79137a15f52ad15f501cf7da34e2c098ca6a504090e46cdd257cdcf24562385f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 6.0MB
Sample260816-e7v1gadj8v
SHA256 79137a15f52ad15f501cf7da34e2c098ca6a504090e46cdd257cdcf24562385f
MD5 53b816eaa02f5a61b9107de7dcc35ee8
SHA1 3a8fda39f3bd55887832bde0f29b481298e54b3f
SHA512 72725354cc71284b67276e9118d99d3bf0f48e3047babe15c1feb29d6c66d9129e0be96757a0679b1cc6586bb0af712a5e44d17543043ad0968f199c09202e16
SSDEEP 49152:U+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOegOU/zXNJ:dYYYYYYYKOU/jIEeQfoR/IuOFVjUu5f
TLSH
T139565C05B6E944A5F4B35630997A82658931BC754731C9DFB2C8C27E9F32BC0AE35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
4648	svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
1600	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAAABACCCBBBABABBCCBCBAAACAAAAAAACBACAABBABCAABACBCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe"	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCABBCCBBACBBCAABBBBBCAACACACABACCCBCBBCACBAABBAAACACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe"	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3672	sc.exe
4488	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
708	cmd.exe
4832	cmd.exe
2264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
4648	svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
4648	svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
1600	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
1600	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
Token: SeDebugPrivilege	4648	svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
Token: SeDebugPrivilege	1600	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 708	3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 708 wrote to memory of 3132	708	cmd.exe	94
PID 5860 wrote to memory of 3808	5860	svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe	95
PID 3880 wrote to memory of 4832	3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4832 wrote to memory of 3672	4832	cmd.exe	100
PID 3880 wrote to memory of 2264	3880	2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 2264 wrote to memory of 4488	2264	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_53b816eaa02f5a61b9107de7dcc35ee8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCCAACBABBCCAACBBACBBACACBBCBBBBBCACACAAAAAAACABBBABABCABACABCBAABAABAABCBBBBABBCBABBBACCBBCBBCBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCCAACBABBCCAACBBACBBACACBBCBBBBBCACACAAAAAAACABBBABABCABACABCBAABAABAABCBBBBABBCBABBBACCBBCBBCBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAABCCBBBACCBCBCBBBBBBABBBAACCACCBBBABBBBBBACAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe" start= auto displayName= "UserDataSvc_CACAABCCBBBACCBCBCBBBBBBABBBAACCACCBBBABBBBBBACAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAABCCBBBACCBCBCBBBBBBABBBAACCACCBBBABBBBBBACAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe" start= auto displayName= "UserDataSvc_CACAABCCBBBACCBCBCBBBBBBABBBAACCACCBBBABBBBBBACAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAABCCBBBACCBCBCBBBBBBABBBAACCACCBBBABBBBBBACAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAABCCBBBACCBCBCBBBBBBABBBAACCACCBBBABBBBBBACAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAACCAAACBCAAAAACAABCCAACBACBABABCBBCAABAAACBBABAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 02b195020bc46a26186df845e4bdae7d2b03f01905dac0ff6cd1619637eeecd5
MD5 35f39301458b7ef393f8b059e2f25d1d
