fd87935bfcc0243ec4e0ec28e6fd6182b1e5c6547ee3dffbf6aaf58c7f91d779

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
Size 12.2MB
Sample260720-lwhdkady3l
SHA256 fd87935bfcc0243ec4e0ec28e6fd6182b1e5c6547ee3dffbf6aaf58c7f91d779
MD5 55e2fe5d4845c3b8c85474c8173b1918
SHA1 3790cfadf756bfa49cbe87c8bdf57d72f39958f4
SHA512 0f3d2a8ef1c57556dcb4ad61150d29a3a2b39e85983e5a9609c5c6224437332db4e28641621fda23d5af649520053099d17bf3c60f8491e4dfc97506a5e4b0de
SSDEEP 49152:PbE2dbE2dbE2dbE2dbE2dbE2dbE2kZAW2ROQcverO04TcbE2dbE2dbE2dbE2dbEi:z4TBVa/rytjpG
TLSH
T1B5D66D0EA2DD00E8F0B792748A5AD62AD631FC56C721E6DF5654470F2E73BA28E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4c9-12.dat	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x000f00000001bbf5-71.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe

Executes dropped EXE 9 IoCs

pid	Process
6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
4364	svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe
4840	svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABBBBCACCCBCACAAAABACBAAACACBBABBBABACAACBCCABCBABBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe"	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe"	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
5708	sc.exe
5392	sc.exe
4688	sc.exe
696	sc.exe
988	sc.exe
4784	sc.exe
2060	sc.exe
3412	sc.exe
1228	sc.exe
2040	sc.exe
4928	sc.exe
5624	sc.exe
6112	sc.exe
5968	sc.exe
1228	sc.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4600	cmd.exe
3212	cmd.exe
3496	cmd.exe
2508	cmd.exe
3968	cmd.exe
4724	cmd.exe
4380	cmd.exe
4932	cmd.exe
5732	cmd.exe
5152	cmd.exe
5536	cmd.exe
2428	cmd.exe
2884	cmd.exe
1984	cmd.exe
1768	cmd.exe
2460	cmd.exe
4836	cmd.exe
3508	cmd.exe
4352	cmd.exe
4996	cmd.exe
3296	cmd.exe
2856	cmd.exe
4520	cmd.exe
2700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4200	schtasks.exe
1480	schtasks.exe
3940	schtasks.exe
2392	schtasks.exe
4952	schtasks.exe
792	schtasks.exe
4780	schtasks.exe
4792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
Token: SeDebugPrivilege	2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
Token: SeDebugPrivilege	4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
Token: SeDebugPrivilege	6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
Token: SeDebugPrivilege	5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
Token: SeDebugPrivilege	5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
Token: SeDebugPrivilege	4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4932	4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe	90
PID 4932 wrote to memory of 1480	4932	cmd.exe	92
PID 4596 wrote to memory of 4996	4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe	93
PID 4996 wrote to memory of 1228	4996	cmd.exe	95
PID 4596 wrote to memory of 3212	4596	2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe	96
PID 3212 wrote to memory of 4600	3212	cmd.exe	98
PID 6060 wrote to memory of 2428	6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe	101
PID 2428 wrote to memory of 3940	2428	cmd.exe	103
PID 6060 wrote to memory of 3496	6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe	104
PID 3496 wrote to memory of 5624	3496	cmd.exe	106
PID 6060 wrote to memory of 5732	6060	svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe	107
PID 5732 wrote to memory of 5708	5732	cmd.exe	109
PID 2932 wrote to memory of 2884	2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe	111
PID 2884 wrote to memory of 2392	2884	cmd.exe	113
PID 2932 wrote to memory of 1984	2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe	114
PID 1984 wrote to memory of 6112	1984	cmd.exe	116
PID 2932 wrote to memory of 1768	2932	svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe	117
PID 1768 wrote to memory of 5968	1768	cmd.exe	119
PID 4924 wrote to memory of 2460	4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe	121
PID 2460 wrote to memory of 4952	2460	cmd.exe	123
PID 4924 wrote to memory of 2508	4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe	124
PID 2508 wrote to memory of 988	2508	cmd.exe	126
PID 4924 wrote to memory of 3968	4924	svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe	127
PID 3968 wrote to memory of 5392	3968	cmd.exe	129
PID 6040 wrote to memory of 4836	6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe	131
PID 4836 wrote to memory of 792	4836	cmd.exe	133
PID 6040 wrote to memory of 4724	6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe	134
PID 4724 wrote to memory of 4784	4724	cmd.exe	136
PID 6040 wrote to memory of 3508	6040	svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe	137
PID 3508 wrote to memory of 2060	3508	cmd.exe	139
PID 5648 wrote to memory of 3296	5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe	141
PID 3296 wrote to memory of 4780	3296	cmd.exe	143
PID 5648 wrote to memory of 4380	5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe	144
PID 4380 wrote to memory of 4688	4380	cmd.exe	146
PID 5648 wrote to memory of 2856	5648	svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe	148
PID 2856 wrote to memory of 1228	2856	cmd.exe	150
PID 5380 wrote to memory of 4352	5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe	153
PID 4352 wrote to memory of 4792	4352	cmd.exe	155
PID 4876 wrote to memory of 5152	4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe	156
PID 5152 wrote to memory of 4200	5152	cmd.exe	158
PID 5380 wrote to memory of 5536	5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe	159
PID 4876 wrote to memory of 4520	4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe	161
PID 5536 wrote to memory of 3412	5536	cmd.exe	163
PID 4520 wrote to memory of 696	4520	cmd.exe	164
PID 5380 wrote to memory of 2700	5380	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe	165
PID 4876 wrote to memory of 4600	4876	svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe	167
PID 4600 wrote to memory of 2040	4600	cmd.exe	169
PID 2700 wrote to memory of 4928	2700	cmd.exe	170

