22ad78f4ff31b0a2757bc22ff93a119e1e75b19139a596dc2192c319fea8ff71

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
Size 10.1MB
Sample260819-egkf2sch26
SHA256 22ad78f4ff31b0a2757bc22ff93a119e1e75b19139a596dc2192c319fea8ff71
MD5 edf428a069e855dd35a823bc096f9e4d
SHA1 58a2f52a048f7c2bddec0eb0b7a7f40f20fb7f75
SHA512 0c3717d7c9f8621c8c22b25912bc33222df303112b8c8789749df73c26bb662bd7c731105704269dd62401301842cb09790a5af8a6e06297ed588262fd1b30bd
SSDEEP 49152:U+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglV+ES+ES+Ed:DYvYu1MbQ9yDAD7KjjqkusjmqMhw
TLSH
T1D1B69D29FAA4C0F1F96B943898ABC376EA717A110933574BCAD5C21F6F336915D28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
5440	svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe
1208	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCCABACCBBAACAABCCBBABBCAABACBBCAAAABBCBCBAAAAACAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe"	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCAACBACCBBBCACBBBBAABCCBACBABABCABCABBBCACAACCCACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe"	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4356	sc.exe
4612	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5680	cmd.exe
4848	cmd.exe
5744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
5440	svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe
5440	svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
Token: SeDebugPrivilege	5440	svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 5680	2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe	95
PID 5680 wrote to memory of 2572	5680	cmd.exe	97
PID 984 wrote to memory of 2020	984	svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe	99
PID 2400 wrote to memory of 4848	2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe	103
PID 4848 wrote to memory of 4356	4848	cmd.exe	105
PID 2400 wrote to memory of 5744	2400	2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe	106
PID 5744 wrote to memory of 4612	5744	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_edf428a069e855dd35a823bc096f9e4d_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCBCCCCACACCBBBAACBCCBABACAAABABBCABCCCABCCBBBCABBAABBBBCCABAABBCBCBCABCBBBCBCACCBCACBBBAAABCBCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCBCCCCACACCBBBAACBCCBABACAAABABBCABCCCABCCBBBCABBAABBBBCCABAABBCBCBCABCBBBCBCACCBCACBBBAAABCBCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBABCAABBABABAACCBABBBABCACACACCBACACBCBCAAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe" start= auto displayName= "UserDataSvc_ABCCBABCAABBABABAACCBABBBABCACACACCBACACBCBCAAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBABCAABBABABAACCBABBBABCACACACCBACACBCBCAAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe" start= auto displayName= "UserDataSvc_ABCCBABCAABBABABAACCBABBBABCACACACCBACACBCBCAAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBABCAABBABABAACCBABBBABCACACACCBACACBCBCAAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBABCAABBABABAACCBABBBABCACACACCBACACBCBCAAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACAACACABCCAAABCAACCBCBBBBCBCAACACCCCCAACACAABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
1⤵
- Executes dropped EXE
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 20.7MB
SHA256 d320822e21dd1f7eff8a18ca62e47e740b7c58487180704a2f598d9dce1dff98
MD5 a4d5311fcb73f4de06dc440f34675e93
SHA1 83b7583df7c8d3039b8466885d822840b8e1a6a7
SHA512 1b14367f4b06b21fe8a91a7c360029e8472708cfe06373c5f0df4f9e7f7331d6be817a4c04ca277d39079bdffd20aeac8e65fbf82cc70a52e9d01ea3b04a5d64
SSDEEP 98304:DYvYu1MbQ9yDAD7KjjqkusjmqMh0YvYu1MbQ9yDAD7KjjqkusjmqMhMSc7Ej6w:e1tIDewjqkjiqMT1tIDewjqkjiqMfL
TLSH
T19D279D29FAA4C0F1F96B943898ABC376EA717A110933574BCAD5C21F6F336915D28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 3.3MB
SHA256 716376461008ae86b2931a02577d3a2aaefb903d0ad0fa72bc31bdd959c46f28
MD5 411087b5b1c78ff80bb4c659610a03ef
SHA1 d60701b419be86496af49030a633d1b9899eb555
SHA512 25b8c22b442189d0779199f3edaa21a7b042292a1f8395180642bce9493658ea462e7e92ac7b28e89b70c3746a4d2c6ee495d22c3909f63d1b09693ae3cf5318
SSDEEP 49152:U+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglV+ES+ES+ES:DYvY4
TLSH
T1AFF53B05F94380B2D82B01B14CCBD3BF8A70BA158B129EEBF74DC76FA933B906525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 498a5801d2feb5c3b8793ccc2360627395d81af83273e74c287042616b5461c1
MD5 5e0518b828c10d4e4b41a916625e54ec
SHA1 e46f8ed5cf9217646e10a173432d54aaa6ff9b48
SHA512 4b6d84587de74981fd58f870a953ddebe5d92b9595bbc1cc6e64e6dee05dd84b8151a77de8d5bb04243d682e271cd96e4347711d785e0471d0a0736d2547cc49
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52302c4a2039d11535d86a97240dc2dc513c67404943b7c8d8564442f3dd8361
MD5 f3ad377347b7b46c7b44e9dfa8ed0d7d
SHA1 9f9c238557d0cc77b14f09e75304b9662cb6d3fa
SHA512 7bddebe1c203e1c93f0037b502471535abee2f28941b9f018c72f153e6db42275fbfc4fdad9ca6e898832550fef94cf5fed163fb01a78d2ebb4d5e72f434da6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b060429b7e21d18eaa1f5b2ec1aed0f558f2bf886e485aaa69d78f16a6c76808
MD5 acfdc8db7ff4f93b95fa934a53e8e764
SHA1 74b630514ec96f10ecc00dfa47ee068ff53eba2e
SHA512 4c2fa83b7d091ca39e5d47805ba591c0b03dee3da2d524fb05d950feb6fc1ad2bdc5f5fe1e91f572585855a0605ba65786c36982395a4dced0f309d93f491f25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c52bc8636ffd8306d6c05b046fe4fd9f1f0404518b81223f54a79eae90dddea5
MD5 1da064589e5625e87b74dffcd9de8f09
SHA1 b0bfd39c4adf885f816bc20fe81d7d6fa342ddb2
SHA512 28319d3cfcb9b76e62041c6f387b86b1fe8ba16a3704bea8c7535c4d9dff22887c91f4159a29daecfd7c4554ae0dd8362ea3aba69f5683c0977851ad2c19bbbe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b2d83bf87e97958afd22b07bc3733d2550e4cbc61c7b7d42b83bddee21bdcf0f
MD5 4bcdeaea6b264f0a4f1a67cc5c9eab1a
SHA1 dc49aa8a9c6e9603f443e6732c6b2e1413ca2213
SHA512 f5e5688be45f931664d6ddcc049b0880e5afcde0329e0a3d2d499572d3fa6bd569a3df4f48453865344e876ecdd9e66535698c61a5e7dd6ca9e0c526425f5411
MD5 SHA1 SHA512

