d0ce0c1364c4691b60f8c04178d1baf15a8d0c24e1910462ffd61abc52288563

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Size 19.7MB
Sample260825-wg5knaxbme
SHA256 d0ce0c1364c4691b60f8c04178d1baf15a8d0c24e1910462ffd61abc52288563
MD5 1bed5c7bc20a3f3093f837576d7a9d6f
SHA1 74199784e4299dd5ad843b6c9f197803ee49c630
SHA512 59d689b907b35ad82e3618d76a16ee90757b09ec2b24c097b76e4f9ecc1fa644b76cfcbbc974d17cbb8060da1028d41220056fd7e0cef17ea18470705eb6f8e7
SSDEEP 98304:4sYA91pH2WpjHrgBFFu416AWvmsYA91pH2WpjHrgBFFu416AWvN7pI:2mHpn6F44IAWvYmHpn6F44IAWvg
TLSH
T18D276B55A2A720FCE0BFD174897AC336D6717C130231879F52BCD65A2F63A946D28B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
664	svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
1444	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABACCACBCBABBACAACACACCBACCBAABAABBAABACACCABCBACCACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe"	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCCCACBABCACABAAABABACBAAABBBBCBBCCCCCAABAABCCAAAAACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe"	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
4424	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3040	cmd.exe
4680	cmd.exe
1092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
664	svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
664	svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
1444	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
1444	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
Token: SeDebugPrivilege	664	svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
Token: SeDebugPrivilege	1444	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5000	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3040	4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	100
PID 3040 wrote to memory of 4300	3040	cmd.exe	102
PID 2324 wrote to memory of 992	2324	svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe	104
PID 992 wrote to memory of 1568	992	notepad.exe	105
PID 4840 wrote to memory of 4680	4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	109
PID 4680 wrote to memory of 2584	4680	cmd.exe	111
PID 4840 wrote to memory of 1092	4840	2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	112
PID 1092 wrote to memory of 4424	1092	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_1bed5c7bc20a3f3093f837576d7a9d6f_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBBAAABBABCACABCCCCBBCBBBBBCACBACBBCABABABBABCABBCCCACACCCCCCBBBCCBBCBBBACCCABACACCCACCACABCCACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBBAAABBABCACABCCCCBBCBBBBBCACBACBBCABABABBABCABBCCCACACCCCCCBBBCCBBCBBBACCCABACACCCACCACABCCACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCCBABBBAABBCBCBCBACCCBBBABCCCCBABAAAACCCCAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe" start= auto displayName= "UserDataSvc_CCABCCBABBBAABBCBCBCBACCCBBBABCCCCBABAAAACCCCAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCCBABBBAABBCBCBCBACCCBBBABCCCCBABAAAACCCCAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe" start= auto displayName= "UserDataSvc_CCABCCBABBBAABBCBCBCBACCCBBBABCCCCBABAAAACCCCAAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCCBABBBAABBCBCBCBACCCBBBABCCCCBABAAAACCCCAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCCBABBBAABBCBCBCBACCCBBBABCCCCBABAAAACCCCAAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCAAACBCABBCBBCABAACAACBCBBABCACBABBCCABABACBBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ad53b04f0a804b9bc1f38112a1fdf1bf79281e6c7d0ddd59f0750ed705398170
MD5 15346180807ec166ceb26571564532e7
SHA1 3f60d5537dd47b88344c97d87efa418ef13af563
SHA512 6f2330213cb802d3accf8048c928bb6ea1286a6184f6a7a0587d4e9703fac89ad3b71ea0573ff81d7eb98a2876c7ba40ca0ae811748812ea1794c7c532e1642c
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 16.5MB
SHA256 7de51d7391bf8f7a4545df123c491ce912559a9bb859333a94480e59b7f3acf9
MD5 4981a87659e866e4831ed70a425c9274
SHA1 647ca209532e49e484f0c97344ccd7d869fb20fd
SHA512 5037b1d52e8ef1d0a353d00cfc60b600454726a5642ccc2a0cdec41b53efc769b7cb026729e23c27b66a5b9c6457dd23b74caaf5efa2a78d210254574e7729ad
SSDEEP 98304:4sYA91pH2WpjHrgBFFu416AWvmsYA91pH2WpjHrgBFQ:2mHpn6F44IAWvYmHpn6FQ
TLSH
T10B076C55B1A710F8E4BBE074896BC336D6717C134231979F56ACC66B2F23BA06D38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Network\Connections\qap`g`v~dtlq
Size 10B
SHA256 b7cbb077035dc5666de5e8f32ce0100dcf26411e7245a9e38b8972e1ee936460
MD5 0b5d8be6064d0787d96797cdd260b773
SHA1 d3d64198d8e71391ff61fe9031e63db5cdee2b5d
SHA512 b7d469dcaf38339ba8115057fbbf759111e3a9cd442e810ffc86857c84ce58493067d7edb26fc084a5acd66fc018c895db44d1305e5f9350bf2e2f394eab03c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32430cb0687cad223789079afee6ddd77237bf2241acae61f48e380de68ee976
MD5 deac34bf8ca7ea43088b76d6dd7cd799
SHA1 31c8d540bacfcf2f608a3c81d94eac648e05ca0f
SHA512 29c4cf53f5182d7ada4a76c9f6f0364758123d4c45834b97a7bff2d77c469179e5419899b910dafaf41f290b7bd0effdb908d8af1aba18d679ba97b2c0968526
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98ff6c07d264c677121ced8470a848b142bd2d4a72017f102a0c0a3c24878a60
MD5 4013eea1451c00f3a94a53f00bd960a6
SHA1 45a4168af88eb61e528909ebb21e3564535f63b6
SHA512 560e903af3f1d040c3d41f9f4e9c1c402363e2ee86d6d639c3c1b605885a805f2f9bfb60e0b97a456f6bcc5ab959fff072baff7cbfa8852161aa47c4239ea218
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a860d93376beb65d0bf139a0c9b47955d8bad687fcce3037333d558720e9d490
MD5 78bddbb28b47b645074e21bf1c7d5817
SHA1 a190e217dab67e8e6cfeff606c78ab037e49a263
SHA512 112ab6262ab7bf80cc75c95bdf9a14eefa248b33f82511e788af5091a1d713916893fd27b9798de18076ef20146dc23fa1be8bd393b01007b663df4d195ef6e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b33cae0ac02181ae8c81a518ad25024cb1dc8074dfb67d0c59d8c8a9cac24421
MD5 1dd56bf5e0aa2470e9d2e964033f1df3
SHA1 e9445b67aae46cd2c0cc5b4f705ad09d80f45364
SHA512 e9dbd402f5900d6db694a6550241d637940b86144f93192928f1a59bf2b4c12cef5edbbaff6696c060eb0b8c30daec50828b59a969935735d522b11328911a09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 33d8a49006fa5bb4bdbad0f6445899e2502c0e5ede17aea1e5feb958e55ff9f8
MD5 c0bc1b4d5d66ae28a85d5df94ec278d9
SHA1 6bf0f1606cf34865e10d5e73bda5e838c3280b2e
SHA512 95be1e7685282bb05e0f60fb86dfa44424772a197e33b71ccf96c2caaa622ae3764707d8662c8e26d2b04887080ac7c3111ee7b43fd8fba0b4a11decb5f55ab0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f8da105a9c6d4a1a1dae9a557c861c759bf8c7403a20c863c834e96c3504ec21
MD5 f02f50fccd8ece5eae129a4a76025a19
SHA1 a578c75426e231c1bcfbd54452d5082e1cd6617c
SHA512 8bb3da64beda14be35bffdb9ed17f6ed6b30d72ff4d34d7a268781a5b41c5b0c6a3089bfa90d3b78c2ef3377171b74ba6fdaf629161ec3af866e2e55b472f568
MD5 SHA1 SHA512

