53d37f173bad09f5d1b8d22712ab262061a5a3eb4114951188b28a0d5f7535ab

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Size 10.9MB
Sample260810-czzycahn6z
SHA256 53d37f173bad09f5d1b8d22712ab262061a5a3eb4114951188b28a0d5f7535ab
MD5 65ac86249eb1e3a532237b544f29b7ca
SHA1 7d7f6721ce0ba36c89b852da8ab621519cf39cf0
SHA512 597678ff3e9c2b92025eb9211d958a5264458b6f324842e29af996a8351ce6f19772ad34ae0e48102d047ddaa80a6afee6d3b05cb385de596fe33449785ce41f
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Cp7Dp7Dp7Dp7Dp7VA91pH2WpjHrgBFFu416AWv2:vBBBBABBBBVmHpn6F44IAWv2
TLSH
T11FB66C5162A350FDF0ABA4758A7BC731E6757C230631838F53ACD65A2F636A06D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
3276	svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe
1912	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAABAAACAABBBACACBBBAABBBBCABCCABBCBACAABCCABABAACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe"	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBCBCBBAAACABABCCCBACACCCACAACAABCCCCCABBABCCBBBBCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe"	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3264	sc.exe
3748	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe
4600	cmd.exe
4796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
3276	svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe
3276	svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
Token: SeDebugPrivilege	3276	svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1260	1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	95
PID 1260 wrote to memory of 3348	1260	cmd.exe	97
PID 1876 wrote to memory of 5248	1876	svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe	100
PID 1132 wrote to memory of 4600	1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	103
PID 4600 wrote to memory of 3264	4600	cmd.exe	105
PID 1132 wrote to memory of 4796	1132	2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	106
PID 4796 wrote to memory of 3748	4796	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_65ac86249eb1e3a532237b544f29b7ca_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAAACABACACBACAAABABCCCABBACBABABCCABACBBCCBCBACBBCAABABABCAAACCABBABCABACCABCBABCAACBACCAAAAAABBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAAACABACACBACAAABABCCCABBACBABABCCABACBBCCBCBACBBCAABABABCAAACCABBABCABACCABCBABCAACBACCAAAAAABBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCACACABBBABCAACBCCBBABABBCAACAACBAABACCAACCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe" start= auto displayName= "UserDataSvc_ABCBCACACABBBABCAACBCCBBABABBCAACAACBAABACCAACCCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCACACABBBABCAACBCCBBABABBCAACAACBAABACCAACCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe" start= auto displayName= "UserDataSvc_ABCBCACACABBBABCAACBCCBBABABBCAACAACBAABACCAACCCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCACACABBBABCAACBCCBBABABBCAACAACBAABACCAACCCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCACACABBBABCAACBCCBBABABBCAACAACBAABACCAACCCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBBABACBAACBACABCABABABBABAAACCABBAACCCCBBCBBCABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
1⤵
- Executes dropped EXE
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 22.3MB
SHA256 cda11c64a530ce7eb4e5418253461374442fa521244fdf40741ddfc10016c9e5
MD5 92ffa2755b2f9a958eb04d3ef21fefdb
SHA1 ec18c5bc7e87c394a9fc7979f18367a0a38d2d10
SHA512 67df7281d15123e12b049340ede51bbfb8e438ac2c436ffb4a05937239876ece349e983078a344c6b6a7e5f29ec13f316258746e5815754095fa696581d70e39
SSDEEP 196608:vBBBBABBBBVmHpn6F44IAWvsBBBBABBBBVmHpn6F44IAWv1Qe5wZ:ymHN6+JrvrmHN6+JrvuZ
TLSH
T106377C5162A350FDF0ABA4758A7BC731E6757C230631838F53ACD65A2F636A06D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 832KB
SHA256 cd1aa14ee147698201f1774ddc07aa8569c413b247bc27ada8859494e9430887
MD5 8a8564db9b48110e3a8160be5dfb1a35
SHA1 f569e1a29923379d85fe04adbd5377c1b9cd76dd
SHA512 2d8c44972391a9c9e9f146b20308e976a40784102b7c818f9a5fcaf52fd7a3a3ef384359a6e08382103ff39c9b1e745cd5aa58b2ed730f93e48cf0dab10dfe44
SSDEEP 12288:mgUFgEsnojAOa0wIk0BX3RKuemGd70ioGuVWW6oIagUFgEsnojAOa0wIk0BX3RKh:m9+EM03afDd70iTWCa9+EM03afDd70iJ
TLSH
T1BF059E10BA818036F5B328718ABFD339556CB9714F2589CFE7C80B2A5E71AE1E53471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c459285e7ca9714377188d55f3dc86305bbe2be2fad4dae530d8087db50ac123
MD5 da286b59fc11e47b4c92b5660a50a132
SHA1 dd070324ddb91b72bca621650f689c2cff004a58
SHA512 0d2eb9297d2239b24dde2e01b5e91a74c29dd984ffc833b17a86cd66717a42d553938312bee254c5387cb031ffc5280c05831022417ccd2c88b0f9f309627968
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6b3bc5c0203ffadb63e8b4b4c477cce1ff8634348b5c40e26ffffbd3264e0a1
MD5 915514bcc4614a66297a8983166ec1ca
SHA1 297afed3833e01da3f6aa5080e0336a85426a625
SHA512 26a78183759e394389703154a5c496f00b152e2889dd36c7ff5db309eb20038d8ed906f2da02c35aaacd998e6b1c7b8a4c0b96b2681a40987525a6dcdff4c65b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f961573f608bfe959948b8afa1c7a829b96b72c4ad15c42a91227bc3f7bb453
MD5 1d1c3b6cc63d1d47a70b8631d76b5c73
SHA1 bcc407e88f731be1bd4cd3d71572d244268fcc67
SHA512 57e61f4fffccebe36dcff66a9489288eb982ff84b0f02bbb6d3fafa7917bb51d3b3d476edfe26ad7ec277359b8d44c97ed8d165e9ef69645bed8c427cd6c66ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e7c4a49bd9992a6e8f956ea8c1f0153085ed96c195f4d5d13efb594a8f70843
MD5 da9f1d9c5f415f99fd6032cc0b2fdcb3
SHA1 81d26135debbb07281c3ddc85665e57f62a53095
SHA512 fed33dc17c144ca476d8464189a1d74aa6bda1677987684e1316ae578abefed7f30d4b5a30d0ea771fa9d12bb2d2e57e1d7275d6a4e27e7bfa6e32cc242853f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86bd796affa0aa967aedec1659e84fc8238760a9d6601ead0f5d4ec429673758
MD5 6dafe79c88dd7a0fd718696e0f3475ca
SHA1 b57bc7d724c56079d0195a5076df036b7eadb75e
SHA512 401cb446c73fd1dfff372077a3a5e5735667c8e9280a400f501a874a14b08c22277c74e543c6d6723e35baffd41fa09adc71f8da4ea803b5fce592df4bacc4a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e36da6c0098a38c1f81a9856d7ae740370a7fe32c6469b0cd8decefc1e5d133
MD5 b9df1260ec27f33b58a3078b040b491b
SHA1 d4c774e9297767fa2c080b876ace9c3908022991
SHA512 bf1a30e44fd4f2f49eb27c1fcc4c69260bf6d241034d1c82522b02479c064b2f4e5f7b9b5fbbb671bbd51fe8d72238cdcaa2eb2a7d0b3e3bf377f235145862b2
MD5 SHA1 SHA512

