83f42031d498e81edde6e084c0b24a7b209bf8a2a333f4e1ba203687b5a50551

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
Size 34.6MB
Sample260810-ec4n5avtev
SHA256 83f42031d498e81edde6e084c0b24a7b209bf8a2a333f4e1ba203687b5a50551
MD5 e9b09c9db75554f4e215661c456dc1f0
SHA1 dbccc9438cefded25077acb09ed7143d4b6b3e79
SHA512 98d5e713e968079dc81fd5aa8e297c360259dcb26a32252ff9f77e09d144fee3344aa9a3411fb3c5fc98e3a4c2f2108970d5ad476d86e37436864953c7add31e
SSDEEP 196608:kFlfFlVFlfFlVFlfFlVFlfFlVFlfFlVFlfFlVFlfFlVFlfFluMqz1tIDewjqkjib:i3Z3Z3Z3Z3Z3Z3Z3ez8Kwekyx
TLSH
T1A487E01AFE9580F0FD7BA43458ABD276D9317E268432875BE9C5F60E6F33A114C19232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c470-18.dat	INDICATOR_EXE_Packed_Fody

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c470-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
2444	svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe
4168	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBABCABCABCBCCAAACBCBCBBCCBBBABABBCCAAAAABBCCCBBCCBAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe"	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCCCACACBBACACBCCACABCABCBAACCCABBBCCBABCACBABBABAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe"	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4764	sc.exe
1076	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4636	cmd.exe
5816	cmd.exe
5972	cmd.exe
1140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3464	schtasks.exe
5624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
2444	svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe
2444	svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
Token: SeDebugPrivilege	2444	svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1140	940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe	92
PID 1140 wrote to memory of 3464	1140	cmd.exe	94
PID 3140 wrote to memory of 4236	3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe	95
PID 940 wrote to memory of 4636	940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe	98
PID 4636 wrote to memory of 4764	4636	cmd.exe	100
PID 940 wrote to memory of 5816	940	2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe	101
PID 5816 wrote to memory of 1076	5816	cmd.exe	103
PID 3140 wrote to memory of 5972	3140	svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe	105
PID 5972 wrote to memory of 5624	5972	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e9b09c9db75554f4e215661c456dc1f0_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCACBABBCACABCAABACAAABBCABBACABACBAAAAACACABCBAACCBCCAACBAABABABBCBBBAAACABAABCCBBAABCBACCBABBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCACBABBCACABCAABACAAABBCABBACABACBAAAAACACABCBAACCBCCAACBAABABABBCBBBAAACABAABCCBBAABCBACCBABBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCBAABAABACBBCCBABCABBCBBACCBBCABCABCBBACBBBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe" start= auto displayName= "UserDataSvc_ACABCBAABAABACBBCCBABCABBCBBACCBBCABCABCBBACBBBBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCBAABAABACBBCCBABCABBCBBACCBBCABCABCBBACBBBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe" start= auto displayName= "UserDataSvc_ACABCBAABAABACBBCCBABCABBCBBACCBBCABCABCBBACBBBBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCBAABAABACBBCCBABCABBCBBACCBBCABCABCBBACBBBBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCBAABAABACBBCCBABCABBCBBACCBBCABCABCBBACBBBBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBAAACBAACBCACBAACABCBBBCCBCABACBABCAACCAACAABCACBCCCABBCABCCBCCCCCCCBAAABABACBBBACAABBBACCBCAACCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBAAACBAACBCACBAACABCBBBCCBCABACBABCAACCAACAABCACBCCCABBCABCCBCCCCCCCBAAABABACBBBACAABBBACCBCAACCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACABABCAAACCBACCBBAAABCBBCBCCAAACCACABABAACCAABCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
1⤵
- Executes dropped EXE
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f28d8f72b2cb38fb3b0457a2730aa97d4e3d90535b76c0c8d4f08236f61395f
MD5 e24456abac15d24d35ddb5e66dcc7c09
SHA1 07e7d14e2db42b8f82fc02e30864846cb79204f8
SHA512 da4b9d19201f196dbf7d7cf7b6b6d23f32c4629407a312d986c3a7ec60bb90f766b5cba297cdd0136dd18c3238884edeefce2540afec4042ae1278ad0c11eeff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4aa721f1aea3c5301623407b968f41d2621d98075702956759defa6bbd6c5c63
MD5 daee6dd708be1dd2058eebf0697206da
SHA1 3e32e0c8f13f89a8a24125919479828b7e8338fa
SHA512 c432cbd74c78e583a40511723e95447cd4cbbf64e4f86b26ca1fc181cbb2fffd2a2bceacbfa72d9c77567cec42130dc430751f6d7ce65cce72fdd956d5d06e3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b340e9cd7cac3c5fca912ec921e0b77bf99e1e34e11b9074a180c6b86020761a
MD5 fdb235bac0cd7eb4c2dbfadcf161ba3b
SHA1 f777897af20e91ea8dda4e910bbad418e286152d
SHA512 e1ebf50b5cbaa6fc5d96eac3f94863f3454abdb54ee1d990ccf7ed41ed22457bfa700e4fc793f21283496331b84f7b5d2dd610599e254a873424f1015c46fbcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ece1adaeaffd9fe73cfacaa57a7e31fcb82c19e3d5ff00819e04cd00a4f3df35
MD5 9b6d471736f49a0ccf209285b85d0bed
SHA1 5dc93700e2e52c62501e196f9a673e19706bf45f
SHA512 78cf86d111ca9d5f0aba689daf49e5a2b213de1e90e378869bf7321310ea68c2a30ea514c82380a48f36c4bee9c3a9234a31b1dd1a492c82cccf21e7ebcadafb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cac521f96d6ad5aee1821a1b3d574b8a456d911db135ac5cfac0aeedc3224f9d
MD5 44c1a9dabb0ff2f5e256693f23ddf21e
SHA1 c8f27b88a997a2a0eda1b70ea63d774fe9244f5f
SHA512 ab5918606c278fcf239472ea3e5b4f65f1cef89759c69782988cb9f68e92f96cdd02527c109cbc82f4e7e43fafea5c86a398a95ba2cfc64720d5d1e96b54d5f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ad74f07670c5584b9b3524b0eb2409975038449242391ba2f07dd61a4e48349
MD5 c706b678a13733473467ac4c6074f90c
SHA1 1fb88798b983dda5e576e5eb428c490515f35d89
SHA512 b7eac9b42ea090f7735ed703e1530a23323757db2df7363bb2c56cbc6a242ab2a34cb0aad9812d4568bb4203e99261cc7a774d5ca2cd45b7e3896ecff38bb8f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3d9f2302ad7e72eb3fe90d8204f2d53ce702be02a7e4a1189477206766562b00
MD5 483b2852ec03f991f54f69ce223b1205
SHA1 42967dfbb6d73661cc787fa3a7547775fc0f8827
SHA512 0e4e23c2b8116ee9385b7d67a478b9787c1ede8915b46cea95380148ed72d2adfd8ca3b7af55a43eb5d6c22f805bd564aa3ab9ec0ef321d75d8fa96b097c6d0e
MD5 SHA1 SHA512

