45b95f293307af1493a5270919e08e8d67f4dd3431b9d16e818adcb6cab3ba21

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 9.7MB
Sample260831-q7gzdswtft
SHA256 45b95f293307af1493a5270919e08e8d67f4dd3431b9d16e818adcb6cab3ba21
MD5 daea88af37963355cdbf0a2bd9794eba
SHA1 dbe2a6c5d81721d2ddace1d0d594e24bc258ae4d
SHA512 d5947ff1f467b470c645e75ba654cbe06bc79b6115a3cbadc86a221747c28b90174c43da327978beb25453ad17a2b6c06a39da40efa38d5217c6a1b992cfb866
SSDEEP 98304:MH1H1H1H1H1H1H1H1HcOU/jIEeQfoR/IuOFVjUu5N:MVVVVVVVV8FIF0wuv
TLSH
T125A65D09F6DA50B5E477517049A6C27A9671B93147218AEFF288C23E9F33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
3668	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
612	svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCCBCABBBACCBAAACCCCAACCABAABACACBACBABAAABAABABBACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe"	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCABCCCABCCCABCABBCCBABCCBABBBCBACCBAAABAAACCCABAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe"	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3700	sc.exe
4880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3488	cmd.exe
2444	cmd.exe
4088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
612	svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe
612	svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe
3668	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
3668	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
Token: SeDebugPrivilege	612	svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe
Token: SeDebugPrivilege	3668	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3488	2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 3488 wrote to memory of 3464	3488	cmd.exe	94
PID 1412 wrote to memory of 3732	1412	svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe	95
PID 2128 wrote to memory of 2444	2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 2444 wrote to memory of 3700	2444	cmd.exe	98
PID 2128 wrote to memory of 4088	2128	2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 4088 wrote to memory of 4880	4088	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_daea88af37963355cdbf0a2bd9794eba_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCBBACCBBCAACABAABCCBCBCBACABCCCCBBCACABBACAACABACCCAABCBBABCAACBAABBAAAACBACCABCCAABCBBBCACBBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCBBACCBBCAACABAABCCBCBCBACABCCCCBBCACABBACAACABACCCAABCBBABCAACBAABBAAAACBACCABCCAABCBBBCACBBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAABBCBCAAAACCBCCBCCBCCBACBCCCACCBBCCBCAACACACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe" start= auto displayName= "UserDataSvc_ACAAABBCBCAAAACCBCCBCCBCCBACBCCCACCBBCCBCAACACACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAABBCBCAAAACCBCCBCCBCCBACBCCCACCBBCCBCAACACACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe" start= auto displayName= "UserDataSvc_ACAAABBCBCAAAACCBCCBCCBCCBACBCCCACCBBCCBCAACACACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAAABBCBCAAAACCBCCBCCBCCBACBCCCACCBBCCBCAACACACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAAABBCBCAAAACCBCCBCCBCCBACBCCCACCBBCCBCAACACACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCABBAACBCACAAACBBABBCABAABBBBBCBCACCACAABAACBCCCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 19b246c94ba5e9fea630ef7b2945a485196540360c7bec7aded2740c50ffc2d5
MD5 3a11b6e1353e84dca63a9e94b6af5075
SHA1 8d932854daddc6741089a781e6a04203516c74ba
SHA512 3f0e0042bc05e74852cb29f769e35ee7f2d127357af0e23091f9ca7434b752cd8a93185d8958a9e3a3f505a73f92135bb1c1ad791189dd02c1ff63a19f0d454d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Parental Controls\qap`g`v~dtlq
Size 10B
SHA256 08d643223419fb1290229eab9476ff7a193ef79bf3d06767a2d08acc5c9b696e
MD5 ba2014a17998622fc1c44b6f532d53f5
SHA1 7cf62ea63a9e447bcafc20a4b47633f089c9b43c
SHA512 271200d357d8ece76fb4a25c81e48a0dc51bb5ef68be47977f0a08890d16b610db348b78971e6233a5635bac274d0ae4f32e655405ccf184db960930850b5482
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.6MB
SHA256 27dd9df9cbe44814a6042c4923dd9b6892782fbd82f369999def7ad2f81f3d9e
MD5 0d1daddd568468a5ea5c7f6c547174bd
SHA1 14bda3e26f6961f579e42ac7cac683e865abba9a
SHA512 8363df30ef55d82689cd1a25d03f3023a22fc05a0878afa79f83f2ca75f28093c84f0770e8c45cbbc399dc1769d68bdf00004a79bdc52051b5bbd51f49bdd145
SSDEEP 49152:U+El/ev6K+ES+E2+EFwhO0+El/ev6K+ES+E2+EFwhO0+El/ev6K+ES+E2+EFwhOF:MH1H1H1H1H1H1A
TLSH
T16E564C0DF6DA10A5E477517089A7C27AD631B9314721CAEFE294C63EAE33BD0AD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 526fa8eaed36fa18e352e4ee50a5edc96cfcd313df70f435ebee31b51ee916ec
MD5 786f91a42152a54f1135e8a59565e076
SHA1 60b811ffe2b4c5f106139330ec040188ae49fb32
SHA512 df78ffb8619e703363654f11dca41b6548cc54e35902283f7fd8d0c4d22ea91f596f302040c2e2b24a16fecfad05f9888000bf772701788b470982d0eb4e988e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da0feeb41c17e14a04096a7b22ab3c6b13b10cef0138307705057dffd7329baf
MD5 74cf39924a34a3ee279ae4505919e376
SHA1 0742b61c493ffecdaca2a87d7bcdf0ba7eee1067
SHA512 707308489fa38b5d0a422b65bc91b7c13b47bac00eeed2e33557f58b076cfa3d7b6b080cbeeef250e279233e166039881d071621d9358c556ed7f498c0cbdfd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7cd5e152673a5e066b5719e73fd427864ab3c5f7d200e220c1bd4db9b1a5f985
MD5 f4de0afde6458a2372f0d0e3287bb99a
SHA1 79cc4bc69e121758a55e8e4f34f74ff9f6c186ee
SHA512 61a40a747ef2a3d6ea6e05d96e7eeafe459d6d02f071224d91bb3f80444128e8172450fef477debacaed180262f573ffd4b42e3b915370535750908b8b077c15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5d485a407a2a3b71db50cc16a7eecff8cf4d2868d76391713aa36bac3a77516
MD5 20c866a9e62104ec86eec58041fe74c2
SHA1 ebfb9154df60a52cb189bc5413b1a0b0b4d7242f
SHA512 df451be159931e1ece98c05d46db02e9150221df986ac0dd9ee478cc032c38e134d6f26bc87340ed8bc4c7d7322d868f992477a45816dc54e275b927b1ddf0ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8fbd8b19f93c0df9d21517018ae73151233da80f97e5313126281c486611d4f
MD5 efe20773162d8ebd70c1b2d86009af93
SHA1 fd729197ece8742906d9e103ee8dc796dc33e376
SHA512 15d185d82de0dd63414a71235053914820041b577d3fc1e549c941dd318f27914a519cf2be2150598ba75d0f13952c879f52f0e09fd12d5706b29567e28e6451
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72df2cc4adc4db4e0c286bbc55a32f7a3edcae093cb79945d673cb6f38abc05f
MD5 9dd0612998a9dc840b60ed8913ffa4e2
SHA1 585ae2c56dd3e42bd33ae5d6a08225362daa3cf6
SHA512 59538a769e4ce0a4d69fc57d67c944206d3d54507b92699309d50f9e48338de353c2cee9ae7aa580a440efb01b31613af2d135f4dfba25e822b9c01d9d429374
MD5 SHA1 SHA512

