f5e397cd1fc1add9d6d8b87379fe7d458a142c16cd73e1a319bf74da8e3c819f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 11.9MB
Sample260906-yntsvada76
SHA256 f5e397cd1fc1add9d6d8b87379fe7d458a142c16cd73e1a319bf74da8e3c819f
MD5 b2d7765d9201a74d5d0f75b2f90df1e3
SHA1 9f2b9df814e6ce21e05dfbd4b682518a45a0a0d5
SHA512 1df7a2775e70049bd3431bfc25a71260585f16041288dd9cec28ac42a0a1fc67c40a561ebdfbf9e4ccdd2fb4074f51c2364cd4cb7c07ad8006c17ed2cd3b1aba
SSDEEP 98304:Y50R350l350R350l3501l350R350l350R350l350K+4jn:Y5y5O5y5O565y5O5y5O5vjn
TLSH
T1CDC65C48BBEA5151F9B746708CAAC2F65D317C204F2087EF6680F72D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
2940	svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
1744	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBABBBBBBABBCAACCBBABABAAAABACCBBCCABABAAAACAABCCCACABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe"	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACBBAACBAABAACCCABBAABAABBCCACAABAACACCCAAABACCBBCABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe"	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4088	sc.exe
3448	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2080	cmd.exe
3412	cmd.exe
1860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
2940	svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
2940	svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
1744	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
1744	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
Token: SeDebugPrivilege	2940	svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
Token: SeDebugPrivilege	1744	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4352	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2080	3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	94
PID 2080 wrote to memory of 3732	2080	cmd.exe	96
PID 1872 wrote to memory of 2208	1872	svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe	97
PID 2208 wrote to memory of 1372	2208	notepad.exe	98
PID 3624 wrote to memory of 3412	3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	102
PID 3412 wrote to memory of 4088	3412	cmd.exe	104
PID 3624 wrote to memory of 1860	3624	2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	105
PID 1860 wrote to memory of 3448	1860	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_b2d7765d9201a74d5d0f75b2f90df1e3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACCAACCCACBAACBAACCCCAAACCABCCCBCBCCCCCACBCCCBBCBCBCBCCABABBCCBAABBABAAACBCBCBCBACACBCABBCBBBCBBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACCAACCCACBAACBAACCCCAAACCABCCCBCBCCCCCACBCCCBBCBCBCBCCABABBCCBAABBABAAACBCBCBCBACACBCABBCBBBCBBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBCCAAAACAAABBACBABBCACBCACBCBBCCACBABBBCCACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe" start= auto displayName= "UserDataSvc_BCCCBCCAAAACAAABBACBABBCACBCACBCBBCCACBABBBCCACBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBCCAAAACAAABBACBABBCACBCACBCBBCCACBABBBCCACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe" start= auto displayName= "UserDataSvc_BCCCBCCAAAACAAABBACBABBCACBCACBCBBCCACBABBBCCACBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBCCAAAACAAABBACBABBCACBCACBCBBCCACBABBBCCACBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBCCAAAACAAABBACBABBCACBCACBCBBCCACBABBBCCACBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABACBCCBCACBCCCBACBCBCBBAACBACBBCCACBABBBBCCCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 11cc0c0d38e57627090ba26ededb60995acfadd5f16f6a6ea40ec7ca20b3b1bc
MD5 59bc2643cfef1d14440509072a225d8f
SHA1 a6bbf15c3c2ebd5d875125a4dbf33960e356dce0
SHA512 aee5c12d0b58c20eb1feba9419678296dd80ba0ee2e46f6f349e3c25c4ed15b62d0ccb4980c4b58caf39f167854748d1581fd2a9a655d834dfdb48cbb619b220
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.0MB
SHA256 e2c8594eb54c4b6c40d467a838b4e3b0a571ae0127d2740393734be1d5eea983
MD5 f41279f72bcdea6ff5a005e22fdea1ae
SHA1 d1a170183e89f01f9c1011381bb8887fbb3d392a
SHA512 d50c68a5c42be298182db48978064877b8a588c032e699ba7ed598f67b6fab216e86549e96a54b08073a9bf08a8bade11e6076a91d2b447d87a9c6131fb5e38c
SSDEEP 49152:U+EeC5g+E3qatglOr+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+z:Y50R350l350R350l3501l350R3502
TLSH
