744c0e3879d49eafa30c2b1e0786ffd74b741c8cce86ede094b8d8e75fbbbf62

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Size 3.7MB
Sample260816-e5alrazzfs
SHA256 744c0e3879d49eafa30c2b1e0786ffd74b741c8cce86ede094b8d8e75fbbbf62
MD5 5b5bc861556c454602a556c219d6155b
SHA1 70d25458976c8165a665cfee53b7066ffb887cbc
SHA512 afddc01bd196c95900075563dbd217242a24510bd951d58493f583ae3b296f8157520774f4c88592ab2e9ca0b754b020cdae17427c5505c87e5806c3a57f4720
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+E6:Fp7I
TLSH
T1D2066C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
2040	svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
2508	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACABCCBABAABCBABBCAAABBCCCCCBCBCBBCCBCABBCCBBBBBACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe"	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCCBABCBCACABBCCBBAABACACBBCCBAACABACAACBBBCAACBBAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe"	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1076	sc.exe
2348	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2028	cmd.exe
2340	cmd.exe
1144	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
2040	svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
2040	svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
2508	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
2508	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Token: SeDebugPrivilege	3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
Token: SeDebugPrivilege	2040	svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
Token: SeDebugPrivilege	2508	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2340	2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe	92
PID 2340 wrote to memory of 5348	2340	cmd.exe	94
PID 3152 wrote to memory of 5912	3152	svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe	95
PID 2400 wrote to memory of 1144	2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe	98
PID 1144 wrote to memory of 2348	1144	cmd.exe	100
PID 2400 wrote to memory of 2028	2400	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe	101
PID 2028 wrote to memory of 1076	2028	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBABCBCBBBBACACACABBAACAACCBABCBCBCBACABACABABAACABCCABACCBBABCABBCCACBCAACCACBBACCABAAAACBCCAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBABCBCBBBBACACACABBAACAACCBABCBCBCBACABACABABAACABCCABACCBBABCABBCCACBCAACCACBBACCABAAAACBCCAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCAAACCABABBCCCBBBCCACBBCACBABCBAAAABAACCBBCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe" start= auto displayName= "UserDataSvc_CCBBCAAACCABABBCCCBBBCCACBBCACBABCBAAAABAACCBBCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCAAACCABABBCCCBBBCCACBBCACBABCBAAAABAACCBBCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe" start= auto displayName= "UserDataSvc_CCBBCAAACCABABBCCCBBBCCACBBCACBABCBAAAABAACCBBCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCAAACCABABBCCCBBBCCACBBCACBABCBAAAABAACCBBCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCAAACCABABBCCCBBBCCACBBCACBABCBAAAABAACCBBCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACACBCACCBCAAAAAAACABCCCAAACCCBCCABABACCCCBACABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ac8e822ae32fc7ec7ad9581474f96b7465791c851398696fb9c9f6cf890837fe
MD5 948b8a68f686fb28d82b889315a28683
SHA1 6a8cdd9dd9a045443c9c23dc00b8a36341d191bc
SHA512 b8512bce2bcd015b4e9079401f3ac04ab500bf2f94e53da653646ecfdab1d5086d997ae919b27103d2e381ba1175bf392e350e581ed8f8e34a0f40d2130a088a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.3MB
SHA256 1351da925de28ebf79eee81335c8c0f1a533146467e151780be592e186ca7a3c
MD5 5ccb2772af83a3894081dae79b906aa6
SHA1 68b12bbcf9dd1d60b94a5532282522943f2b8c94
SHA512 2ce820ceadc4dde5abb6101ea9a188eb280d60dd11ccff42ec4ca3d847a932c7a629f8d0b57be56c839eb7a383dff4b39c12398ed73c79202573d2543a917015
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+Es:Fp7HgZ2Hb9t+2xq
TLSH
T10A268D14F9D20872E57B11B10DEBE27E0D34BB25822589EBFA8D8B4F7933B905436752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\qap`g`v~dtlq
Size 10B
SHA256 d1697d9a322057a4db9269ab8e67bafe737c0c071930de0a11eb4c7c3977d80f
MD5 d62a2d769a3d87cf70648cba5929066f
SHA1 83703af5719767af72b0f1339a2000785929d31f
