fc337307d8705c933b10c482ed881e5d3c72bdc0703a8ee69ac97f7e37463f99

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 28.5MB
Sample260818-b9gdbacm71
SHA256 fc337307d8705c933b10c482ed881e5d3c72bdc0703a8ee69ac97f7e37463f99
MD5 cecef17ffdabb7d3ea07e3a04b62f015
SHA1 8b7ac4cc274284c4d44dc634df8dc9977c805714
SHA512 03f3120f9d96f5064e9cd91fb1c7a5b31bab9a152523b8d9c63f5edabe0186013e61f651bf6460af2f108c8bbbfc31f6d9280fe3a576911705bb464bcee32a1f
SSDEEP 49152:U+Eq+Ee+Ee+Ee+Ee+Ee+Ee+Ee+Ee+Eq+EJ+Ee+Ee+Ee+Ee+Ee+Ee+Ee+Eq+Ee+EG:bOU/jIEeQfoR/IuOFVjUu5y
TLSH
T131673B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
2184	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
6088	svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCBCAABCCBCCABCCBAACABCBBBCCBABBBACACABBCCCABAACACBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe"	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBABCBCCCAAABBCBBAAAABCCCACAACCCABCCCAABBCACCBABACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe"	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1768	sc.exe
572	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3976	cmd.exe
2368	cmd.exe
3468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
6088	svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe
6088	svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe
2184	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
2184	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
Token: SeDebugPrivilege	6088	svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe
Token: SeDebugPrivilege	2184	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3976	3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 3976 wrote to memory of 2364	3976	cmd.exe	93
PID 4620 wrote to memory of 2276	4620	svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe	94
PID 3116 wrote to memory of 2368	3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 2368 wrote to memory of 1768	2368	cmd.exe	97
PID 3116 wrote to memory of 3468	3116	2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 3468 wrote to memory of 572	3468	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_cecef17ffdabb7d3ea07e3a04b62f015_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACCBBABABAAABACBBBCBCBBBCABAACAABBCBBCBCAABCBBCACACCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBBCABABBBABBCBAACCACACABBBBCCBACBAACAABCBCBACCBBABABAAABACBBBCBCBBBCABAACAABBCBBCBCAABCBBCACACCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCCCBCBCBCACCBAACBBAAACACCBBCCACCAABCCBACCCCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe" start= auto displayName= "UserDataSvc_CCCCCCCBCBCBCACCBAACBBAAACACCBBCCACCAABCCBACCCCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCCCBCBCBCACCBAACBBAAACACCBBCCACCAABCCBACCCCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe" start= auto displayName= "UserDataSvc_CCCCCCCBCBCBCACCBAACBBAAACACCBBCCACCAABCCBACCCCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCCCBCBCBCACCBAACBBAAACACCBBCCACCAABCCBACCCCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCCCBCBCBCACCBAACBBAAACACCBBCCACCAABCCBACCCCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBCACCAAABCABBAABACACACBBAABCAABACCAAABCCAAABACBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bb5861e805e6e55e5991794618e6ddd2ce0f9d7da51c0f4ca58e60d727f2f52c
MD5 0e90d6410fe87de16a8a0a7ae58a6c20
SHA1 4cd79723c08e2abdacd275e5e8cac223b8dfcfef
SHA512 f837b347f765a836b55a3b338c58217f6b6339414dfe2e121006ff0fc1ccdf1231fe25375bddc279253d4335342593a06c5e523618e344738300162a926cf448
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Office\qap`g`v~dtlq
Size 10B
SHA256 36395f3457f664ac9edce3c21ae47ae50fef5fc72208020eecdc1000cef40dc8
MD5 8e8e1f2eec79a43c162a9de3b85e51af
SHA1 f2e3b79926913f7b12c4fea2ddbf3963fc82abb2
SHA512 b824738ea373714d9ef193617014b02e994905fb9a5f35fdb7c0500e554ade0dfc4d767668d3ec0deff22ff4acf6bdabda068cf4e9f71cce8aa53519c6686ffb
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 29.1MB
SHA256 c3cf83483637d417ae5b94103622512ae60dc012b08648fd7065dbecf8f13f15
MD5 07da585a4037f13c13fd55b6748a0df3
SHA1 35c63cfdefdf64c54dffadef8263ba4de29cf223
SHA512 8594fb2ab711da19fb9b5c0ba0adfda9b86e39af80b085f4b149d731dca3679fc4d531e22458aa7eedb049a3dd39d12effda7897b32b6c85de185321d05f515b
SSDEEP 98304:bOU/jIEeQfoR/IuOFVjUu51gZ2Hb9t+2xv:bFIF0wuvgZ2jv
TLSH
T169673B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 a24bcb7c82f35302ea88eb399b118d14c810df7340bc594ac40200bcdbdc8048
MD5 c3c2421d6f22287b77963a700a08a3c4
SHA1 e3f287c6b659e478e3ee4d5dbae9afcfcc286a8d
SHA512 01e249eb936bf0f0c581554d6a7731f17dec27fa81d204fc4de97a7e080441823b251d714b6db0cf7cc70acdad1e8c98a941aee9001f2b23e2c6419044196d97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 167d69aefa42fb28d3f2197b2a584a3778cdee90a8c96382e7c9cb90563315fc
MD5 3fac063ceccbc6f43a8c5cf6ec475b13
SHA1 2fed10e0c72836262dad623a08465349c7c888c3
SHA512 ac81659239f2c8a0b40f7bd6ae07cda7588ba70c245ebaaa3b456cb2ed297164ab4ae50f12789479c29e1e0701cf61c1463ddd2a0f90757d5d22009f2435fa89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 d1e60bb8711f85dc68c453770bef0dcb0965467aa33a5bbd8047803b3c71f629
MD5 4e954f6783b4e009ce131e816bbff350
SHA1 8208d476e078b2edc01e34db1ff2f2571c36bbc1
SHA512 6e1e506ddd279256c8d143e1babdba8bfeefcfcf23dbad7ec651d6866a8d90f0f0054b7d96e85ef7308114508406d4ce20fae0291bf9ff3aee4223a512d5162f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb82227c80c968e3296e96382ff6e29db98e00e07e5fc050428c8ee6476c71a7
MD5 0919dca926d519a84dbf98c69b19b163
SHA1 ba8137f89e2b474b7b175bee0749647d508ddb4d
SHA512 a3e7555ecd7fdc966bc45c14ca332136c35a1a6149a562f294dd1dc0d3908aac74e6581c7afdc6302a3525dbff0344eb7a71c38a77831bc090f3e56cabf217c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a32386c0728c45a03f69669b85eede082676b3979b82667a9c91ca6b3ad379c8
MD5 5a9413003f5fc25308c5751a12f6fffd
SHA1 f0adb091b2cd64908546de1d4b64a8401708a9a3
SHA512 2549d5595a33110a9b68b7d200ace3864b8d5c4257a2ef12e51271d6e140b3ea87d620e8336324d275caf7875d93bdc985091cd2901455ecacb7befbccd766a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0c58a1eddc996144ec676876ad9e9557c764356db4555387be479d3ea8f04ff
MD5 6a360b7e0481354298ee56105ffbdcdd
SHA1 62fb7e3450de8d2e86e9d83919691f7b5f8098bb
SHA512 f1237f92aa627f9b0cec9362e255dbee4b63ad9c9cff349bd6cedfe6bf345a94eb5c219e01da32d195da0fb5373113224080940f1c7eea44dd1d095df0bb77ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 106c9424c5c46991be0467fd5d03ccb495e6386ff0df739895031f5cf38fc0dd
MD5 3efc3a200436b35d9e6b8c415c8f594f
SHA1 bf5db0c22d6f55d7260699ab2eef9b344048526b
SHA512 047a38cc58b8c7d3994eebece8237706e3a405c6aab1f6ff42bd0f29e84eb0089ba2b9bb1b27fa6fc92407b2104b3a9ccd5c1d5a33f7692330b8a59c874e6711
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e72888dd01ced6d7289f6e1d681384ffda7e7d399f90f2908420f6df8e185350
MD5 c5997c7fd7cf785d4ad4e04f04d9212e
SHA1 984bc8543d79825786fd839ad75a46a7e1f43b27
SHA512 b07f5e8bdc3537d11a2d4f479aa227c536866b3c69bddaa35a93ffbdb45e8f793ac76cd7dede7962c5c20de05835267c93cbfd3086b716a9297bfa3f179a682c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d95b44c79a4a6e556573404d01cae6d93a0275c3b1b18066fb4802e203619dc5
MD5 c0d31c08e7df5537306ac638adce1a90
SHA1 04d45aae0d2f69141aa75454d770ad3b8452216b
SHA512 55de5d98fc3ec180cb21c4d100ae03cc32452eaa750a6e2194da3827f338f5014aefb727111d90e12da45d745d70b71ca82fa2da4a7f3c4f585d78dabd20fc4d
MD5 SHA1 SHA512

