1f0d0bb0a490ab9a86ceefaceb5fa9e719162f14083bf263ea75dbe591262a45

Analysis

max time kernel
121s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.2MB
Sample260816-d1lyjscl6w
SHA256 1f0d0bb0a490ab9a86ceefaceb5fa9e719162f14083bf263ea75dbe591262a45
MD5 ed6dd093beb3152730db9061a7c2c89a
SHA1 82e5eb1836d8ac779b5c05f255b4f0098d1937b2
SHA512 7db9c9ea58150e820041945faa93b4b6f2446185db0726a1aa695964345a42a26964da5bcf5704b8f4363fcfeec1269c6ba461ccae8a8ea68e9aeef939ae9f54
SSDEEP 49152:U+EF+EF+EF+EF+EF+EF+EF+EF+EwOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMx:pOU/jIEeQfoR/IuOFVjUu5r
TLSH
T1D4E59D11F9C68032E57311714DEAC37A8670B9A5873289EFF7CC461E5F31AC19A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBBCBACBABBBBABBCBBBAACCCBCBBBBABBCBCBACABBBABCBBCCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe"	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2848	sc.exe
4328	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe
4604	cmd.exe
1928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3200	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3200	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3200	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3200	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4288	3200	2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4288 wrote to memory of 5220	4288	cmd.exe	94
PID 2752 wrote to memory of 3404	2752	svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_ed6dd093beb3152730db9061a7c2c89a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCABBBBCCCBABBABACBAACCBACCBBBABABCABCCABCAABBCAAABACCABBAAABBACACACAACBACABAACCBBBBCAAAABCAACBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCABBBBCCCBABBABACBAACCBACCBBBABABCABCCABCAABBCAAABACCABBAAABBACACACAACBACABAACCBBBBCAAAABCAACBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCAAABACCAABCCBAAAAABAABBBCACCBCCABCABBCACACAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe" start= auto displayName= "UserDataSvc_ACABCAAABACCAABCCBAAAAABAABBBCACCBCCABCABBCACACAABA"
  2⤵
  - Executes a command shell one-liner
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCAAABACCAABCCBAAAAABAABBBCACCBCCABCABBCACACAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe" start= auto displayName= "UserDataSvc_ACABCAAABACCAABCCBAAAAABAABBBCACCBCCABCABBCACACAABA"
    3⤵
    - Launches sc.exe
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCAAABACCAABCCBAAAAABAABBBCACCBCCABCABBCACACAABA"
  2⤵
  - Executes a command shell one-liner
  PID:1928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCAAABACCAABCCBAAAAABAABBBCACCBCCABCABBCACACAABA"
    3⤵
    - Launches sc.exe
    PID:4328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABBCAACCCCBBACABCBABACCBBBABAAABBBBCBABABAABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABBCAACCCCBBACABCBABACCBBBABAAABBBBCBABABAABACACBB.exe
1⤵
PID:2036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a530965b195f5de5f83c557e75a7de8941871f0a39b100400badb2d1c1ea4932
MD5 166b66d9fa74a8adcde6d3543680681a
SHA1 a2aff8232965585536ee6de25f3b1fe96db967a9
SHA512 165cecc769d15d9542469c276e1cc93bf62a8ffcd78b959feb3d1ac9c025ff70ef4e113213dd45e6fccd4ab7c0955a63115c970ecb9594bbcc5fc0c4b937ae3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 74be894e8d2b4d0eac6a373dad32d2ce860cc9d002041e146cac87e7022f4c97
MD5 3d6479f31f8852959acd5bcdcc827f71
SHA1 da80c138492bd87483a9b47a04a0494b26e31493
SHA512 a0a411dda5996776298fab7a888cb54009f4a6df8f6a73cb4899d4a80cca422aa574a6b38766460ca6bf7083a4724110538d100f4568f06db36818ffbdd75682
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage\qap`g`v~dtlq
Size 10B
SHA256 eeea0ea2ed6c3d120f3a7cc12aaa1b745e7dc43460af61914bfbe0f1be66f626
MD5 d6e7a1bbaa58488093f299619acbd5a5
SHA1 0710aa0d3e8cd7878b82fb96112171a74295e9cd
SHA512 e7a3391bd06e63435cf4c3af7a7ee30859230c4fd1e9df728494e5a6ca4759fdc7f20a3123b162cb2d3928c40641b68014b7eac9481c9bc069246650167a9c62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Vault\qap`g`v~dtlq
