efdbf33092418673a092e8b873c20ef988328fe34f24dbe759dfc1ffd9f2f638

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 15.9MB
Sample260814-e35n4sfc22
SHA256 efdbf33092418673a092e8b873c20ef988328fe34f24dbe759dfc1ffd9f2f638
MD5 50aa8bec3f01dfb38e1a40a363003f2d
SHA1 7a97215487c9c625a773c7c83a353e8813176eb4
SHA512 d9e2e2cc4d692e944676b483da21beb0d657a0e760dcf1b6bdd048411b9465082c06d7a92ae5913bd8dd1593e9ba09497f4782e849c479126d76268e27acf02e
SSDEEP 98304:1LPfLPfLPfLPfLPfLPfLPfLP/OU/jIEeQfoR/IuOFVjUu5e:pFIF0wuQ
TLSH
T139F63B42BBC584B2E4770231486B82A75A71BC115F22D6DF7398636D9F337C0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
1092	svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
4464	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBBABAACBCCBBAACBBBACABAACABACBCBCBBBBCCCCAACABCCACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe"	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBACABACCAACABCCCCACCBCAABCCCCCBCCAABBCCCCCCACAABAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe"	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1992	sc.exe
556	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3800	cmd.exe
3772	cmd.exe
2052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
1092	svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
1092	svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
4464	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
4464	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
Token: SeDebugPrivilege	1092	svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
Token: SeDebugPrivilege	4464	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1100	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3800	4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	90
PID 3800 wrote to memory of 736	3800	cmd.exe	92
PID 2112 wrote to memory of 3356	2112	svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe	99
PID 3356 wrote to memory of 2400	3356	notepad.exe	100
PID 4460 wrote to memory of 3772	4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	104
PID 3772 wrote to memory of 1992	3772	cmd.exe	106
PID 4460 wrote to memory of 2052	4460	2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	107
PID 2052 wrote to memory of 556	2052	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_50aa8bec3f01dfb38e1a40a363003f2d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCBCBCCBBCCCABABBAABAABBCCCCCACBABAABBBCACBABCCABACCBCBABBCCACBABACCCCBBAAAACBCACBCCBBAABCBCBACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCBCBCCBBCCCABABBAABAABBCCCCCACBABAABBBCACBABCCABACCBCBABBCCACBABACCCCBBAAAACBCACBCCBBAABCBCBACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACCAAACCBAAAAACBCCACACABACABABCBABCACABABBBBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe" start= auto displayName= "UserDataSvc_CABACCAAACCBAAAAACBCCACACABACABABCBABCACABABBBBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACCAAACCBAAAAACBCCACACABACABABCBABCACABABBBBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe" start= auto displayName= "UserDataSvc_CABACCAAACCBAAAAACBCCACACABACABABCBABCACABABBBBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACCAAACCBAAAAACBCCACACABACABABCBABCACABABBBBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACCAAACCBAAAAACBCCACACABACABABCBABCACABABBBBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBACCAAABCACBCBCBABABAABABACCACCAAACABCACABAAABBACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d71c1d85af8566690d68eb9de1a42c872ca6c907292176608d740494fbdc6d46
MD5 7c16d0b86bc67a4b521aa03fb516420c
SHA1 51f94eeac0432a86a80f54fdc9c39ffd2957947f
SHA512 149a52aa3e3f287b1a9a973e70350fa7d6b0f883d3ed64f090b8d11b4e12721b01f10f23a9cfd4c38e18946c67e99db3fa200bb9bfd80bce3eddbc71aa2b74b6
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.3MB
SHA256 1ed73d5e4e56e5206b236eaaa7ee6b7001592531f923b0abc1dfda1a481f139d
MD5 4799fb56c84f7d820d0ab3aa9f9f5275
SHA1 fb6ed0ac4f3c5ff189dfe19a711ebe10f6411b97
SHA512 4b713db839766a00058dc5382ee85b40c2d84c51bd266f6291f77fe3532db4d878dade06210aa8b54302538b688756a7d36cb2979ca433ee897d5ce30fee9efd
SSDEEP 49152:U+E9oqatglJ+E9oqatglJ+E9oqatglXXpH+E9oqatglJ+E9oqatglJ+E9oqatgll:1LPfLPfLP2
TLSH
T181463B42FBC984B2E477023148AB82A75B71BC115F12D6DF7394A36D9E33BC0AB31665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 28c010cf74a6f48de15b7dc27a99bec7c0b12479a89c02577e4f8c63b92e7ef7
MD5 debcbbc8daf4f7467b1afb829212ce4d
SHA1 8927a5e849e35a45b1445043da551e0344419139
SHA512 ac2c01b0efbbb1ac7fb86b45c11f2696a7e8f8f322b6ca58d643e96d47664ab709531f41b1308ec84e79851da93c1b2b72ebfb9139d7949095523cc42d376278
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5633d0bcffc216462350f27a159186ac0f70cb5635b5682993dde87daca18131
MD5 7a30b20a68df0dbbf16f7c02d4ef5ba5
SHA1 d8f0011f1b5fee30c5a8474597cf62ef144341b2
SHA512 44821b1130e2b66f034c153fd01fa979301fbd10aaeed025997898781499626c5cced029eecb03348d38635230435254df062103799bffc2e422f5f67bdfb7a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31e30d3d8d8089c9bf46afbe7bd8c38fc3e9d6480360205e9a4d941309dc2c80
MD5 0dd6d0e650053230e16f465647be7392
SHA1 0f5228eead684e9e0263645e994be6457f7a4635
SHA512 59ef04504cdb5c9a3275257701bbb1b79b4fee790bf52cdd5abb1b6beed47c4e8c4caa6feba44d98d1526572dc829294b5a79094ca5be7d7ed28d59f56216f86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5d55c0019968f99ce647ef60be478fa18feac23f76cf57000b2060c2b0804de2
MD5 3fa1bca0d2d547165ce5e82bb30c21f3
SHA1 8d46d78b24658414f9faa116fb0a384a154b1f60
SHA512 1ae70cbe0747783f4b6945bbb95ccb08caf878cc71ff780bdd9cf835798f14ceb57035f4b6a591f2b4627fc4227a56a9cfcc7202c126f4debe3cbb52c0f000f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 674d66af06e2a3cb025f7393214b006c4e59e9ff93260548e7aedaa8cec20301
MD5 bb45efa9cf7a6019564b7ff81ff21114
SHA1 584a7f8d784e7df248679ea6fde719b20d499721
SHA512 a425a35b64517109a4787fa917ff1b66eb755c9bc70363ae26e41d7a3c2bd162be8711baadeea0ed6c916be714838e6210a4838939bb93dba07e2a6d585dbd5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c4b9a39047bae1e2ecd7af0ffc053727def293605f80260132e3300b97ae9b95
MD5 26975c63e16e6bdf3d6fb8f891fb48a1
SHA1 646334e103314bcf6a8cccc444f5da5bbec9b964
SHA512 b7cfe612fa5a779e949f8865c6134abe24516bb189654e839b2cb7493dc16ec8fb5755ab8c58005c5336d9cdd66e93415d9377911e5a1010b4b6c1bb25f14e57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 512824e8a14d0f5db64051fff986e9bfab3a90307e1ad922ca746c8c24033ac7
MD5 4c444d4d4af0254fb5d93fb7e5641c9c
SHA1 7fa88d5c3be383d068a63524f05477ea643a9558
SHA512 7fcd3bb480ecc3f0540a19d6335d25ddcaa3741e9265b76a5cff2537d77502b45dba9163891b299c9852a84d646bab8d02c5948edd58b50a3f5e2e7864ce0bbb
MD5 SHA1 SHA512

