mofksys | 580b77a22e5a9ef904cbfcb694ad9dbecb940e73b6c8afb0de84d09f79baf458

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
Size 1.1MB
Sample260808-vx2cha1flg
SHA256 580b77a22e5a9ef904cbfcb694ad9dbecb940e73b6c8afb0de84d09f79baf458
MD5 b5ca0ed781e0ba9627d8473851b88914
SHA1 beff4591bd57db37ad8e5b12e74cc117403298a9
SHA512 b61f3f13d86520fbfd0613a7dcaf9cc39eae19c19ed1c1a960fe2f28ac8d1dff3d5a209a2b61f85f63a8e77ba7c44b76a162d506f20ce4a1824695506f05330a
SSDEEP 24576:m5xolYQY6ir5fVFKZ9b75uF0hbYa8MgT8eYWKQg5/QvyaKB/5olaKB/5oO7:hY1413CafqbKBBZKBBz
TLSH
T18E35BF26F64150B7DA8260F054BAA736B939A9350B387EC773E02E652A711C3797D30F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mofksys persistence worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 12 IoCs

resource	yara_rule
behavioral2/memory/4608-0-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x0005000000016b3f-11.dat	family_mofksys
behavioral2/files/0x0006000000016cbe-16.dat	family_mofksys
behavioral2/files/0x001300000001c422-29.dat	family_mofksys
behavioral2/files/0x000f00000001c424-38.dat	family_mofksys
behavioral2/memory/3576-47-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/2404-50-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c427-52.dat	family_mofksys
behavioral2/memory/4608-53-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/5756-51-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/3508-54-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/1496-55-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
5680	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
5756	icsys.icn.exe
3508	explorer.exe
2404	spoolsv.exe
1496	svchost.exe
3576	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5756	icsys.icn.exe
5756	icsys.icn.exe
3508	explorer.exe
3508	explorer.exe
3508	explorer.exe
3508	explorer.exe
3508	explorer.exe
3508	explorer.exe
1496	svchost.exe
1496	svchost.exe
1496	svchost.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
3508	explorer.exe
1496	svchost.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
3508	explorer.exe
1496	svchost.exe
1496	svchost.exe
1496	svchost.exe
3508	explorer.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe
3508	explorer.exe
1496	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3508	explorer.exe
1496	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5680	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
5680	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5680	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
5680	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4608	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
4608	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
5756	icsys.icn.exe
5756	icsys.icn.exe
3508	explorer.exe
3508	explorer.exe
2404	spoolsv.exe
2404	spoolsv.exe
1496	svchost.exe
1496	svchost.exe
3576	spoolsv.exe
3576	spoolsv.exe
3508	explorer.exe
3508	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5680	4608	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe	89
PID 4608 wrote to memory of 5756	4608	2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe	90
PID 5756 wrote to memory of 3508	5756	icsys.icn.exe	91
PID 3508 wrote to memory of 2404	3508	explorer.exe	92
PID 2404 wrote to memory of 1496	2404	spoolsv.exe	93
PID 1496 wrote to memory of 3576	1496	svchost.exe	94
PID 1496 wrote to memory of 4780	1496	svchost.exe	95
PID 1496 wrote to memory of 4652	1496	svchost.exe	100
PID 1496 wrote to memory of 1648	1496	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- \??\c:\users\admin\appdata\local\temp\2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
  c:\users\admin\appdata\local\temp\2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5680
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5756
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2404
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3576
      - C:\Windows\SysWOW64\at.exe
        
        at 18:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
      - C:\Windows\SysWOW64\at.exe
        
        at 18:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
      - C:\Windows\SysWOW64\at.exe
        