Size 10B
SHA256 1bc0157b6b5c710280f4ecb6ebd3074dab688ac47f7b61114f772090e678984f
MD5 8ce6712cba56b652c86d802a850aec35
SHA1 e0e982f117ac03d0dd24a2f4bd55f50a47748830
SHA512 89d471ad365dd2b09eaf7abf5c85aedb0a97fe667cbc726278b2c1e94c72b0fc31698872c5cd42448f29581dfd7f04176b3514e8a5956496fc2b92817ee83b0d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.1MB
SHA256 e463850b71298ac7d2e3001cec7c240fb7404ccc8ee5bd0f48cf397bc22d02da
MD5 1f8131bcaffe334fc64dfff9fd971dc1
SHA1 de78c1fe18d0ea7f5ab4f38d13b754a2747caba3
SHA512 129fb7303247185807c408172c6089bab53d2c8427286bcb9cdcb56cff6b90292470c79ba8046c0cbd11407a4efd2c6ade7d9e4501e90ae61f57fad3bb83c42d
SSDEEP 24576:m9+EM0R9+EM0R9+EM0R9+EM0R9+EM0R9+EM0R9+EM0R9+EM0R9+EM0cJOU/z:U+EF+EF+EF+EF+EF+EF+EF+EF+EwOU/z
TLSH
T1F4357D09F8838472D92B50B00DCFD3BF8A70BB2585128DEBFB8DCB5B6933B516519259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 9c68b4370fec120b9c2a5ae836f439039a47cfc09e83ddb40e3733bfa31816ac
MD5 f3676414f292754ecae88bac3be96ca2
SHA1 91502e8297058a1c77ba22546d8e70a2d78f53ea
SHA512 cecbada78b41208da46f8436b43c6ab95285f173524b244158124f9954731a8f03a7b11c56ca60f522cb8437112abbedd297e2669083ba4cd5e4a0e2b83b85d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 80a0b14b0730df8865efaac4910064ed821ff711a0207ffbabcc34a523b5a63f
MD5 6710e49ebaff30b3705c407938c980de
SHA1 342b4d634e7f41ef5f6ff5ca9980cfeac62d1a45
SHA512 9f94262786966023557d125080babec4efc6dbb68ad518e3797ee51b4436213956b9c1e713ecdd77ad14ce0f7a69f64dcb2c470c9e10fcacfd2ff81197848c87
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ESE\qap`g`v~dtlq
Size 10B
SHA256 5878e2cc0602598c9f3ae92dec1834bfe7ee5c9db0dfe7b3526568987de1f0a9
MD5 0e7e5fc4401e24ca3f5d3609fd08c1e8
SHA1 e1b5f4ab3ae08be107125bf616067c720c956d56
SHA512 9bdd3b78048a6325688d4e52700476d35eac730263f9bd9a2733068d83f77f05251dcb2c4f49c873b08c0ae273907838b16249020815a273272fcb9c8a59c1f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9670c8dc76cf93e9c145c432c4faeb67dde5d6aab4ca8dc7d5093f43fb0c2bfe
MD5 e4be68e3a440e1da7094440c743d620f
SHA1 a4776bb13ab2600662deb8a5194c07d893975c25
SHA512 7ef659dfe3932bdf3dfd5aa234b3c8950dfc6625d3900d698174ffa86e58403f084b9408613d3cc63db3653e095d2c9b615efdfc37e2964751c43616e472daf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 29b01bf90032e7081f61a3d253e75421cc8931994af365b615fb5d1cc1e183fb
MD5 865ba4fc075ff8b794df8cf92e759e58
SHA1 f2bf01c66ebf96bc4ccf49a481b9a545b4321925
SHA512 545070b6d986e24fc18fd57a99969dc06520f336fa4113b53467e23fd345df824c378ed50a2165cf201ef85360c30ba9a03a3a8c813be1424cf289669dc0d904
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 be6a19455aca2f8d991d573a4f87126c81749df36f4ea73013c467d96d5d3c83
MD5 79d48fc2c219c4d7e2329a8b4f1dcbf7
SHA1 2b86a824455376c965fd31db4398610547e31dd0
SHA512 ccc5a49dd7fd58a167341e016840023d569875b0fb5f7814e37c0ac9db8076833dea4392481ee7560f5bef8e60ff0045c7e9338e291ff8274b6da9303969ebaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 21e3267855b1b07e946f30333a247335f4a360bf175c29f5c826852036e2563a
MD5 524c043893febe30d55c8250f8a94028
SHA1 712b375ea373ea99c1a8186ba2e3129b2a69007d
SHA512 c832c8cc61d8b1b57f2c9cbe189e9bdc390918b4a3870b8473564366c8d7b967687d1ed1577291fa88784f1d20ab1080d9bd29773370a0aa6ed08629a7bf9d1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e16f2001ad47a4d63b213a3632455ba092e6b0bdda4986a35cc4cc97f77d43b5
MD5 84ed3c53e6629446a4b80b210105a1bd
SHA1 bbea45c63a7c6e00335375b19114779e428a3256
SHA512 537baab6779d877158613443cf91c2b4648e82647e81a9e34b22d3a1057b8e45d0c7e80031b0015bed4d2bc249b5f46b31e34f03b82470d0906151675227b477
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 33b1977545272aabb31ada787d5622cdd665090e2e5f4b1447688823f8eabe90
MD5 27aaf67bd1900552b9365d9d2f8664cd
SHA1 ebcda67e44ef21d0f9262dbe35c75b4d1f6a53c6
SHA512 72e824b69c30c6deab9c46cc9bc53cb0753432efe8202477d4a986867e948dd1a3e1d839c073e17fe752ee6d3814900f6f0a733ee9856a4fd3b1a3805887c4f3
MD5 SHA1 SHA512