Submit Download

svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBBBCBBAAABBBBBAAACCCBCACAACBBBBABBCCBCCCCCACBABC.exe
Size 34.6MB
SHA256 83f42031d498e81edde6e084c0b24a7b209bf8a2a333f4e1ba203687b5a50551
MD5 e9b09c9db75554f4e215661c456dc1f0
SHA1 dbccc9438cefded25077acb09ed7143d4b6b3e79
SHA512 98d5e713e968079dc81fd5aa8e297c360259dcb26a32252ff9f77e09d144fee3344aa9a3411fb3c5fc98e3a4c2f2108970d5ad476d86e37436864953c7add31e
SSDEEP 196608:kFlfFlVFlfFlVFlfFlVFlfFlVFlfFlVFlfFlVFlfFlVFlfFluMqz1tIDewjqkjib:i3Z3Z3Z3Z3Z3Z3Z3ez8Kwekyx
TLSH
T1A487E01AFE9580F0FD7BA43458ABD276D9317E268432875BE9C5F60E6F33A114C19232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 56a8f0f5ca210763d2706405b25dfe830229549c5814017a2aa26f75ff4cc6f9
MD5 cc62b890fa724614be043244ee67dbc0
SHA1 8b9b508adb6b4de87716516cffd2cc4cb6f02983
SHA512 8185ef4f72aaf7fdd908f92235e629d7476b9eb3effc283da98f664aa03ff81beeb9106e89cf85074a57b7a5358aec612a641ab4c9c56fe9c333a1f9f6e43970
TLSH
T1F3014E81E4EAD467EE332CCF811E8FA20CEC768F7454AB24124C061C7B59C26DE654E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ba2a4166d444d5e7fdc29241dea1f9b3fb2deb4c709be33fba98a852f721a00d
MD5 cfc3a4bd6024977c5ac2b1cb4d927fba
SHA1 8acdaf4dc2c33d84e0f66ef83a306bda53dc6848
SHA512 a037bbbf86e3a8e40c816e3859040b57b32b65c89ba3436a58ab9590292a3f58ede4fb3f2b7b9542ea3eee0897b542ad7ce8cbbb5ba0dcfbe778044566c3bd87
TLSH
T1E7112B51E4E9C873FA336CCF912EDFA20CA8339FB8585A50124D4718BB99C32DD654E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/940-6-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2444-63-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download

memory/2444-87-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download

memory/3140-32-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4168-73-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download