27a4fbd44c97dc467da061ea19d49cd1a751d0816289b2f85e7aeeb102269cf2

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 14.8MB
Sample260810-fxc8cabn8y
SHA256 27a4fbd44c97dc467da061ea19d49cd1a751d0816289b2f85e7aeeb102269cf2
MD5 24397cd27c3d9822ae317688f707a196
SHA1 a393448d210d40d4dc4aede9d8346e88d8302e96
SHA512 2d47471a0c900144ea82a28c89688a4aaf2081e103c6d017bcda3771f67078d0c255e853f654258bfc3dae47cd5c2b8527e0d3033cce5243798458e692c66f58
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xP7p:kFlP7APhNNECwHrc8u3x3AEcq/fByuKW
TLSH
T1D4F6AE13B25A41E6C42AE2B88A474223D7B67C440334B7DB16E5B7692F37BE4573B360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c505-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
1684	svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe
936	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBABACCACCCCBCCCBABACCACCABCBABAABACACBACABBCACCABCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe"	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABAABBCCBBCAABBBBCABCACBACBCABBCCCBCCCAABABBCBBCABCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe"	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5940	sc.exe
1240	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1532	cmd.exe
5736	cmd.exe
2824	cmd.exe
6000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3068	schtasks.exe
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
1684	svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe
1684	svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
Token: SeDebugPrivilege	1684	svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1532	4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	92
PID 1532 wrote to memory of 3068	1532	cmd.exe	94
PID 2588 wrote to memory of 5128	2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe	95
PID 4484 wrote to memory of 5736	4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	98
PID 5736 wrote to memory of 5940	5736	cmd.exe	100
PID 4484 wrote to memory of 2824	4484	2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	101
PID 2824 wrote to memory of 1240	2824	cmd.exe	103
PID 2588 wrote to memory of 6000	2588	svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe	105
PID 6000 wrote to memory of 1140	6000	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_24397cd27c3d9822ae317688f707a196_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCBBCBCCCAAACCBACBCBAABCCBCBBBCABBBBBCBACABBACCBCBBBCCABAAABBBABBAAAABBACBBBAAAAAABBABCAABCBCABBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCBBCBCCCAAACCBACBCBAABCCBCBBBCABBBBBCBACABBACCBCBBBCCABAAABBBABBAAAABBACBBBAAAAAABBABCAABCBCABBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBBCCCCACBBBACABCCAABBBCACCCCABACCBCAAABCCCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe" start= auto displayName= "UserDataSvc_BCABBBCCCCACBBBACABCCAABBBCACCCCABACCBCAAABCCCCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBBCCCCACBBBACABCCAABBBCACCCCABACCBCAAABCCCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe" start= auto displayName= "UserDataSvc_BCABBBCCCCACBBBACABCCAABBBCACCCCABACCBCAAABCCCCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABBBCCCCACBBBACABCCAABBBCACCCCABACCBCAAABCCCCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABBBCCCCACBBBACABCCAABBBCACCCCABACCBCAAABCCCCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBBCABBBBCCBCCACABBCBBABCBBABBAAACBCBCCBACBBCAAAAABBABCACAACCBCBAACACACAABBBBACCBBBBAACAAAABBCCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBBCABBBBCCBCCACABBCBBABCBBABBAAACBCBCCBACBBCAAAAABBABCACAACCBCBAACACACAABBBBACCBBBBAACAAAABBCCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABAABCACBCBCAAABCBACACBBCBBBBAABCCCCBABBBBABBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
1⤵
- Executes dropped EXE
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edbb8b90c70c27344aa7272d1cf0fda91adc4ffd5f065205d787deb885d31c95
MD5 c0c6643ede32fcf945a5de81f61bbc9b
SHA1 59d6ea8d5f76ee1c87d075d3658d8a1fbdda6886
SHA512 6aed75d7ba7afc95165d9809260b71b971501a907d9e7305cc9b263dbbf69050a3e4645ce0a0e4e810b413ab591f9a420e6b1709b2507d63a046db020890cdf9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10e63be144a709e5148a2d14e893eabed3913eac84e0d92fb0b6b5eb43ff56a5
MD5 9e6e9c15ae52d40ea3bb0b11798f3c97
SHA1 6f67002c2379b09ea0af49b4013bc22fffcc07ca
SHA512 26a5cdb98dbc7cf947286447f19d2c8a17d529e3de4d042aafa29c2ab67b0eb97c6a391ce566c51f19a8271361d541afcd7d340789a7368a1f83aec06c177603
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e36e049d5b879b1892d9f2d4db3584405ef2458fccfc9c294162b4cc07e55522
MD5 aa1e012f97571f4fdb9ed4591b92b9f4
SHA1 7b37da7b4cbe035cf1945ed9b3459275ca3c040c
SHA512 2c1b75327dd1c2f9185736f49f7ad13e373daf99d31a35b417e089e5a58bbc454ee85a9d500c7d8166d6f9ee47a4dca1da904aa88ad62c49d18fdec07cac4aa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5eb82c32e4dde0b407d2905396b17b9576cfd800d9dc48ba0bd5c7be0289b2c4
MD5 88ecfb3914654c0c47afb58920f9fb37
SHA1 368a8842d7da38030fc36bb4b0d9e0ba228b124b
SHA512 88f41fd0b52824464d0b98c3006a7d84d44d17b78a41707bb7203cf9388edb3ce81843c8b24203e01ba29c511442561b6b97d099ae2470b0327845be773811af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0802529bb49821ce4f0dd5d860ba10c1e70e928e6fe09514ec1724305e849aa5
MD5 470d1b7f7e3e237659ba27b7defcede7
SHA1 9eff0a90addb75b13b499f9bc1dd5fe3305cfee7
SHA512 354c7400a1d7b86ebfd6a42fc1b923ceddf5544152f7e68aae1d72eb773eb32a52ea09c8a4705074218b17177b583236b400f3f2ea091c08fc29d0175cc201a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7f4602bfc2715d5a7ed28bef4d5d248e4bf96ea0fc107969dd7aa8759fe66ea
MD5 7dc5fa0a4188c5ade2ee37283756b29b
SHA1 587e5fe422370f993d49122cf790a8ded8a7c09a
SHA512 27dbbe4497a0e961eb64f00cbc495712d0f24898eeb7ae8a871cea65011a404504d4c4e233a24dacfdba8de9e4e6a3e3817b17d9f3d1dfaeedb0a1e912a4745b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 636a6a79bce6f27f87922e8cd9bf66f884cecd36047f20cd87aec61315a53305
MD5 013aa1ed5acdbd1b5ca48562aef99c25
SHA1 fe9f2340079c596d557c843035511ef0ac1be11d
SHA512 36fb03b8b95ff9500b2a8833b4c93c282f02f43b5403a85efe1352dec37583feee4b12ea08caf6d70567556114f52a80bbfefab752107fe6886ef11ed9252904
MD5 SHA1 SHA512