C:\Users\Admin\AppData\Local\Temp\2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_55e2fe5d4845c3b8c85474c8173b1918_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBBBCACCCBCACAAAABACBAAACACBBABBBABACAACBCCABCBABBABBACAABCABACAACACCCBBAAACBBBBACBABACBCAABBBCCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBBBCACCCBCACAAAABACBAAACACBBABBBABACAACBCCABCBABBABBACAABCABACAACACCCBBAAACBBBBACBABACBCAABBBCCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAABCBCBBBBCAABCCCCAAABBBCBCCBAABBCCABBABBABCBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe" start= auto displayName= "UserDataSvc_BCAABCBCBBBBCAABCCCCAAABBBCBCCBAABBCCABBABBABCBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAABCBCBBBBCAABCCCCAAABBBCBCCBAABBCCABBABBABCBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe" start= auto displayName= "UserDataSvc_BCAABCBCBBBBCAABCCCCAAABBBCBCCBAABBCCABBABBABCBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAABCBCBBBBCAABCCCCAAABBBCBCCBAABBCCABBABBABCBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAABCBCBBBBCAABCCCCAAABBBCBCCBAABBCCABBABBABCBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBCCCBCBACACBABCBCAAACCBBBBBBABCBABCBBAACBBCABBBBBBCBBBABCBBACCCABBBCBBCBBAACABABBBBCBCBCBCBBAABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBCCCBCBACACBABCBCAAACCBBBBBBABCBABCBBAACBBCABBBBBBCBBBABCBBACCCABBBCBBCBBAACABABBBBCBCBCBCBBAABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBBACCBBABCACCBCACCCCCAACCBCACBCACCACCBBCBCCBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe" start= auto displayName= "UserDataSvc_BBCCBBACCBBABCACCBCACCCCCAACCBCACBCACCACCBBCBCCBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBBACCBBABCACCBCACCCCCAACCBCACBCACCACCBBCBCCBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe" start= auto displayName= "UserDataSvc_BBCCBBACCBBABCACCBCACCCCCAACCBCACBCACCACCBBCBCCBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBBACCBBABCACCBCACCCCCAACCBCACBCACCACCBBCBCCBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBBACCBBABCACCBCACCCCCAACCBCACBCACCACCBBCBCCBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCABACABCBCBAACBABCBACABAAAACBCACBBBBACBABABCBBCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACBAABCABCABBAAABCCBAABAAACABACBABBAAAACBBCABBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACBAABCABCABBAAABCCBAABAAACABACBABBAAAACBBCABBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCBCAABBBCBBBCBCAABBCABABCBBACBCCBCCCACABBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe" start= auto displayName= "UserDataSvc_ABCACCBCAABBBCBBBCBCAABBCABABCBBACBCCBCCCACABBBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACCBCAABBBCBBBCBCAABBCABABCBBACBCCBCCCACABBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe" start= auto