5f0da7e630dfb36440aa4f73fddda42eff861ef48295bb8b4620adf8e7923ab7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.4MB
Sample260910-jt2cjsszbs
SHA256 5f0da7e630dfb36440aa4f73fddda42eff861ef48295bb8b4620adf8e7923ab7
MD5 00dd60e4a12ab80c5cd55f21412cb160
SHA1 fcb4d64f8017ffe6248f932b2d888c8395e58df8
SHA512 93f8ae03740d532a7e8631122060188e97ec76da22f468d637a4e93fbb51b2f7d25fd1c646cb60b84eea5604f6ffa450ac780cc10c4895b6f3c03481d0474c94
SSDEEP 196608:A7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouk:AahvQHrc8u3xXJ/f4uUWHx
TLSH
T18FF69E17B35681E6C02AE2B88A474323D7B5BC440334A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245e0-14.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245e0-14.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245e0-14.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
3360	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
3456	svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCCCBABAABBCBBCAAACCBCCCAACBAAACCBBBCAABCABBAAABAAAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe"	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCAACAAACCBBACBBCCAAAACCCBACCCBABCBCBBCCBAAABACBAAACCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe"	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1780	sc.exe
3432	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2196	cmd.exe
3876	cmd.exe
4736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
3456	svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe
3456	svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
Token: SeDebugPrivilege	3456	svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3876	2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 3876 wrote to memory of 4532	3876	cmd.exe	101
PID 2000 wrote to memory of 4736	2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	106
PID 4736 wrote to memory of 1780	4736	cmd.exe	108
PID 2000 wrote to memory of 2196	2000	2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	109
PID 2196 wrote to memory of 3432	2196	cmd.exe	111
PID 760 wrote to memory of 1412	760	svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe	114
PID 1412 wrote to memory of 2764	1412	notepad.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_00dd60e4a12ab80c5cd55f21412cb160_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABABAAAABAAAABAAACCBABCBBABABCCABBCBBACBBACBACBCAACCBBBBABCCCBBBACCBACABCACBAAACABCBCCABABBCCCACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABABAAAABAAAABAAACCBABCBBABABCCABBCBBACBBACBACBCAACCBBBBABCCCBBBACCBACABCACBAAACABCBCCABABBCCCACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCBCABCCBBBCBABABBBACACCACABBBBBACCACACBACABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe" start= auto displayName= "UserDataSvc_BAABCBCABCCBBBCBABABBBACACCACABBBBBACCACACBACABBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCBCABCCBBBCBABABBBACACCACABBBBBACCACACBACABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe" start= auto displayName= "UserDataSvc_BAABCBCABCCBBBCBABABBBACACCACABBBBBACCACACBACABBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCBCABCCBBBCBABABBBACACCACABBBBBACCACACBACABBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCBCABCCBBBCBABABBBACACCACABBBBBACCACACBACABBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCCBBCCBAAACBBABBCCBBCCCBAABACBBCCCCCBACBABBCABBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c56532d74bc992135a3ecdaf9ea21ce518427bd36d284e92ad032cee2d995fe1
MD5 3b23b75a12a89945f572a32aaff03013
SHA1 6592e7fcbb970f3306977760c5c57c653357a28b
SHA512 1bc8e7a83f1f99e5f50e9b8584c08af42c3488c5d6673375d05ce4b6f3023803ff8b743697da6311e798e76571e6d6ea4cc0e2144768ba01928e7f218ffaf909
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c5d2e8837593f71b375a5619c20791fda7236e8c91747562c7eeda517d42d50
MD5 152c5aafd8dd78b7b7d81f7bae268fef
SHA1 21757691f125505cbf6933ac3dba8caf09b87023
SHA512 8e06e4de6ecfd4a6161ae97a5001cd4505910360b19cc2ec32818af9912f1fa852b54d61f298e60b0096a3265d123142ff5008d9ce95865a9852d89e2bfe1bb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 107bd331c97d14a9fc55e125ec7953880db2eac54c996a207053bcc9b9ea7c41
MD5 d91682d4b3ce15f4e0f1378b7548d339
SHA1 1d4041c7fa020aa2cecedab8889b7270c9a87f8b
SHA512 784596ab18096413ce40461d23acf4f080a9f75afb1d32fa81d58b2c26d7c1058dbd7b8c1a2a0e15e2080dc6834acf216a0784b81f97e33488521291e513790c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f974dd7501e88953bba3b9caf987bb25362b33aebdfbe7bf3106039a75f63a5
MD5 f1f910fded6f0cf872244fd410a4ace1
SHA1 978c73100e83ae5f080842b8c57580c07b2219cf
SHA512 5380703db254ef0c098574feac62b7b2486f1a03f220dec7c1cc6dafde6de740ac6c60a235134e82579f47bd378aa8695807ed7ad40d91261db185b751e56baf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 63d085665be2f91186f90d465ca23577733a4c0a915301ae0b25090b5976d783
MD5 893d9d78f25f6ae24c95ff4c0759c8b6
SHA1 2ce516e49b4de634918692d3467eb04bda7bab06
SHA512 e1bb49bbc783e56a129b481cd1a97c0503e08a63a000971ffb06a14ad89b1c9ac39cdfd6a90717d445c9cd00a4c8238e037377e3ef8dd65db9eb82696ad82864
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 233a6fd988082e9ff675e780320c4d97ccb516127eed778fdc57b4a0867f58bb
MD5 6f6e8d23c13d7c6bff4b226b8760a556
SHA1 2248742651436fd7f3d8399bc01b51fc0bcc9018
SHA512 3c7cad873f2dd8d2d884aadd3e7e29f815f145f389b5971506ff44067f57f58fe71c2696146aacd460e3ad03322221eee556e9ccba41171699855dbbc71a13f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 80b5e94b34c19918145ae70d7bf81d7f3f3df4d057e1a29eb538c81020032397
MD5 fb44a9cef9b6b009e0ebc17c0a856481
SHA1 f0365cd630e6ef20ca20bc22410ec1d35c67da2a
SHA512 70f91c20bd19021ebd4bea3fd70175b62f9d5fde961f457e3c198e2850bb3781e6d82df5417e18422793dfee993ff4bb0e93bceef68363e3b3c93432a5165e2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c4c507870843caddfa9b303fac0cf54a4aa4873fc2943b33e3e8a9a48c253f77
MD5 e6c212994eb719692a514fb6148830e6
SHA1 feb9edca9fb88ec6a9ac5cabf0e6eeb5e028fa35
SHA512 df1ea2e2f72151ef01113159bacd833a1df0b9f8612d6758b600b5987da88fce2eb1d0ea90201b14d4c5ccde2c1b6e660bb07735ae39ab2c491aebbc983c1437
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e0712d7501905a49eaa756204bf17cae5ebf0f603bba4e277868df587e1496be
MD5 884296a9f89651bc2525960e29df0b75
SHA1 0aab411fb17c83444605077c1ad268fbc1709b47
SHA512 7bb86f6976ed775629afe3a68d85f8afae4b45afe72dd58b51466301c2f25a8f3031c7ada828a15eae8117e1f6d2b717e116e6f89b294113a61b0cf82eb681d5
MD5 SHA1 SHA512

