93dfc9bef8fe29cdb628560da564210c6325eae24ab98c4f8da170d579fc2581

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 17.6MB
Sample260810-e9gwma1emb
SHA256 93dfc9bef8fe29cdb628560da564210c6325eae24ab98c4f8da170d579fc2581
MD5 7a676d13d88420a7e9042c0b2ba50513
SHA1 9ebd52a6b9c701f350b5c1960c093a19d6f0486b
SHA512 2986dacc3c723c5a177fadf6e9f0c29c6fab997982421407efcfc084707e62be01443fdef17cc77f037b3a7717eaf1298418cfe7a0e86687f2042747c3706b27
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKKU:iZahvQHrc8u3xXJ/f4uHU
TLSH
T19607AE17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5fe-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
5244	svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe
4044	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCACBCABCBACBBBCBABAAAACCCAAACBBABCBCBCAACBCCACABABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe"	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCCCCCCABCCCABCCAABCBBBABCAABABBCCBCBBCCBBACCCBABCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe"	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3664	sc.exe
4040	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3484	cmd.exe
1912	cmd.exe
4280	cmd.exe
5428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
700	schtasks.exe
352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
5244	svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe
5244	svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
Token: SeDebugPrivilege	5244	svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 3484	4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	93
PID 3484 wrote to memory of 352	3484	cmd.exe	95
PID 5972 wrote to memory of 3108	5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe	96
PID 4172 wrote to memory of 1912	4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	99
PID 1912 wrote to memory of 3664	1912	cmd.exe	101
PID 4172 wrote to memory of 4280	4172	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	102
PID 4280 wrote to memory of 4040	4280	cmd.exe	104
PID 5972 wrote to memory of 5428	5972	svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe	106
PID 5428 wrote to memory of 700	5428	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACABCACBACBCAABBBCAABCBCCBABCACABBCBABBACBACCCCABBBCCABBCAACBCABBCBAAACCCCACCBAABCBCCCAABBCAACBCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACABCACBACBCAABBBCAABCBCCBABCACABBCBABBACBACCCCABBBCCABBCAACBCABBCBAAACCCCACCBAABCBCCCAABBCAACBCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBCCAAAABBACABCCCBACBCBBBABBBCAACBBAABCABBCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe" start= auto displayName= "UserDataSvc_BCBCBCCAAAABBACABCCCBACBCBBBABBBCAACBBAABCABBCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBCCAAAABBACABCCCBACBCBBBABBBCAACBBAABCABBCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe" start= auto displayName= "UserDataSvc_BCBCBCCAAAABBACABCCCBACBCBBBABBBCAACBBAABCABBCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBCCAAAABBACABCCCBACBCBBBABBBCAACBBAABCABBCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBCCAAAABBACABCCCBACBCBBBABBBCAACBBAABCABBCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBBBBACCCBBBBCBCCBBACABACCCBAABBBBABBBABBBAACCBBABBAAABBCCBBAACCABBACCACBBCABACCCCBBACBBBAACBAACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBBBBACCCBBBBCBCCBBACABACCCBAABBBBABBBABBBAACCBBABBAAABBCCBBAACCABBACCACBBCABACCCCBBACBBBAACBAACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBACCBCBCAAABBAAACACACACBCBCABBBBCBAAACCCCBCBBABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
1⤵
- Executes dropped EXE
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10406886362ccdb359da2508e3eb25085f39f823271ecaae96a5d2c1f9f67783
MD5 7e3043136eedfe01c91223f965cda60e
SHA1 61519790d033f5c3814a29bd65f30ce76b13af8a
SHA512 c35ecb885c10b34aa231919350dfcf7c5f0f5eefaa9d6c165ad474db111da324395b9a92d1ab161d4c1a0214add1fad59ef70f3d6eed38b23857c993c7abbc63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85177be9deb2f104156a93e52260d825619e03299807f9c36c3a58cec91fb58f
MD5 fae2c970025dcac9711108f35888c142
SHA1 47f8425690f7afa3d7caf6dfd4d89134ec1fff2a
SHA512 23eee972085d83a2c89be6a2d1de5ad2f824c4bcacfc79e92436d2e22017002b793096a37085d99046bc42bd5dded7c32917edf3e79ec04843f099fa791a3ed9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bab5d79ce9f8f4d2def1b229aaf8b765fd5bb5d31a7072983825664068f84e6b
MD5 2e0f44f8b1dd1b30b02a3935b806bbd8
SHA1 d110bbd346585c10b3eb41d9c3e97811f4090f98
SHA512 a8e0a2324ef41249e13fbd6cd65cdfe21e7b6f53dd21f6ecb8634e70d9bd8125f9ef21409c8176813d993f8eb62fe353a319d946875096eb01756fec265a8ec5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 407ffde62f4ced7d6314a754981e1365303db8e12084cec08356721edc97dc8c
MD5 e98814be1c9c84dae267821a161153e4
SHA1 76f11878242686eaa4062adebcfc157612c70eaa
SHA512 b2ed88e211785c3b5e8254a90d421b8646aedfc7e723106f95ec5c75030fbd5276f267c5dafc4529173ee2c16b899ba4f87f40a0ad847058ad7c044b8c37283f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e62fea89841e7f9db788b3ae8e40180854fe2590419da2b69b2cd360cca1faf
MD5 97af9620370d21d97b0c3aada9181c78
SHA1 14a18d56bda92008641dac7cc24125333ad488c1
SHA512 bd33016dc8db77692b656757b966896aad7dca3f9983eda67dc88841938fad0f27e0b02a90595251c053a1d0082e1a8417a8780fa0163ebba79b58f7c13b8463
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4ebe6b79a05a4f96552919c5c180660fdc55581e168ba82a8d75718dc32ad6b0
MD5 f1de9f9c2d2bfc42c65f02837207ea71
SHA1 3c3ec3bc8ebc9fb6363b8da865f55554017483f1
SHA512 71b548f8c5af5958ce0e08c23f1bda81ab42da53286e1d8827d9df85348490283e08965bf4a53eab016f2be7b2a001038158f52658cd02187152fe0c1231da23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 97810f3428f68184a6aef68844a2c418a8be89b32636e37a3e431ee74ad5ddcb
MD5 3d9321454c45e6621a91866eb42a7c73
SHA1 3efb7958efad0e1d5e1f404b603794f841b6e1bb
SHA512 220aa05c85bd1b3dd7cc03424e3773bb2325399838db98fc0bf514d923f7789f26e1c79581a264872c8aa379c93a8bff6c4b4f1ee26c5043a8ae3d6c2a81bdf2
MD5 SHA1 SHA512