displayName= "UserDataSvc_ABCACCBCAABBBCBBBCBCAABBCABABCBBACBCCBCCCACABBBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACCBCAABBBCBBBCBCAABBCABABCBBACBCCBCCCACABBBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCACCBCAABBBCBBBCBCAABBCABABCBBACBCCBCCCACABBBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABAABAABAACACABCBABCBBCCACCAABABAACCBABAAAABACCBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBBAABBABCACBABBCBBBCBBCACCAABBBBCCACACABCBCABAACBCAAABCBACBCCBBBBBABCABCBACCBCAACACCABBCBACBACCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBBAABBABCACBABBCBBBCBBCACCAABBBBCCACACABCBCABAACBCAAABCBACBCCBBBBBABCABCBACCBCAACACCABBCBACBACCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBCBCCABCABCBBCBCBCBABBACCACBBBACAAAACACABAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe" start= auto displayName= "UserDataSvc_BACCBCBCCABCABCBBCBCBCBABBACCACBBBACAAAACACABAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBCBCCABCABCBBCBCBCBABBACCACBBBACAAAACACABAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe" start= auto displayName= "UserDataSvc_BACCBCBCCABCABCBBCBCBCBABBACCACBBBACAAAACACABAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBCBCCABCABCBBCBCBCBABBACCACBBBACAAAACACABAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBCBCCABCABCBBCBCBCBABBACCACBBBACAAAACACABAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCAAACBABBCBBBABCBCCACABABBBCBABACBBBAACBBACCABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABCACCACCCAAAABCBBCCCCCAAACBABAABABCACCAABAABBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABCACCACCCAAAABCBBCCCCCAAACBABAABABCACCAABAABBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABCCACACCCCBAACBCCABBBAABBBCBBCCBCABABCBCABBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe" start= auto displayName= "UserDataSvc_CCCABCCACACCCCBAACBCCABBBAABBBCBBCCBCABABCBCABBABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABCCACACCCCBAACBCCABBBAABBBCBBCCBCABABCBCABBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe" start= auto displayName= "UserDataSvc_CCCABCCACACCCCBAACBCCABBBAABBBCBBCCBCABABCBCABBABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABCCACACCCCBAACBCCABBBAABBBCBBCCBCABABCBCABBABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABCCACACCCCBAACBCCABBBAABBBCBBCCBCABABCBCABBABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBABBCBBBBACBBAAAAABAAAACCAAAACCBAAACCBBBCCBBAACABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBCBCAACBCCAABBCCCACCAABBCBBAAACAACBCABAAACCCBACBCAAAACCABAACCBACACABBABCCCBCAAABABACACBCBCAACACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBCBCAACBCCAABBCCCACCAABBCBBAAACAACBCABAAACCCBACBCAAAACCABAACCBACACABBABCCCBCAAABABACACBCBCAACACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABAABACCABBABBCBAABAABAAAABBBBBCACCABACAABBACACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe" start= auto displayName= "UserDataSvc_AABAABACCABBABBCBAABAABAAAABBBBBCACCABACAABBACACCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABAABACCABBABBCBAABAABAAAABBBBBCACCABACAABBACACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe" start= auto