ede49adbb0779ced6320acc1cc537ad40a8a1534425681bcefed7e108d7fc13f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Size 21.5MB
Sample260831-pr56lsvtcs
SHA256 ede49adbb0779ced6320acc1cc537ad40a8a1534425681bcefed7e108d7fc13f
MD5 f97a1b74237cbcc8634815fd9613154d
SHA1 e16a804316bc235f05c565ac138dff4046ecdd2b
SHA512 36c374e6f0b95d27532275d68e43d958d5d5804d325392d12cd8e3499a7edea3c71c6ae7f9b52fbac6f51f57c0d91a417f70a0323ad562729a3915630805f88d
SSDEEP 98304:i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416AW3:MmHpn6F44IAWv1mHpn6F44IAWvf
TLSH
T197376A5A62EA10F9D4AFD176C6A68332D6707823033157DB527CC63E2F676906D3CB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
6004	svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe
2240	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCBACABBBBBBCABABACBCCABCABCCCBBACCBBCBBCCCACBABABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe"	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABACCAABBACBCBCBCABBCABCBCABBABACAAAAAAAABBBBAAABABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe"	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3764	sc.exe
2764	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
3756	cmd.exe
2328	cmd.exe
5328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2632	schtasks.exe
1364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
6004	svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe
6004	svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
Token: SeDebugPrivilege	6004	svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5328	5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	91
PID 5328 wrote to memory of 2632	5328	cmd.exe	93
PID 1868 wrote to memory of 4664	1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe	94
PID 5100 wrote to memory of 1132	5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	97
PID 1132 wrote to memory of 2764	1132	cmd.exe	99
PID 5100 wrote to memory of 3756	5100	2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	100
PID 3756 wrote to memory of 3764	3756	cmd.exe	102
PID 1868 wrote to memory of 2328	1868	svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe	104
PID 2328 wrote to memory of 1364	2328	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_f97a1b74237cbcc8634815fd9613154d_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABABAABBABBBAACABAACACBCCBBACCCCACCCBCBCCBCCCBBBAACBBABAABAABCBAABCBABBBBCACAACCBBACCCABCCBCCCBCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABABAABBABBBAACABAACACBCCBBACCCCACCCBCBCCBCCCBBBAACBBABAABAABCBAABCBABBBBCACAACCBBACCCABCCBCCCBCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCABBCABBCCBAABCBACABACACAABBBABCACCBBCBBBAACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe" start= auto displayName= "UserDataSvc_ABBBCABBCABBCCBAABCBACABACACAABBBABCACCBBCBBBAACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCABBCABBCCBAABCBACABACACAABBBABCACCBBCBBBAACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe" start= auto displayName= "UserDataSvc_ABBBCABBCABBCCBAABCBACABACACAABBBABCACCBBCBBBAACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCABBCABBCCBAABCBACABACACAABBBABCACCBBCBBBAACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCABBCABBCCBAABCBACABACACAABBBABCACCBBCBBBAACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAACABACABCABCBABBCCCACBACCAAABBAABCBBCBAABAAAAAABCAACAACCCACCACBCAABBABBBAACBABACBABBBCCABBCBBABACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAACABACABCABCBABBCCCACBACCAAABBAABCBBCBAABAAAAAABCAACAACCCACCACBCAABBABBBAACBABACBABBBCCABBCBBABACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACBAACABCABCCCCBACAACBAAABBABCBBBCCCBBCBBBACCBACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
1⤵
- Executes dropped EXE
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d87b04ccb1bd22b6384c27a40f9f13c3341ab7de1225eb01d442f27a0e00366
MD5 d9a09db698acb93afc5e675ffa1f05d1
SHA1 e3620ce381cf9d86fa49ef0a20121e069521322f
