49fd43e301f46f09b07a6a04a8a152a2e3bd0c1fc98a7371b0986cb8afacf196

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 9.8MB
Sample260810-eld5tsap21
SHA256 49fd43e301f46f09b07a6a04a8a152a2e3bd0c1fc98a7371b0986cb8afacf196
MD5 c625caa47d20d4c38c45fbaae2a9496d
SHA1 d74191d013dcf1dc07e18750fef2a64434a176fa
SHA512 d8e839ce3c4f9288a62711b83bcd9309b3e4bd085b356b4181cb7be10ed83839aca1740749dd1ead70f8218ec7721d4cb0b02e635944fe3bb87535323ee14251
SSDEEP 49152:U+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2h:7OU/jIEeQfoR/IuOFVjUu5j
TLSH
T135A65C0577ED4825F5B372308DB68669D6B2B8915B31C6DFB284823D0F73AD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
4916	svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe
4840	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABBAABCBACBCAABCABCACBBCBCACCBABCBACBABAABCAAABBCABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe"	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCCAACBCAABCCBBAABCCCBBAACABAABCBBCCCBBABAACBCCCBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe"	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5788	sc.exe
2660	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4472	cmd.exe
4872	cmd.exe
4540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
4916	svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe
4916	svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
Token: SeDebugPrivilege	4916	svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 4472	920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 4472 wrote to memory of 2160	4472	cmd.exe	97
PID 5364 wrote to memory of 1632	5364	svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe	100
PID 920 wrote to memory of 4872	920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	103
PID 4872 wrote to memory of 5788	4872	cmd.exe	105
PID 920 wrote to memory of 4540	920	2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	106
PID 4540 wrote to memory of 2660	4540	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c625caa47d20d4c38c45fbaae2a9496d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABCBAAACCCBCBABBAAABABCBBCCBCBCAACCABBBCACCABCABBCBBCABCCBBBBCCBBCAABCCCBBACCBAACAACBACAAABABABAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABCBAAACCCBCBABBAAABABCBBCCBCBCAACCABBBCACCABCABBCBBCABCCBBBBCCBBCAABCCCBBACCBAACAACBACAAABABABAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCACCAAACABBCCCACACACABBBCBACAAACBABBACABBBBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe" start= auto displayName= "UserDataSvc_CACBCACCAAACABBCCCACACACABBBCBACAAACBABBACABBBBABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCACCAAACABBCCCACACACABBBCBACAAACBABBACABBBBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe" start= auto displayName= "UserDataSvc_CACBCACCAAACABBCCCACACACABBBCBACAAACBABBACABBBBABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCACCAAACABBCCCACACACABBBCBACAAACBABBACABBBBABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCACCAAACABBCCCACACACABBBCBACAAACBABBACABBBBABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCAACCAAACCAACCCCAABCABBBABCAABBCBAACCBCCCCCBCAACCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
1⤵
- Executes dropped EXE
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 20.1MB
SHA256 e48ba2956f1d34ae3e473909b1d63a315941087e0a97158c74188bb6ab4006ac
MD5 5946f1004bbd70015ae8ae800dd5afa7
SHA1 55852072579620fb0dd3928c146dc95598bc76e3
SHA512 7603bcc11b9f2867fd851b5059587f0e515c8a8659a8600c321d7be8f97a857da459b250cad37b616725015dae4cd30c9dc333452d7068f91e990ade6144b57e
SSDEEP 98304:7OU/jIEeQfoR/IuOFVjUu5vOU/jIEeQfoR/IuOFVjUu58hQe5wP:7FIF0wu1FIF0wu0Qe5wP
TLSH
T106275C0577ED4825F5B372308DB68669D6B2B8915B31C6DFB284823D0F73AD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 2.9MB
SHA256 3edea2b12ff09a7f0af4da7ce3c6affbfa4da8be5b1c169eab2ab03ed6e06307
MD5 5eee8b67f31abe4a76265fff5e630e06
SHA1 edcc6fad0992417488367aa3b128eb50e91a06f8
SHA512 e997cedd955cf60bef41c48e85e793b16d1f2e3f19364867a36ef33a6d83b3cfd966dbb88a97374cc43aa4199253d24624f2e6f4ed5107a5a555b8a03854c7d1
SSDEEP 49152:U+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2d:7
TLSH
T1ECE53B0977ED4814F5B7B23489B68669D6B2BC915B31C7CF9280823D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17836952b59ee975934a18dcf8b6f9e3da9819ad0cf507705f5a90375f51676c
MD5 b356bb6162a9721dd39d3ae800fe926c
SHA1 77f2170c6204d2240b3eaf12f87cdef1e45f5763
SHA512 03387a44d3dd1293cb56910c0852545200cc89d86dc01ce4783247676b76ec3e94ab61c97ec868f1b07eae3cce313774c71201b3b6392e5dc2b6569e3a9867ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8af2df90cc0de31b514ca42f8164386e405fda7f2f59c3e13be345120b38a3b8
MD5 248461fc1599cd314cb8692e325f140b
SHA1 d62ca0aabae25ca819cf29db6b54653be7f04e93
SHA512 212a2a8b380a27126864e8757fd786fa69defc2ee80004cd0e856f66216dce6ad341e3e8e90377381ed101789e9d29234c72df44aa80f7a2875c0762a474d4c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a2cc240036e06e7bf225363631a1f4d7948fd46e62310c00d57e9cc0bfbe59e
MD5 1e917ef00475c10fd88d8f05a8b1d354
SHA1 f037139ec04c232c69c9bcab6138808a2371887d
SHA512 478c8b9df64cb3a71514eeff22b10024b7e5e8146127100ae8c2413f86f9bacf66d2248418b0b3c45df467a115254266500ff9e64b645a2ac990119d7134e968
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6af1289c8ff454b14254cbc57475e759eb34d89ebdf9277be4a9b5708b31f572
MD5 5677424ac779a9059095a9b28510f241
SHA1 9901f29beff12ec86257b1a7ea5f48f54bbfef28
SHA512 c79804bf8dabb0b46e6b4569f998ccf40f9316359456c69d465aef170c903c988ea96bb5793402cadead1cef7a08f0f50877b731e5ba49a154ac7b4bb8478e3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d9b33893fa807be0b9b7c761653e6c161b467b5a9fdc8059881f84259e37ef2
MD5 5866e121bac36e756aa923737f9cb9d4
SHA1 80260863cc3ebf2282bb3fae5756d49a8de843f1
SHA512 85e20f7519fefade25566fdafbc5adf38ccecde52c19160732f9ea894eaacfb976a1ed1d2f69e14be35e8039c81ab94fc791a571413768d726f2c28aea53ed2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 40f56ee93c6a8709fc048fb277fd7bd5908fecff5d81de7d698004f24f07eaf4
MD5 11b2aa4e98565cd55e92a278c2cf86c3
SHA1 a019ac1813e035633a745260af9ce4b9cb3cec2d
SHA512 8369c3d41f167326e5e4b823d6560927295e38218d41a94eac11fb9afc283119d1580fb8feeca5cbc19c216088e33306063c562db6382195f667e007e339d25e
MD5 SHA1 SHA512