displayName= "UserDataSvc_AABAABACCABBABBCBAABAABAAAABBBBBCACCABACAABBACACCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABAABACCABBABBCBAABAABAAAABBBBBCACCABACAABBACACCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABAABACCABBABBCBAABAABAAAABBBBBCACCABACAABBACACCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABACABACCAACBBBCCBBBBACACABBAABABCCCBACCABCACBABABBCCBAAAABCCBBCAABBBBBBBBBACBCBABCBCCBBBBACCBCABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABACABACCAACBBBCCBBBBACACABBAABABCCCBACCABCACBABABBCCBAAAABCCBBCAABBBBBBBBBACBCBABCBCCBBBBACCBCABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBAABBBBBACBBBCCBBCCCCCABABCCCBACACBABAAACAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe" start= auto displayName= "UserDataSvc_BCCBBAABBBBBACBBBCCBBCCCCCABABCCCBACACBABAAACAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBAABBBBBACBBBCCBBCCCCCABABCCCBACACBABAAACAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe" start= auto displayName= "UserDataSvc_BCCBBAABBBBBACBBBCCBBCCCCCABABCCCBACACBABAAACAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBAABBBBBACBBBCCBBCCCCCABABCCCBACACBABAAACAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBAABBBBBACBBBCCBBCCCCCABABCCCBACACBABAAACAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCAABAACCBCACCCCCCBCAACCCCBCBBBBCACBACACAACCACCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCAABAACCBCACCCCCCBCAACCCCBCBBBBCACBACACAACCACCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCACACABABCAAACBAACAABBBCACCCBCBBBBABCCAACCBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe" start= auto displayName= "UserDataSvc_CCCCCACACABABCAAACBAACAABBBCACCCBCBBBBABCCAACCBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCACACABABCAAACBAACAABBBCACCCBCBBBBABCCAACCBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe" start= auto displayName= "UserDataSvc_CCCCCACACABABCAAACBAACAABBBCACCCBCBBBBABCCAACCBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCACACABABCAAACBAACAABBBCACCCBCBBBBABCCAACCBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCACACABABCAAACBAACAABBBCACCCBCBBBBABCCAACCBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBBCAACBABAAACCCBBABBBBCBBACBACCCCCBBBBACAACCABBB.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBAAAAABBCCBAAACABBACBACABABABCBBBBCABBACBAACAABCCA.exe
1⤵
- Executes dropped EXE
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 72e639bfa1cbb5312a9338339e7b97e890cbc3005d0314c99a45776b1da84251
MD5 7b44af4f4f82bbd11addeaf7ebebbb9b
SHA1 b119ec7f933334bc610b480fabdd6dfb9c393ebb
SHA512 d7ae92b45acfdbc77e94a8dd221c40c80b69867337c65fa4961d5dda6865e4736e0ea551cf055e31cb7c847fce88649e508836690df7cf0aeb8a30671a2db42e
TLSH
T15F314622C1F9D8A7952154D78B39EADCD89C77AB2CCC2A0853098629B794D32CCE95D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 2KB
SHA256 f58dbcb453b80c198fc5ed4e03b23c6c34b34360eff32aa2e8dd0b9cc644ba37
MD5 055520d86e38227bd29919c5adcab919
SHA1 8c5d7d1804b5b2746260788736764043c4a6b218
SHA512 b31a35f53f36d1d0dbe6764a955c7a58a3ba51c0c889dd5ceaebee8b5f81abda075b7b33116a5c06717ec41c3cfd2ed24b9a2a67f4294ec06f45273cd53db5a2
TLSH
T1DA412952C1FDDC67542190D38B3AFECCD8EC7AAA2DC82E0C530586297794D32DDEA582
MD5 SHA1 SHA512 TLSH

