f79a526808ba6fff944796eccfb4d1fb035a83ba6c8ad1774a3dc897a8c3ac4d

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Size 6.6MB
Sample260814-ewjs3avbnd
SHA256 f79a526808ba6fff944796eccfb4d1fb035a83ba6c8ad1774a3dc897a8c3ac4d
MD5 64387d723dfee419bc40c6c605f10c14
SHA1 385896d5549469ad8978bcf964efe7fa0238ffa1
SHA512 c01100005d7eda717068395b9a33b6258db805dce9d291cc965b01031b257e53e78566cb266a4895190323f365f42e549742d2223ddd70b041293a73ccbd6fdf
SSDEEP 49152:U+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+D:0jjjjjjjWOU/jIEeQfoR/IuOFVjUu5C
TLSH
T179669D05F99244F1E977417048DBD27ACA70BA268522CE6FF78D870B6F33B519C29722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
728	svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe
3248	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCABCCBCCCACBBBAACABACBCBABBABACBBABAACBCBACCCABBCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe"	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACAABCAAACACCACCACCCBCCCBAABBAACBCBCBABCABCABCACBAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe"	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
628	sc.exe
4892	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4248	cmd.exe
1028	cmd.exe
4796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
728	svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe
728	svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
Token: SeDebugPrivilege	728	svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 4248	5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4248 wrote to memory of 1332	4248	cmd.exe	94
PID 1328 wrote to memory of 3144	1328	svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe	95
PID 5956 wrote to memory of 1028	5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 1028 wrote to memory of 628	1028	cmd.exe	100
PID 5956 wrote to memory of 4796	5956	2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 4796 wrote to memory of 4892	4796	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_64387d723dfee419bc40c6c605f10c14_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCABBAABACCBAABCCACABCBBCBBBCCBCBCBABABBCAABBBABCBBCBACCCABABAACCCBCAAACCAACBBABCBBCCABBCABCBCCABBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCABBAABACCBAABCCACABCBBCBBBCCBCBCBABABBCAABBBABCBBCBACCCABABAACCCBCAAACCAACBBABCBBCCABBCABCBCCABBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBBBCCACABCAABBCCAACBCBBBCAACAACCBBACBACBACAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe" start= auto displayName= "UserDataSvc_BCCBBBBCCACABCAABBCCAACBCBBBCAACAACCBBACBACBACAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBBBCCACABCAABBCCAACBCBBBCAACAACCBBACBACBACAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe" start= auto displayName= "UserDataSvc_BCCBBBBCCACABCAABBCCAACBCBBBCAACAACCBBACBACBACAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBBBCCACABCAABBCCAACBCBBBCAACAACCBBACBACBACAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBBBCCACABCAABBCCAACBCBBBCAACAACCBBACBACBACAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACAACCAACCCBAACBBCBACBABABACBCACACCBCBACAABAABABBBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
1⤵
- Executes dropped EXE
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 303b759d8152a7509a31cb701e179ef9a6b34d0372dc74af9df3f9cccf39bf86
MD5 069303203dc25e3c1027b104b9dcfd80
SHA1 f937db37fc59ec580fae8e126b4481a8b96826c2
SHA512 2aef4ca5b9e5eafd85b75739de34a4dbe649d26ff7b2b166a72a108a63b3bb0481c934a4252bed6a5f725c8236379cb93ef89abe374d8141744d0fdc0b029af6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c18249f69ef0ea3596d5db3c6c8ffcbd4767850283b3a81e88c484187f297084
MD5 319dd180f07637d6697de0bb8976584a
SHA1 095f26d68beb843b29a503e79adeb34505c07d17
SHA512 0c2c2bddffd7f72609319c6afe28a9952b6d7da9324758e3feb314aea8425569fe28bc08a1773f7e24b5118e921087b8fc9eed0dfff6ccfdf42b177d4ea03ce3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0da3935c03d2a3bf7a303f18e449ab5cbf9c67fd3a534f30ee7dea1c58a1b5b3
MD5 5e7ba09055e21d42f15d4df35e29aab1
SHA1 725eba80294d02d4aacf38900ced26c9b132f41c
SHA512 4e299bc99a973176cbe18cb52514ac63fb6ad0c84bb0dfed04a771509e662dfe13979485c71e88de155614dac3635486bbe843d3724d764bcd437ed6ebdd5778
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11efaba646661bca702a1f604a5e8eb9155a01793953a9ab5c33499e2a363879
MD5 8b1701bdf80a6ca070fd5aeaefaac55c
SHA1 4d60438dbcad4ad9bb383d0bf5ca4f46e8f72890
SHA512 cbefd6e8cb12a381e8223aad2276b21a2e3cb0d0133ab23c4715620e3b13049a775bbccbb9d9a8c443ba46ba77b52a64ee283b9540072342c3436a1e445a9c4b
MD5 SHA1 SHA512