SHA1 4448a5fbeaefe189f895df9ca3741db015ead86f
SHA512 2758f91b531634d6fa6416a62872dc2b331a2b4ff7f1c4fd95acb045f0fdcfc31a0a9bffae35504c022401e4fe695a8647035c74685f24475b03d939d088282e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c59911c3a4789804f91a3531f8c8ef2b8967dcd1cd7be0e129ac6a45df7ef1e1
MD5 01c83146b2dfc6a4337eda025e1d8209
SHA1 3c1b1709148186bcc150e733aedf8b93c857fb83
SHA512 6e2d46edaa778a8a55dba163e5c94c2f0fc2a894214112cd0318f294157cc02998c0fcfac24382421e2c83a6f74e5bbd08b2e610ad276aa908cde643a323c656
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c17a4a5acfff1938c5bbdec66cbfe4de89263945ba2a6bb9d5e19d7479ea22d
MD5 98a9c823b483dc45e2ef5736921c625b
SHA1 ef040dae7ef6a1107be3149fc725eade1af4bd67
SHA512 d3c65963f6d18e226bdb48e2f754b7b8a245fbf13ba4e87043c4b64e428cc4630fe017934b69b8222bbc2ed564781b3ac0660738287b36a4d95102d181839174
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e21db464b46d8bd6d7c647ad2f4ae30407aa50bc44c5a3f57d36b7099013950
MD5 8914f511032ff625d742a16581fb5ac7
SHA1 81dd37255fd31c6d8c450aa4c62324ef3ad7c548
SHA512 a9fbc44fd45545e3e1a615cd02546888d14cfa55fa4a2927144b292b3a8c705b3a1d225961541d435c082f5fac272e50a20d017eedc55ec7150fce57758071c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9f6728d2cafe93e1ab82406ab6f19cd861b3a75fd2557ff0d0ad1c4dc7a454c
MD5 df05d759d96396e1cd3ce3e6ecb6fc21
SHA1 35a6cd2ce986b8a0b3adb888dc98b1b3639926c3
SHA512 f981401f512b9693cf58ecce871169239ee8aa75a776834240bf6edf7e56a45d58d2cd10033b858427c272ad773b9b4571ba9c1781e2d8f30739b4f2c141b23c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb8b6e47a1387c0891b5515e93cf9072ff3eea7201af1ec3a4a7cea289a26ccc
MD5 94bb738f3871eeb2982ef0623cf4e4a5
SHA1 03b83f3174d84fab123db9f16f580eb242c4bca2
SHA512 8c9438a55618bc82615bfdc5e618d6fb383206738eb9ebff8977bde8b030414ee269e996d3a5189e4c823aa974ab09f5a0f25d713427380e8c610fc5e7ea78c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b88207852353f83725f3208807cf9535bce0148bdc1285abb945407d15d5a4ba
MD5 a6bb18d464beb68f34a2efcfab59fb6e
SHA1 8dd49109e1de2ba7de8c20d55833853ebf022d1b
SHA512 db243956f37f980891722dff29a78e0d263a17493895f7b0a16a8fe04385747e81e3a149105d06c53ae79b549c49d538f218004df743b692298db75b5347dddb
MD5 SHA1 SHA512

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 18.9MB
SHA256 b502e7ed82418ab5aef25e1f78f73425c7573ebae57c53062979e5a446fc5420
MD5 a03e3ea998fc95d78a67879cc4b714e2
SHA1 8bf8ab66f4c160a04c16d5481dfb7e29ff34b160
SHA512 17416e287dc1cc84d0d294aaee5419c45cce4b04596e8f613be8b27b78d74723a31c95fba3c03195419fef33bc2dd60317fcbefb7b72bcf0567226bb7d071d5c
SSDEEP 98304:dYYYYYYYKOU/jIEeQfoR/IuOFVjUu5lYYYYYYYKOU/jIEeQfoR/IuOFVjUu5lYYr:ZFIF0wu7FIF0wu7FIF0wu8UUq
TLSH
T116176D05B6E944A5F4B35630997A82658931BC754731C9DFB2C8C27E9F32BC0AE35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 960KB
SHA256 6eead4d939da66211d24f88cdeefe032533ebefd1313101340bfc5c918447f82
MD5 48d23f645e95746ed03fde8e7fd38071
SHA1 88c0818c32555feaf926c8a2e086197d7acabbfb
SHA512 9cca95a4826e59302f0b290a6cd44b553552d62d1044b8eef36ca8998560da81e0000abbc5a80fea922fe03197deac34ae792555b0d6c3f5ae254b0a2023040f
SSDEEP 12288:mgUFgEsnojA9yYymh7vag9CGPgUFgEsnojA9yYymh7vag9C+:m9+EM0qyIh7CeP9+EM0qyIh7Cm
TLSH
T115253B09A6EA04E8F4B3567089768165C932BC315B21D9DFA2D4C27E9E33FD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 42.8MB
SHA256 55c2df7a389be7faa8df4b00cab8de806d1a2ebc5094e5b2a92e9313db6bf261
MD5 737810d45c5dd537bf623ee756b90f0b
SHA1 49fd9b8d2350e5bc42c0f7f15da9d875265cdb85
