8b7c478686fd935cf7dc5960845a59fb080630e3369c5fdd6c2494fd52380990

Analysis

max time kernel
151s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 19.4MB
Sample260818-df32bsvcnf
SHA256 8b7c478686fd935cf7dc5960845a59fb080630e3369c5fdd6c2494fd52380990
MD5 af37a98e4e9d5568b6135d2841b3d389
SHA1 6d54fd8a3707883872d8339e4576961e13333840
SHA512 cd2e008a9c9f80367834d022654edd7c99433f6c455f4383dd4c620b9bd2da3ac8a7b4aeb3201ac1a44b1dfc4fae21680c6e7541a17348cc339e6ca6634854ab
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouzl:iZahvQHrc8u3xXJ/f4uUWHol
TLSH
T14E27BF17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000011bbd-19.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x000d00000001c4c9-26.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000011bbd-19.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x000d00000001c4c9-26.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000011bbd-19.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x000d00000001c4c9-26.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000011bbd-19.dat	UPX
behavioral2/files/0x000d00000001c4c9-26.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
3192	svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
4396	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBACACACAACAAACBCAACBCCAAAAABAACBABBBACBCBBCBBCCCCCBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe"	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCBBCBCCAACBCBABCACACAABAABBABCABABAACAACBACABBBBAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe"	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1128	sc.exe
1216	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1964	cmd.exe
1688	cmd.exe
2252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
3192	svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
3192	svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
4396	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
4396	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
Token: SeDebugPrivilege	3192	svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
Token: SeDebugPrivilege	4396	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2252	1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 2252 wrote to memory of 1976	2252	cmd.exe	94
PID 1276 wrote to memory of 480	1276	svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe	95
PID 1088 wrote to memory of 1964	1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 1964 wrote to memory of 1128	1964	cmd.exe	100
PID 1088 wrote to memory of 1688	1088	2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 1688 wrote to memory of 1216	1688	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_af37a98e4e9d5568b6135d2841b3d389_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBCBACBBCAABCABBBBBCACACAAACACCBACAAACBCCBABCCBCACCBCAAACBCABBAAABBABCACBACABBAAABAAACACCCCBACCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBCBACBBCAABCABBBBBCACACAAACACCBACAAACBCCBABCCBCACCBCAAACBCABBAAABBABCACBACABBAAABAAACACCCCBACCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBBACBAACAACBACBAACBCAACCAACABBCBBCCAAABCBCCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe" start= auto displayName= "UserDataSvc_BBABBBACBAACAACBACBAACBCAACCAACABBCBBCCAAABCBCCABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBBACBAACAACBACBAACBCAACCAACABBCBBCCAAABCBCCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe" start= auto displayName= "UserDataSvc_BBABBBACBAACAACBACBAACBCAACCAACABBCBBCCAAABCBCCABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBBACBAACAACBACBAACBCAACCAACABBCBBCCAAABCBCCABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBBACBAACAACBACBAACBCAACCAACABBCBBCCAAABCBCCABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCACACACAAACCACAABCABCBABBBABCCBACCAACCCBCBAAACABBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 92ccd97a670b0dcda123bc15fda00bfb3e2b8dab41c649aded56cf80f047e20c
MD5 fef24459896e78d8687c5b092dd7892e
SHA1 e876a6f975f7037415836d977e3736e85b26c686
SHA512 92ed3cf395907fef21b982de37fa8bbdbce9842a9aab88a629643d4bd37b7010f9965ee731e55afdbc1997ef99d5fd699fd2b118e06a4df26f0b4c0cd5eda5fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 6f27997ad272b2da18cea652e4b78af3fa941067d44f5f5594bea37c631208cf
MD5 53b2ba3cc6ffa5f421f8b6255019e2af
SHA1 7b84a6736744fa0ea0a0cdea1e67ae7226a04371
SHA512 8e7fa2c89fb02c67215b5f5bcee3257a92ea58fd37e3a1e7ca062f6d70427d9ae9ddfc72523e3cdef6a218d78014a7baf06d22c404c610b9da4137fe2a8543ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ms\qap`g`v~dtlq
Size 10B
SHA256 ab332769242e67a97de6ac5a84fd90f90450d0f391b09375d718e8192dfe63ba
MD5 9a0339f6a57a4543f78c7439fb75ee4e
SHA1 9f60112ef1dfe5c601f26b8afb8a6e126e6eef0c
SHA512 6be676da7dba6d4ffd3c1f4dc390f19df79e44d37ab0339c1da1dab544601262270d44472a4e05ff1e30ca074ba69c0327b87c17753e7d3c8883a8dfc7635dbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75e896ccaf68621a922b68d385c131a630937635d02e2820879c1672061114d0
MD5 029550b73cf643c628686d60fc14dd9b
SHA1 de050967a0ddd66e7da6a26bd2c9faa690ab985d
SHA512 17809b30b650579b8f0886d4b1b621f97bcb48a256cf31b63e9a13ed51bfe776fac9156fa62dd804dfb6e6c55232177a39a1bb6ed199e91e99c17d97a03a7db2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f0edde7951fc4c9648bb8bcfd55dd2a1dffc2b5f2093fcdf9d4906555bc02d3
MD5 7655878dbf1cf4767cd70e85b3dc303f
SHA1 4f7f00887571a3a65e256544674a7523311a3ddc
SHA512 73eb0ec3f956d7cb9e19a56b17a1d64c1e8f68f3747612492f26aa54b4a92959b19d5765b866399e875d09b3497a207c58f22697098cbcaef5aadc63bd101416
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7653c5d644c1bf975506108540201e7cdc96f3de6e14bc5a77be4ca5d0252e15
MD5 e8d6c36b820a1d8b3184ef16cbfbe8e0
SHA1 b1c72272671adb40b43ab92fbb77b95c92531621
SHA512 b328860af72d1d910dedd2a8ca0d6218a230f492c9dc4d2cbc63f9c19f8829743391e0f7ce6b6d8a86a89c8bb71d4f95ed18046dc22e02c359b5875dcd856706
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d73ab6fb235e7badcb5b69655b0089901361f00bda343850cf2abd1bed95f741
MD5 ef8a6d72f2abb82ef37c6641628fb887
SHA1 9e202b8a36fa332328f3809501a9388913f5a8c5
SHA512 49926d169de111510a9fc6b4c469dcd1b6a80442501bdd28bffa7a1083baadee4a6f89a45982eedc524128efd020e7dd60ed5225506ff4eb0b6c9821f69648d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c88a0d3ea6bde08f703fd115bfa9ba4c3c7c226694e30869e3e8e7f694b14aed
MD5 2d1bc9d381c514aa29d618aae812e710
SHA1 3e8d942030e5dcbe219e90ab369a6e50c0b8b428
SHA512 f7a1e5d251f35135296d4476442ae663b28ed858d270d5fb78f5a45f323f76fc64bcdb90eafcbf9b1284637b119f98c60d1e52a24dbe6ce4adfaf36680404d18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4389df65af17a13e7301d1dc6a3df6f0b95c47cd015aebda5775fa22cb5d6212
MD5 1935e39cadf7ccb6ac1de48a55328a2d
SHA1 7d687c20d2919f39e95ed93bfb925b2797b72ef8
SHA512 f4e2f734641bfd3d205e95a4493027630851cc4d859c3c13d62096fe0f9842710db3f0248843a2ce79b38a767a2118f87d0bd8a46af8ee741cf1315070cddc1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7bb6ce1ac368c5bad13acf5bc60f022ed2ea608adcf1202cb0ce230e7e4b93bd
MD5 5e64e5cababbf2b937e47d51e6ac9628
SHA1 16a92fd309c56e9de569a4d275d24a7acd9b5645
SHA512 d4b3fa0bd28648ad45a84190ba17024905026efe8169720237843340d399881f67fea248d6589bc7a3df407098888296c9fb0e4959a5d859c672a8aabb7ec4ca
MD5 SHA1 SHA512