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 20.1MB
SHA256 fa6f92790ad6ab8a118c961494fc2ec81d6349b48b331fce50b05514c5ac6da3
MD5 3b2d374eeaabd9de4fea11c7faf98b20
SHA1 36ec569453a054d16f200e4d0c3500bab9cfb1db
SHA512 3030e6a66984c0414d94ebb768d1ace937e9d77c5418f6bad019d90ef105c2104f846693f4c92070d3e0d8143f6c6cb6a8cdd7692fe4383ac5af10623f2080d7
SSDEEP 196608:0jjjjjjjWFIF0wuvjjjjjjjWFIF0wuvjjjjjjjWFIF0wui:pkki
TLSH
T125279D05F99244F1E977417048DBD27ACA70BA268522CE6FF78D870B6F33B519C29722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 4.3MB
SHA256 6cdbbc6c79a8bca0621edfd1008c3e9e5db1e9ab9f28017fc6d80b57159ba650
MD5 e194ac871616521f3abcdaa6c2408518
SHA1 40c25f8e30187cd8eb9a4aa61d398a8ace6f5f50
SHA512 38ed9694bd8bfa603de495ae7a41a30081a6034549b5df41d6183248a70f6234b7ff17b55de3d10ab70ffa4002580df2efe77d445a1f20b1b473d856c3edac3a
SSDEEP 49152:U+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+G:0jjjjjjjg
TLSH
T136265C09F99248F1D96B417049CBE2BBCA71BA268411CF6FF759C71B6E23B21AC1D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 704KB
SHA256 5634ae5fcfd481543a710623c21cffaa8ba1470d45f3444e64924b458ad1ed78
MD5 4ff542ef1af88131a78b8f194b8a5b10
SHA1 09e47fc5c03dca9536c05e7c655df3157985a5b0
SHA512 98fc1faa848ba89320e9e69a9704fc6658e03a4fc04217e4c305df20f17e364d6e02dbca6eb50a28ab145592d6fb4ce20ab90cc8a0ffcd369360fb9df0ff2d0e
SSDEEP 12288:mgUFgEsnojAmgUFgEsnojAVgUFgEsnojAmgUFgEsnojAXrCB1igsNBfcsc+ZOnZo:m9+EM0p9+EM0u9+EM0p9+EM0dslZOZAr
TLSH
T135E45C09F99244F1D92B51B049CBE3BFCA70BA268411CF6BF75DC71B6E23B21A81C651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 832KB
SHA256 46a21d294f7fe7120adb322667561dceee19f9e347e60074886a98089a92e70b
MD5 7671c75b16e403c0e3f736f5580f9523
SHA1 abfe2190f0bfc35eae23db65bd3c346d9cd90cba
SHA512 01659726da5d82b5eed6660337a1760019a7897d82a977a0f9c5cc07246b2f1aead0e999ad1cd920800d3c951718909e6f6892d14a28e71d76ee04501a4b63f5
SSDEEP 24576:m9+EM0p9+EM0u9+EM0p9+EM0dslZOZA9+EM0p9+EM0u9+EM0p7:U+EF+Ei+EF+EKn+EF+Ei+ET
TLSH
T113055C09F98344F1D92B51B04DCBE3BFCA70BB2684128E6AFB5DC71B7A23B21581C655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 026b2d9a3896a117b3e77db7edc40fcc85bb006691fb7e9dec30e920de2ce407
MD5 ac82222edc879af45ce04265addda9df
SHA1 07b83ede5981f1158aef2d138e3230260ccd8c19
SHA512 4f81c9d5886a6ae06092620fd56b950bc25780fcefa60c427b984c79f30b4d4767927ad46cf649e425b5750bd1cdb02d8bd80182012941f7f84de0935def39c5
MD5 SHA1 SHA512

Submit Download

svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBBBACAAABCCABCBCBABBCBCACBCAAAABABBCBBABCCCACBAC.exe
Size 6.6MB
SHA256 f79a526808ba6fff944796eccfb4d1fb035a83ba6c8ad1774a3dc897a8c3ac4d
MD5 64387d723dfee419bc40c6c605f10c14
SHA1 385896d5549469ad8978bcf964efe7fa0238ffa1
SHA512 c01100005d7eda717068395b9a33b6258db805dce9d291cc965b01031b257e53e78566cb266a4895190323f365f42e549742d2223ddd70b041293a73ccbd6fdf
SSDEEP 49152:U+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+EKn+EF+Ei+EF+D:0jjjjjjjWOU/jIEeQfoR/IuOFVjUu5C
TLSH
T179669D05F99244F1E977417048DBD27ACA70BA268522CE6FF78D870B6F33B519C29722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e55a0c393d02459959a2de22458d9ea25ffc29bb3692c5a63e8c517334b467b1
MD5 18b780ff58f6f10b124e19192acbd69b
SHA1 cac1f4dd0e4c0222b04d7804629a71c7ed691451
SHA512 22f7af21cc75112add59be253f1c285ed18b07f4f5861da5733eba1553702c98eaef6fc71ee49881411a1752202f2aaeef8cc94388a8a4f04e12c8165cfd0030
TLSH
T1F2110D72B8E6DC73FC32B8CB82295B820DF8759F5C6C6A14134982297B49E318F5549E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/728-87-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1328-71-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/1328-48-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/1328-34-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/5956-59-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5956-0-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5956-85-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5956-33-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5956-22-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5956-11-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download