SHA512 ffe50dc8aa3dd98f87381558d24aea0f98bbc3e8c0ad5463fe64fea66048924d2d19abe9cf10cda93db808fc879c588b3617f1d387f7a7f1a7fa38906056cacd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fc3915d7bc68d175f9456a00dc8d4424c4879e51ec59925c986387fa0de200f
MD5 6f6fd2b53bc8de426eafc1be63274db9
SHA1 19f42e9b5fc1396e034eb8b3165c7867081c927f
SHA512 c334dec6e1625eefcc10573612c2891ca83a49dad65664eac936afec7ffd7853adadcba276029971a172e14b8c67564ae70f9bd5b75062d2024616a7db06b17e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8317b64df139ef5b17adf58d0f5e9da77cb72325c9ee4921745cd73961cb33c3
MD5 40611e6656cab3dafb185d4b57a38e32
SHA1 805f77b2417810493905455eed5eb22269024787
SHA512 7e1fcaa0370add27765d6ac5ee99e0ccefc07eea6fccd40e0c8925857dbfc9dad74d7fc62e7a35addb30176281b7a747dcdb229bddef99c987439436e2e861d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15561de540c09f55c924a659bff511b8798f75723cda41873a2c50d25e25730f
MD5 e423d29eada4c64b0c6739be0b033ab1
SHA1 94880c90887238955f9da83fe365cf3da79f837e
SHA512 9ff01279a6cdd24fe1d212c0564c21ffabb6d163e56fff727c17ba8c391c012a032f11b79d85268ab4df7e6508368568d04b77438966cb1942f31d803419f33c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 912988d2f1640b2343163438091e3a340b14c8affd14e42d8a01b60781ccf275
MD5 40fe9c3fff081ea3f90e047bfa10ad3e
SHA1 cce9fa66628e7d46318d69a5f2927ee6faa93e66
SHA512 79a68570bc1d18f52422f069482065b9f9b19c48409f7987bb21f98c9a8200da3bda4585f157ad8fc4a87dad10f69169a2532e624a7194d25262bffe5fc23215
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be62de0481769093ed58b7db21441051571395244394a5e0c471cf2f377e6cf4
MD5 cda1704fbbb843873a58f5dda4157847
SHA1 1573ff484ebcc4c51767ad83566f282a4823b85a
SHA512 519b743810d4e5da103691d11990b5f9fd265388eda06a8ecbf181ba2a88367124fe795fabc1d9bae819b013303fd1ce558eca9e45f090916f8833b52d40fe7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bb70e62be9fd00ee5a3eedb1415beef9658afb3a73295532901cffd8607235da
MD5 e48906a5a69e9d0ef680f43e63c8e411
SHA1 f4790afa1151834f9af6d92c21a0c2206ebd16c5
SHA512 0a5d2121149f10f081cf85fb2908da92dbcf532d1596fae55e694ee06a127a88ee041ada5cc38aef7716f0aa53356cbb7f9b3d118dfc9f63802c9e02e8da6af5
MD5 SHA1 SHA512

Submit Download

svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCBAACCACBBCCCCBAAAACBBCACAAAACBAACBAABACCBCACACB.exe
Size 21.5MB
SHA256 ede49adbb0779ced6320acc1cc537ad40a8a1534425681bcefed7e108d7fc13f
MD5 f97a1b74237cbcc8634815fd9613154d
SHA1 e16a804316bc235f05c565ac138dff4046ecdd2b
SHA512 36c374e6f0b95d27532275d68e43d958d5d5804d325392d12cd8e3499a7edea3c71c6ae7f9b52fbac6f51f57c0d91a417f70a0323ad562729a3915630805f88d
SSDEEP 98304:i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416AW3:MmHpn6F44IAWv1mHpn6F44IAWvf
TLSH
T197376A5A62EA10F9D4AFD176C6A68332D6707823033157DB527CC63E2F676906D3CB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 28e9c8531c7d6201334143bd9cac7e34849247fd2e790f167665f4e11022835b
MD5 c42358ce67b746086d69d4682e742d45
SHA1 1e5c65522797ffaa3520f29400e58b24e3bf085d
SHA512 33574ddd9d996d7ddc46c3b98c1d8d38a9683a5a62d58d5bf93ccb956bf05956c87d930ef33f7e59fccd56baa653d1d5753bdd8c92c39968d2483e4afb0eadc0
TLSH
T12911E351E4F5DCB3E93364CF86219AE708A4367EB85CAA15131C1218A7A5C338E114F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3e0e6532b3122a11be7bb501ea21f154540623bbbb4935b8784bfa25470b7742
MD5 ed539c55e11b440196ba676f2ea33802
SHA1 831ad5ece7bcadc8867139b97b68e90b79d2d850
SHA512 43eade40747986909cf8a336caa61641a29a9f46f1a8904b2090e503895f79b4c2dfad8faeab3844b4791e1f9f5f38fd24b931c960327c3cf21bdc5c1e70c716
TLSH
T1BE11C021E0F5DCB3E533A8CF9625DAE708A432BEBC5CAA01171D4218A7E5C338E154E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1868-32-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/2240-82-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/5100-6-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/6004-63-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/6004-81-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download