Submit Download

svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABCCABCAAACBCBCACCBBBBCCBBBACABCBAAABBAACBABB.exe
Size 15.9MB
SHA256 efdbf33092418673a092e8b873c20ef988328fe34f24dbe759dfc1ffd9f2f638
MD5 50aa8bec3f01dfb38e1a40a363003f2d
SHA1 7a97215487c9c625a773c7c83a353e8813176eb4
SHA512 d9e2e2cc4d692e944676b483da21beb0d657a0e760dcf1b6bdd048411b9465082c06d7a92ae5913bd8dd1593e9ba09497f4782e849c479126d76268e27acf02e
SSDEEP 98304:1LPfLPfLPfLPfLPfLPfLPfLP/OU/jIEeQfoR/IuOFVjUu5e:pFIF0wuQ
TLSH
T139F63B42BBC584B2E4770231486B82A75A71BC115F22D6DF7398636D9F337C0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 d7ad68beded521bc90089caded4e523232064feff67c997ff745a63a4b34143d
MD5 8696e811615b4fe82c62d3969013e63f
SHA1 78371a57bf5d8224caf4f01cd6e04c2f9d98f582
SHA512 04ad6ca01a158822976f044850ad2a28a453e0a6b7b1f51f3332111b81660619cf74642ed2743a4f9c11e9c582a4a52c69a4cfa042b9a479078fdfdc19bbe518
TLSH
T18F01FE51DCD5DC73EA33689B862FDB530CF0B78F6D9CAA086305422CAAC8D25CE554E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 21608c555dd7f30fb7fc75a4d08bbd94e86bc6d13fa9351c673e1f9c578e3f4d
MD5 634576ba490b2fe53abf30a0c44d7044
SHA1 c71e82dd2866e14f3d4b9f2b1210fb694767a505
SHA512 6518b692eb1dd54b65abb244bdbe8e0f890f11cc482565a97c1de67dd6ae22b6243336bea3e1af754dacf17c8c3b9545f039010b7929288fa1a7afed2f0e3f5b
TLSH
T1F8210151D8D5CC73EA33689BD62FDB930CF0B78F6C9CAA1453054128A9C9D21CD598E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1092-78-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/2112-36-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/2112-26-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/3356-59-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4460-0-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4460-7-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4464-89-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download