Submit Download

PopUndo.exe

Path C:\Users\Admin\Downloads\PopUndo.exe
Size 3.6MB
SHA256 6911becd3cacc6001e8720b932eaecde232d6713aa155a8fd1bf8b97146de14f
MD5 da4d3abfe996547370a2bf52ed46b4e6
SHA1 94d1cbb065267cb73337e95c30170b8a3c3be3b7
SHA512 c22e5447503b79e2b6c779ede96ae58010150176038bf9a77c706386d565e0e5866c20ad9360d184dd294c9267f3174ad3c49bf9a9d98d7206a438081becdfc8
SSDEEP 49152:U+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPK:D
TLSH
T10B064B0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 23f1605427c278a1575647d7afdb6074a81c09cb176095ddf8d1736e51bf326d
MD5 468f49a9b37411aac202f033c0affb28
SHA1 022aef27925bdddaaa79a657e387931028eb8d9a
SHA512 f81ca6958551c7c25480024917b7c6b2b43e565e4cdfd3b1e3d6959322c5221bf3d28656addc781e6e63eac925b45aac3efb3fb5a04552336ffd6ad6c9f78e88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 722bd5b28b54897308381c1a62766cef3c700c627251752450c2a7effda03f96
MD5 68e0b3ac989eb972ca4767ce8098815a
SHA1 4b45792399d71e88ce68b6d072052d95a3581928
SHA512 757c18222c7f2582e16f41deeaeef872c81f27c9e51f39e8151bebb086a10f1d5629c389a83f0f0cd3f0ff8c1d66473bd11484dfa36fb316f393d4d33c75e4a6
MD5 SHA1 SHA512

Submit Download

svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCCCBCBAABABBCCCCCCBCABCBBCCBBCBBAAACCAACBBACCC.exe
Size 9.8MB
SHA256 49fd43e301f46f09b07a6a04a8a152a2e3bd0c1fc98a7371b0986cb8afacf196
MD5 c625caa47d20d4c38c45fbaae2a9496d
SHA1 d74191d013dcf1dc07e18750fef2a64434a176fa
SHA512 d8e839ce3c4f9288a62711b83bcd9309b3e4bd085b356b4181cb7be10ed83839aca1740749dd1ead70f8218ec7721d4cb0b02e635944fe3bb87535323ee14251
SSDEEP 49152:U+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2k+EPiw2i+EPiw2h:7OU/jIEeQfoR/IuOFVjUu5j
TLSH
T135A65C0577ED4825F5B372308DB68669D6B2B8915B31C6DFB284823D0F73AD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1706d989ff44c48a80616c75a0b2e48d2f38c8248294c8b29f573db245e77298
MD5 07ee83e78e9d48d38ce24ecc0b8c32c6
SHA1 d9d905793f746b626700ab3819cf7bed9b00c98a
SHA512 5ba7d6cdce142aa6b1f4595e7720f8eb4e897fe1e8c8fc4d94b890cbe984ce4d06d419ce86bf94a2c77c7b8d53312b76fbba4b8835f29d1c169cf2e27830c1a9
TLSH
T13D119452D9A9D433FC332C8F521EDBA308B43A9FAC586F94134D4219E7A5E31CD958E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-76-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/920-0-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/920-29-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/920-113-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/920-44-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/920-15-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/4840-137-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4916-127-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/5364-90-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5364-43-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5364-63-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5364-136-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download