Submit Download

svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBCCCAACBABCBBAABACACBCCBBAAAABCCABBCCCAACBBAB.exe
Size 28.5MB
SHA256 fc337307d8705c933b10c482ed881e5d3c72bdc0703a8ee69ac97f7e37463f99
MD5 cecef17ffdabb7d3ea07e3a04b62f015
SHA1 8b7ac4cc274284c4d44dc634df8dc9977c805714
SHA512 03f3120f9d96f5064e9cd91fb1c7a5b31bab9a152523b8d9c63f5edabe0186013e61f651bf6460af2f108c8bbbfc31f6d9280fe3a576911705bb464bcee32a1f
SSDEEP 49152:U+Eq+Ee+Ee+Ee+Ee+Ee+Ee+Ee+Ee+Eq+EJ+Ee+Ee+Ee+Ee+Ee+Ee+Ee+Eq+Ee+EG:bOU/jIEeQfoR/IuOFVjUu5y
TLSH
T131673B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b8779a98c26d971fd1a21e02e5945b79a26bbcbff95f70050d287583ca54a708
MD5 af0baf8fad216ca75f29fe573ceb3bbb
SHA1 bae79e99d08f00ee8e7ad40138e98d0ef6ce9f78
SHA512 5f25d1abe7da5bb2553d91804cb20a9bc623908b36562870b844fc8d8fca370f8ccdf9e21563579945fda528cbfabb848a04c1eaaa0c6777c06851035e19953e
TLSH
T19011916A94E6DC67E9732DCB711DEB830DA436EF595C6A142305831CABC9830CD268F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 71476fceb81b49331b2a0af4d591787bfdb3360c85082258d68ef06a5ed74ae3
MD5 4852e440e7d5edc54aa88c14da70e33a
SHA1 030f71c8453e4a38e05f1b0573508313aeb567c3
SHA512 4b58ad759e1ebb0b4fa6c83c97956f1339db8258e2b3781ffb6a95a463ceeb6b016f5b14d1ea1e044a8c53e7a682ea09b8393112e0689e3f0ae32b887e684c61
TLSH
T134219F69A4E6DC67E9732DCB711DEB930DA437AF595C6A142305821CAFC9830CE168F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2184-65-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/2184-450-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/3116-6-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/4620-35-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4620-22-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/6088-81-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download