f8d946432cd1d63edac686d8cc4d46ea22767cfe4f884448a08b8d6e270ac91a

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Size 26.5MB
Sample260819-gpwkdszvbx
SHA256 f8d946432cd1d63edac686d8cc4d46ea22767cfe4f884448a08b8d6e270ac91a
MD5 3b25f42dedc001bf81db3a1c35a85e34
SHA1 2c42b069513ceccc5fa1ce9fb9375143d9d4e06c
SHA512 276957d936b56cb468a46da76cf63e862dd71cd7d59c7aab44883f5447c88f5d497ac9f38e89db85801fa55a3ec04f2daf295c36173bc5f01f060a9df108f576
SSDEEP 98304:kFPdLbFPdLpFPdLbFPdLi1/tr37wbrU5h1MbQ9yDAD7KjjqkusjmqMhb:kFlfFlVFlfFl2v5h1tIDewjqkjiqMN
TLSH
T13657AE19AAA4C0E0E86AD2389867C272E9727C150532537FCDE1F61EAF376A14D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52c-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
2620	svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe
572	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACCACBBBCCACCBBCBABAAABBBABBACCACCBCBABCBABBACBACAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe"	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABABBABCABBACBCAACCBAAABAACBAABCBACBBCBCCABAAAAAACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe"	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4192	sc.exe
1952	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
408	cmd.exe
1764	cmd.exe
5492	cmd.exe
1452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4788	schtasks.exe
1496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
2620	svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe
2620	svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Token: SeDebugPrivilege	292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
Token: SeDebugPrivilege	2620	svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 408	972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe	92
PID 408 wrote to memory of 4788	408	cmd.exe	94
PID 292 wrote to memory of 2916	292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe	95
PID 972 wrote to memory of 1764	972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe	98
PID 1764 wrote to memory of 4192	1764	cmd.exe	100
PID 972 wrote to memory of 5492	972	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe	101
PID 5492 wrote to memory of 1952	5492	cmd.exe	103
PID 292 wrote to memory of 1452	292	svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe	105
PID 1452 wrote to memory of 1496	1452	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCCBBAAACAACACCACCAAABBCBCBBAAAAABBBCCACBACBABACCAABBBACACBCCCCCACBCBAACCCBABABCABCCCCACBCBBCACACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCCBBAAACAACACCACCAAABBCBCBBAAAAABBBCCACBACBABACCAABBBACACBCCCCCACBCBAACCCBABABCABCCCCACBCBBCACACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBAABCAAACBACACBBCACBCBCCBBCABCCABBCCAAABCABBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe" start= auto displayName= "UserDataSvc_CCBAABCAAACBACACBBCACBCBCCBBCABCCABBCCAAABCABBAAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBAABCAAACBACACBBCACBCBCCBBCABCCABBCCAAABCABBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe" start= auto displayName= "UserDataSvc_CCBAABCAAACBACACBBCACBCBCCBBCABCCABBCCAAABCABBAAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBAABCAAACBACACBBCACBCBCCBBCABCCABBCCAAABCABBAAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBAABCAAACBACACBBCACBCBCCBBCABCCABBCCAAABCABBAAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCBBABBCCBBBBCBCCBBABBABBACACBACCBACCCAAACACCBCBBBACBCBCBCCCABBBBBCCCACCCCACACCCBCCABBACBAACAABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCBBABBCCBBBBCBCCBBABBABBACACBACCBACCCAAACACCBCBBBACBCBCBCCCABBBBBCCCACCCCACACCCBCCABBACBAACAABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBBABCCCACBAAAAABBAABBCBABBCCBBACBCABCACACCBCBCBBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
1⤵
- Executes dropped EXE
PID:572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad4fa32183e139ea404efc7e4f4eff35587b6b8dcc242ff56b90df8d03fe148e
MD5 0ef67b85fdd5aee0676cd9666f293d06
SHA1 048919f6a8b16a5fc56814039a4577b0a5b76a66
SHA512 78b1fb680b3fb94f76d34ae4772185b74f57f056f682113ba009271c53d5659226ecc72b7a4e4d9441d426ddab9eb37c0999e22c6d203823287ab71bcca9d1ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c40d85d098e59ea0c512d67d735405ca724e0a05264c5bbf16ad551052d062b7
MD5 4ce5b0081a37b5351c868e11676b31e8
SHA1 4fce88a85f1ee25174f2866c1c9eb5feaebe8135
SHA512 7751b6c9b70a84bea34885b1dbf019b373d745e8fcd75e9098e7a12086223c2423fae372b273ea4336766d91f06890482ce31f85242a2b7dc7427f45a3809aab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77f4634aa73f7895806d80258c82e00d004f3896de6f1a17f10fc0eb22540a93
MD5 effdff8a5b0035a13537e8ce78a5908b
SHA1 1379e5c8a37fc2e99e4fc7aa43e25672a4d26814
SHA512 2d62aed00eb0838fbd038ba22f3ae4f260f339fe7c3e63b1be0ad12ffe5184e88bd25c9914755b0650ad2ca9fc595afde239510b3e50adbf333767c9724d62cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f18d4f21faaa39f40c8b84110b137ce8e15001279e41aa71c1d200aad0a300e
MD5 252b76d633a0afb7a4a235105eb2c0fc
SHA1 2aa022b4283200c782af983dfcad62ea9a3aef69
SHA512 c8f86ff3cd165833db0b28a880dbee6a7be6baedb8b9d3208038dc9e8852777999622ea186336457489a5b605c71a9c8d86d17bf0e9725f423c33c37c7ef1e42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 959cc8bdb03a56aed3aa88dcfd14890fce408889843fc2496b8f4cd396f47027
MD5 ca0bb155e452ba60b93db6b5c920e941
SHA1 a711c2ce7445144ad6b706be652fc37f9ddb8c91
SHA512 a1b4c44f83712f3b1e9bc67d117926a03787a4bbe9f2e72652d7b4ba66363f2834d71fe289489c01e456021552b4a12f2cd67133815d9e2ac0abd5194b715213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 363edaed5fc6f9f7d01341fb871ec40e7cd384700d7d69a4610d3585de3c247f
MD5 75800428e12eeee49b91e2083b369683
SHA1 0da11d8b3aaccc49b592817127ba55c90f2b7b2a
SHA512 9cefcb03bcdc61a30e12ecc34abc7f6d97942d75eb2f431fad21675fd461608fcbfdac96259286ba1cb9c005e8c1e155b9634fd512982d72fd058f02c797086b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 76adacbce84c4228109c5ca89c3815b61d793a93e151b77b199e129361e13b80
MD5 f429ba29c9749925a81ff2990a7d37fe
SHA1 3b8fc72f53e2337587155960b4450ec8f4e18c95
SHA512 cf735df4fcdb5390a2b2fb282d87f78d70cf92c2f578198f287a37f32d8a16a931cb440ec1d0f5cb23be2b8ce7f3ce2ea9c301507397c8e4eab91091949190fc
MD5 SHA1 SHA512

