530b3a8031ffea7bd27b200d951c6f4d36c41b730d557bfe964966d4c5182fd3

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 2.5MB
Sample261024-svjcsscv3j
SHA256 530b3a8031ffea7bd27b200d951c6f4d36c41b730d557bfe964966d4c5182fd3
MD5 40b46caa59a88e846e4d9ecf977e51f4
SHA1 3e4bafd5601593caa4ed750a7759c8b0cbc99c86
SHA512 90a6fecd2a88ffa056eff89fe7db63adf54246ce43cf13e045b7a4d82edc154418dacb48eb0c89fd32c12d30fdf676b460786baf892153e7d302f5fdc63fe90f
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecC:jJ690d1Qy
TLSH
T1B8C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe
1244	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95e0d954.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a58cb85a.lnk	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\12aef8b8 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\5bee96de = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened (read-only)	\??\PHYSICALDRIVE0	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3152	schtasks.exe
1588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 3404	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 5240 wrote to memory of 3152	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 5240 wrote to memory of 3308	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 5240 wrote to memory of 4552	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 5240 wrote to memory of 3408	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	97
PID 5240 wrote to memory of 4960	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	100
PID 1504 wrote to memory of 1588	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	103
PID 1504 wrote to memory of 4224	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	105
PID 5240 wrote to memory of 2928	5240	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 1504 wrote to memory of 1800	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 1504 wrote to memory of 1244	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 1504 wrote to memory of 3060	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 1504 wrote to memory of 2744	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 1504 wrote to memory of 4108	1504	2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3408	attrib.exe
4224	attrib.exe
2928	attrib.exe
4108	attrib.exe
3308	attrib.exe
4960	attrib.exe
1800	attrib.exe
3060	attrib.exe
2744	attrib.exe
3404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Adds Run key to start application
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\4a5b8156.tmp
  2⤵
  - Views/modifies file attributes
  PID:3404
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn 9f1fe15d /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3152
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\81b565cb.dat
  2⤵
  - Views/modifies file attributes
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95e0d954.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\f16bffc0.bin
  2⤵
  - Views/modifies file attributes
  PID:3408
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\7589790c.log
  2⤵
  - Views/modifies file attributes
  PID:4960
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\9bc3ed5c.cache
  2⤵
  - Views/modifies file attributes
  PID:2928

C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
1⤵
- Adds Run key to start application
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn b99d3cf1 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1588
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\97e8ca04.tmp
  2⤵
  - Views/modifies file attributes
  PID:4224
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\a382ba5d.dat
  2⤵
  - Views/modifies file attributes
  PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a58cb85a.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_40b46caa59a88e846e4d9ecf977e51f4_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\81955a35.bin
  2⤵
  - Views/modifies file attributes
  PID:3060
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\119ff146.log
  2⤵
  - Views/modifies file attributes
  PID:2744
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\799b141d.cache
  2⤵
  - Views/modifies file attributes
  PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81955a35.bin

Path C:\Users\Admin\AppData\Local\81955a35.bin
Size 2.5MB
SHA256 9e3073a15548835d17ba9f25deceadcfca2e32bdc37f963f2e9dd0abeb172b14
MD5 2a01347a3aac023b27b6d6d21cf250b4
SHA1 92b3a7d6864fdee4b3955a8bcd4bda3bd9fb8249
SHA512 a9a029a3734385ec108bf764d729901fd2055b48f4631975e307a0c9eda9f98dba005c2c55f27dcfb203efe5d076674f6c606bee9cea074e525c79656b0b448a
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ec8:jJ690d1QM
TLSH
T143C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
MD5 33f7a6fe6a1ea0bc7232e4b50743aaab
SHA1 f6389fac11178ade648f5f722858ade7790e8676
SHA512 64fed57e8e59a8d4c52029e5b9a9e95959a860dd2b01f96eda9e0484d0ae4572a4759db8892bacc9ddc3f3b2def74d2f9da00853aedc08b55520c731ed45658a
TLSH
T12C115733F3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

119ff146.log

Path C:\Users\Admin\AppData\Local\Temp\119ff146.log
Size 2.5MB
SHA256 cfa6eb6a529c777ac216a78ff5bc9a3c5c8b92e99637ad35876ad3a9465e455b
MD5 fc7911848dbc98ec406a5a575493a89a
SHA1 6e9b0ae71e1a142b898f0b8b703d2573ab30b530
SHA512 74f206f47abe4a806a93702dd7feaa4d7e63887021a2efc117c33b584d713dc3d3aa32d5a5525f9cedf9dd434e9f1023543911dc061de90c4d55ca0ce9c639b4
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecp:jJ690d1Q5
TLSH
T1FCC55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a5b8156.tmp

Path C:\Users\Admin\AppData\Local\Temp\4a5b8156.tmp
Size 2.5MB
SHA256 c372b819271e1c93eb4a1df05c9ac9e31a29e2f4dbf3839d4bf90fc3d794cfde
MD5 95f14451d1016fe0e80f1afa6d17dcf4
SHA1 1f95ba8b636dd78063fd7ce7f810e8a91a5651b9
SHA512 0fb73684ae9f96b9a06bab73b9162303f49fc086b2171797926040b5bfcbfa8fa07f3abcf0b2ab0a15d11d6ed9e5b37fd4412377295827c29e490c0a67b4cc1d
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecF:jJ690d1Q1
TLSH
T11CC55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7589790c.log