Submit Download

ClearJoin.exe

Path C:\Users\Admin\Downloads\ClearJoin.exe
Size 24.6MB
SHA256 9ba443f5043c5253a2708629631dcecd9d05533bb43ae797944940cb82c3dbf4
MD5 1612130b0071aaeaf3acae442706e6b3
SHA1 cd5e0210b0bb3d552bda01333be1a3ca9130a37d
SHA512 a1d608e827ac13008c9466cafa4dc3a89c52638bc12745cab45bf92ada2a196b9cdce3d5fa201865559ca73aad9ee81ecca7bfc22d86242d3d692b8d78e3d9da
SSDEEP 49152:PbE2dbE2dbE2dbE2dbE2dbE2dbE2kZAW2ROQcverO04TcbE2dbE2dbE2dbE2dbEI:z4TBVa/rytjpS4TBVa/rytjp4Rn
TLSH
T156476D0EA2DD00E8F0B792748A5AD62AD631FC56C721E6DF5654470F2E73BA28E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCBACCABABCCACABACCABBBBAACBABBBACCCBCCCCBBCACCBB.exe
Size 12.2MB
SHA256 fd87935bfcc0243ec4e0ec28e6fd6182b1e5c6547ee3dffbf6aaf58c7f91d779
MD5 55e2fe5d4845c3b8c85474c8173b1918
SHA1 3790cfadf756bfa49cbe87c8bdf57d72f39958f4
SHA512 0f3d2a8ef1c57556dcb4ad61150d29a3a2b39e85983e5a9609c5c6224437332db4e28641621fda23d5af649520053099d17bf3c60f8491e4dfc97506a5e4b0de
SSDEEP 49152:PbE2dbE2dbE2dbE2dbE2dbE2dbE2kZAW2ROQcverO04TcbE2dbE2dbE2dbE2dbEi:z4TBVa/rytjpG
TLSH
T1B5D66D0EA2DD00E8F0B792748A5AD62AD631FC56C721E6DF5654470F2E73BA28E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 32b1883eb5d69b1c8f8141a937a549a442a44eb2142f6a6067ee7e760d9cb504
MD5 084d7fa00409862d2b2f648542d3db20
SHA1 ebc9280da107fcce66d5e21c10c4a49cb480c8d8
SHA512 4fc51fb5eeeb3e43d09b89bffd61b6f63fb0d72cf5a1e21d02de054e8e180607497996648523143b6e4c6d9f1f82c8d90c225aa747f33b1ba99ec065097a89f3
SSDEEP 96:ozA/u1V14MQCc+bgNs1ym4t5rx+wACLduQ1oFky4FkhD5L+w+PFkA1DUn4US+4qX:nmgagiUTJPgHCeAiX
TLSH
T11AA10A31B1B5DC67E63218C78A29E9D55DEC729F9CCC5E18230E4328A769D32CCA91E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 2265b8766ef6ef240e1b2dd69984eb56ca228a253685ded33021313e08245382
MD5 750ec3e09f0420af41ff0aff9d6f49ac
SHA1 e95f12fdadecd48b18a13018b267e02ef916180e
SHA512 0d62c63052082d1ccd5f94142acfd94391cb69a7eae4fe6ef7fd4aeb5679ebce2667541a265e1ab2ffeefb2e1025efcf89d1c4ee9a783c7793dedd89d290f24f
SSDEEP 96:ozA/u1V14MQCc+bgNs1ym4t5rx+wACLduQ1oFky4FkhD5L+w+PFkA1DUn4US+4qE:nmgagiUTJPgHCeAizWh4at
TLSH
T142A13931A1B5DC77E63218C78B29E9D55DEC729F9CCC5E08230E4328A769D32CCA91E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 9f28935e3b2ba36f9244eb63dc3ea84dc472669da92911eeb83200080d5ad1d2
MD5 9bf47a726a155ddda8cee62f9a43091d
SHA1 9449911f16893ad560f536a4052aaab2f2795b22
SHA512 b85a8610fecd68a59f52817936432d7e32154245e629ef00156b31a6ab6db55f2c85cda4da25d8a9eb0ffb2d18607e0f552672fb873effd23a4f8d2f24782392
SSDEEP 192:nmgagiUTJPgHCeAizWh4a2krbThTE/xX0QScDq:nPagHTZgHCePzW3F81ScDq
TLSH
T124D11831A1B5DC77E63228C78B29EDD65DEC729F9CCC5E0822094728A759D32CCA91E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 d4bfbcfb68cf12a9abdb5f84055a4aa3224e04c505688f5d6240cc7f2cd72feb
