c1598b1f7143a536db378de726e1eb889dcbaf5f0305711c2943ffd0c0e4b86e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 33.8MB
Sample260811-dltpvavama
SHA256 c1598b1f7143a536db378de726e1eb889dcbaf5f0305711c2943ffd0c0e4b86e
MD5 65c008b1d8e13f89edc42dd904e278c9
SHA1 a3c9b9467fc06f5b65bab7d43e7f28db0227ea9e
SHA512 4b2856768df9f061d4b8f42c100acb83b7b9c6ece2158a2700601a384df7135814016f37e0369d38cc2683369a68ca7748e0d38e09b838b45453876977454ec1
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlamHpn6F44IAWvJ:i3Z3E3Z3E3Z3E3Z3smHN6+JrvJ
TLSH
T19577C045F99750F9EC7AA17088A7D376CA317D278031875BB6EDFA062F33A205C19722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44f-18.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44f-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
3260	svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe
2468	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBBBCACCCCBCBCBBAABAACCBBAABCCCCBCAAABBBABCAACBABBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe"	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCBABACCABCCCCBAACACACCCAAABACCBBBACCBCAABCBCBBCACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe"	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2320	sc.exe
2324	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6028	cmd.exe
1060	cmd.exe
3052	cmd.exe
1096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1492	schtasks.exe
2864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
3260	svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe
3260	svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
Token: SeDebugPrivilege	3260	svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 6028	2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	92
PID 6028 wrote to memory of 1492	6028	cmd.exe	94
PID 5480 wrote to memory of 5012	5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe	95
PID 2360 wrote to memory of 1060	2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	98
PID 1060 wrote to memory of 2320	1060	cmd.exe	100
PID 2360 wrote to memory of 3052	2360	2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	101
PID 3052 wrote to memory of 2324	3052	cmd.exe	103
PID 5480 wrote to memory of 1096	5480	svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe	105
PID 1096 wrote to memory of 2864	1096	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_65c008b1d8e13f89edc42dd904e278c9_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBBCCABBBAACCABBCBCCCABBBBCCBACBACBABACAACCBCACAACBABBBBCCCCABCCABAACBCCABAAAABACACACABCBACABABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBBCCABBBAACCABBCBCCCABBBBCCBACBACBABACAACCBCACAACBABBBBCCCCABCCABAACBCCABAAAABACACACABCBACABABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABACCABABCBBAABAABBACCACABBBBCABAACACBBACAACAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe" start= auto displayName= "UserDataSvc_ABBABACCABABCBBAABAABBACCACABBBBCABAACACBBACAACAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABACCABABCBBAABAABBACCACABBBBCABAACACBBACAACAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe" start= auto displayName= "UserDataSvc_ABBABACCABABCBBAABAABBACCACABBBBCABAACACBBACAACAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABACCABABCBBAABAABBACCACABBBBCABAACACBBACAACAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABACCABABCBBAABAABBACCACABBBBCABAACACBBACAACAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCCCACAAACABBBAACCCCAACACBCCBBABABBACBCACBBBCBCBABABCABCBCAAABACCCCACCACBACACACBABABBCAABCAACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCCCACAAACABBBAACCCCAACACBCCBBABABBACBCACBBBCBCBABABCABCBCAAABACCCCACCACBACACACBABABBCAABCAACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCAABAACCCAABABBAAACBCCACCCBCACBAABAACABAABACBCCCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
1⤵
- Executes dropped EXE
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01c03257fbc62016f8a5ab69c654a16b09eed6fedda97c5ca4f6de79409d675a
MD5 41474b87ebe31355454373bf8dd2385e
SHA1 23e0a93f2501ff59e2c506bd0b46a37542c0b22d
SHA512 f5da8578cb7f899cf101a611f5aefb4095ebf6369ad40eb6f5a65c9c295436e55e50a3d90fc417a0a9e26f640d4f3175bf80e0ddd4001ad6d72e23b172797a76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48b552ea4978bce7dec49ee0ff75ce9159c729d6318aa18d1fd7fb8a3433d6ea
MD5 6ed6bca3d890162a0e8a213bf59a0a8c
SHA1 30ee9a9c9745e37e84f0f319c593b994eb42203a
SHA512 b5475aa89997efcc63699d7fced02d43cf155d2144ccf933343a20af9a6a8311652be20f7f7dc9a9dc07583c46c2c54a44c4d0f87c6ddf69bd01d1df1c5548f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdef111e672555dd38fb3aa7d50dcc6f6404f3a6a84bd42416690a6bc25129fc
MD5 f3bff5d59fe37d582bbc364d3ca18436
SHA1 48f88ab4061aa1a1cb07bcc3453f7589985316a8
SHA512 d9cd5aabc6f35991a017ec86e4bad7987b07d1eed9ce092c98930f732d1052a76d965c3ff30de2a4e0c59dc022eba7e806b906f17caa13e94e9051476e35fe52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b26403b130a359349eadbbd3e43ae67302c4575d4c7411d32d598288f383f26
MD5 2e01dc74ebc691ceac61546b1a47f2a2
SHA1 2e5d794b7faa3ccaf466eb3e2f38b9b74a9b9181
SHA512 0d344a7cec37626aaeac5601a706cab7118f0f1d273739e010c6bde07dc354f190ad427a9409a96e29b7a2998c75e082c4cb8c6574425ef8872aa2a7ab3f55f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d2c45c4a65f73f86a91ab8cb990752579ca417bd233a12ba551e57ece96cba8
MD5 58ba655188b906f0796dcb6d845c6168
SHA1 b18fef9cb4bd6a82005fd53e1a877c2321b811d0
SHA512 496cfcd2f66706e0116c7b3b711fdaec2f452f04f550eba8abe71e1e2edd58e3f1aecae437e66526b234f267710aa9fa06bb14eccbc287a1106ed2fc6df4de3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 77878d0598a0b05bf9c758025757850358327d719d1b56b295c8626b4672ea08
MD5 d3289ae295c2d20d7ae236ab347d1bfa
SHA1 46fe3c06a414548c76d7a036817319ff839baac5
SHA512 da76a7ada022f37cee4a71f95aee85e7f498ec74c77e4663b2a0c880ff1c1feaf838f7bc57e5818320d9388d5f37a25e8c40e6f0ce760e2ee63a6b3ea50c4409
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1194f5ec1b8f3f4ccb4dd13cb66c8aefa3abd26907201302c4a6371e1626e306
MD5 3753b438e2a28af7a69c361636af8a4d
SHA1 66ce2d8240832743f9e4dd20e4162672b0a6fa65
SHA512 3f4e820296d4a6050eb6fcd78b0324f8f0308d467b4235711b184401ef7f627e572ba4fd02d88caf3cad377711d1f85d242bb11ce780b806e29697eeb969ebd5
MD5 SHA1 SHA512

