6409c8c60e7232b2ea9b1ff07cf048b9d23e97598b3e672cd5271579e
MD5 f809ef1e04eccf63c90215829306280e
SHA1 dbd3fc75cb420f53c244a62e303f04ec83fd03ce
SHA512 7dd2f365677b7f9e646fc06f2156623f620d8a8fad4bacf0d0cd84f511484db749c55061fcaae9335a137648cc19ad4c4f7061d2f1284c038ba6463bfd057006
SSDEEP 98304:N/fh6ImzzJoDfuBcMv+A73XAKgZ2Hb9t+2xg:NHh6ImzD+FKgZ2jg
TLSH
T1A3E66C05F9CB44B1E967517048DBD37F8630BA158732CEEBE6488B2BAD23BE15835316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\qap`g`v~dtlq
Size 10B
SHA256 d298c5e2a7a72029e8ae354cc3f9adf7df47d4957675b4bb76510dadf471effa
MD5 98e7ea5222c245f428c6dc276e7b8e95
SHA1 e367826b090231eb95bb27b1353e9aab34edba65
SHA512 62426f460791d5e4134db6f95e7298266879ec6f8b18786a02b1b7c4055542b27abb25136eef2c9a1584e63a0afe77b137b80cced61da5bb2bd8c5b5c379e6a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 e1d747e6b1fbb9677a4afe4e787ec52fa01d4ba404f93071ff418ea12f97215c
MD5 23116b3a2c96bafa04993b9d9d4a4464
SHA1 7f883c9be4df089bf0ac2a2e8f88c0ad31e680e1
SHA512 58eecdf27f085fb4a527211fbc0ff9820898ad6229ecb91e0011bb8ca94aecbac7ed35e8d190b36d83bab12b54015720b392e0de02ef4604c135c98d6d48c002
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25270260f2abfb7ec2d3388bdd279470615172be8ab7435aa28a6b2e712fdb30
MD5 aedfb36e6a7fdcdb8583666e99cf9f6d
SHA1 d92dcc26ca0d18d60f42a6202a070d57b669eb02
SHA512 04172614cf43f76c4f244878b34ff3f44a03725c0afb68e475066a7a1d2454371be64437bc062ef968c4600dc45d04aa54e43a9bcf342afe425545872f948d9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed36cfff458a793567e5cb9ab2296e4ba84b7783150221379d701191ddee910e
MD5 7d381854231aa90f49e51bf1349e4eb1
SHA1 edceabd35f0e9ff5b939dd44361df90c031d853d
SHA512 8d156b67abf22178e825e42db03e421d6cf0d151369cc17c9a76ea0284972e4cc2acef69aa3da19f60bf60701d7beaa9c5b08bd924e3e8a24d1832026e1a8cd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86390067d77ca4194ba917fa6a75d6254c845e5aabdf42351509c774259d836f
MD5 b7f815f1c6de4955b7403d55bde82749
SHA1 42ab9a255d1934bd582239e334b2bd85f3f9668c
SHA512 9d392f3c84be5a9d76da51354e1609bb2e9fadfe89ff86f1f97f6ccd370bdb3734ebb048ad37bd5889c752895ce7da2f111d9c2ec67b9f4b3df8c73f02fcd768
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c14993dda829e79fb1a9c5e889ea5da53100ac4ed5df8d90b82f3315599b07ed
MD5 7f1b4649968f096b1288bb217e428128
SHA1 26518fef3384367de0859965e3b5751ad23add4f
SHA512 adbdcb431998e1a2c03066f1e6d5a6468ac72856c71b27722f09d52dff8d6fde26ed6c0a187344ec32cfeb4bb650bd6af0c7511962af665a923908bc7c30cb1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a3bfdd10f68368f88853a86758c5e3710634fe4b591e26c2aaa6cde4be5a173
MD5 13792d59e1f7a3fc3cf9b6d403912c7b
SHA1 648bda7ba5262ce44239f67dde465d979bb3b32c
SHA512 a0313c2ca6bafda184ad90fad3d83874dc316f0a3c7f1d03940ed92356e23f0435898a4b84a852d17f3a5c18fddc74952e19ec6cc849d6654918ec570aad5d74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c62352dd97fd22f7d613bb40a79c17b5f2c2407efcd36509f7a3979f51246827
MD5 80c04ea5dae19cea44e33f71cb48f76f
SHA1 95da71ccd7cf3e305371d940e21143b8e457edf0
SHA512 47d9d7259a3b840c028f4073dd05750589e095f755027136a2c5c6428a70e87c1561d72d94383db69d21c71d11bc4b2e1061988d9892b4a8a40f1b6289a4f3f3
MD5 SHA1 SHA512

Submit Download

svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCCCBCCACBCCCAACCCAAABCABABCACBCAABCCBBBAAAAABBB.exe
Size 13.2MB
SHA256 8faa5beee1b8bbeb2852060d6bcfcc71fec91758fceca0573436a73095e4d0f8
MD5 cdd691f46a0b62f778411fef911754f4
SHA1 a2f1b47b40958abe0bd7463d050bbe4f697261b5
SHA512 60caa4f32f86239ebdada5d184a93c609b88b9d002acea02a92d7d944002426ee2bb9c239c93902b2251da7af2a6b082b0dc70d4559be8be51c7f9454fc50519
SSDEEP 49152:U+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21k:N/fh6ImzzJoDfuBcMv+A73XAX
TLSH
T107E65C05F9CB44B1E967517048DBD37F8630BA118732CEEBE6488B2BAD23BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 913486f0e75af9e53d5f7340de5faf35ab7e6db00b0b0283f6d885f59a0b6171
MD5 5b9663921b4473a37a6cfd1fec2ea079
SHA1 18905cad0de27cb87035dffa448da6080d4ef90c
SHA512 e6d4f59225985350ba801df021105f2db6861fce4f4049962702118753b7e9498786d223dfbc14f180625525a72b5cc33517be0b650212375ca55da098e653b5
TLSH
T17A11E350B0B59463F121ACDB6925DB7B5CE1778F7CA4AF2422084618FF61C3ACE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6e58b13540de3c339f8b8923e42b0f71fb7b7d787d2142d82cfd57f7c8b7ae79
MD5 c1d4a6797220b9340354cc2445ebeef6
SHA1 fea1d4c9ef04e874ac78342228bdab4b5dde8ae7
SHA512 385e49865d9d5c5216fa289cf1417ea8df5e02fbd38f4ad6899caf13edbf40be1f60cadba5269c3cb1ae24ec84224a5db947bb0cd9ae5b40ed67ca562ad496a4
TLSH
T1EC21C650B0B5C463F121AC9BA925DB7B5CE1778F7CA4AF1423044618FF55C3ACE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-81-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/2744-79-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/3756-0-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3756-7-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/4076-33-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/4076-23-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download