T12C864B48BBEA5151F9B346708CAAC2F65D317C204F2197EF6680F32D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 7371fc3c3ce321d17af80efa20d48fc926b2916eaf7acba1f91886e52a325555
MD5 bdd5b87a57d9212a696b984caf1e8e62
SHA1 29acbae59464a530575e02e019e51ac6e5677880
SHA512 b67248776b84cb0b622ee1472a4bc1fdf0d85e5078807bc4d7806202e64c7965d85ee374c9f1a169778cc0052db7525dfd6028e591fd8917ba776ae6dd2538d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 94bcfbfce0a35d7cfefb8c5885c1fe54a83ec747e6c4ab9912e8b3804f41fb6a
MD5 360b6c3d7bbc7cf0d25db900adc3a42c
SHA1 74899b499f4387e5f9b684c7f22dcbd88451dac9
SHA512 f18fe30c8d778a79f2146893fd650c98bdb3de31390d631bd716a4851c7688fa18374943c5e292c4caeb355325231e54ee8f3ccc32b82b6a8fd5649e7dbe1109
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9a7d72894d13cff1f9ae4e49bf67596dc1314642f49e8d0059ad82e80394631
MD5 309fa7149c87a1f1ab1786de1bb6de33
SHA1 875326719d8649a9fb4f010ac641ac8a43e47cae
SHA512 f305c76a23a002780c2dafe73e8c51131e4611a957092a4b18ef63ee88f964000d59ec4e429f13915ccfee49d76dbf5b7ea44a0f86725086f7f99a6e4311ba41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7291d3cf0ef1a68b4fec87d24086d767289308f9033a5d4b6be068f4b14692c4
MD5 0326b62e587cbf28176fd4b725f5948d
SHA1 f270ad799f90f0e84ab3baeaf28a96b8652f8d14
SHA512 345af64b50b1a86229e7330bef6f649e605e8ed5b5f6fdc6ea92ff72f86ef11615562cd3c2ef4c3407a671f8b6ef64bb4ec21fdf3d606e143978383f3d265720
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44af2c80c1402145e44cdfc51201a61afb51759174d0a03725cb15ab91f43b14
MD5 abf6644ffe383fb1ddcc9477aa483390
SHA1 43a2e054133975f45794af7e75ca520254232895
SHA512 7398585bf6abae22527274493b63517909cb68727607ecab8ead9131258295469fc0881840c8bb02ac7b25085276b374a5288eebafebc92bc062243c5bda4b70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bef71e7ad3d8a11bd29622113b94b62c7aeedc14e56eecee52dff545e260d93
MD5 5d5cee2d6c697a4540492b5caa840b09
SHA1 3c05a717401462fd6ef0518ccbc90012a3ba3b2a
SHA512 5b0d1704b5f31e9eb20c3497aa9428f06947409ecf5ff7c7bcdb035f3ca1637055bf8417e47e9d71dcabdbfa17b2c7f1903a7d61c8de990c20c200fb94362acd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8b54a7ec3d5dca32df531a0b22806b916d11a06df626c8e8dea7b7ac1e537394
MD5 6fcb9440f01c649cdc57607a4ecf7453
SHA1 2cb8329e0938d3bdbb9973aa54dd68e047804d60
SHA512 989cc77ce8a1b4bf541407d6f1fd2452c389b199c4c634eefde7df3e57daa29ed822ee2d84897f971e520a5034b618489a10b541269ab620362a316f7e351b8c
MD5 SHA1 SHA512

Submit Download

svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBABACBACABBACACBCCCBACBCCAACACCCBBCABCABCABCBBCBAB.exe
Size 11.9MB
SHA256 f5e397cd1fc1add9d6d8b87379fe7d458a142c16cd73e1a319bf74da8e3c819f
MD5 b2d7765d9201a74d5d0f75b2f90df1e3
SHA1 9f2b9df814e6ce21e05dfbd4b682518a45a0a0d5
SHA512 1df7a2775e70049bd3431bfc25a71260585f16041288dd9cec28ac42a0a1fc67c40a561ebdfbf9e4ccdd2fb4074f51c2364cd4cb7c07ad8006c17ed2cd3b1aba
SSDEEP 98304:Y50R350l350R350l3501l350R350l350R350l350K+4jn:Y5y5O5y5O565y5O5y5O5vjn
TLSH
T1CDC65C48BBEA5151F9B746708CAAC2F65D317C204F2087EF6680F72D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 a5a83f8c47faf4aa0e1b5973b217bf17d61175ee1586cea8d451a88e102856ba
MD5 46adf25a4a857f903043e59cf33ce630
SHA1 6d178a2101c7ac8ee63290506a9f27a99722188a
SHA512 0f1d4808ab40f68568ae57b1dd30b3cd4fecae7ba27c4f1bb65e81ac37975530e4754d2f0b5d7fb9132a7aabef9aa1584be8c17c2e3b33b85c2dba11e349cce6
TLSH
T11911E354F0E59D47E43064DB622A9EAB49D87B8BE85CEB34230C921CBB45C3A4F590E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 70252d2ea9afb12b2a0798dc6c15fe1184ed67ae2e5632d34e8a828dd131a598
MD5 373322fa7305017bdec9065c84fb8d60
SHA1 01518a2e9402fef9411921d80d712fe885d3d36a
SHA512 c73064b03f03748c41104e304e577f1424271724fa90aacc8a1089823090a59194ecd692db3011d24016b9fbd01030a3efc898dd45f47c45fc3eddd597baccac
TLSH
T10921F654F0E58D43E43064DB622ADF9B49E47B8BEC5CAB30130C921D7B45C364F590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1744-89-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/1872-36-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/1872-26-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/2208-59-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/2940-87-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3624-0-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/3624-7-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download