3a5f3991c23b0a20b2b3b88c54d3f262785825ffa74232ac9619c7f8bacd96dd

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 23.4MB
Sample260827-nabd8stdmd
SHA256 3a5f3991c23b0a20b2b3b88c54d3f262785825ffa74232ac9619c7f8bacd96dd
MD5 a607f32371e2586e52362d8fc7653d0a
SHA1 39cb0f116ce34141125c18038c67ee88f6eba86e
SHA512 34ed2b64039278705d65e08266e4b166272c2a5601259fe9d32f2374b32d1838c7681f7d190e7c49106426de761096c7733186bf773c1513b90ec16f6ac06ffe
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw3:BRRRRRRZOU/jIEeQfoR/IuOFVjUu5L
TLSH
T16A374C09F6DE0465E877617049E7C27AC671B9618732CADFE288C63E5E33BD0A834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
4648	svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
3180	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBACBBCBCABABABCABBCBCBCACBCCBCBBBABCBCBCABAACABCCBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe"	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBCAAABBBCCBCCABBCAAACACCBABBABAAABBACCBACBCBCACBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe"	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3672	sc.exe
4488	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4276	cmd.exe
5612	cmd.exe
5828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
4648	svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
4648	svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
3180	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
3180	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
Token: SeDebugPrivilege	4648	svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
Token: SeDebugPrivilege	3180	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4276	3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 4276 wrote to memory of 5660	4276	cmd.exe	94
PID 244 wrote to memory of 2236	244	svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe	95
PID 3360 wrote to memory of 5612	3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 5612 wrote to memory of 3672	5612	cmd.exe	100
PID 3360 wrote to memory of 5828	3360	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 5828 wrote to memory of 4488	5828	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCCCACACAABACBBBCCCCABABBBCABBBCBACCCACBAACBABCAACCACBAABCAAABCBACBCCCABBACCABBABBBAAACBAACCCABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCCCACACAABACBBBCCCCABABBBCABBBCBACCCACBAACBABCAACCACBAABCAAABCBACBCCCABBACCABBABBBAAACBAACCCABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACBACAABACCBABBBBCACAABACBABCABBCBBAACBABCBABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe" start= auto displayName= "UserDataSvc_CABACBACAABACCBABBBBCACAABACBABCABBCBBAACBABCBABCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACBACAABACCBABBBBCACAABACBABCABBCBBAACBABCBABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe" start= auto displayName= "UserDataSvc_CABACBACAABACCBABBBBCACAABACBABCABBCBBAACBABCBABCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACBACAABACCBABBBBCACAABACBABCABBCBBAACBABCBABCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACBACAABACCBABBBBCACAABACBABCABBCBBAACBABCBABCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBAACBAABABBBBCBBACCCCBACBBCACCCBBBABABACCBBCAABBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7e690920204e8d3c723a87608a6f337226ed7857e16860ffb16ceeabeb7238ce
MD5 87a0a04de9870ed10600e649dcd9e48c
SHA1 0ea7870783d16c60ac4705f054c969bfaf54382b
SHA512 38c193cac3a82e3b95021073113b2fd4773eeeafc210f800e82b3828ceabc0581c5e4604aaea7dfebbbfcdedaa55ee9c4ce9e37c66b549fa5ac202df6671be17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 4b7ad5b86b2e100108d0f90c6a786609bc2e0edf78398e8d4c48805c941df3d8
MD5 051a6bc73e8112d73a422b7ad61d8935
SHA1 fa1f396b51a1e329cb16f66cbcd9faf255ebd3e9
SHA512 a43cb4d93e0adeb7e760b5a89cc22d63b848501eca9d7cbd38d41a5f9aa3ab48687e7b007aeb227f326c9711789645ce4c9db997ffe2579511a06cd94835d55e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 1f64f4c4918eb1ad4cf2bf2a1b36354f63f41ec22f742291585137ef3bd15e10
MD5 bdcf1858f7616f1b0a876a91023991d2
SHA1 9cc7b02fd1fb1216a4a2f2e5e6dfba7a3fa5f2b4
SHA512 5cb531bc866fb9326ea9ca34fca2f1b68e0e739b01cc38eae10fea70c5ae547c71f84906969daee6a53c3d2febf287c529d9991f53c15f1b76774da9c1ce5284
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a960952b3edcb41977ff0faf1fa4373bc797050a4de21153ab65bb70507ec710
MD5 965dcba7ce3ab4de73468df6f2156a8d
SHA1 7b0d54d51e54a057d47d1c4f0e456a88f1a25519
SHA512 6874f47a4bb1d4df5358d01ca9def41ceba5d661135caf0bdb732ce6a3cfaee56ee77652ead9dc6ac1e7235f0df2abeb32f5ab1786c737106bb955a4adb2461a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9ff303b033e305913bcdfea976d10eae640e73734337e638ccbfef38441c385
MD5 ab7c6f7386b24fcc614c6e1b13d9623e
SHA1 f4ef1738cb1eb72ff4c5e03ec2e776bcea5731b8
SHA512 fe3e63b56b9bc86ee6198633336df651fa62a3f77be09b7de7d004fa8ce07a8cd6cbd642202e8c9285762388878df40365e2d8dadbe2bb08a7ccd331da9e14a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f6ba3779ee9cca559a689b8513e642b387dc5e80476791569bfdc0f51769629
MD5 4a593a170da324c5fc480da308335728
SHA1 f9da259e3d91cbd356f70048a6f8b78904d7cccf
SHA512 d29937f436465bdbf35d9b8d4ea26547d623fa4647bac19a6c93d7abd65c53812e53836516d7b749d441833fbb95f30b491c9497f0f2993c7c4f6a8ad4f4164f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0b2acd07b9031f80b002054d19499bac65b7dc707a2e67e93de1677aac6c9ec
MD5 b9ebe0fd00f0b6c8801fcbc3b579ce14
SHA1 2eb1df99c4eb6e1cf278d179ff393a0622978cb3
SHA512 a49be0c820be8cd4fe3a73fa21b33ffd57fcdfbb498d428f6e68b35bd3b41ef9593614a61858db1312b0feaed9c4b4c4f4661a01120f08e52ae8c62c4701bb64
MD5 SHA1 SHA512