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 13.3MB
SHA256 2e48b4603f4454e9ab4573e1abfe033c1636b10635fa2eb90b952ad3d5825b90
MD5 d23b42d949cc86356000b820c0a59df1
SHA1 0f6f2b2cdd2fab79af4a46eae4ab2652ab77f7ae
SHA512 4e6c551a1c8e8ba308e3ba090e0b01d2fb892397780a094689371897be2094ba0def8013b18cec72d8c0b2767648b44e6fc505d3efaa09617b29083d9bba254c
SSDEEP 49152:U+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglV+ES+ES+Et:DYvYu1MbQ9yDAD7KjjqkusjmqMh0YvQ
TLSH
T18EE68D19FA9580F1E86B807448ABC3B7EA717A110A33579BDB99C31F6E337915D28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 61.1MB
SHA256 9aa2832de6677941375035eeaa54016a22bc297a7a0897fbaa1718d307fa7c9a
MD5 470c1c8ea8e5002093aabf8e22a107bf
SHA1 aab1fa0e1a4c40366f197447e142935cb09f8652
SHA512 1b9eda448c28ebe92d7d00a2dbbc61d85e65455f1025b08b4b629e1b5d14e75797bdbeec633f002314471881f11943520a8c6bb3befdbe311aaa81ca15423d3b
SSDEEP 393216:e8KwekyT8KwekyT8KwekyT8KwekyT8KwekyT8Kweky8:c33333S
TLSH
T1D8E79D29FAA4C0F1F96B943898ABC376EA717A110933574BCAD5C21F6F336915D28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 29c9a93b26e25806dbf0012a1a2f81addddc785a0fdd7a0c120e299599b1de7a
MD5 1876e5a4b1e7037fd6bb170bdb434db2
SHA1 d4b81c315fa7dda7e37034d102738d3edb015fdb
SHA512 56fd89bf7e0f020a9af56c257d46396be0750cc623f9e4d4221807deb09f7c1e84e9f314b835df5f51c0c9668d05b5eddb25a9cf5b2edfbe9f1a278bb279f625
MD5 SHA1 SHA512

Submit Download

svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABCCABCCCCCCBCCACCBCCBCABBCBABABACBCBABABCAABABAB.exe
Size 10.1MB
SHA256 22ad78f4ff31b0a2757bc22ff93a119e1e75b19139a596dc2192c319fea8ff71
MD5 edf428a069e855dd35a823bc096f9e4d
SHA1 58a2f52a048f7c2bddec0eb0b7a7f40f20fb7f75
SHA512 0c3717d7c9f8621c8c22b25912bc33222df303112b8c8789749df73c26bb662bd7c731105704269dd62401301842cb09790a5af8a6e06297ed588262fd1b30bd
SSDEEP 49152:U+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglV+ES+ES+Ed:DYvYu1MbQ9yDAD7KjjqkusjmqMhw
TLSH
T1D1B69D29FAA4C0F1F96B943898ABC376EA717A110933574BCAD5C21F6F336915D28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0aaf956c52322a126073636d191d53ddb80066b9dcf21190c65056989d788500
MD5 c444397dd422fc3e4e778ca256d82849
SHA1 1d27dd646c71693fef69f7e172713c9af7cece05
SHA512 1bce4d28fde355807cf0de1a5af5f1ec00b6f0688b28cc562950b8c26af9bf516d635ad228b83fefdef946628cde04c74a4335dbc298b3cda61f8d3f1dec6e46
TLSH
T180115160A8F5DC63FE3328CF921DEBC208F8379B9C986A595315521CBA85C32DE154A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/984-60-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/984-85-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2400-61-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2400-86-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2400-0-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2400-30-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2400-16-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/5440-115-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download