45a3e02348fb9c35f4d86ed6a8b676e74da6d240b8dc4afaafc950ac3ea345b3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 2.5MB
Sample261030-eb2hdaws6m
SHA256 45a3e02348fb9c35f4d86ed6a8b676e74da6d240b8dc4afaafc950ac3ea345b3
MD5 5bd5226be866a7455cb2c88ddfe0d9b6
SHA1 f7a28efbcaf57824f3d216b49b59fab3c1f3a863
SHA512 bc78e48c2b5dce1a566c2bb5b7b780904737c800d6c833cdce243c785bfc683bb72c5775bddcd5f4e416a970f081891ce310a90ba75f053d662a7450c5c41505
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecB:jJ690d1QR
TLSH
T1C8C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1328	powershell.exe
6092	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d09cca8b.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\90383a1a.lnk	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\da5c6e37 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\59c7e093 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened (read-only)	\??\PHYSICALDRIVE0	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5524	schtasks.exe
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6092	powershell.exe
6092	powershell.exe
6092	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4580	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 3332 wrote to memory of 5524	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 3332 wrote to memory of 2512	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 3332 wrote to memory of 6092	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 3332 wrote to memory of 2872	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	97
PID 3332 wrote to memory of 4676	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	100
PID 952 wrote to memory of 2744	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	103
PID 952 wrote to memory of 1452	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	104
PID 3332 wrote to memory of 204	3332	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 952 wrote to memory of 5788	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 952 wrote to memory of 1328	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 952 wrote to memory of 5652	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 952 wrote to memory of 3864	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 952 wrote to memory of 5064	952	2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2872	attrib.exe
5652	attrib.exe
3864	attrib.exe
5064	attrib.exe
4580	attrib.exe
2512	attrib.exe
4676	attrib.exe
2744	attrib.exe
204	attrib.exe
5788	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Adds Run key to start application
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\5d240928.tmp
  2⤵
  - Views/modifies file attributes
  PID:4580
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn 3f6dbc6a /tr C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5524
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\cf67af7f.dat
  2⤵
  - Views/modifies file attributes
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d09cca8b.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\d7da358c.bin
  2⤵
  - Views/modifies file attributes
  PID:2872
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\de70a352.log
  2⤵
  - Views/modifies file attributes
  PID:4676
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\d4969d37.cache
  2⤵
  - Views/modifies file attributes
  PID:204

C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
1⤵
- Adds Run key to start application
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\22ab18c2.tmp
  2⤵
  - Views/modifies file attributes
  PID:2744
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn 12ef0c36 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1452
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\15182cf1.dat
  2⤵
  - Views/modifies file attributes
  PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\90383a1a.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5bd5226be866a7455cb2c88ddfe0d9b6_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\0ac85338.bin
  2⤵
  - Views/modifies file attributes
  PID:5652
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\c23dc5a2.log
  2⤵
  - Views/modifies file attributes
  PID:3864
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\24f6ca61.cache
  2⤵
  - Views/modifies file attributes
  PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0ac85338.bin

Path C:\Users\Admin\AppData\Local\0ac85338.bin
Size 2.5MB
SHA256 4327560228020a1bcc1d8b4e85b8906f45225ac19310f0d585c2b913a69d0cb7
MD5 0ad5aee686878bd891653b0e24935ff5
SHA1 c9d84b8cd8c0cadaa7cb72307180fbb27f1225cc
SHA512 0b78d043422567dfd8250a0559267a9e668a26c56706ba10beb0fb79feac9c35a5de3b017f5ad3c80ce0f1a1da4b5c67b3fc394a1f6e90b6e51f5783c99a5d18
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecA:jJ690d1Qw
TLSH
T173C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

22ab18c2.tmp

Path C:\Users\Admin\AppData\Local\Temp\22ab18c2.tmp
Size 2.5MB
SHA256 1a0741a382574c06d116daddb461d4fd679215fd970f7be5c8180837ef22a6d1
MD5 a8dbdba4c48f9eb61f551f063e1590bc
SHA1 66306bd808244dcb98705e928b860bb9260ec09b
SHA512 7824379dbff1fd3efe33658e88949de6f11eb5af6e2c00e69cf3e4b23209f03416119574e52d8ea28bfbc7a674d35fdd47c1382c0205580aaa16e6faa83675dd
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecG:jJ690d1Q2
TLSH
T104C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d240928.tmp

Path C:\Users\Admin\AppData\Local\Temp\5d240928.tmp
Size 2.5MB
SHA256 befebf2e47dc3f9fce667504c696fd40a7c4dc091891294f9ecdc6cd6c1b646a
MD5 e17080ffdb00281b38499421018c01b2
SHA1 1f10513cb7894bb12125f6331194853abfcfc09f
SHA512 d28ef79129b620d62a4e5acc21ec80439cf49251b18cb4953d214d82218e1a0598bc612602f1f58d9acd60717841dd39b6b1dc042dd59e847301cc5589a66f78
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecy:jJ690d1QC
TLSH
T1CFC55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_na54ujlf.yc5.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_na54ujlf.yc5.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c23dc5a2.log