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 1.6MB
SHA256 a276fafa250e660ab6bb805d11b55e2980009f2b4db5419ccfe49f9f4cd73a74
MD5 87b2c3ad0857c7a70cb340eaec7bb563
SHA1 65021626b1ee170555e60d32a33286f3b6a685db
SHA512 80a8114c072e4c31bfeb2ba91102fe715067f1de182356954d2484d19a394d1009ce686e1bf61071e80876bcf4e6ff92793f3fce69e332d78aefbf6461f9fe85
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+Ee:F
TLSH
T114753A09FADA0471E877617049E7C27ECAB1B9118732CADFE649872E5E33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 03abfac3393f93462ea05767bd2a39bc9141a8a5a3149316c2ef1639a7e990f8
MD5 2ff737814564fb3d804734bb8a3516b6
SHA1 e9c72e9bcc3510daa97919c064e0ad9810fcdfef
SHA512 025b2198376033506729673e90a3bd8dd0e61c95da2872b4a00584a4a6f6d7cdd83122a9706555abd967e79614b8a7dc10cddb43c052a82c8e17d88224bc291b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f0becb28f3954c6355bdf1c65645b64644281148e4b84ce4845612803c0c2f92
MD5 08eafdc7342f4c7edc0ad1436c2c0b6a
SHA1 78e19d4ef2051770de67bc4865be4933cd05fb9b
SHA512 fbab1cad83a792e6cae98a3e3320f90065c942d2264689fa8757863404b46beba5b166331cf3a822e011353008e484d0b76cbbb2ecc806e73157856465cd4ae6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db4093acd596241f664196ab8cd4f3e8a531c6356d20c8c80f9e9b52a0199fec
MD5 18c99dbfa1347ced351e0828b46b2f80
SHA1 e2ebcf8daa2b6aa416190784e1801bc4505debc1
SHA512 1d825483bdf5e4eccd8fd188a98450520751becf243c24dd1dafcb7b353914fd4898792e65f21a0f6e07d007a8f1daf661becd7cd44bfb45bd539f9f0a1fd0ac
MD5 SHA1 SHA512

Submit Download

svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCCCACCCACBACCCACAAACBBCACBABBABABABCBAABBCABCABAB.exe
Size 23.4MB
SHA256 3a5f3991c23b0a20b2b3b88c54d3f262785825ffa74232ac9619c7f8bacd96dd
MD5 a607f32371e2586e52362d8fc7653d0a
SHA1 39cb0f116ce34141125c18038c67ee88f6eba86e
SHA512 34ed2b64039278705d65e08266e4b166272c2a5601259fe9d32f2374b32d1838c7681f7d190e7c49106426de761096c7733186bf773c1513b90ec16f6ac06ffe
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw3:BRRRRRRZOU/jIEeQfoR/IuOFVjUu5L
TLSH
T16A374C09F6DE0465E877617049E7C27AC671B9618732CADFE288C63E5E33BD0A834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 260219caac29b8322f132148b1d895faabc74aa5b618e76a14f9ac2fedacec1b
MD5 3d947c46093d14a28c8a78bc10bb1a81
SHA1 3fa501ec30dc98e44afa8307f37e99ac533139c2
SHA512 1789dd5254a8b7e69ad9ad2ca9305f29b289f3dd9e6aace2037f69f253952468df0fd265f3ebe0bc96bd5da635c54ab187ffb69e76a137f97be9894a9e8f831a
TLSH
T1F1210580E0F5D953EC3364DA9636DCD32C98368FA93C6A24134B4318ABDAC318F595E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 27f315d3a328f2b57e19ccf39aab82ad21c676aea54262dcb2a4bf696ff6caee
MD5 ce8fff1ddf55faebe2ee97cb9311b583
SHA1 23724dd278c0db48d9b72d79b5717f7cf6c270af
SHA512 cb52dc307d5376944c3c2fe3756333d4b4d55c83f6ccc18f60b3fbfd31d190f458567542e7556346a461ecf75ada133e6eb8294c3e716cdaaa753ff8db6c7152
TLSH
T17111E380E0F5D953E83364DA9635DCD32C98379FA93C6A24134B4318ABDAC318F595E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-70-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/244-48-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/244-108-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/244-33-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3180-109-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3360-69-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3360-91-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3360-0-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3360-47-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3360-22-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3360-11-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/4648-92-0x0000000000790000-0x00000000007B1000-memory.dmp

Download