SHA512 c46024d54352e7dfa4344d651be3d87a1baa50c59f2f205a7f50bab73e3c8306c8b9b84cd40e1b9c3017cc362df0f9ed0a433b6fac757204b8fb9108978750b6
SSDEEP 196608:ZFIF0wu7FIF0wu7FIF0wu7FIF0wu7FIF0wu7FIF0wu7FIF0wu8UUh:ZbbbbbbOh
TLSH
T1FFA76C05B6E944A5F4B35630997A82658931BC754731C9DFB2C8C27E9F32BC0AE35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 576KB
SHA256 ffe5ff4f732cf457e4bfe9b1e4cdc174c5b3e7270f948b795546d8072fda2710
MD5 b36b88eb21be997c3f674a02931f7f48
SHA1 33c94786d127f67deb851a848dbf058cb380c749
SHA512 fe2037eb1b7ec255000e8de68ee7994bff28ccadb7e657541cef3b3f5c8a45978612ed7de34256295e68a6dbdbe9b107c321d584d6730d714c2fb70db6f5490f
SSDEEP 12288:mgUFgEsnojA9yYymh7vag9CGPgUFgEsnojA9i:m9+EM0qyIh7CeP9+EM0qi
TLSH
T133C42B09F6DA00A5E8775670896BC17A8931BD314721C9EFA294C67E9E33FD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 1.2MB
SHA256 0dd52b88eaf82398c9e4ae00fbebe4aa5009a450066e92c83e8931696af1ee87
MD5 3406120db7c52ed205f217ea9edc208f
SHA1 5577ac6dd20e9d7dc008dec2f7c481f7566525d1
SHA512 4b481496a7b4fd163f9053d3adbe7fd7fb04e8260da11ba8c18b3910c7a213f8027269c92d9fef8679888348cf65f0ba2e90385810352315dff96acb5a3efc26
SSDEEP 24576:m9+EM0qyIh7CeP9+EM0qyIh7CeP9+EM0qyIz:U+E+hOeV+E+hOeV+E+z
TLSH
T138453C0DA6EA10E8E4B7467089668176C932B8315721D9DFA2D4C27E9E33FD4BD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBBBCBCABAACAABABCAAABBBCCBBACBBCAAABACABBACBBAAA.exe
Size 6.0MB
SHA256 79137a15f52ad15f501cf7da34e2c098ca6a504090e46cdd257cdcf24562385f
MD5 53b816eaa02f5a61b9107de7dcc35ee8
SHA1 3a8fda39f3bd55887832bde0f29b481298e54b3f
SHA512 72725354cc71284b67276e9118d99d3bf0f48e3047babe15c1feb29d6c66d9129e0be96757a0679b1cc6586bb0af712a5e44d17543043ad0968f199c09202e16
SSDEEP 49152:U+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOeV+E+hOegOU/zXNJ:dYYYYYYYKOU/jIEeQfoR/IuOFVjUu5f
TLSH
T139565C05B6E944A5F4B35630997A82658931BC754731C9DFB2C8C27E9F32BC0AE35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 71dc3313cbff29c021f1470f518bfc338c1a82f86a653e194f5eb8408c4c2d7c
MD5 d16f9f33c427d3aeed03e0d8e9ade141
SHA1 692d6ded048f34949f0ee0ad93017b6e797e740a
SHA512 61a2574f05087995f279263592146b1c07b85a938befccfb93c467f34f38f68e0a8be4a07f3f14f25483122ebc187e96f1cfa441693b0f9cd952311be8ffbfbb
TLSH
T11E213BB1B8E4CC73FB337CC7A71F9F820CA9275F6858AA0013098218E6D5E31DD558A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d2e5e7c9b195205d88375f7042a76784d06b12f757e9659f45a7a5556fac370b
MD5 e18a232fde56c59bf65c7365a5f6d8ce
SHA1 c5f2df7bbbf3b9f101fd5942505ef5fac14a59aa
SHA512 0d19a234f14e573cf6b68fdc5913cacf130e6a70de8662c2780a55cd1ea3c80d7b8ac961cd7ff13418adf3f7a20377509796f8c115d5d6225fc42878a8cfff27
TLSH
T1C8112B71B8A5CC33FB337CC7A71F9F820CA9239F5958AA0413098218E6D5E319D558A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1600-109-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/3880-92-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3880-69-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3880-0-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3880-47-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3880-22-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3880-11-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4648-93-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5860-70-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/5860-48-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/5860-108-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/5860-33-0x00000000007E0000-0x0000000000801000-memory.dmp

Download