77967e5fc2db7214e164ad54f4e8ff64ccd1a2f25b54209ccf660611fbedbb8a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Size 4.2MB
Sample261004-29pb2adf52
SHA256 77967e5fc2db7214e164ad54f4e8ff64ccd1a2f25b54209ccf660611fbedbb8a
MD5 e8cd13eb2c592c8194fab48ae34f6464
SHA1 b2131a96297d56b18cd47c1f2ed0f0a50ff0df42
SHA512 4c544cb5eefa87294e44960785b99c3573d0318a7f6f056234215c7ba1d5f7e2e3cf8cf1b3410a2c5e8d5a4acf8d551283f0bd54149f6874d8cc0918e5fccd2e
SSDEEP 49152:U+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+o:Up725p725p72CZq
TLSH
T119268E01FA8180B2E477017149AFD37B5A75B9214F258ADFE38C972E6E337D0AA31716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
3368	svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe
1876	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACAACBCBACCBABBCCCAABACCCACAABCCCCBAACBBCCCBCABAACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe"	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCBAACCAACCBAACBBACACBABACBBBAAACCBBBBCCABACBBABCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe"	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4812	sc.exe
4348	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2120	cmd.exe
4384	cmd.exe
3872	cmd.exe
1840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1168	schtasks.exe
5608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
3368	svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe
3368	svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Token: SeDebugPrivilege	2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
Token: SeDebugPrivilege	3368	svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2120	552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe	93
PID 2120 wrote to memory of 1168	2120	cmd.exe	95
PID 2284 wrote to memory of 1264	2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe	96
PID 552 wrote to memory of 4384	552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe	99
PID 4384 wrote to memory of 4812	4384	cmd.exe	101
PID 552 wrote to memory of 3872	552	2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe	102
PID 3872 wrote to memory of 4348	3872	cmd.exe	104
PID 2284 wrote to memory of 1840	2284	svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe	106
PID 1840 wrote to memory of 5608	1840	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e8cd13eb2c592c8194fab48ae34f6464_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABCCACACACCCBBAABCAAACAABBCBBCCBABABCABAAACABCACCACCCAACBBBCBBCCAAAACBABCACBAAABABAABBBAACCACCAACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABCCACACACCCBBAABCAAACAABBCBBCCBABABCABAAACABCACCACCCAACBBBCBBCCAAAACBABCACBAAABABAABBBAACCACCAACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCAAABBBCACACBBACACAABABBBBAAABCBBCABBCABAAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe" start= auto displayName= "UserDataSvc_CBACCAAABBBCACACBBACACAABABBBBAAABCBBCABBCABAAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCAAABBBCACACBBACACAABABBBBAAABCBBCABBCABAAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe" start= auto displayName= "UserDataSvc_CBACCAAABBBCACACBBACACAABABBBBAAABCBBCABBCABAAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCAAABBBCACACBBACACAABABBBBAAABCBBCABBCABAAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCAAABBBCACACBBACACAABABBBBAAABCBBCABBCABAAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACBCCCACCBBCCACBCCBBAABCBABBCBBABBACBBABBABBACBBCBBBACACAABAABBCAACCBCCCABACABACCBAABBACACCBACBAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACBCCCACCBBCCACBCCBBAABCBABBCBBABBACBBABBABBACBBCBBBACACAABAABBCAACCBCCCABACABACCBAABBACACCBACBAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAAACACBAACBBBACABAAAABACACBBBCCBAABACBBCCBBBBBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
1⤵
- Executes dropped EXE
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81994b4ced36b475df7966c8c83febc2657b8fde6a3a64371b85a28e7a7200fb
MD5 9a56a50e6d65557e943bab0332ef7e06
SHA1 343988d2368aa8d47da94e031c33c081a1f07bf6
SHA512 d2519a7c6031f24302f5ea2be90212623383b252a2b8a020912ec7f9ed7042923bebde7b6fd181ace8d8f02efe17b1493c60f0bddf9d88ca114d4662ad35f0da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9cc58287a85ca1310c2129fa6fdd9d8e69fc883cd8dd6b8611508e154695efdf
MD5 a0d5af95e0c2f328f37c60de7d029f48
SHA1 2cd634938a0d8777bd4429dfaa85d2a36e6dc8c2
SHA512 6ca83d1f43175af8e6eb10fb4754b25a237cf341c60a8b7f2fdc8d33e36bacd0403809e963619cde140d0bf38585ba82e56f7378d1e85b1fe3a0b27118127f59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b2fc7a3b53b59d79a2ed331509acd344e6d26d35c7c7cbba241fde14ba53d2c1
MD5 655fb8c7b7f2c00505420dad3578fe32
SHA1 0a1ed5e15e43371faff153f08d3ab3d0a279d4f7
SHA512 fb4919609518fbf2337f4d5dab6f7f1989f4bff4c138e28d2654ff5cda001a6090063013ddab357cbf8138e5347c0328966d284644ffd4483552ad55a139c3a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85e615042e322f732f6db0dd1945520fa1898dc1dd0d8d17f5650b2afb99094e
MD5 287af7f55668daf3c101087d984f8248
SHA1 16ce3da6e47ec2802772c0fd54781040450821fb
SHA512 112fcef37bbff81c9eb0047a35c7a983502d4e7f3d3a6ca8598187d3410a7c284c70745ac807e720d8a3012755cc493b525494f5c1fa76c323d7a6205ccd8683
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 576eabca0d4466455ea1541138e075b5b64915792d34dd2998dd9f4842e6c84b
MD5 13eb88ed8194b0cb80fbc7765a0c9146
SHA1 338cfcca6cc31a44ef5d28cb4119a2e01e2d9f1c
SHA512 8a3a334543738059d470e8151ac8b286822d921d400c2cda67302af15e1c6c129142e6d3ced9ef56d0d17fdd6454d3c654f8fbb0e1391d33a3bff3171d85ab97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 495691e2a3b57f4edeb29c525358597946405beb8aeef2070f3ccebbabaa89f2
MD5 64ad798e68c0918f9dff609af907aec2
SHA1 75cce8718112ebb3f09792fd803efcf60d8146bc
SHA512 87bc3f27ca944b5ae49c362ba5699089e215af21907302deb806cb0044edfa93052c7d3af652101973e1fe9cb42eaf5ce6fbc1d5f04b3a1771c5ef162732a985
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 683aeed7b104327c46cccfaa0e5810b015c0887e96452f3e19c41145847fcdd2
MD5 17d63b2da5609898843cfccc1eed8c87
SHA1 cd711267ecd993419915bd3e482520e49f43c756
SHA512 6da66d1ef79f16ace885dbe5204dd241319e5ec0d480100d3fbdc3bc935831e4bf827e04cbd69b239c8d759ff9a23b6bc6bf93d49291b25dd8f02576c4ebe58a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7a73a2570b2d59a440324c74800ad39bac31c164b98cd9496259149732359b27
MD5 7989fbc7de72d6c876325bdb8553bf26
SHA1 ed6f3c6116ef87c37ae575aed5bfc99bdc93c8bc
SHA512 ebfc357c33e9cd374171bd8d70a47695ef9663a75658c79008fae9de410207c38e2bc39a92dbeeb2fdeac26817ec2cc94b6424d981f2eb45feca2873a4e97079
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8ad6fd189b939301b7ffce63e735e9d3a3c55b7309899eb7d80d320cd93f5216
MD5 d73e54bbc8cb24efa04a43645313f5e9
SHA1 11239b020762d6a6baaa70f14815321ea427d490
SHA512 4fb42c3b234f70c757e2ac6ad237f44c3020a09afc77971dc9810dd0d36423eaacd12de01fda9d73f73d8a357d0f870750a542a08d8e8a6002a751fcd4e24a33
MD5 SHA1 SHA512

