9eb5ae66c84eb811b953e0d386043ddfd813c782146ff96399163094d1a9c11c

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
Size 368KB
Sample260816-mdarfavzev
SHA256 9eb5ae66c84eb811b953e0d386043ddfd813c782146ff96399163094d1a9c11c
MD5 9d803ff880da52f288af0a9c36d11625
SHA1 4e3806530d65f7f94a22d64541224020d4a7131a
SHA512 f32ab3a3bad378fd61502dbbcba93f31e5b36c05c1fee65f1e9b9effb570f09db0fe7ac4317a53703aa3db397d6196cd20f9ae2e33c5fd0be4e8b307d6b43499
SSDEEP 6144:m+dTTUFgEs3XojAdP+9wLuLahmZ2uhuYz:mgUFgEsnojA9UAmZXuYz
TLSH
T10584E71AFA4240F1D4650D704A96E77E9720B925C4134F9BB298AECFFFF2AD14E14631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
3868	svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
748	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACCCCAACAACAAACAABCCCBAAABCAABCABBBBABBCACCCBCCABBACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe"	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABCBCAABBCBAAACACBAAAABCCCCBAAAACACAACCABABCAAABCABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe"	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2032	sc.exe
696	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
980	cmd.exe
1428	cmd.exe
3204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
3868	svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
3868	svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
748	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
748	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
Token: SeDebugPrivilege	2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
Token: SeDebugPrivilege	3868	svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
Token: SeDebugPrivilege	748	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 980	4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe	92
PID 980 wrote to memory of 2272	980	cmd.exe	94
PID 2464 wrote to memory of 2456	2464	svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe	95
PID 4788 wrote to memory of 1428	4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe	98
PID 1428 wrote to memory of 2032	1428	cmd.exe	100
PID 4788 wrote to memory of 3204	4788	2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe	101
PID 3204 wrote to memory of 696	3204	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_9d803ff880da52f288af0a9c36d11625_elex_icedid.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCABCACBBCBCAAAACBBAABACABAACBCBCABBBCBBAABBBBCABBCABACCBBBACACCBCCCCBCACABBBABABBCCACBAAABAAACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCABCACBBCBCAAAACBBAABACABAACBCBCABBBCBBAABBBBCABBCABACCBBBACACCBCCCCBCACABBBABABBCCACBAAABAAACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAABBCBAAACAABCABCCABCABAABCCBCBBCCCCCCBBABCCABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe" start= auto displayName= "UserDataSvc_CBAABBCBAAACAABCABCCABCABAABCCBCBBCCCCCCBBABCCABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAABBCBAAACAABCABCCABCABAABCCBCBBCCCCCCBBABCCABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe" start= auto displayName= "UserDataSvc_CBAABBCBAAACAABCABCCABCABAABCCBCBBCCCCCCBBABCCABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAABBCBAAACAABCABCCABCABAABCCBCBBCCCCCCBBABCCABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAABBCBAAACAABCABCCABCABAABCCBCBBCCCCCCBBABCCABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCAAABBABBCACBBBABCBBCBAABACBAABACACCAABCCCAAABACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2457ca058055cd5c368b943863631c1ea4ad94b332743b6241f1fe54656bb394
MD5 bfeae90ff7311444f9d9859301ec83d5
SHA1 977fdfa276e00c8258bb6658373db6b9dd12c34b
SHA512 f579a0bd074d0ff8bc2931eaa6c6c8d0c5b35be18d5df72081073588466c3e1be442d35dc6b1a2e11ed6cbcfcfc5cc9acf6d2ad33298a5d7d3565f091a0e127a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 976KB
SHA256 93310a2b08207a25cc26daaa0d95d00ec0a24e8020c5b6e7b9180aed72a0b990
MD5 086fba389767811d5d8a731ee28221fd
SHA1 3ee863f2b7a4b72f33e489270e161f0871af0b96
SHA512 f04b340c8b503eb5a9bae788f054eaaf1d8196d83fbfe21967b69675a0abcb58cbad7acac1b4f4009b891eeb2421c27198da08c71527046fe914147e464b6830
SSDEEP 24576:m9+EM0qUAhY2m39PZfePv3r7fm6t+jqp+3l+zCM0P:U+Et8gZ2HbbZt+jqpQ0CM0
TLSH
T1E2256B22B5514072E6B105729954E23D6F28B628C6138DABE2C4ADCEFFF18D15F77232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\qap`g`v~dtlq
Size 10B
SHA256 a85af680ec90efe23da6e6753f6f21b9efd9f34e2180ee33c6cea3f86a4ce670
MD5 845b16472e56c7eb466ac7e65cfadc5b
SHA1 f2af0798fbccba4db73471bbe88248a00b229871
SHA512 78fc4df2ac6964b558d0a3c8ba2bef6fed8b92ff997418295d00dce38b6fb06b084a41dfa1004f0de4816804132708c6d30f3e5e83d8bdb09d5dde8d03c13a00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\ConnectJoin\qap`g`v~dtlq
Size 10B
SHA256 721080f762877084a825054e3cf04129f4f0c64a7a49e821af3b071e03fcc22b
MD5 7bacf6f02b674fd52707e0e6f4a38ec8
SHA1 8b772670f9abaf793fe80f184921e2e5dc99d040
SHA512 69885db657842c5530d5d84e6aa5d135ebf1b1539ecc1b5044ddfef93169485bb2289e1b79f7e42cf06081da9a103e3f299cf0684c6048291beaee6dc109ff97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 292e27250989b257de88ba2b8e6066a88c2d7e9157ce5e53395142289507808a
MD5 fbe0a21229e77d406c2ea1eab25c13b7
SHA1 82a5a2c2879bf2f82cccabc391fcad895efe759c
SHA512 71fde4774726b43414bd32f7f18b8271f84f7d240d30f296d89445897061377ee4346eb08cd8a8d74b23ac8648615075c5b4f76104603e197f1fd708459dbf90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f91180c96fce623d5c025e4953d037a79419d649c30029f5231c2a25756c72d2
MD5 d750c056c0446464eea98ed6c047821f
SHA1 9c26251de74d68707999cab7dec6da0b76fe2aa1
SHA512 04ddce0dc67f2421fd6d7fc1b29d7b0a3dfabef23ada1f07e55b6860641034c07648ba70d5fbb5704c17f0c463c810fcb4c15f825b9c0baba567426ecec227ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 43ed44c290af572b7cbca84e5710f51163abb73aed47db4eb885b4c3401f05bf
MD5 fa8a9f2b060ecde63bf80319d3f0a5fe
SHA1 3fceb20aca4d8655b29fc471aa1a40d6edadf2d4
SHA512 2b114d85c984bbf0ba09adc9c8916e24e1857560e8f99cc55810e7951862d62188904b4d6ca043a646fb393ec01b995d94777d5fd77a3039fe4edb11dce4d049
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 adf3aed5c06057943c9405a3783dff490fa5638a2aaa1b94192993e87ed792f8
MD5 9660be9e236db13a64ec019b19d8f927
SHA1 24e2ae147887b363f3781645e44dc6c1f937cc6d
SHA512 32a4769d1d3e5446186e7b448860e2a03ba7efd20e2565b9413f2e3081e225773d0146d7ed6911fb08fa398ff3f6a04598910c9bf67c00616aa2a61a68f7d514
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ac7963fa69449ef6534bfabe5c0ef3f7be1a7f73f7fbd0da4ef48b9ae851bdb
MD5 e49f4f2d390b574e09f1dcf1bc4a6c54
SHA1 db5ffab6ff8a09906be0c4af121aca7dffe1b0e6
SHA512 e19c4b939961c06e153076c7dab2df36dbfdd0fca0f1e660472a9c2f2ccf3b9a59b467276e992b383f9cb5e84437b4660f4481239b9a536506121a80fc0889e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 3afc8177099b97f6176d6097ed3b869c8bcc255c64973fdd150de782fa54cebb
MD5 ebf1d2cb1e8657f0a55d036edfff79fd
SHA1 3847e4031f0d2c24986e6c2c57b2e82f53f5972d
SHA512 52a51021b12b012d59bb6ddecdd84c7cd32da5abdf142ac27fb2141e2c855c026c51a08deac85e3d34433bc33585071acefe40fc777a28ffd9b54150c4aa2bc5
MD5 SHA1 SHA512

