c4367dae21dafbf223bef4d93cf54a7934553b28dbbe51a5451d59caac5697c8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 11.1MB
Sample260811-bas8tssdph
SHA256 c4367dae21dafbf223bef4d93cf54a7934553b28dbbe51a5451d59caac5697c8
MD5 c28479c08c05c6ccf8f0231fc324fe71
SHA1 c790dfabeaa5a7941df4b79239034bcc1a3ecb39
SHA512 741f823651856e875c0553a729e340c41dd4505c5b091f76950b79f9bd172b42eb7081fa08592c32af93247c11d1a6518d924db574256abfa04384f53c2a7185
SSDEEP 49152:U+ES+ES+E2+ES+ES+E7+ES+ES+E2+ES+ES+EZE+ES+ES+E2+ES+ES+E7+ES+ES+J:ZOU/jIEeQfoR/IuOFVjUu5n
TLSH
T102C66D09F98340B1D92B51B04DDFD3BF8670BA2583128DFBFB8DC71B6A22B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
1444	svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe
3112	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCBCAACBAABCCCBBAABCAABBACBBCBAAAACCCCCCBCAACCABBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe"	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBABACACBACCAAAABABACAACBBABCABACBBABACCAACBCCACCBBBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe"	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4764	sc.exe
2860	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2512	cmd.exe
2732	cmd.exe
4320	cmd.exe
4904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2772	schtasks.exe
4696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
1444	svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe
1444	svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
Token: SeDebugPrivilege	1444	svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 4320	2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 4320 wrote to memory of 2772	4320	cmd.exe	99
PID 3372 wrote to memory of 2164	3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe	100
PID 2164 wrote to memory of 740	2164	notepad.exe	101
PID 2736 wrote to memory of 4904	2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	106
PID 4904 wrote to memory of 4764	4904	cmd.exe	108
PID 2736 wrote to memory of 2512	2736	2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	109
PID 2512 wrote to memory of 2860	2512	cmd.exe	111
PID 3372 wrote to memory of 2732	3372	svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe	113
PID 2732 wrote to memory of 4696	2732	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c28479c08c05c6ccf8f0231fc324fe71_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBCBCBCCCABCCACCBBBCBAABCAAACACACABCABBABCCBCBBABCBAABABBBACBBBAACCACCBBCBCCCBBAAABCABBABCAACBABCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBCBCBCCCABCCACCBBBCBAABCAAACACACABCABBABCCBCBBABCBAABABBBACBBBAACCACCBBCBCCCBBAAABCABBABCAACBABCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBCAAACAABBABAAACBCCCBCBBBABBBABCBAACCACCCBBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe" start= auto displayName= "UserDataSvc_CAABBCAAACAABBABAAACBCCCBCBBBABBBABCBAACCACCCBBCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBCAAACAABBABAAACBCCCBCBBBABBBABCBAACCACCCBBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe" start= auto displayName= "UserDataSvc_CAABBCAAACAABBABAAACBCCCBCBBBABBBABCBAACCACCCBBCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBCAAACAABBABAAACBCCCBCBBBABBBABCBAACCACCCBBCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBCAAACAABBABAAACBCCCBCBBBABBBABCBAACCACCCBBCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABCBAACCACAAAAABBBCBBCCACACABBABBCCCACCBBBCCAABCCABABBBABCBCACBCAACABCBCBBAAABBACBBBACAABBBCCBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABCBAACCACAAAAABBBCBBCCACACABBABBCCCACCBBBCCAABCCABABBBABCBCACBCAACABCBCBBAAABBACBBBACAABBBCCBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCBACBBBBBABACCCBAABCCBCCACCABACACACABBBBBCCBABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
1⤵
- Executes dropped EXE
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de46b607a57b81c8bd1cfe2c2cde372295ba9b94a292dff22296dfc5bb6cdf72
MD5 982f3e7d979fd6c8e663017fb928d7d4
SHA1 f46fbf3dde9d97e3161ce2d6deec4b17faf707dd
SHA512 b6c62aa2c51899ee7ec86d75ea8cc68ed1b3c535e7a8be18b347b4eb20cb15f5b5a0b132059dcc297ab3d2cdd89ba8472b12e6f2f440cac99c592cf2f90c54d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55216ece129b0a2c2d2f0993e3f76e403463d2fb20bda431f925e885afa512a2
MD5 a559fae2c24edf75f26f259659bc9e18
SHA1 13a8652be18118637b7e1324bbe3817f3c58d325
SHA512 637f4e956a10fa75221b9743ba276a81fd71e89ecd7b9f23c0b7f26de1552c81a78c2245a9b4d1d89813fe5be3e5aafd12b7db1f04f9844467a39bd909f1a392
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82e817ba03b930ea2ea6a4c200b2ee685d0886751e09dacf5a74817b221f3a4d
MD5 aa39d41d60eaf2d62b78943cfbf32857
SHA1 f8291ed347b912849d8c529fcc27f9e85c4d338d
SHA512 ad11f66bf805a3c4b919787036ddd0daff7c4e418608fd827229ea149b04aa7111eda42bb479c2662721f536d89210928cb22fafb7a5f8ac3e290253f50a2459
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1607e2a74e5f219db496a8c74b09d1b68a6f696119596524a24295477f8c82ab
MD5 20b23e807dad39fbb142463f450cdffa
SHA1 975e6d8d5e54b9ea692eb044f4e4af78ed582194
SHA512 4b9bef5e0108faa10e95a9426128b75f5ca3c6849bf6d419c3b20ed717d4c2d8acefc0ae85f122acdd0e5351e31dfd44764ac715a2c879997bc1f00eba473b50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38a9ffcd88090d52604dbea390e15a0db11480b62b6fbacf4a0aad7aaa533ffd
MD5 e8b0c8233cc2cfb3e96520c6c644cd89
SHA1 32dc3eb4504b1d2564afa969fa3678e852518cd6
SHA512 3f722ed5198ca546cfe5e3faed4f58572eb26a8acd9b775f80892674f6499e85a7144f1500a8e948faf256e0026c3e3bd5f6ce0309a9d1ffcef31b69910be142
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c0451afdbb12a51b0188cf933cc683644b720419bb40a1d01ce4bbd3b2c00cd9
MD5 1839e7d1c01567feaecc35012d45a633
SHA1 cead085c750191dd13e9b99ba25dcbd188137e23
SHA512 cc2599d47fdb7fb2ec9ca9b81005726b16e8da1b5b16d625d95b2da91299978f5de5e36f1ea8e14a1ac2b7e10a60cf65bdd4af028ba0598098f47d89a5835710
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2bbdcf44878b966599bc79c8c12a2270215eae18adbc4908bc210cd4336caf49
MD5 055ac9d3b6d75aa94e0984e86237feb4
SHA1 e553267ea11b6ed2987ee39dd142a294d049deb7
SHA512 16e2c1a308ff30bdb44cd8ab975f5c22efd5ff5dea4128da1f17e2a081cded7c64dc9a623ced710a8feee3a61a7d06aa20bba51b9de76667353c5cddd75ec939
MD5 SHA1 SHA512