Submit Download

PopUndo.exe

Path C:\Users\Admin\Downloads\PopUndo.exe
Size 65.5MB
SHA256 fec512daba5d9bea67413f2ed8378f6437007cea0fafa081aa2f956bc238bd40
MD5 96031c2d4754509290c5d13ca5a181e7
SHA1 0c8aa0e164e0a86dd384bf9bb17d220a1ac04839
SHA512 edb8c3391e54677b9fe84c8eab847782fd2904d78b13dbe8383f23450b0a690d8f9eb67605d8241c6a9c9a70a505ccf257314940343082673cef541931e49bd9
SSDEEP 393216:ymHN6+JrvrmHN6+JrvrmHN6+JrvrmHN6+JrvrmHN6+JrvrmHN6+Jrva:/bribribribribribrC
TLSH
T198E76C5162A350FDF0ABA4758A7BC731E6757C230631838F53ACD65A2F636A06D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c174b366e140e0f31c960e8546775bc30444ca80f1c8bc50bbfb2acc9622bc92
MD5 28d2352f0f817c1628838fca508fc309
SHA1 af1218fbd18f108dff09ae7b31f128c0ff68d54b
SHA512 ab8dc5750ee00ebcf312ff1d5043746d6c6907db1f7a40070f392786a6e03243a73f7e9c8d094b4dc67431f4d1d4b3b19347d46b86930ebbc5ca013f041fe6b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 033df310998b0d8a9373690aac9f85849576c1443e517fa3e20c1f96c1daba68
MD5 b43e0ef507fda66c4e205b6d8b3203ac
SHA1 35ebda0303b70f9f9f22709a80da3925519f93d9
SHA512 fe7e33e320fd33c88ffa90eb636a546d6d634cc79ce628eda251ff4a3c57dbcadbae0dcf07e038bbef40cef5b0103898ade5ef8cea82cff5a306b124a6e56ecb
MD5 SHA1 SHA512

Submit Download

svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBABABACBACACABCCBBBAACCCCBBACACBCCBACBACABCBBBBCAB.exe
Size 10.9MB
SHA256 53d37f173bad09f5d1b8d22712ab262061a5a3eb4114951188b28a0d5f7535ab
MD5 65ac86249eb1e3a532237b544f29b7ca
SHA1 7d7f6721ce0ba36c89b852da8ab621519cf39cf0
SHA512 597678ff3e9c2b92025eb9211d958a5264458b6f324842e29af996a8351ce6f19772ad34ae0e48102d047ddaa80a6afee6d3b05cb385de596fe33449785ce41f
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Cp7Dp7Dp7Dp7Dp7VA91pH2WpjHrgBFFu416AWv2:vBBBBABBBBVmHpn6F44IAWv2
TLSH
T11FB66C5162A350FDF0ABA4758A7BC731E6757C230631838F53ACD65A2F636A06D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a7704937d4b390231f48706d63871e617d24611e6577db7e05153d484774a75e
MD5 69d935b71ef1f516218ee50d0ee2fa94
SHA1 3276f1ee9208d3d33b942418a04059b43726e96e
SHA512 89c35f4f007946ffc8fc7ef199482dac1719d73e1213d6e763c82dfea24b282e1626d931599318de15a3b78c0ccdd054612ef0964fe85a72cfb5a0913b0b8b60
TLSH
T1EA110116E4F9CC23B933ACC7D52ADBA208E8337BB85CAE045246411C7F89C31DD5A0B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-44-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1132-76-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1132-106-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1132-0-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1132-29-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1132-15-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1876-90-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/1876-63-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/1876-43-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/1876-136-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/1912-137-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3276-130-0x0000000000290000-0x00000000002B1000-memory.dmp

Download