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 58.7MB
SHA256 7f5901b81b5fce508731b2a168759fdfad5746519b86600d316a66daa9eae032
MD5 9c3ff5f89ec3904348cc515431bbd5e9
SHA1 cf80a5e3ddaa2f7a6ff558bfec7dd21bbf040d87
SHA512 e11590af4cc0261524302359887baca7b5463ceb07dcd448bd00467ac1cdc023791222383ba14fe7ef083b4bce0b1e81948748acc8f491f9d770ba8abaf1cb2f
SSDEEP 786432:iSvQHrK5/f4uUaSvQHrK5/f4uUaSvQHrK5/f4uUF:iSvQHW2wSvQHW2wSvQHW2/
TLSH
T143D7BF17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCABBBABBCAABACCAACAACCAACACABBCBBAABBBACACBABBABB.exe
Size 19.4MB
SHA256 8b7c478686fd935cf7dc5960845a59fb080630e3369c5fdd6c2494fd52380990
MD5 af37a98e4e9d5568b6135d2841b3d389
SHA1 6d54fd8a3707883872d8339e4576961e13333840
SHA512 cd2e008a9c9f80367834d022654edd7c99433f6c455f4383dd4c620b9bd2da3ac8a7b4aeb3201ac1a44b1dfc4fae21680c6e7541a17348cc339e6ca6634854ab
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouzl:iZahvQHrc8u3xXJ/f4uUWHol
TLSH
T14E27BF17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 618f009170f24c940553c1824e81bd3352a8c1c173150dd561466a5fcfd8ffbb
MD5 63dad62077a117e748aadac9d64be2b6
SHA1 a4dfe1ca0f536a6f3e3656143e6429d155b0d50e
SHA512 2605f5026a9602e04c54cc90116727d3969284fbe0325acca917c2d36fbfe897e47b8176ab5b2f424cf15ca4e170ead5091b5e61779e1d1c4ce583040ea3310b
TLSH
T1FD21A161D4F6C863F8332DDB621DEBC34CB4369FAD5CAA1812058219AB89836CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 57797ad0d4f9333d895219a6096f40a2e0e5a6e25fe15d4324cba57d1a26090a
MD5 910144eea2a2e73f38175d0092116cab
SHA1 949f86e8d401499f6eada92a1172d38c184ba9e5
SHA512 2b89698a436484764276267a56f55010168a071bdfbad0c0a3041de25ca19b9725d50bc234128f4fdca9f365e9399e259fa99c62e840f8a42dce969a9d571b6d
TLSH
T1AD11C461E4F6D833F8332DCB521DEB874CB4358F5C5CBA1812054218AB99835CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-70-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1088-0-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1088-108-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1088-48-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1088-22-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1088-11-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1276-68-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/1276-47-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/3192-100-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/3192-542-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/4396-543-0x0000000000470000-0x0000000000491000-memory.dmp

Download