Path C:\Users\Admin\AppData\Local\Temp\7589790c.log
Size 2.5MB
SHA256 370263cad078fa8832e5670c1dcef1529f24b21750e9215a7ced5aef4b16bb80
MD5 0f8ed5600f64932138e074b72422694f
SHA1 10e5864281a0023a8265e01082ddc2d05500394d
SHA512 3bccdedca49e6b87b39fd849ea17f4b6e419b2d371e7cc3d183d8c9928e546715408a0b0f0ac169f7c8d3e94464b23510f6b28dd003ce16df63a3f10b3af0bee
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecq:jJ690d1Q6
TLSH
T1DAC55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97e8ca04.tmp

Path C:\Users\Admin\AppData\Local\Temp\97e8ca04.tmp
Size 2.5MB
SHA256 5bd22bd8cf769d9f4b52318e798ccf0ec5f2d853951fa330b2b2f0cb1921cdbc
MD5 3378f37d7d566f71834573a1d422a24c
SHA1 58cdb682ef4a1cc855b573188ab003cc4d590699
SHA512 c6ff6b745632ce045dfb46e645f6375d27f2579c94bd21433f84d8fdf3e8aa4089f56b4dda329f45a213bc1f847702292a10bce25e4ec8f5f4ca80ef0e121f6b
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecd:jJ690d1Qt
TLSH
T17AC55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_me1otajk.nrd.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_me1otajk.nrd.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f16bffc0.bin

Path C:\Users\Admin\AppData\Local\f16bffc0.bin
Size 2.5MB
SHA256 1d2c13847b4e121ec70ba2bb0976bf2275bd466c65e5bfd030c22a97f451b6e9
MD5 c8262823d2277fe9834109284c124cb8
SHA1 bd7396909749bfd2e9d007eb8787eb28d5576d48
SHA512 8f4ce686b39b5d99a07774fe82181a74f55ac3d70c1132f5be2390e20df2ac6e73660021d13571fbd7761cceb949bdb674607a89ba56deb1495695748475704b
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecv:jJ690d1Q/
TLSH
T1FBC55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81b565cb.dat

Path C:\Users\Admin\AppData\Roaming\81b565cb.dat
Size 2.5MB
SHA256 fea9755015210c5d56bc4e525751be2ca4b59d7d8db460d49606d849d6f23cd8
MD5 bdce115044ce2f51d2e72d82ee2c5037
SHA1 a323b9d856a2db7207ce57df41d0a0b2a88d1117
SHA512 ab5403040b2eea75d6880fab4e2cdb44a29cbed857b6a67b9dde1e3fdec8a3f6db6cfc4381c4400f3ad8fe9e6907e39341953186a4cf7619901630c7674ca210
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecI:jJ690d1QY
TLSH
T1FAC55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

799b141d.cache

Path C:\Users\Admin\AppData\Roaming\Microsoft\799b141d.cache
Size 2.5MB
SHA256 5a062689c913375d129011ba8cdd8d48a7b756bb1efa08168e8b636e1b2eb54b
MD5 7e2b3a37c6b938484a7715cabd8c440a
SHA1 b52de2be545a60dfa4932270cb5c40a4640c4bd9
SHA512 7de141adfba8a325b90834f07acd929d42d81311f5ab0fb913975b6a10046f4916e3f36b248e3d59d5a8783aadcddf61ff8000f91922731b2200042015069421
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ec2:jJ690d1Qm
TLSH
T117C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bc3ed5c.cache

Path C:\Users\Admin\AppData\Roaming\Microsoft\9bc3ed5c.cache
Size 2.5MB
SHA256 7f87f62111a219bc81e6b4332b8f5f79a44605664b9b747d8e60af01a5eed030
MD5 bc14e33cc12fe6e837a1b2a082e33ccb
SHA1 221fc29ff65af24f67315e1244d926ddf6314cc3
SHA512 18fe52d36b72d3d91de002eebb2f3c37caf2c54c3e0e5d32f8a71a9ab7b5d819ba2e2d98f612f3d1494daa20373379204091c22b78c394831d561b93f28d93d1
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0eco:jJ690d1QY
TLSH
T105C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a382ba5d.dat

Path C:\Users\Admin\AppData\Roaming\a382ba5d.dat
Size 2.5MB
SHA256 659e5e83a2dc523fdad636bb07cf5fc7bc9d83cb2ff3c231f4fe1683db118d1a
MD5 3348de6a3e55973643a873e550806317
SHA1 bb32fb5d75dbc38c463be170888c72dbc424707d
SHA512 91558a2cad54ad7bc052d287432c6ec1bcf07ffe32da9ba3adb15ecc3cbf6adf3ad65cd477d7020eb894e17ca40a324ea1c57a28b7baa8d5f50a84578b04f20e
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ech:jJ690d1QR
TLSH
T159C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4552-9-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-17-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-24-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-18-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-12-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-21-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-20-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-22-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-32-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-15-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-11-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-10-0x00000192AA440000-0x00000192AA462000-memory.dmp

Download

memory/4552-8-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/4552-5-0x00007FF89FD7F000-0x00007FF89FD80000-memory.dmp

Download