373c4e1e7989a9d841ab707ccc180219eaa87ecb182fbd9467280a6972665220

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 6.8MB
Sample260815-cfgbwsdl2w
SHA256 373c4e1e7989a9d841ab707ccc180219eaa87ecb182fbd9467280a6972665220
MD5 0530d0b6fc349bcb7f764d5a758513e6
SHA1 9f0deb1bb5e4b32e528cb7788cf4ce904a87adc5
SHA512 3c9b7650ad2e3916056123f8e132d1c977f4deb9a54c51bb6e2eb37a0039ed6585b3e1a7e39fd23894f650b0f388f3b40e9a6133203708a41714379e4f928b40
SSDEEP 49152:U+E9B+EEDf+E9B+EEDjb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPN:gA91pH2WpjHrgBFFu416AWvm
TLSH
T1EA765AA562EB20ECE0AFD179893AC732E6717C130131934F16BCE6562F636586D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
5744	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
3724	svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCABACBCABACBABCCABBCABBABAAABBBAABCACABABBCAABACCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe"	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACBCCCBBCCACBACCBBCBCBBCBCACCACAAACCBABCBAABBCBABBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe"	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4628	sc.exe
1936	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1084	cmd.exe
468	cmd.exe
5920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
3724	svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe
3724	svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
Token: SeDebugPrivilege	3724	svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1084	5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	95
PID 1084 wrote to memory of 4236	1084	cmd.exe	97
PID 5104 wrote to memory of 468	5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 468 wrote to memory of 4628	468	cmd.exe	103
PID 5104 wrote to memory of 5920	5104	2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	104
PID 5920 wrote to memory of 1936	5920	cmd.exe	106
PID 2396 wrote to memory of 3484	2396	svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0530d0b6fc349bcb7f764d5a758513e6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBCBAABCCBABAABABBAABBACCACBAABABAABACCCCCACCABACACACAACBCCABBCBCBBACCACCBACCABBAACAAACBCBBAAAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBCBAABCCBABAABABBAABBACCACBAABABAABACCCCCACCABACACACAACBCCABBCBCBBACCACCBACCABBAACAAACBCBBAAAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAABCAACBCABBACCABBBBBABACBAABBACABCAABCACACBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe" start= auto displayName= "UserDataSvc_AACAABCAACBCABBACCABBBBBABACBAABBACABCAABCACACBBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAABCAACBCABBACCABBBBBABACBAABBACABCAABCACACBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe" start= auto displayName= "UserDataSvc_AACAABCAACBCABBACCABBBBBABACBAABBACABCAABCACACBBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAABCAACBCABBACCABBBBBABACBAABBACABCAABCACACBBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAABCAACBCABBACCABBBBBABACBAABBACABCAABCACACBBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
1⤵
- Executes dropped EXE
PID:5744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCCCABABABACCBCBBBBACBABBCCBCCCABCCCAACACBACAACCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 20.7MB
SHA256 0ab41dd7f9c1fe2d0f6ca0a129342a2b9812d5149a3f7ed1d53e6cd904eaf05c
MD5 c5d305e7b73fb7cc30bfc4dd46bf159f
SHA1 969c85a37410cadc7889efff4acfc5ef4cd727d3
SHA512 50d823f86f5e3b83d55f8189470d62093a685a61dec3179a808aa0922f58065e53ef02fe565c5b949b3b233b97875cc69aabd7c61a790f7fb06ff24c7c2f6d2a
SSDEEP 196608:gmHpn6F44IAWvVmHpn6F44IAWvVmHpn6F44IAWvBZL:gmHN6+JrvVmHN6+JrvVmHN6+JrvBx
TLSH
T11F275AA562EB20ECE0AFD179893AC732E6717C130131934F16BCE6562F636586D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 1.9MB
SHA256 834dd2c7f543c7b3ffe6c85da13eee652b45ed6fecf70ff816d2b05f65a39119
MD5 f3691de3ae10c249f768c45b85f45b3a
SHA1 768f36f1574a58f85eef9b91f518b19cb9af7c88
SHA512 9a2c0fa8c722f6d03671f667a91dbc55c2e0282a56eb0129fd384fe129241f5aad22c2d141d552ed89d39b1bb39189a3495883ad60acc0fb2c5c7a06198fe5eb
SSDEEP 49152:U+E9B+EEDf+E9B+EEDjb6LgA97HrsdochZVNhcOgs0v:gA91v
TLSH
T1AE958D09A2A940E4E4BBD174CA2AC637E7B17C124330A79F56A1D76B2F33B905D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 48.1MB
SHA256 d8e060cfbb8f10e5cd12f44fdb883fd6e249a9bab88044cb0f84a501ce54a8a4
MD5 f2bc2f6b8e4cb16bc824f22baddb325a
SHA1 3abaea2a5764178c0b643cff62630d5924bc6af5
SHA512 f656489c16253c6ac380c760d7779bb6ff8b2316eae1abf36bcf48170b6fd221dbda78af65f0bd9185f56472fa1348cadff1c0b17da768d739bc287327016fbf
SSDEEP 393216:gmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+Jrvk:Bbrwbrwbrwbrwbrwbrwbrc
TLSH
T181B75AA562EB20ECE0AFD179893AC732E6717C130131934F16BCE6562F636586D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 55.0MB
SHA256 e4a3af702728554ca2658fba8af46c67853d85f71fec1d076764945e4edc043c
MD5 659b9360c11a9a01da3eb7e87440bff2
SHA1 222a62cadf4c368aa1b89a7ed4c8c8a36a88e77d
SHA512 42d7921879c1d7565d9c7ce0a842e92408afb2eb7c4b29d362eb8b43b312349aa1edebd10b482c1f62939e9d6bd46924c933a06ea3edf442361fccc5e8d09949
SSDEEP 393216:gmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvVmHN6+JrvE:Bbrwbrwbrwbrwbrwbrwbrwbrv
TLSH
T1F6C75AA562EB20ECE0AFD179893AC732E6717C130131934F16BCE6562F636586D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea805ae4110225f8985fda5f61389c9f6149b91c66c09d4b31e181f09920c6c1
MD5 1d7dcd2739832743a9a459ea03a3a316
SHA1 5c2fd7de4e26beafc9018c380785aea1f9dd650e
SHA512 3fc4f03e3343acb94ad885212622a892ec0cfb13b08309e018c56fc3ce7fcddfde3c79c2d6551179552f614a962d027a13d674c95430b91f2e6541cef826042f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f231d30e4bf1ea11b83882d9c03285e485af95933556f99d0f2f37a9845f480e
MD5 61c82f599b32488bd54829c903e9c3ef
SHA1 519a8eedc89bcfeef0f0297debbfe006646e53bc
SHA512 7a8aa3d9a1ba54699a2b6f57954f6ed43fab64da0fa028af8bc0d2340679e4a7db227b60b6c98a3eeca45141f40fe66524e4712e88bd9d932730b23091ce57f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 200cbccb7ff17a90a1d2a328c08faa99108ba0f9c7f12fca961b5baa51ed54a3
MD5 27ed6be3edc5ab9f9dccdd5ebb01458c
SHA1 19d3191fc74eb1d185985bfbbc7a990d0b1a7005
SHA512 e2f4c81b55948118df1e8625b93602104755811ae4f8a14602ce55f2c2e6b63b83ffa4e898e6e69336b51c4a681cea5ef37c8c4314d466950eaf744ce993b11f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4278a7b904b6a5ba9e594058f200e912e649be3c702ea11b43671be27119937
MD5 31fb14a28ad419052168b2963d023040
SHA1 68e7c8863bb3cb490950f6527912c8f2675120a3
SHA512 496b2747f214989293c6630e52b48e3f6e870392a3b662b84a18b45e906e5dbfe82cb118a528321c66034b1f2aee247b4b6a108be49af86b48f53c47245b1979
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f4a4536155518bc2913bb850d428dce1a31de2e2af9ac5f9934cc2525ca04e7
MD5 9fffeadbdb762533c96d9bdb3c8e291a
SHA1 0611f63e83cb0fd36a0fccb3ad1f72eb7f8817ba
SHA512 dda6343b707ce8fe0a710944b4effe9fbff82b50c5d69ff2b926b493118bbbcb2b1f11854eb56ef2be54b0d1b28d66d8c3c1c4d727b3c2b9227d20c1a1422c95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70eafa7bc1d1d0a3d8e1fab98c2f322151e3597328cd8d2f6781e90e8bb0ec8e
MD5 8c22898aac5e5d0062a73c8e95537821
SHA1 4d74d13df00120bf3b372c68f5650641a023fd4a
SHA512 77b44d7fc996b8facf97d6e93f77e65d913229ed927448c71cd403bcf8220174b0ee6b924fa75559eb5ea76fd427f73a6f825f285a682ad794dcac4fae53b7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 415fde6c3b0dc7c0aa9d2b9ac36e0dfc5f1359927eb6da678bdd42caba48f447
MD5 035548ca8cac1a3bba9612f981cec556
SHA1 e6a354745adb9b1b9d4c3ba6d8656cd47ebea88b
SHA512 d9df1fc3361460565c2505edc7bc3f0d2b59eff573cdd0c828b4bd101df82f8e6051676e2777d65dc545b141cd15a64c92b78893547a9fac2722f9ddca762328
MD5 SHA1 SHA512