SHA512 b69fa009c35b3eaeafd2fef9bca26a4f1f1294b176d9e0ce9900e51785d6d5de22d8c6f6d4387a35d0fec3cd37cde3051a6fca3a02c9763b4c860038d7383ce8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 66b928859ffafff5ac07b41b316908ac599147f24217aacab17703f30a190e32
MD5 fa8360040283262b2cc071998eb634a2
SHA1 167f00c4b37f5ac72ef01478ea5f2fd0e5a73169
SHA512 0f50b0d1cbc016fab770882d270b196ab9acf47160a317fbe9ac6d5a68d048f1e026151b2eeca2296d79daee50224f5dabde242bb531ad2af23ec84d12adeec0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67f955ca86ca19d5f35550a125805982c3879fadf622e868124c674c2bc7afe6
MD5 0e6b61b626fa11005c2154219815b3db
SHA1 00521fecffb60259accaf7a2f8245a23c52df779
SHA512 c1fd5f3ba7f6e72e370158e65ce8caf0d616d87847a49161e6a24c23eb48f9e2778459bf04c474f642968b387a58fef53fed89f07a18ba2534469612f9d6fb96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 692ff414eccd20875bd76e4dc4c57ec0c78bc430ebd03cba3c0584611ad263ce
MD5 5c1cc165bcbed1029c55df52bd066b29
SHA1 de77e7c3a97ffa3e937e9711fc396dd49999b061
SHA512 b15fbb6b0e440053f5357aee757bed1643e9df0cd0d5a0070d2a3e28e8a09a008239dabc46276ff90f44d94cef7b9f442e46c3091f8b6d0258898c4beb0e0c6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0b8e7b747ac88fce2a1005e2cc91ae99a5780cc0254bb598e485c7d55fa28ef4
MD5 ea481ec012fc25741c6e51db78d86bc9
SHA1 483f148bc70c139c1d787e1ac7d042048bee4517
SHA512 2aae9d4937d898950ca45b367608402d36a5b261364555a9cd1eb0bcd71c0d7063835ca30a9fbd7f00fcee2b40d11bfa4fd7ef2b2b93e87a3e71fa0a27319f79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8dbeb4fb77511b45acfda86e17daa34ea957f90932c4292b18748015664b8a9d
MD5 6237a34569c24e0b6f414a1a47a4ffb5
SHA1 f6b430f6873ccc3fa2962c94ec6b8c398aaf64f5
SHA512 9a33ee1a889091fb71db58b0809bcbc1b49e44a0bb0c99b8268e1815380c609a976a02bc33d903dd7fd7e2c9b1cb0dbf6c3c3f89b2df648748daf429c1d725b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4b7c878446dfa385fc56056b2f1e9aad507c1860fcef007b5c5fe0815c20730f
MD5 acf4b7625115fb19965805772131624b
SHA1 ca3702989e53c7774dc8563a5e453a61ec944c61
SHA512 bd49e569007d3ec51f281cd9cd11ad490680a1fada2e0899bc8112b4ab443fa66c1d20a3af0ef4109ec71aebb54964f6fa1c6fe019ce46d7e6fa64ef49e6f694
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 29f25f7d3d98c9e00dadd8a7bd79bd38a2866be71bcb895af5724b62de6eb3b5
MD5 5e8caa78c35997af03b0aebe6082bb44
SHA1 28f3e57970148f89fd8828374dc8ab6f903b37c3
SHA512 cdee7e9503ae0f8035009c09b919b241df04bc48c6c38b3db0d77aeab63135bfd83c797e328945d45a3fadc815e48638f9b0ffa5e89c870015cf0e562971e937
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCACBBBCBCCBACBCBABBBACACCACAACCBCCBBCCCAAAACBBABB.exe
Size 3.7MB
SHA256 744c0e3879d49eafa30c2b1e0786ffd74b741c8cce86ede094b8d8e75fbbbf62
MD5 5b5bc861556c454602a556c219d6155b
SHA1 70d25458976c8165a665cfee53b7066ffb887cbc
SHA512 afddc01bd196c95900075563dbd217242a24510bd951d58493f583ae3b296f8157520774f4c88592ab2e9ca0b754b020cdae17427c5505c87e5806c3a57f4720
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+E6:Fp7I
TLSH
T1D2066C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4a6c1d26590e307277de8899e2bf8f3d9929e26b8d77e19e6cf459821edb7904
MD5 926b1b3c46eadd4dc88636179d709139
SHA1 5461342bf5b5dd0ce4a1b5d13871c54f7273dc03
SHA512 9f39a54de0bc38d36bcc237a98e97e35e6799e086da0c647e6facf768c1cb498056e4bf99d686034bbb2fffa89e8b39789459e85454ca654c4fc69426fb2f8a9
TLSH
T1DF11C165E8E5DC23FB3328CB932EAF420C95379BEC58EA5423085118A795D32CE558E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d9e103654ac51e5f7986464e3ec371c121db17b65185271151b93a7302bf76b0
MD5 a08f0f8db7edd428f2fd90fabc8cb135
SHA1 4569fbbeeb3f956e34139c502d5ca3f5ebe71c62
SHA512 5e2b3fab9d316627728ed5ab1c79c7e50d00a14a2a1a914387fb6cde7a5e065978b33187196ac1146a446625c5140fd418a9bf01d0b80db9aceb0a4518ed8d83
TLSH
T13221D761ECE5CC23FB3228CB532FAF920C95375BEC54EA5423085118B785D32CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2040-70-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2040-1137-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2400-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2400-7-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2508-602-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/3152-25-0x0000000000630000-0x0000000000651000-memory.dmp

Download