876ea06782ccd5c459a6cf70125e394701c2f8cfa777e1dc2abc85a4b19eb469

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 10.5MB
Sample260810-fl2rkaeb86
SHA256 876ea06782ccd5c459a6cf70125e394701c2f8cfa777e1dc2abc85a4b19eb469
MD5 4a645a496cb8644bccf1c521ee1929ec
SHA1 87b20acf380a8f9fb2039893edfda0b9cc54df5d
SHA512 4ba15cdc0343cdbf6f4107566b57e875130d4cac6ddde5b22f9b2a61f9288a9d84686ea1467b54e4ac91c5690d58efdfca398fc9bb47c7d6e2a5ee0b0b7f6287
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEsr:kFlP7APhNNECwHrc8u3x3AEm
TLSH
T1E3B69D27F29900E5C42ED178C75B8623DA7A7C554724AADF06A076252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024212-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
3964	svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe
3612	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCAABABBBCCCABBABBBCCBAACBAACBAABCBAABCCBCCCAACBCBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe"	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBACBACCCCBCBABACACBCBBBCCAACABCABAACACCCAAABCCABBCCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe"	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4112	sc.exe
3480	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
560	cmd.exe
2324	cmd.exe
3108	cmd.exe
1604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3000	schtasks.exe
4976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
3964	svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe
3964	svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
Token: SeDebugPrivilege	3964	svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3208	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 560	1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	97
PID 560 wrote to memory of 3000	560	cmd.exe	99
PID 3312 wrote to memory of 4724	3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe	103
PID 4724 wrote to memory of 4328	4724	notepad.exe	104
PID 1284 wrote to memory of 2324	1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	108
PID 2324 wrote to memory of 4112	2324	cmd.exe	110
PID 1284 wrote to memory of 3108	1284	2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	111
PID 3108 wrote to memory of 3480	3108	cmd.exe	113
PID 3312 wrote to memory of 1604	3312	svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe	115
PID 1604 wrote to memory of 4976	1604	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4a645a496cb8644bccf1c521ee1929ec_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAABACBBACCBBBCAAAABABBAAACAAAABCBBCAACCBAACCBBABCCBBCAAACABABCAACACAABBCCACCBABCBBCCAAABBCAAAAABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAABACBBACCBBBCAAAABABBAAACAAAABCBBCAACCBAACCBBABCCBBCAAACABABCAACACAABBCCACCBABCBBCCAAABBCAAAAABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBCCBCCBABACBBBBBCACBCAACBBAACBCCCBBBABBAAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe" start= auto displayName= "UserDataSvc_CCBCBBCCBCCBABACBBBBBCACBCAACBBAACBCCCBBBABBAAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBBCCBCCBABACBBBBBCACBCAACBBAACBCCCBBBABBAAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe" start= auto displayName= "UserDataSvc_CCBCBBCCBCCBABACBBBBBCACBCAACBBAACBCCCBBBABBAAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBCCBCCBABACBBBBBCACBCAACBBAACBCCCBBBABBAAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBBCCBCCBABACBBBBBCACBCAACBBAACBCCCBBBABBAAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABBCACBBBAAABAAAABCACCABCCABAABBBBABABBCBCCCBBACAACAAACABBBACCBBAABCABABABBCABABCCBBCCACBCBACACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABBCACBBBAAABAAAABCACCABCCABAABBBBABABBCBCCCBBACAACAAACABBBACCBBAABCABABABBCABABCCBBCCACBCBACACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCCACBABCACCBBCBAAABBBABACACCBBBCAACCABAABBBABAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
1⤵
- Executes dropped EXE
PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bf9bb7af7450501a773b7ddcb55bd56ae3edb662e64ff0612ac7cf7b4dc65d1
MD5 96d4ea7162614b5e8c3912cffa825f71
SHA1 12e39512068e819b00a18699226df464a5f5788f
SHA512 97987c8d2ba97f2dc26e1b4e3cc34471a201a035b224070d708abd7da4d24d99f7ff6de723783ad03818be678dcb9202faf1f1de1703ff4efb5830188bccfbe7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7cf024a3b519853dce38a765a35a42dc27439b9a2d8deaf1caaf28ab67793e63
MD5 cb61db0829ccd5f24f04ecef123c10c3
SHA1 b423690ef09cf90a15b759f9b16500619abddfc5
SHA512 3bd015471e246cd83e64f7a32faf1c96d1a2d03cfcd62ae3454d5f91cf060b56a1640887ff4b4500bfc24587784699f9c5c971a8aae6127b8817866c67eaf0de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ea9ac5b94c515c3f637ef46c7bb978f5af4197a2a7177d8c4e1dbf61fcd465d
MD5 09bc3aa1342822e828fe8c03dcf975db
SHA1 414df6c528ca2b97b7ca136881a862dcfed02943
SHA512 3bcfa11c011c13a9aeec453fd1e216f5f932d275819d2d67e6082bfd70ca058ff51c0502814783af4ccfb9a31982e8d96e951d6315b0d7658796f009a4e3bd07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1043066d7aa7284483c0fa2951cc5d4696b6c019496fc0e33883ce091de1aae3
MD5 89208274ac7306611f5215cca6c6937c
SHA1 789feafb1e4523fa0f8ff6643d573952751b7c8c
SHA512 234312550aa372ffb8d23ffcefba154b71e30d2c774fd29994f4a6ddc8871dde414b31f90387935e6e1a0cd8258f8d0123d380ff324cbace286b65ed96329f8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3c12eeb094aa978bdeabcf8883a6a66efa0daf7a4b0ee33c056024b0a44d9e2c
MD5 521af9a9182d8c0b770e6181d2f4c863
SHA1 f05615c8b000a50e54aa6dc6a2d55c323d17f1b3
SHA512 bc39959c426d74dfba0bc552889458b594b1ff6fe601381a856b869ce36fc158a6ae0d0571ea4ade514f23db783b6d1b35072154647ad4cf63aed8241561494a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a440ff6761765be6a9556649cff2b3a01446a223ecca0109e54d3761a4965da6
MD5 d303e2b2fb18e9db90daaf62907f3858
SHA1 b54cb388706b8dabff2ca5c136479a5fc3cb35e2
SHA512 359a708ac64bc8b63ea02f08578523d4201d51a2e254703851475af99fc2372fcad5e8541e7c86d5c281cf1f5090395651d2f649358e2ecf4a56ac2e0512eed8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c215639b20a94e25cecd0642ddab77b2e014c1b5b0d6eb84c993d28de5eba2d3
MD5 1cebe8141fa436011c51021d3b57c049
SHA1 fcca6f11536f7db928ff587a7965c7a1a1474a09
SHA512 98359170c90f868aaf11d7a21ef8a75a8728abc8cd91401d7ea42c71035f867a6a9d066d5e887fd344474153328fe8cc043c66a1643809106ad62fa42e2f3d3f
MD5 SHA1 SHA512

