0eeb328f839d7300eed04d64b5b4c338d49b0a87ac122c622b81376447aacd69

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 13.5MB
Sample260816-kbvygstdme
SHA256 0eeb328f839d7300eed04d64b5b4c338d49b0a87ac122c622b81376447aacd69
MD5 2069b7d022f9256067ae29e998bcdb3b
SHA1 39ea2b5f8133ad56e6a6420ee77815349d78e212
SHA512 41d6bf0b1a1217d4dd7ed937b60f8e0bbd48b79c97301dff2ed7a3bb81cca9db941b8d577a2f52011a142198b8596521c9d31cc99e7b4636ab8c832f536770ef
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJOr+ES+ES+ES+EyJC+ES+ES+ES+EyJOr+ES+H:0TTTTTTTTaOU/jIEeQfoR/IuOFVjUu54
TLSH
T151E63A05F98240F1D476157049ABD27E8630B925C6238EEBF68C9EDEFFE2A905D24731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
7064	svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe
6224	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCAAAAABCCABACCCCAAABACACACCCBACABCCABBBCABACCCBCCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe"	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACAABABBCCACACABBACCAAAABCCCCACCBABCACCBCACBBCCBAACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe"	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4204	sc.exe
2164	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1876	cmd.exe
5928	cmd.exe
4888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
7064	svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe
7064	svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
Token: SeDebugPrivilege	7064	svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 1876	3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	93
PID 1876 wrote to memory of 5540	1876	cmd.exe	95
PID 4112 wrote to memory of 4892	4112	svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe	97
PID 3688 wrote to memory of 5928	3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	101
PID 5928 wrote to memory of 4204	5928	cmd.exe	103
PID 3688 wrote to memory of 4888	3688	2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	104
PID 4888 wrote to memory of 2164	4888	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_2069b7d022f9256067ae29e998bcdb3b_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACCCABACCBBCBCCBABACCCBCCACCCBABCBACBAAACBCABCABBBCCBBBBBCBBACABBCAACACAABBAAABABACACBCACABAABABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACCCABACCBBCBCCBABACCCBCCACCCBABCBACBAAACBCABCABBBCCBBBBBCBBACABBCAACACAABBAAABABACACBCACABAABABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCCABACAAABABBCBAACAAACBBCACBABBBCAACBCABCCCBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe" start= auto displayName= "UserDataSvc_ABCCCCABACAAABABBCBAACAAACBBCACBABBBCAACBCABCCCBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCCCABACAAABABBCBAACAAACBBCACBABBBCAACBCABCCCBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe" start= auto displayName= "UserDataSvc_ABCCCCABACAAABABBCBAACAAACBBCACBABBBCAACBCABCCCBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCCCABACAAABABBCBAACAAACBBCACBABBBCAACBCABCCCBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCCCABACAAABABBCBAACAAACBBCACBABBBCAACBCABCCCBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBAABACBBBBCBBBAABCBCACACCABAABCACCACACCBBACBCACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
1⤵
- Executes dropped EXE
PID:6224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RemoveRestart.exe

Path C:\Users\Admin\Desktop\RemoveRestart.exe
Size 384KB
SHA256 29a7047365f2363bdb4d4fc245d28aac00f9cc1f038b23b204b56db3e824c77c
MD5 abfc3802a297c227fad1f5c599c2f098
SHA1 9d28bf6d12913c1ce815107e5fb9a89229e17f87
SHA512 70609482c7b4091728a56d7c8333d85047e05c42c2877aaf9274fa1a64d12d418ed556ba73d40b63b8e9a221745e1259c480dc7be25b343856a20d013035f556
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdP+dTTUFgEs3XojAdP+dTTUFgEs3XojAJ:mgUFgEsnojA9gUFgEsnojA9gUFgEsnop
TLSH
T1E2843A09F94340B1D92B51B04DCBE3BF8A60BB2583128EF7FA4DCB5B6933BA16438555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveRestart.exe