Submit Download

svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAAABCBAABBBACBAABBABCACAABCBCBAABBACCACCCBABBBAAC.exe
Size 17.6MB
SHA256 93dfc9bef8fe29cdb628560da564210c6325eae24ab98c4f8da170d579fc2581
MD5 7a676d13d88420a7e9042c0b2ba50513
SHA1 9ebd52a6b9c701f350b5c1960c093a19d6f0486b
SHA512 2986dacc3c723c5a177fadf6e9f0c29c6fab997982421407efcfc084707e62be01443fdef17cc77f037b3a7717eaf1298418cfe7a0e86687f2042747c3706b27
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKKU:iZahvQHrc8u3xXJ/f4uHU
TLSH
T19607AE17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5934e2530d1338aec4a15322b464cb296b065efdddcf3661a74594f04f21d7e3
MD5 629fdd56301f4f956a37771b95e8e8fd
SHA1 960cf62bae2f09af1ae975728870622162d21af0
SHA512 f9e05c90a9a68175ff4d867f93785cf3f56f934e40afca3e194427508ee3d825643dc310c942c52735cc79611b624d5698eabbbc9b96c6353ffc443fa56c2cc0
TLSH
T147110652FCE9D453E9333CCB92199BF30CF9768B78986A646305421CB989D24CDD98F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6bff8708ccd2e6f1320374fc3bf2bf0f983b129319b123482b5683f553bfe413
MD5 b5c9562575cb7abd823bd174cf1a419d
SHA1 d09c78bc59c49b288ceb0f0d8b8809a8b959f5c7
SHA512 da4791977657e768a466c094fdda6de9f259b4e4e18f463d1a332f68ab6a087c5187449d5f1e53e21c9ef5e2c9a3bc5cf355cf190ec3aa39b40d7c7a9661ba75
TLSH
T11C11E711F8E9C853E9326CC79729DBF30CB9738BB89C6A5463094218F6D9D24CD998F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4044-83-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/4172-6-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/5244-63-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5244-87-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5972-32-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download