Submit Download

svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABCBCBBABCCABCCBACBBBAACBCCCBAAACCACCBCCAABBBAACBCA.exe
Size 10.5MB
SHA256 876ea06782ccd5c459a6cf70125e394701c2f8cfa777e1dc2abc85a4b19eb469
MD5 4a645a496cb8644bccf1c521ee1929ec
SHA1 87b20acf380a8f9fb2039893edfda0b9cc54df5d
SHA512 4ba15cdc0343cdbf6f4107566b57e875130d4cac6ddde5b22f9b2a61f9288a9d84686ea1467b54e4ac91c5690d58efdfca398fc9bb47c7d6e2a5ee0b0b7f6287
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEsr:kFlP7APhNNECwHrc8u3x3AEm
TLSH
T1E3B69D27F29900E5C42ED178C75B8623DA7A7C554724AADF06A076252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 33b6391a00ea7b551a0cccf8ca29ea90fc10d01df7cd36122f0b96cc11397281
MD5 30f285603bd37095cdcc7b88e2e37749
SHA1 34bdcb79425561010ff3404becc882e962eca0e6
SHA512 5fc7071489d0f52df617404f740c169fd311888c700a02e52414f555d1eb779d179fe1dc1041f30f15c2e45767f7d8a31a9c6f3afd1ec17861bbdcfab21b41f2
TLSH
T11301C841E8BAD453B87224CA9629AFD70C90779B7C586A0413494118FFDCC39DE5A0E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 843af36764207a1a9022c38f4bb2794062d8590f7166498f2882004afe43ebe7
MD5 2844d06663b8c2d501eeeeac2213a862
SHA1 2f26e70835eb729bc8512424c50d18ef0526bcec
SHA512 5b507e1cb74d2008a4ac5d846bb0c1aec2fe5fc49f4a95082c71622cd980e1616cb48cb5c72816b7750a331fd7f82f023e82b2d5a82e2f95d925ca04fea94e47
TLSH
T16611C911E4BAD893B97264CA9629EBE70CA477DB7C5C5604134A8118FFDDC35CD4E0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1284-6-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/3312-35-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3612-91-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3964-71-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3964-95-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4724-59-0x0000000005850000-0x0000000005851000-memory.dmp

Download