Submit Download

svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCBBCBBCCAAAACBBACBCBCBBBABBCABAABCCABACABBBCCBCCBC.exe
Size 26.5MB
SHA256 f8d946432cd1d63edac686d8cc4d46ea22767cfe4f884448a08b8d6e270ac91a
MD5 3b25f42dedc001bf81db3a1c35a85e34
SHA1 2c42b069513ceccc5fa1ce9fb9375143d9d4e06c
SHA512 276957d936b56cb468a46da76cf63e862dd71cd7d59c7aab44883f5447c88f5d497ac9f38e89db85801fa55a3ec04f2daf295c36173bc5f01f060a9df108f576
SSDEEP 98304:kFPdLbFPdLpFPdLbFPdLi1/tr37wbrU5h1MbQ9yDAD7KjjqkusjmqMhb:kFlfFlVFlfFl2v5h1tIDewjqkjiqMN
TLSH
T13657AE19AAA4C0E0E86AD2389867C272E9727C150532537FCDE1F61EAF376A14D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3d77188b345b7cc454a4a2b4b56d40a3d55b552178c946872846b5aac54e386f
MD5 1c10c6c7b69d259590b815e974ee30ec
SHA1 a4e7ddf5f49508e03baa30b70dfcbc1648572c61
SHA512 ce6cb3f8f60c003962ba3c674e8a6d2ec75c0c2afc9c8151d302b02b50b0baec748b6307f8f7c98df1b0b5e0a4e82f485907832c84dc1a9699f0779773c8ba7a
TLSH
T15411C4A1E5E6DC0BD83364D7463DCBD38C9837EF585CAA2412098318E7C5C75AD150E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3d7fad30ae54f59c6345f94a422d74b9ea447e1657dd5ef35a19855a2b4d18fc
MD5 7ee4aeb4daf9e785a79c2901ac5c6dd0
SHA1 56616a9e2d35b5e129ba7c6b2142429d74a82235
SHA512 ec3a8efb9c0069fc22f1669fcaa206906578cc85c1db84c6cae0a4868756fd69ef7f58653020a3fb54303161187abfe39c8544aa557b55c50f2a306a8562becd
TLSH
T1A011F3A1E5E6CC1BD932A4DB4B3DCBE38C9833EF5C5C9A2012098318E7C5C75AD150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/292-32-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/572-82-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/972-6-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/2620-63-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/2620-81-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download