Submit Download

svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABBBCCBABBCBBBCCACCCABABABAACBABCBCACBACCCACCABBBB.exe
Size 15.4MB
SHA256 5f0da7e630dfb36440aa4f73fddda42eff861ef48295bb8b4620adf8e7923ab7
MD5 00dd60e4a12ab80c5cd55f21412cb160
SHA1 fcb4d64f8017ffe6248f932b2d888c8395e58df8
SHA512 93f8ae03740d532a7e8631122060188e97ec76da22f468d637a4e93fbb51b2f7d25fd1c646cb60b84eea5604f6ffa450ac780cc10c4895b6f3c03481d0474c94
SSDEEP 196608:A7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouk:AahvQHrc8u3xXJ/f4uUWHx
TLSH
T18FF69E17B35681E6C02AE2B88A474323D7B5BC440334A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 fb5dc20d98bf405cd3181282ac4b20e24b5b127109557b4019ac8aa8b587a771
MD5 f0481ea4a05fcde4fbf44170b0ca7d76
SHA1 f13b9d3a863cedacc2a2059db790827a0b3bb5b8
SHA512 63cc0bd7f69144c0bf7640ec112534d23fad18701e629af2be625521fad0260ab32c19acb238b39f00faa2dfa262cb8ffb1160e05965a8413a16aea11f15cab6
TLSH
T10F115E62E1A5D897F031A8CB53359BD70CD86BAB781CAF54320A8218EB05C7ADE154E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-76-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/760-35-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/760-53-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/760-117-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/1412-88-0x00000000053C0000-0x00000000053C1000-memory.dmp

Download

memory/2000-10-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/2000-62-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/2000-87-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/2000-36-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/2000-23-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/3360-95-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3456-118-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download