Submit Download

svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCAAACCACAABCBBCABBABCACCACACCBBCBCACBABABCBCBBAABC.exe
Size 368KB
SHA256 9eb5ae66c84eb811b953e0d386043ddfd813c782146ff96399163094d1a9c11c
MD5 9d803ff880da52f288af0a9c36d11625
SHA1 4e3806530d65f7f94a22d64541224020d4a7131a
SHA512 f32ab3a3bad378fd61502dbbcba93f31e5b36c05c1fee65f1e9b9effb570f09db0fe7ac4317a53703aa3db397d6196cd20f9ae2e33c5fd0be4e8b307d6b43499
SSDEEP 6144:m+dTTUFgEs3XojAdP+9wLuLahmZ2uhuYz:mgUFgEsnojA9UAmZXuYz
TLSH
T10584E71AFA4240F1D4650D704A96E77E9720B925C4134F9BB298AECFFFF2AD14E14631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 38847791d1cc0d6722fb96173d27a8c2112305d9d6c3d612078995ed6f4c9163
MD5 35dd0f9e9728ac128f06785eda790ba9
SHA1 9af7672ad3bddb532d11159c905ff34a3a80f79b
SHA512 3d8608c132438b1eb05f5e738c3f6f77c96dadb7344eddd31e657f797945564680b83cb6e9e84fe742ba5620f4a4a13b8c56f047da6e0a8e93dc21d70a284f8f
TLSH
T1CC112BA8E4A9D813EC732CC6621DDFD209A537BB9DAC6AA433058118B7C5C30CD15CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 295dd175884e21892c6b5459a35bd4be4d7cb8fafaef5f3ccab08ce47a315035
MD5 89d276525201b2335540558d7c5d65da
SHA1 7e0d0f0e2e6881025d27338fdba728e6ed13efb7
SHA512 eea1fc9c3cc98a916d204a6c3a46957839969d78afab486d2e9e5d44cb350c7f6d85aead9766c7ffa052267e41e7f79087f805e8893d85bebec740cdc3f68126
TLSH
T1F0210B98E4A9D863EC736CC6721DDFD209A537BB9DAC6AA433058118B7C5C30CE158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-81-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/2464-33-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/2464-23-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/3868-78-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4788-0-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/4788-7-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download