Submit Download

svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABBCBACABBAACACCCBBACACBABBACCBBCCBACCBCCCACCBCBAB.exe
Size 4.2MB
SHA256 77967e5fc2db7214e164ad54f4e8ff64ccd1a2f25b54209ccf660611fbedbb8a
MD5 e8cd13eb2c592c8194fab48ae34f6464
SHA1 b2131a96297d56b18cd47c1f2ed0f0a50ff0df42
SHA512 4c544cb5eefa87294e44960785b99c3573d0318a7f6f056234215c7ba1d5f7e2e3cf8cf1b3410a2c5e8d5a4acf8d551283f0bd54149f6874d8cc0918e5fccd2e
SSDEEP 49152:U+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+o:Up725p725p72CZq
TLSH
T119268E01FA8180B2E477017149AFD37B5A75B9214F258ADFE38C972E6E337D0AA31716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ed0efa1f665b6a9ceed10bdf088822715570ab540af53f9a9e15205184dbd81b
MD5 8caa589302574811fabfc76a5f039a49
SHA1 6629e7ad963bf232468e5847c605af5f353e5f7b
SHA512 e6a237079698d48fab81aab12b0078f352c723253abeaf42c6857b263a108a8663e0810e1f844ff77d5d099d07eed63809ea6dd39b87de78f8f5b58abc4c7130
TLSH
T16311947280B5DC57F43269CF523D9E930CB436A758BCAB986208821C7A9DC31EE154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 522ead3c53c124084225f1b2f04323150b510728f36c6a1d2657404c5f1933f1
MD5 9136175b23653e3d97cdb8c838a60842
SHA1 8f6bf6ba6c9dfd5bbeebffb05da79c5a1bde07ff
SHA512 b33dfe950b54aa2e8c5db441634b7b25a61cd69ea9ed34af1e8bcdd4dcae1b8013b875a4a475e541fe3a20b4396cb4e302fc9680eb324da3f5b09d7011f169c6
TLSH
T108116272D0B5DC67B53269CF57399ED30CA437EB58AC6A4852088318BA9DC32EE154E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-6-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1876-83-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/2284-32-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/3368-63-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/3368-87-0x0000000000370000-0x0000000000391000-memory.dmp

Download