Submit Download

svchost_CACBBABBCAACCCCBBACABCBABACCBBBABAAABBBBCBABABAABACACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABBCAACCCCBBACABCBABACCBBBABAAABBBBCBABABAABACACBB.exe
Size 2.1MB
SHA256 185de82eeed23838ceb580e9fe97672dd023ba8f99a2193d3f0718e783442c76
MD5 1b0fe41752eaa89743d455fd7652b2d2
SHA1 a2b11ff889aebe5ea4406bda1a79e5233949abc8
SHA512 8d32554bccaf71fafda418071621002cd97503b8df893965b4b08815dfc65b39e65d6aceeb860033e13490907ca4a7806b40f98fd9f4a78776346aaeb079f6a9
SSDEEP 49152:U+EF+EF+EF+EF+EF+EF+EF+EF+EwOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3n:pOU/jIEeQfoR/IuOF3
TLSH
T125A59E15F982C473D52700710CCFD3BE8630BA7546238DA7F7C98B1E6D31BD1AA29A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
Size 3.2MB
SHA256 1f0d0bb0a490ab9a86ceefaceb5fa9e719162f14083bf263ea75dbe591262a45
MD5 ed6dd093beb3152730db9061a7c2c89a
SHA1 82e5eb1836d8ac779b5c05f255b4f0098d1937b2
SHA512 7db9c9ea58150e820041945faa93b4b6f2446185db0726a1aa695964345a42a26964da5bcf5704b8f4363fcfeec1269c6ba461ccae8a8ea68e9aeef939ae9f54
SSDEEP 49152:U+EF+EF+EF+EF+EF+EF+EF+EF+EwOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMx:pOU/jIEeQfoR/IuOFVjUu5r
TLSH
T1D4E59D11F9C68032E57311714DEAC37A8670B9A5873289EFF7CC461E5F31AC19A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCABBACBCBBACBCCBAACBABBCACCAACACBBBBAAACCCCAABBAAA.exe
Size 1.6MB
SHA256 4b1e5c3f5865da76630d2b7fba12c19e53826b09125f5eae10376fd837f0a2c4
MD5 1c2c290eab5239061b0166e36b4ca9ae
SHA1 c29aab24edb8581d348b4f27164be7219d758ee4
SHA512 f2d5c7b98834a8a95b87a76dfd58fbd309889a68e86eac517cffc980b8a156266b280db9ac6b0ecd818e041069a2294043a6cca30b884960249c05d7921d3305
SSDEEP 49152:U+EF+EF+EF+EF+EF+EF+EF+EF+EwOU/zXNUfEeXAxhF2rn:pOU/jIEeQfor
TLSH
T171859F05F8838472D92700B04DCFD3BFC674BA6181228DF7F7CD8B5AA932F91A525A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 62f97598926c15111756f464ebf40f1d4afb7aa68a50391b3f6f7540378ecfd8
MD5 6a99e4ebc17114c7e07674f8f68aca75
SHA1 36b84f6f47852f79c8ad85522ab047a8b01e9bd4
SHA512 b97923e0ef43d9aa1a1b2b8f1b463b580a4f2bd7f650ba816ae1ecb938fec64b4239bbc14fc6cd0fb7266ce7874876341a7133552c3e703d0afee13a7e3172d2
TLSH
T174110A9194F5D4A3F83328CBD22FCFC30CD6779B6C58AA28130A4119FACDD368D190A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 a01db0a8b4b7de22e131f3a0f8465285c6c253fbfbd6c0881972339b0c522ee4
MD5 5e84f61c9dea0e1edf58683fd4428335
SHA1 4a9ee868fbbb4f3bd32963867daebb34c02f5a50
SHA512 c3be034fb6515d8cff2a3345adbfa978de15ec458af52885866844c741aeb15f1d88fa5d959ba2ab1277b1dc9464ede9f846e1094548e867364ece1bfbeca776
TLSH
T10311C89194F5D4A7BD3364CBD22FCEC20CD6779B6C58AA28130A5119FACDD364E190A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2036-78-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2752-31-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/3200-0-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/3200-7-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/3392-1632-0x00000000007E0000-0x0000000000801000-memory.dmp

Download