Path C:\Users\Admin\AppData\Local\Temp\c23dc5a2.log
Size 2.5MB
SHA256 be118e4c21ffe48fb20dc01c6c509df7642ce2ab66011f010a7bfe9daa8963ee
MD5 8016757eb0b810be1c335c0f1bb0ce92
SHA1 6d7a18a640c7bd090862537fceaa4936a1c4ae4d
SHA512 4a119982ae51c0b24a000d79a9858d84a59b0ed4e243ce5eb0007e249e76f8cb53341a07186c3bf4498dfefe322a42505254e9a0e47de7987d4b74770a2a85fe
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ec4:jJ690d1Qo
TLSH
T134C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de70a352.log

Path C:\Users\Admin\AppData\Local\Temp\de70a352.log
Size 2.5MB
SHA256 a1979cba4a36cee9eac646c2e5a955da18888426e12e3689621a173076aef68d
MD5 061c408abc3f27860c70554ea8ec3b3e
SHA1 ee1192f34ed86342a337236a1547d2d3ca88d889
SHA512 adbdcbfb75d30a08bab2f48ad3f82010a25ec2abe1b7031331fbc06e14c477f7e59a03626b81137d5351256ba15930bffb0c09f1b7b01fee580d1c59a5891b27
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecl:jJ690d1Q1
TLSH
T101C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7da358c.bin

Path C:\Users\Admin\AppData\Local\d7da358c.bin
Size 2.5MB
SHA256 511eddbb6c874d851dd46333f9f4ba5d237b37fa9ee215d4e31f9916af7a2711
MD5 87be6cb1038cfc1c76b55d4091630551
SHA1 ac9e6e51e9e01a2e9fcc2153d3d760b30178b08c
SHA512 7900f67056d38907183b7608725739483b474e918e4b3ebf630a2876d1b3de8f8b58d27e106969d0633797f3896dc0347ac5110e13f8013580edccf6abfbe026
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecD:jJ690d1Qz
TLSH
T1E2C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15182cf1.dat

Path C:\Users\Admin\AppData\Roaming\15182cf1.dat
Size 2.5MB
SHA256 344a03dca52ec4190c0ef9c01fd297f3068d8991c9b36091f4d30dc3b92ab9d0
MD5 c1c0f9bfb29780110a74a79c32f36fda
SHA1 09e8620c8fc23ee232a3ac5aa895ea8658367d7e
SHA512 c71d265fd76250df3c1408146d6350955a13c1304174c4761fb2d22f63458585317acaea3b6f70e2cae0ad31d19186ed33ec4c11614de4f379584998a0d6f54a
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ect:jJ690d1Qd
TLSH
T1B2C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24f6ca61.cache

Path C:\Users\Admin\AppData\Roaming\Microsoft\24f6ca61.cache
Size 2.5MB
SHA256 b8f60c20ea66ade46c90b67d7914400f8553abe9b9b4f45f3396f11e36bd1ca2
MD5 527c91b8a5f0810cb74483acf83a6716
SHA1 17fbd247e4a07b1c89758b4031bd46559a481e13
SHA512 97842a30cf34e94661d011f34c59f9051da48bf60c76e637132441601f6a0a3a111bca4b33c7f63610edfe274972791892cd4fcefb2b0c7962d100c219906724
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecZ:jJ690d1Qp
TLSH
T177C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4969d37.cache

Path C:\Users\Admin\AppData\Roaming\Microsoft\d4969d37.cache
Size 2.5MB
SHA256 7d8bc06c6f4b5b5537f67f26f2d2eb03d6ba032db181f30de5d5431fa3c6f3ce
MD5 c13108c8ff368a4d3216cbda96463caf
SHA1 764a6a8f51d9ec492f485bada5af80a44aaf4f84
SHA512 9d0427c8f7cdc74152cdf2ab7c353755890147939c008ce35ce3dc17dc688bd8d8d764f9d1a4b1df813016ecc76db76f6bf57ea1b88ab1a301f6f760496d4a4f
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecg:jJ690d1QQ
TLSH
T1ACC55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf67af7f.dat

Path C:\Users\Admin\AppData\Roaming\cf67af7f.dat
Size 2.5MB
SHA256 6cfb030db0c86f33fbdf713240c102af48b50ffdcc1ff5494b1c17bf0d2b7b70
MD5 8c1eaa9dc68743160af8e1e5b2888905
SHA1 f21d8dc28bcc329d05d365442c8f5c0999ab16ae
SHA512 284c1707a9f9f3971589c79fdee653f620e6d1c3b4db3dd2fa782395b90d702353bd5b5f72c2f63842e6276fe3076d90edeb8c614634610c499eae326a4ad180
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecj:jJ690d1Qz
TLSH
T190C54B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-43-0x0000020113490000-0x0000020113E34000-memory.dmp

Download

memory/6092-25-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-20-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-23-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-24-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-12-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-28-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-27-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-21-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-19-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-34-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-9-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-8-0x000001B33C5E0000-0x000001B33C602000-memory.dmp

Download

memory/6092-5-0x000001B33CDEC000-0x000001B33CDED000-memory.dmp

Download

memory/6092-16-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-14-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download

memory/6092-13-0x000001B33C650000-0x000001B33CFF4000-memory.dmp

Download