Submit Download

svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCBCBCABBCBACBACCCCABCBCABBBBCBBBCCBBACCCAABACCAAA.exe
Size 19.7MB
SHA256 d0ce0c1364c4691b60f8c04178d1baf15a8d0c24e1910462ffd61abc52288563
MD5 1bed5c7bc20a3f3093f837576d7a9d6f
SHA1 74199784e4299dd5ad843b6c9f197803ee49c630
SHA512 59d689b907b35ad82e3618d76a16ee90757b09ec2b24c097b76e4f9ecc1fa644b76cfcbbc974d17cbb8060da1028d41220056fd7e0cef17ea18470705eb6f8e7
SSDEEP 98304:4sYA91pH2WpjHrgBFFu416AWvmsYA91pH2WpjHrgBFFu416AWvN7pI:2mHpn6F44IAWvYmHpn6F44IAWvg
TLSH
T18D276B55A2A720FCE0BFD174897AC336D6717C130231879F52BCD65A2F63A946D28B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 3294cf9143def7a8382aadef0b8437e5ed937a9915ba6978f486f1204040df9c
MD5 3b5d7daf277316951f5a4c6453b329eb
SHA1 21d9d6c2589fb170200ac6e4e808a79bc3ad9119
SHA512 fbc57ac517d10e0ffc8fa695a4c78ce14bad02bca43f906083e5a49e028f016019ff243f40488fc9463e3a671e776145f0d8e1bf7806c9e36222ff2c7535d4a6
TLSH
T162112723A0F5DC53F97368C7BB15D9C329E832DABADC6E082306421CA795C338D550E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 86551e0f4875c1b3a961e6dd6e55b5041ca35e1c19f250f321dc6573e4c93e76
MD5 79bd79e0eb14989b4eeefe9193eaa67f
SHA1 5d015dadcbe34e406c41c6705deaa92bad055722
SHA512 a03ebeaa924407dff1edfaf31f330eaff018ec54adf6ae9950ac18d4574f9d6634e535c19d304439b8e105f7c746dd0d84cc30afd49c540a6f77a7a7d60c1851
TLSH
T1F7210863A0F5CC53E973A8C7BB15D9C329E877DAB9DC6E08230A421CA795C338D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/664-87-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/992-59-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/1444-89-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/2324-36-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/2324-26-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/4840-0-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/4840-7-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download