Submit Download

svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCACABBABCCBCBCAAAACCACBCBBCBACACACABCABCBBBABCBAB.exe
Size 14.8MB
SHA256 27a4fbd44c97dc467da061ea19d49cd1a751d0816289b2f85e7aeeb102269cf2
MD5 24397cd27c3d9822ae317688f707a196
SHA1 a393448d210d40d4dc4aede9d8346e88d8302e96
SHA512 2d47471a0c900144ea82a28c89688a4aaf2081e103c6d017bcda3771f67078d0c255e853f654258bfc3dae47cd5c2b8527e0d3033cce5243798458e692c66f58
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xP7p:kFlP7APhNNECwHrc8u3x3AEcq/fByuKW
TLSH
T1D4F6AE13B25A41E6C42AE2B88A474223D7B67C440334B7DB16E5B7692F37BE4573B360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7b0d62e50f8d3cc3abcff13713a0f31280734094d1d292edc0c3b07fa06e43bc
MD5 b8a91f3f12e27467d7fec74801c29d00
SHA1 94b011c68ec2f1f052da11b3afe34e65d6edaf15
SHA512 3a4100ffe255762a687b0df41894e1bec9e8f065968ad73b7a1ec0cb2a661bbd9d1fd63e570e7f11fbd01783fdfeae84bbcef4f1a9d38388f1be6dcec3044e7d
TLSH
T13711A351A4EAD487D97328C79329CAE30CAC36C7686C6A1413090518EB8DC35CF5A0E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 febe2c266ff4a8d822244cd1ab4c40fc98a803697404bc8e4548b9ee7fe951f4
MD5 6faeacebeb52fa91043957059b0ff246
SHA1 f4e7229aa1c04bf054d8b8496880e26091b85b3e
SHA512 8885c0dd1f071f3e644383779d9d8be89e53c989cf0c42371429cc46f816110ddd5afbd842e561690997d18dd9886e5ac7d415bd94bf0914bbbcfc4a2c152db1
TLSH
T16B11A552F4EAD897D97268C79715DBE20C9C37C7A86C6A0413094618FBCDC35CE5E0E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-83-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/1684-63-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/1684-87-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/2588-32-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/4484-6-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download