Submit Download

svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABABBABABABCACBBCBBCBCCBAABCBBACBBBBCBAABCABBBCCCC.exe
Size 6.8MB
SHA256 373c4e1e7989a9d841ab707ccc180219eaa87ecb182fbd9467280a6972665220
MD5 0530d0b6fc349bcb7f764d5a758513e6
SHA1 9f0deb1bb5e4b32e528cb7788cf4ce904a87adc5
SHA512 3c9b7650ad2e3916056123f8e132d1c977f4deb9a54c51bb6e2eb37a0039ed6585b3e1a7e39fd23894f650b0f388f3b40e9a6133203708a41714379e4f928b40
SSDEEP 49152:U+E9B+EEDf+E9B+EEDjb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPN:gA91pH2WpjHrgBFFu416AWvm
TLSH
T1EA765AA562EB20ECE0AFD179893AC732E6717C130131934F16BCE6562F636586D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b36149781493fe312b682c7ad92eefcd58c6131aa51bd138d6debac880dc36de
MD5 5e1187b460d18b8d582f94e7c6538885
SHA1 bb80763be4578813ba185578667fa5674fcf448a
SHA512 557ad7f93104935547267784cbf03ed00bd1e0e4dbbe951a7ffac76e84c9ef1c2c2a702d21e6eb70621c19f05a793f437e71ff06215541af64706249a00621a4
TLSH
T17B11B259E4B5DC63FD32B8DE9A19EBE308B83F97A86C6E5412498118A749C318E150D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2396-80-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/2396-32-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/2396-51-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/5104-10-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5104-82-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5104-58-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5104-33-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5104-21-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5744-88-0x00000000003F0000-0x0000000000411000-memory.dmp

Download