MD5 b1636297e14fcbaaad86fd20bff77846
SHA1 05abe6e44eab0d9282ae2b22a760ba1395cdd8f1
SHA512 0b71a93110a8e1ce650b7b183d3238206a0b975753b6fb61eb759e0ba3a9a319142484949e2898b2de2349319fc011dd0e5862e344def3b8f0e793babd74cb7f
SSDEEP 192:nmgagiUTJPgHCeAizWh4a2krbThTE/xX0QScDptq:nPagHTZgHCePzW3F81ScD/q
TLSH
T100E11931A1B5DC67E63228C7DB29DDC65DEC729F9CCC5E0822094728B759C32CCA95E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 ea88996c37dee51ca2179b054b4533f4feedfd7f2f9bf8ac319796e57703d437
MD5 80722905c35e9a7ccab459a49c4e4933
SHA1 c73dfb4cee91fca325aec22116222a9c1c5ac790
SHA512 067d0ba80d85f04fb644e0af67d4a63205e3faa50ac921d4e3d74c3023963ceeaa50acab9da273b1074df0a8a117121ce40ff1b051a3998a30191eccdffc51ab
SSDEEP 192:nmgagiUTJPgHCeAizWh4a2krbThTE/xX0QScDptpHaL3Y:nPagHTZgHCePzW3F81ScD/daLI
TLSH
T183F10831A1B5DC77F63228C79A29DDC65DEC729F9CCC5E0822094728B759D32CCA91E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 1a6da62d5747576991ec0eed16c2ef412219b7a8d4b287f884411dec7d479897
MD5 2c4ac53e080156bb22b47793b86d4ade
SHA1 a35ffedd5d124c60dee805f87fb23fa88712466f
SHA512 31fef8faa7b592fa3c12258a59bdc28837fab9bbbb2f4c18a5dfacdb2f85f4e6355d45c9cff735c484b242a09811d9dfdb6ec20a9ac84b05deec6fe1d31a1942
SSDEEP 192:nmgagiUTJPgHCeAizWh4a2krbThTE/xX0QScDptpHaL3tXI1:nPagHTZgHCePzW3F81ScD/daLdXI1
TLSH
T1C4F10931E1B5DC77E63228C79B29DDC65DEC729F9CCC5A0822094728B759D32CCA90E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 51020c0bb72ad0d544a32ab437af5ee3794e5eb01ade27fadc59c670f7819f53
MD5 d7dd16adff676d30d7b927fb92c0daba
SHA1 3d65ee64eb61ba6a24afeca33c573cbe2a15a300
SHA512 b060fd612d9e7f80f8f152a93ce7008f48d620e64f79423afe7011e51790924d737e9079b17bc994678f26276540be4fe9eb136eddd213e07200e2375bfe5193
SSDEEP 192:nmgagiUTJPgHCeAizWh4a2krbThTE/xX0QScDptpHaL3tXI9y:nPagHTZgHCePzW3F81ScD/daLdXI9y
TLSH
T199F10931E1B5DC77E63228C7DA29D9C65DEC729F9CCC5A0822094728B759C32CCA94E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 d00d0d37c5766ca9008b163b32642e64304f9650dacf7451f7dd37c1596549ec
MD5 c8df0f98a991b0deefbd5e90dde4b8b0
SHA1 7a97ef5feeb27ce4536b25f509d78bc857529ddd
SHA512 d3ef8b4216a58257cdfc66c5ec700d1ae71d747b9999d72e0e00cb441e5cadf0bb665f72935831b2ac754afbd319fb2a5c1ce831e1984d0c91448b262621cce3
SSDEEP 192:nmgagiUTJPgHCeAizWh4a2krbThTE/xX0QScDptpHaL3tXI9YBb:nPagHTZgHCePzW3F81ScD/daLdXI9YBb
TLSH
T19B020B31E1B5DC77E63228C7DB29D9C65DEC729F9CCC5A0862094728B799C32CCA94E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 751ff3104a0760ec91da76aad75c7849fca3ca0383353e6627014434c8796b92
MD5 d605a7bf2b235323352ff3358ab0a49d
SHA1 58c13ea76a36df894ed269c1e707e57b1e8946fd