Path C:\Users\Admin\Desktop\RemoveRestart.exe
Size 11.8MB
SHA256 eca2ab7fbe09177e67588745fe922d994ebb0ea202f3d6fa9b7ffdab86bd9b50
MD5 03141dddd625145b1d4fd17a28a60b6b
SHA1 f88929da07009f201e0562e7b7bf890c7f4eb079
SHA512 6e4c53afa81c9ed05abe07f5637ebaf8247848492daaed27c51b9582eee8b6f2e1de8396f362032de625ead2e8d6d1171f359b4e96f7c2e8e3b4e5176041fde9
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJOr+ES+ES+ES+EyJC+ES+ES+ES+EyJOr+ES+9:0TTTTTTTTaOU/jIEeQfK
TLSH
T16FC62A05F94240F1D4661570499BD27E8A31BA21C6238EEBE6889EDFFFE2B905C34771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7fc69489b1281e508ea26bce2550307dfd395ad4c5984a0d74d37ab129591ee6
MD5 eea89daf6f28055ca20d28085039950c
SHA1 bc533ec1ea5d1eecc6bf73e6dfa7db84fc961d88
SHA512 8f25a0e8a07d8adbea6dc2dbc436dbf43d1f2162dafc0f3a64c4037d15ca5ec03665db066640f1531a4651673c39ab38030545a2bd80429021355300cbfd7b19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76c23843e884a48ffcdb78a6ecd6dc5aebcb9719f5858cee12510bb0bc2d66f7
MD5 8c2775da3edc700aa32d0f2f117e9dfb
SHA1 30c0884043c6104708cff82515a3c8ee59178491
SHA512 b1f3c0d32ddc71643bb17586b4f696bfefcbefa4755230c82da13da3b4a71e6dd27282b9ecd511f60081bde45d55072eff9bcdbdc739052b7c9496f7c6e7a025
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21d96173522febf662a6831f0a12c25f33495805bd6ca24315a5b7cc126ce2bb
MD5 3706b689511893600348fb7accc96591
SHA1 a3619400267f7434ee5b5f3a0a52f78705a0acc1
SHA512 9ebe377f683d80fc1c1bc3621ae9a867144dc54e53de72f7899552f5ab049080b5f9aaa68bc51573eb85752b727e12ce0a8d5564132f58194017580f34483f56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 260d62ea83e51873c80a9a6e1163605706e7de9a4bc2f4f66a6ab7ef423b06b6
MD5 6ae7f02bc94435a4a8813398e6279fec
SHA1 3148dce2329ac3cf37f09978538315f0039242d2
SHA512 17d39715154daa0bd52567b11a4b21080ae92651045d6acc4b9d20cf9ddd478ec7ff870a5ffc5e38648ed10f3291bd9619a01024efc1d2a436dae53627321b36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e35523bc614d71a295e96624eea5747e4ad4db08f97c79ff337737b982c581e
MD5 840e10c1b554384c9ad407af9bbbcd04
SHA1 ff6818b0bb20b0753f34ad69576852562f296b0b
SHA512 28ba1657e2cd58706ecebf2a29ba7d77014a0b3871e4c6e9b4bec8c092f3e2c9ee4cdac22df7419713223466ad340b7031e1a96be3bfdaaece8e423c01ea6c91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fbe286a2f1917fa36ea0521b2f052fe8423ff5129ad9620a39ea99e443e2463
MD5 1c1fb118b985086cdd3ab3f60d13f184
SHA1 99b2e9f358056fb86031267a8c18ca3be305a759
SHA512 87ca020a5b38934050210f8d6688736892afc78c8c42f79eda31eb39dfeba3113b2f8bf78d2cc07cffcf833a2bace75fd0d6922bce1f66ae5ce8a2d83cc1acc1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b47e736556af23844c31df9711132b3152d4c082a869a1337472ec43b6955a8
MD5 4b61f05a28a6f068ac99539b90cdcadb
SHA1 320a3c4db86ae16508f2de869338f53ce80c7122
SHA512 f3d74609d76e699d5eadb2149e9e5f7d9dee5c3fe26974fddb67eed99b6e3d38f26b294b2beb75c5a0b15812f087b452e346354ac81e9ff56ef8496f0c73b43d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 77a50a231b3b31955e732183ed61fa0ae31e49a0a3e890dfd60faf004f129f9a
MD5 3016408a980b94e8a86c703c69e2afb7
SHA1 fd44803f5e04b3468a57332ff90f7a77e9696b37
SHA512 59b42806725a6da0157e4f9baf3a532208d501d33ad0a1b9a4ad6665532100a6d05fca25719ff9d84c79e499881274c4543d7ce15d290399cc88aeb8828a596e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d96c49296762559fdde87a85d1fa037605fff0fb4bfcf1ea01e8fb498120efb8
MD5 2e0b1b04ba6ab6393c72524170c759d4
SHA1 73922d465a67e8901176c833cb6fdbf2d0edfb57
SHA512 df20224ead2a69445c63e230560628dbf307b3d0c422f87609dcb0e51070f41ed961d57b4b91be911c462482f3308d27b686ec8b301f7321bdc1dc32f224abe9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5f9b70c40e75f651be71a3730310a1172a33fc98abbb4809b337c2aa520f786
MD5 02051c859862e769cdec53ec04b2d049
SHA1 c1c81dbea42695fed4b459d778501e76e433961d
SHA512 3d666155958c1601f021235bcb301e81bbaa7c187e5216ccf43684986ff1f55c44b92492a0e14e6bef502b5406556eb54f2d2b7473d25906ec66f3955b7f2142
MD5 SHA1 SHA512

Submit Download

svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABCBCCCABACABAABBBABBCBBBCBACAABCABABBABABBCAAAAAB.exe
Size 13.5MB
SHA256 0eeb328f839d7300eed04d64b5b4c338d49b0a87ac122c622b81376447aacd69
MD5 2069b7d022f9256067ae29e998bcdb3b
SHA1 39ea2b5f8133ad56e6a6420ee77815349d78e212
SHA512 41d6bf0b1a1217d4dd7ed937b60f8e0bbd48b79c97301dff2ed7a3bb81cca9db941b8d577a2f52011a142198b8596521c9d31cc99e7b4636ab8c832f536770ef
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJOr+ES+ES+ES+EyJC+ES+ES+ES+EyJOr+ES+H:0TTTTTTTTaOU/jIEeQfoR/IuOFVjUu54
TLSH
T151E63A05F98240F1D476157049ABD27E8630B925C6238EEBF68C9EDEFFE2A905D24731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6a5b17d295dd5566b433cdc2a56475cb9f6ae08666ea108bd1728544117d6a45
MD5 28b091705ac9f19413393a007ccdd2c0
SHA1 effb4aad02526ede74a289e50f8dea3105fed524
SHA512 36f1c4843212f4739dc8ecadbf63ac09dbe76adfec4c7154b3174c3462e5c86eed0d14c8a17e73d66a5192585da13ebc9f1ca61771790948dfa9de219cc8223f
TLSH
T12511E751A4E6EC87E93268C74B2DDFD30CA9368BA85C7F947305851CE789C31CD190A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3688-49-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3688-71-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3688-0-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3688-12-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3688-23-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4112-70-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4112-94-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4112-48-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/7064-81-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/7064-109-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download