a63cf8486a1665c05f6b04910ceb43ae08f2d2819aea323e1ecf2235b93fc638

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.6MB
Sample260901-2b96vaycqa
SHA256 a63cf8486a1665c05f6b04910ceb43ae08f2d2819aea323e1ecf2235b93fc638
MD5 022b228acf809e9f82106486bf975143
SHA1 15832cc1374866a797359939f95696f1654539a5
SHA512 3ce4edd652b8127b462d4aaba05084ff3388ae85eb017c4cea0cd82b421278dd6bccd6209c60e7c59892bb96396cc075948f379a3d5fea0ff6926d96a8e44d4a
SSDEEP 196608:Q7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouN:QahvQHrc8u3xXJ/f4uUWHy
TLSH
T124F69E17B35A81E5C06AE2B88A474322D7B6BC440330A7DF12D5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458c-15.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458c-15.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458c-15.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
4992	svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe
4340	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBCBCCCCBCACAAABBCBCBCCCABACACBBCCCBCACACCBCBBCABAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe"	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCAAAABCBBAABABCCABCABAAAACBABAABBBAAABBABACCBBABACCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe"	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4756	sc.exe
2692	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
808	cmd.exe
4532	cmd.exe
3320	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
4992	svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe
4992	svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
Token: SeDebugPrivilege	4992	svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1168	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 808	4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 808 wrote to memory of 4492	808	cmd.exe	100
PID 3156 wrote to memory of 400	3156	svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe	103
PID 400 wrote to memory of 4748	400	notepad.exe	104
PID 4148 wrote to memory of 4532	4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	109
PID 4532 wrote to memory of 4756	4532	cmd.exe	111
PID 4148 wrote to memory of 3320	4148	2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	112
PID 3320 wrote to memory of 2692	3320	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_022b228acf809e9f82106486bf975143_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABACAABCCAABBAAAABAACABACAABACABABBAAAAAABBACCBCBBCABBCBACBACBCCABACAABBCABACBABACCAACCABABCABBBBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABACAABCCAABBAAAABAACABACAABACABABBAAAAAABBACCBCBBCABBCBACBACBCCABACAABBCABACBABACCAACCABABCABBBBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBACCBABCBBBBCBBCCCCBCABBCABCBCAACCCACBBBACACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe" start= auto displayName= "UserDataSvc_CABBACCBABCBBBBCBBCCCCBCABBCABCBCAACCCACBBBACACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBACCBABCBBBBCBBCCCCBCABBCABCBCAACCCACBBBACACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe" start= auto displayName= "UserDataSvc_CABBACCBABCBBBBCBBCCCCBCABBCABCBCAACCCACBBBACACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBACCBABCBBBBCBBCCCCBCABBCABCBCAACCCACBBBACACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBACCBABCBBBBCBBCCCCBCABBCABCBCAACCCACBBBACACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBABAABAACABCABCCBBCCABAAABCCBBCBACCAABCBAACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
1⤵
- Executes dropped EXE
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BackupSearch.exe