SHA512 a9974fa5be46724495384a34addae68e4efe2220693c401b44dec7aeb4c4323107c887b7183f8322e56aa09c0cec2c21c76f1ca876e2d78db7c7aec90dd8a4dd
TLSH
T1A721B910A1B5DC67E53214C68A25EDF55DDC778FAEC85E18120E4328A7B9C328CB90D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 0eb63d5718f9cd9c8657f3d091ebd66c982f8e2ed857f9cdc9f5c60aee40e190
MD5 c611ab452d3fbe703d7da609fdd44c29
SHA1 086a8527b79d8e4785c042cd3cc402d2de65a867
SHA512 56293d0ebdf7d47cc56299c369a8e5439dfa14c4b325ddc56fdf042d9475ec55f5fc5fe985f7df78c16358bf5480d1c571d2e5fdc110376d86e70b8833f6b99d
TLSH
T1CB41E921A1B5D867E53224C6C519EDEA9DDC768FADCC5F0C220E4339A769C328CB90E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 150a232e85ed1eaf06c07370ac784bab29aa7a0d31c4bd117900352209c5d90a
MD5 5e6148adb559d5da3c71550304a8036e
SHA1 fc4078518d8dded134cf2124f2f1a15d83afa588
SHA512 422225652ba2ffdc69f14bb9652d12d681cdee302bbffff9ee963755a49982ba7da6544f4ad77dc622c0f804e13e629dac8b959afcf99c737731d0ee507f5052
TLSH
T18951D831A1B5DC67E63214C6C619EDD59DEC728F9DCC5F08620E4329A7A9C328CA90E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 bc66175392476d6d8e9111dfc3528ab0c8a1df82bf272d1e173f6575ee72ea06
MD5 6b61d416d464d52cfd48c3c06cbca097
SHA1 28072128769ee65e21f692d974d6d3e71e8322a6
SHA512 e138ae02e95366e732f56029df15c1e9b53cb094c70a60dc3950ebbe54784d14d0de1462f43aa8cdbe1dd9d85eae5b57505931e19eae2f9ed01dae7e4ed1d330
TLSH
T193710831A1B5DC77E53214C79A19E9D95DEC728F9CCC5E08630E4328A7ADD32CCA91E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2932-78-0x0000000000E80000-0x0000000000EA2000-memory.dmp

Download

memory/2932-27-0x0000000000E80000-0x0000000000EA2000-memory.dmp

Download

memory/4364-197-0x0000000000250000-0x0000000000272000-memory.dmp

Download

memory/4596-80-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/4596-0-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/4596-195-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/4596-140-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/4596-11-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/4840-198-0x0000000000580000-0x00000000005A2000-memory.dmp

Download

memory/4876-194-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/4876-144-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/4924-96-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4924-79-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/5380-196-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/5380-145-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/5648-142-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

Download

memory/6040-125-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/6060-26-0x0000000000990000-0x00000000009B2000-memory.dmp

Download