        at 18:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b5ca0ed781e0ba9627d8473851b88914_amadey_elex_glassworm_smoke-loader.exe
Size 870KB
SHA256 9606a23c6e3ea1ccfc959a7f01d525693b64ad20b00392030e255ab7f960932e
MD5 a1ab4bf65d039deb1afbf50a53517ff4
SHA1 4c7ce21d89c50f6de97830ea9ff027e44a83d603
SHA512 b4f4e4cb979a7f1bb5b4d8fe5ea45ea0db89576c445119009d7efe75eec4284b88de32d6c0159713fbb94e31b6c5e4f21b4eb8d356f91494376a6d231e8e2222
SSDEEP 24576:Ar5fVFKZ9b75uF0hbYa8MgT8eYWKQg5/QvyaKB/5olaKB/5oO:m413CafqbKBBZKBB
TLSH
T17515BF62B68240F3DA8170B045BAAB329939E13507397EC377E52DB51F521D36E3E389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 089593b46370e1a182027e02550588d1c115a7cf108a6316b802ab54fdae7c5b
MD5 71a318a41f489e55a321903daa46c090
SHA1 4f8f9e29a37900c0ff01dee0a59e7a890c21ddd9
SHA512 464efc9874f8c9300cce6230863019de71bb64fb070f4c7485ff0999b809624a7003feb8806d808fc181d4db848537cb2cc74f7c6a41eabad3c5d1ea7c9b40ae
SSDEEP 3072:YvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unBo:YvEN2U+T6i5LirrllHy4HUcMQY60o
TLSH
T12D24193BFE00713EE96796F02466B1AAB6251E321F919C4BA3916F4534B0213B1F971F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 0bd53f0bf353e5ce7d8388c935107405af91e2ced87513cb43430b1f5eb08365
MD5 88bf54448795c5013edc922b0f013605
SHA1 d43d9b55c6ee051da2649d532ccbb738b5a2ed3b
SHA512 890b3a420f0d9b4cde9905e9648438de34a481dae5a9a6116333f6791947d6ba7f80f59bd52724d9609815a50e1324b78596b5f39e71d51424d8a6f52d25c644
SSDEEP 3072:YvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unBv:YvEN2U+T6i5LirrllHy4HUcMQY60v
TLSH
T1D724292FAE40602BE46B89F058A6B2A6BA352D750BC05C4F73D2AF563572503B1F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 207KB
SHA256 8647ee3f5b4066b4d13d0a374a0b7581f0c49a7296603e3ea45fe93b7d84baca
MD5 f0d2b4bde7b8263a787b07d85f07445a
SHA1 c3064ff5eecea0950b273d713f54e0521a23a504
SHA512 aced5520a125a0c0c9260dccb39713e1cdcfc12d9ca204c50adf66019a6040a9ab1a8bc432d89c14d04293f4c510cb446b052f5e9cee3ce835d581eeb7bc65e6
SSDEEP 3072:YvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unBk:YvEN2U+T6i5LirrllHy4HUcMQY60k
TLSH
T146242B57FA50213EF4638AF45866E5BAB7212D251B829C4FA3D0AF4834B1017B5F932F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 206KB
SHA256 7d1dcad2f4d1969df0af7af282215be0f433589d8f47300a26b1015face0fc41
MD5 72dc086d38121ac96f25d689db889482
SHA1 72393ba6a60c46b572d481d8c63d7b8c3818f58e
SHA512 c048ca9105014f438b389cec53dbd9446c9357fe42279b968b66dda4d23130992815566df5c5c433682108d228d5f495966307900c32bf373866002f1fd2b499
SSDEEP 3072:YvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unB0:YvEN2U+T6i5LirrllHy4HUcMQY600
TLSH
T16E241A1BEA04602EE477C6F16516A1A6B6323E711FD0AC0B63C0AB4638B1567F6F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 206KB
SHA256 581a3554bcf807425d8c02987de46a0b0af4062e684c505d519dc5dceb8c1b91
MD5 fd7dced72477488a0d8c21208fcf3015
SHA1 23ecdc875b19f3132eea7ceed0e11cfc8359baeb
SHA512 667ac89efd6a8a61b97adac1b70142219a801794879d47e14d3b892e85e723dd3bf53e115a3985b1ce91388036f94d6188b20dd70ccb6fd9eeffe70c1663ddfc
SSDEEP 3072:YvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unBi:YvEN2U+T6i5LirrllHy4HUcMQY60i
TLSH
T1AB24072BFA01701EE853CAF01866F69ABA322E351B819C4F6790AF553871513B6F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-55-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2404-50-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3508-54-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3576-47-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4608-53-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4608-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5756-51-0x0000000000400000-0x000000000042F000-memory.dmp

Download