0b3d0c2e589ce53dd790568019d2cddb797edbac8a0b3633e886b11ef9f1e770

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
Size 13.8MB
Sample260812-xf75tsshjf
SHA256 0b3d0c2e589ce53dd790568019d2cddb797edbac8a0b3633e886b11ef9f1e770
MD5 da2696c33d685c51b8734cacc9f5afaa
SHA1 29ddd0fe4691a8a2ddade9d0f25213eaea67cbb3
SHA512 8348770a2ec4ae83ab85dcdf15c568ffd3a67da3aeaef1a573906756690982c289568a8243a99d26d93f780fd57c6d5c619952b917e59db95d1d34f841000cf1
SSDEEP 49152:U+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+EeW:K1MbQ9yDAD7KjjqkusjmqMhI
TLSH
T146E68D19FE9680F1E96B90744CEBC27BDA707A1146334BABDA89C61F6E337515C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
2612	svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe
1636	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCABCBABCABCABCBBBCBBCAABACCAACBABCCCCCBCBABBAABCCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe"	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABBCBCCABCACACABACCCACAAACAACBACBAAABBABCACBACBCCABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe"	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5840	sc.exe
3240	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3916	cmd.exe
1788	cmd.exe
708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
1636	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
1636	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
2612	svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe
2612	svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
Token: SeDebugPrivilege	1636	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
Token: SeDebugPrivilege	2612	svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1788	4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe	91
PID 1788 wrote to memory of 5856	1788	cmd.exe	93
PID 4368 wrote to memory of 2936	4368	svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe	94
PID 4840 wrote to memory of 708	4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe	97
PID 708 wrote to memory of 3240	708	cmd.exe	99
PID 4840 wrote to memory of 3916	4840	2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe	100
PID 3916 wrote to memory of 5840	3916	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_da2696c33d685c51b8734cacc9f5afaa_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACCBAAAACBABABBCAABBCBCCBBBBABCABCACABBBAACBBCAAAACBCBACBCBACABBABBCCCBCBCBBCBCBBABAAACABCABCCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACCBAAAACBABABBCAABBCBCCBBBBABCABCACABBBAACBBCAAAACBCBACBCBACABBABBCCCBCBCBBCBCBBABAAACABCABCCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABABBACCBBBCACBABBBACCBCACAACACBAABABCAABCBACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe" start= auto displayName= "UserDataSvc_AABCABABBACCBBBCACBABBBACCBCACAACACBAABABCAABCBACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCABABBACCBBBCACBABBBACCBCACAACACBAABABCAABCBACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe" start= auto displayName= "UserDataSvc_AABCABABBACCBBBCACBABBBACCBCACAACACBAABABCAABCBACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABABBACCBBBCACBABBBACCBCACAACACBAABABCAABCBACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCABABBACCBBBCACBABBBACCBCACAACACBAABABCAABCBACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACBBAABACACACBBBAABCBBCABAAABCABBCAACAABABCBBAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 51a580aaeeb0456bce8f2d7cf7742215b1a47f2e959c1a892cdfbb9564b1c539
MD5 e0935b244ce0bd302c11d48ea64d3e7b
SHA1 51a424ee1613c160cbe4f3800703cdffbff1c12b
SHA512 e684ea1a1904381c7086773b80c8f2ea5ea96007b27938fbbebe800798930fb1cc20fc32ceb2f828e4d3615b817d4f30357203f8c5ff6d2719579d265a4ec389
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\qap`g`v~dtlq
Size 10B
SHA256 09249d0cda81c86cfc9c64de0ce3ce937444a3640cdc269e0713d0aa9c0b00ee
MD5 4891ff54e40d70eb927a55f9497d6354
SHA1 48a14201339e686009d582006ed436338cbb2087
SHA512 a8798aec612bb4acd3b253a145c56d35d04bd4f60f330f242ff0a5f8f301623d54f4cc3885db2302e1a0a36f49c7848ab27df3072add12e5432bec7292b228c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\qap`g`v~dtlq
Size 10B
SHA256 af878996442cd612c81374f244e20b5327f93b45da6dcf123c6f2d80cfdc16fe
MD5 176770452222b46e110345f43955d192
SHA1 35fda31722b944301883bfa303a4d9c0f65feb02
SHA512 208a8fb94566527ca7d33aa690e86f0684626bd1f12f7cd7d742ea922592c94d8dba0ac564c9ccd1657e67cedbdf7dafa100b726d72b400552f3db25188d20a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e7187231ad306b31934e18f597f4372584ffe0ed3ea07372bfc485d8590163d9
MD5 3a0541f34ede3326c0839ff13b2f1415
SHA1 de99b846aa655e880ace6d698c2ae1f2ec6c3c75
SHA512 187f61d6f02ac2bc2e6a120afbdaea7f50a0726bcc7b503663c6ee3772cface12b64554c14ee74648cef51f5f390208dc8f2db9de91c3f2a078d7ead9794c7fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a8faa0facf32dd2d559a8c8d39175c91209cf4bc3060e3cd7d4d826620bf14d
MD5 ba466d3167c87ca015fbdf809d0bfafd
SHA1 10a4fdafc5d68df2d57c91396231a2310753cc99
SHA512 3cab1d6d7be5e308b43c51356b2b1c7c7eb9db5669a0917e2055166a560bc37addb602894642553131a23ca1217923c0b5a8befce670b9c2f7fec5c78ddf7d28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9c618afeec863ae9bebb6a62489a18cfcf65f7e36e09a78e631fedccb0733e6
MD5 23eb3b71552ba5671b3c115a1ee57b2f
SHA1 3e4599ea6f16aced13d2e8234e14482c4bd02e30
SHA512 550e7ef47c5b2bf4116a6a7240a68e94992d448378cfe2e3cdd28851fb634b89eef8d70f9553729c5aca56c214dda5f47af4db82aaa794282b00db47feccf6b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2db43b64b0579f081cd8cee5a777087b68218b14efbe77108efa1f98a2758039
MD5 8d55206410c38ab98554ebd3edd859e6
SHA1 6798f9a5b22f862c3733562602c72b4e20955e23
SHA512 8b5b3a3f446f99860efd7ed1c90671f5cadc60cdbc78b6618659f8f44db65498c12396fa086d3055234bb2c7181e16f8978d74808157e447514840f41de0a0ab
MD5 SHA1 SHA512