Submit Download

svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBCACBCABABCACACABCABCCACAACBCCCAABAACCAABACCCBABA.exe
Size 33.8MB
SHA256 c1598b1f7143a536db378de726e1eb889dcbaf5f0305711c2943ffd0c0e4b86e
MD5 65c008b1d8e13f89edc42dd904e278c9
SHA1 a3c9b9467fc06f5b65bab7d43e7f28db0227ea9e
SHA512 4b2856768df9f061d4b8f42c100acb83b7b9c6ece2158a2700601a384df7135814016f37e0369d38cc2683369a68ca7748e0d38e09b838b45453876977454ec1
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlamHpn6F44IAWvJ:i3Z3E3Z3E3Z3E3Z3smHN6+JrvJ
TLSH
T19577C045F99750F9EC7AA17088A7D376CA317D278031875BB6EDFA062F33A205C19722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 35ad9c3509d409f6ed4fede88364e3587bb8144c1322528d8d50ab8e15fd6c92
MD5 395a81a9e36c28ccf953345686f9e572
SHA1 165c1139bbfb7738a3dddbb88e51b58cb6fb4206
SHA512 64088466d513dbe1a876653ce2be80f1495021725d5257ca14c36c5a9a77ecb5138b31170ea02fa31ce5b5004f101ed49610b2b7f12038c91ed708a3b01d6933
TLSH
T114118C72C5E5DC17FA23389FA53E9B1308A4778BE95CAF2466144318B765C328E258F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8e02580c3cb78990aa5ca64ec9b8a519739fee6bb941418281c6fb1b6ab7a843
MD5 c61198ed8a49c66ab1802b41ed59268f
SHA1 0f1979ee98d84504ede9e992277cb1519f38a780
SHA512 c6fd3be7890038f10339b3a50c20c69b2c9c67fca924515ac5adba51005bd3dd5c096e8ddaa61aee35b11a983407a64e6514ea5cfa0818703a4d34f23ccbe065
TLSH
T15411AE32D4E5CC27FA2338CFA53E9B5308A473DBE85C6F2066154318A7A5C32CD158E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2360-6-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2468-82-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/3260-63-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/3260-87-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/5480-33-0x0000000000450000-0x0000000000471000-memory.dmp

Download