Submit Download

svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACABBACABACBBAABACAABCAACBBBBACBCACBABCABCBBBCCACAB.exe
Size 9.7MB
SHA256 45b95f293307af1493a5270919e08e8d67f4dd3431b9d16e818adcb6cab3ba21
MD5 daea88af37963355cdbf0a2bd9794eba
SHA1 dbe2a6c5d81721d2ddace1d0d594e24bc258ae4d
SHA512 d5947ff1f467b470c645e75ba654cbe06bc79b6115a3cbadc86a221747c28b90174c43da327978beb25453ad17a2b6c06a39da40efa38d5217c6a1b992cfb866
SSDEEP 98304:MH1H1H1H1H1H1H1H1HcOU/jIEeQfoR/IuOFVjUu5N:MVVVVVVVV8FIF0wuv
TLSH
T125A65D09F6DA50B5E477517049A6C27A9671B93147218AEFF288C23E9F33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d63e6eb87584a749c531d191317d3829513f29c3b7052dcbfa19423250db61e9
MD5 0772468397f602a43d64c7d04ed5c6d9
SHA1 289972b05e8e5357d61126325e02687079f0ab1e
SHA512 4aacf5ba9f4199d8ef9896472d0b008e34933da69b38c44667abc296db5e851bd999962ff726607be69978c702526698e7bf5bc93d133ccb7c0ecb69d218081f
TLSH
T16E110A51E0E5DCD3F433688B9B199ADB0CE876DB689C6A143354A218E7C1C31CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 de5ccda1804caaa7e4a684ca181645b2e9a97bece5d1504268e4295218d4bca0
MD5 2c7d2647fdbcaab99156f722a9720c60
SHA1 5fa8b193333c8df3c3b65d8fbeb0f831051ed000
SHA512 b5d326e181fd9c2597e8899aa84b6dd4ce9c73a922972ccd0b9d5afe2d14a6de3a5f7d123787e551508f12906a94aee73cfd235c7c3672f6f6d25bb714c91132
TLSH
T108212751E0E5CCE7F433689B9B198ADB08E876DBA89C6A143354A218F7C5C31CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-81-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/1412-35-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/1412-22-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/2128-6-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/3668-66-0x0000000000040000-0x0000000000061000-memory.dmp

Download