Submit Download

DenySuspend.exe

Path C:\Users\Admin\Downloads\DenySuspend.exe
Size 1.3MB
SHA256 2992ff7422de8824660ca00f14cc88b1ef502e61c1bcbd1025d457c4a016c8ae
MD5 f114b7ed8250ffca4062b26c15271bac
SHA1 fbea3f384ff849339c43a1d9640171bb44ceee5e
SHA512 ebcf3520411c0028a03efe7b3ea575d2f4bc14285c7b1427343be09f2598d9270ac2317db4ea91a98cdb52785c00df237d5fd883495910d6e1d3fdd8252ba3e5
SSDEEP 24576:m9+EM0q9+EM0q9+EM0q9+EM0l29+EM0q9+EM0q9+EM0q9+EM0q9+EM0lwb69+EM8:U+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+E9
TLSH
T1E2553B09F94344B1D92B50B04DCFD3BF8A60BB2587128DF7FB4ECB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 681ed2f76399b8699ec2c6e18f844099041547882d643f4a72af0d736fab89e1
MD5 99c8ef09a22e2b7b75563737b07fb713
SHA1 fd8a2dbafecb8572922485ff00820d6407832ef6
SHA512 9f8b3b78c51a210fde3cf2ce61f8582fbec00a3c7a0983c9f89730779cc43be9e515edde6d96d9ac4e79cdecfe1a1e2783ff0abffafe020b0673fd277ecddb5d
MD5 SHA1 SHA512

Submit Download

svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCBCBCBBBAAABBAAACABAACBACCACCCCAAABCABABBCBABC.exe
Size 13.8MB
SHA256 0b3d0c2e589ce53dd790568019d2cddb797edbac8a0b3633e886b11ef9f1e770
MD5 da2696c33d685c51b8734cacc9f5afaa
SHA1 29ddd0fe4691a8a2ddade9d0f25213eaea67cbb3
SHA512 8348770a2ec4ae83ab85dcdf15c568ffd3a67da3aeaef1a573906756690982c289568a8243a99d26d93f780fd57c6d5c619952b917e59db95d1d34f841000cf1
SSDEEP 49152:U+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+EeW:K1MbQ9yDAD7KjjqkusjmqMhI
TLSH
T146E68D19FE9680F1E96B90744CEBC27BDA707A1146334BABDA89C61F6E337515C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8c37132500454933f3ca403a18faa406be8ff65721bd2f67c1708a4c4c721c2c
MD5 2cfa8a07a2c17f06843e337bea64c0f0
SHA1 5c7e254b1e7017853ee0a540543d0007ed14d8d8
SHA512 4ed12f35517cf5889eb8b2b7e82318dfffba77b13bb16c3f35b8f8e5c695fc0064c547b38d38f692bcb283f4dcfa1166fd5b14fc67b0091042a285c4fc8d0897
TLSH
T15D212C6184F5DC97F973A84BA11ACBC70CB575AF983CAA0853486118F7C5834CD190F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5f1bb1a5c5f1a1b860b9d4426f762e9d42e5ff6405cb2cc37c1c2bd129008f6a
MD5 fa61cc6f091c8d2b7cfbefd71adc8533
SHA1 9198b0e7ea9f87b52b8a690a1ea93a6a3e7f1bfa
SHA512 328a7f8d7c7a9749e4beec7eb6ee35b6e1241fcc57409312f8534be531c9f147fd1c6a47e6aa1f074b4270e9e4717c757c2f460473984f43f5eb27fa3818af09
TLSH
T16F11272184F5D897F973A84B921ACBC70CB571EF682CAA0853496218F7C5834CD194F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1636-94-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/2612-93-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/4368-70-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4368-95-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4368-48-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4368-33-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4840-91-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4840-0-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4840-69-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4840-47-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4840-22-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4840-11-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download