Path C:\Users\Admin\Desktop\BackupSearch.exe
Size 4.2MB
SHA256 ab8d26bacaab751b2796c5c1a85cb9aaa769d82a72e12d55a05ea06e9689c869
MD5 97b17902539544a0544ed67ac4e6b0ad
SHA1 50987d274fc4426cd7e8a0322f3408b53c974128
SHA512 c7051dac8046c9c69a4c67efcd94868ef895907f3b47bcd9d18eab4ce1f3ce69e88e20bb058cc7409a8c50db878b2cf06a3a2c7ddc1b1d544735969aad6b646e
SSDEEP 49152:U+EG+EG+Ebiw2e+EG+EG+Ebiw2TMlPhwc7Ue8j2f+K3ZCQgzIhNFjGcVuknKHzhR:Q7Upmya6iSNN5
TLSH
T12F167C07F6DA00E8D06ED1788B668636EAB2B8550B32A6DF465087252F77FE05F3C711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5565db932614c41c26817e1277bc7b8f9d032c8e13f242dfa1e94c7f54e2d23
MD5 318814782d56560f40246256b20c997a
SHA1 4b6021a8f0b250d8b5d83c10f457c127ccd7c433
SHA512 286b4ce543508a68b8b61092ff0cbdf49855a8746c1120ac957c04b7ea186bb68075fda516d529ac91f21bb75f0295f10f82b81359165b08b9245c6ae716c789
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edc4687d9e6b95a837f35e80270ba6b617528ad28425ad1a6c4028ec8c95a063
MD5 fb6a156adcdc382ef1f15982894102db
SHA1 d2037574b03a2af9e34cdcb5fa573ced0c8d8b2d
SHA512 3844901f2eed1701e1070d679e249b399aa428b61d68e5c7cc47eb2188e94a68ecf3777ccb28ab41aa357af07cc4b05ada41e51a3443a82797cb22031e39507f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f7dfbe3939925428aa8fec2ee5438d3ead619a09aff9cc54d5c85f6b67a5dc9
MD5 17f9062195ee8f9292f266ada6a2cdf9
SHA1 746be0456cd62b4a0978fad60c5755b873b5f5ab
SHA512 c397cac4eca6428ca49fda9401334b1391a42831c559cb4f75eff4c3b3c2a66ffef9a65e2e3cac9b4f6e169bdc457061bf2811e0432147aae30d4ad4c5f99a47
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49c1db33a82a59608d766a663469b228ea67e887c73b57de652e7cf773743913
MD5 17052eae543f0cac6a5c13acfa7f70bd
SHA1 f0068cba8a2f87f29db7341f99c9bc18a5e8e04d
SHA512 cf8674f3d137842baa258aab2481fae1195e7b9bbab9312e728aa3ea33e37172d98e183a609c6a9ae9465462165331b2265e5477880abcc170dc7c220efdcf71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a22c59e5a773e1aa04fd43f385565afb042253f208ba8384c52157def2c69a0
MD5 4373fe672d127af14f8064cdc2076c09
SHA1 dca8b5f7ff4f1dfbaf08be6114b012efe9c57771
SHA512 70039657b1258b943e15f03d5db2184ecbdd32afbfdd47ba882928c1e6975dd16fbc6b752bc60fd91d035707db90dac43cf984ab62cd43e8bbd6d6e0514cf756
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a9d081f0382b101b201da2ec47315731e57f9158e7ef33d7f28f6ad1dc928e3
MD5 2557acbcf689f50b542e9232173197ab
SHA1 d352d1d7f274299209947509c7815a0bb69b49c6
SHA512 07b847ff02778ed56694948b4d7df23b1cff8caf6fb390707701b1128ad3b272169ef2ee4a11c6eef31c644c5731ad762eee74c58bc18cdc0a7a62f8c990c448
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6ce903c4addf61d7b5f9e8d27501d647058edc5fd2769bc085cbbe3d3c58cd6
MD5 92f81311823db69305c3ac3eb798246c
SHA1 6db99c803c082f21249c596ff65a4368bb7a4ebf
SHA512 fffc99e42c69b9248a62893313ede3c17a994a8ae3c3c933b87bbf808142873239d9b8362e236d6a033e0b6166c22b481bd6b527ee2fc1351286546e229a14b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f4b875e778a95e6b0f58bb85cf700b54fbead6e439dc8653c8f4f294de07bb42
MD5 1f9602657aff0b77d037c62e1a8bb9ff
SHA1 9c905721867e33762f7e545de374ebf465ffc4af
SHA512 fe0b140a550a77950ec032fe17d5e0550eeab040aabc20b65bf10d40285c9a29a61bd183360fc9d8274d36e60c696970452f9bdc39d27bd64f85ccfd5c27218d
MD5 SHA1 SHA512

Submit Download

svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCACAAACABACCBABABBCBACACAABCBABCACBCCBBAACABAABBBBB.exe
Size 15.6MB
SHA256 a63cf8486a1665c05f6b04910ceb43ae08f2d2819aea323e1ecf2235b93fc638
MD5 022b228acf809e9f82106486bf975143
SHA1 15832cc1374866a797359939f95696f1654539a5
SHA512 3ce4edd652b8127b462d4aaba05084ff3388ae85eb017c4cea0cd82b421278dd6bccd6209c60e7c59892bb96396cc075948f379a3d5fea0ff6926d96a8e44d4a
SSDEEP 196608:Q7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouN:QahvQHrc8u3xXJ/f4uUWHy
TLSH
T124F69E17B35A81E5C06AE2B88A474322D7B6BC440330A7DF12D5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 c4f350f1f0ff7d24a4f6febefda1f5256123a15c77f364ab03f47c908c3b5bf9
MD5 9ab3180f9156dc97111301a7a5858d16
SHA1 cbff5c867f5de7d5d19969e661fbc1ded3893858
SHA512 7a900dffda5fee5fca35ad436bed50428c33d86ef15b342b133c5839f43ac03d0a7814c71ab83e018f52ed2c00212ede0e9112df9916363fccb2cf88933f94de
TLSH
T191014262B0FDDC63F13164D74215AFC74CE53BCB685C9B48174C420CA7158B9CE118E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-77-0x0000000005890000-0x0000000005891000-memory.dmp

Download

memory/3156-50-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3156-74-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3156-95-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4148-0-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4148-75-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4148-24-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4148-102-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4148-51-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4148-11-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4340-105-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4992-86-0x0000000000970000-0x0000000000991000-memory.dmp

Download