Submit Download

svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBBCCBCCBAACACAAABBBACBCCBBCBAACCBBABAACBCBBCCCB.exe
Size 11.1MB
SHA256 c4367dae21dafbf223bef4d93cf54a7934553b28dbbe51a5451d59caac5697c8
MD5 c28479c08c05c6ccf8f0231fc324fe71
SHA1 c790dfabeaa5a7941df4b79239034bcc1a3ecb39
SHA512 741f823651856e875c0553a729e340c41dd4505c5b091f76950b79f9bd172b42eb7081fa08592c32af93247c11d1a6518d924db574256abfa04384f53c2a7185
SSDEEP 49152:U+ES+ES+E2+ES+ES+E7+ES+ES+E2+ES+ES+EZE+ES+ES+E2+ES+ES+E7+ES+ES+J:ZOU/jIEeQfoR/IuOFVjUu5n
TLSH
T102C66D09F98340B1D92B51B04DDFD3BF8670BA2583128DFBFB8DC71B6A22B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 8274642f55d8da2bcb031bf2b7c777c9daf60dff8319311cfe043a4b3b8fa0d2
MD5 a3858c92e4c84c4dccc404f182e844bc
SHA1 1e6e931ceeae854a1a7a270bd5e49faa6451b4c5
SHA512 abb1ea030b712b97b87518c66b76357fe7efe3378c341960460256ee18b61e9db45889def3fb65cc95c02cee4919d4af6fffc4d53fc2898a4f257244d4b0fe62
TLSH
T15911C150E8E7DC93EA7368CFE23A8BC309D8379B68186B5423598218775DC76CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b14695526b55ec49c8560ffade2c0b60a30b27dc1dd42d0b5680d46198236470
MD5 e265d935812bb0ab67d592ca7d7a10f2
SHA1 38af32e89d8dd2e82fc2d06e369c59de7badfa8d
SHA512 e22dc07c472cca8e2d9ed162454c50ac74ec943bbdd1a793a50feeaf85f5fba7cb0727697e826e44315056eaa3f98d6d093737ca35294c1e8690bad902e2bd69
TLSH
T18311A121E4E6DCA3EA7368CFE2299BC30998379FA85C6B4413598208779DC76CD194F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1444-71-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/1444-95-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2164-59-0x0000000002510000-0x0000000002511000-memory.dmp

Download

memory/2736-6-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/3112-81-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/3372-35-0x0000000000960000-0x0000000000981000-memory.dmp

Download