cb08d34bba4891bbde39f879cf0f52082e76c81f045c44d68d53f7fdc437e936

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 5.2MB
Sample260909-jfdpbsdk61
SHA256 cb08d34bba4891bbde39f879cf0f52082e76c81f045c44d68d53f7fdc437e936
MD5 097b99a4c90978729520aa8b4f0b276b
SHA1 99b56bfe1f4b0cde42ec054b6d0541a2df69ca00
SHA512 4c82089d3520ebe45809e39d19758bca2fcb5398127b31ffb0124fe3768e05804663cfb1aa9a8514f455e6b80e4983099d973464d8db680869160dd72936d866
SSDEEP 49152:U+ES+ES+ETqatglT+ES+ES+ETqatglT+ES+ES+ETqatglT+ES+ES+ETqatglT+E1:oggggggggHKjKWQckVgtev5mnlNLG
TLSH
T12B469E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
4604	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
2712	svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBAAACBBACAABCAABACBCBCCACCBBCCCACBAACABACCCABABCACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe"	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCCCCCCBBBBBBCBCCBBBCCBACABBBBBBCCCBCCCAAACCACACAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe"	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1036	sc.exe
5172	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe
4236	cmd.exe
2996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
2712	svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe
2712	svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
Token: SeDebugPrivilege	2712	svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4288	5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	94
PID 4288 wrote to memory of 1392	4288	cmd.exe	96
PID 5456 wrote to memory of 3892	5456	svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe	99
PID 5960 wrote to memory of 4236	5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 4236 wrote to memory of 1036	4236	cmd.exe	102
PID 5960 wrote to memory of 2996	5960	2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	103
PID 2996 wrote to memory of 5172	2996	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_097b99a4c90978729520aa8b4f0b276b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAAACBCAABBAABCCCACCACABCCAACACABBBABAAACCCACBCACCABBBBBCAACBAABBBCCBCBACCACCABCAABACBBBABBBCCBABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAAACBCAABBAABCCCACCACABCCAACACABBBABAAACCCACBCACCABBBBBCAACBAABBBCCBCBACCACCABCAABACBBBABBBCCBABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCABACBCACBBBCCBCBBBBBCBBBAAAACBAABCBCBCABBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe" start= auto displayName= "UserDataSvc_CCBBCABACBCACBBBCCBCBBBBBCBBBAAAACBAABCBCBCABBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCABACBCACBBBCCBCBBBBBCBBBAAAACBAABCBCBCABBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe" start= auto displayName= "UserDataSvc_CCBBCABACBCACBBBCCBCBBBBBCBBBAAAACBAABCBCBCABBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCABACBCACBBBCCBCBBBBBCBBBAAAACBAABCBCBCABBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCABACBCACBBBCCBCBBBBBCBBBAAAACBAABCBCBCABBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBCBABCBCBCBAABACBCAABBCCCABBCBCABBCBBBABCBACCCAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 15.9MB
SHA256 6db5afec5313bbecf40578d7a7ffe87b812a58571995e3c3efbd618b678d05ca
MD5 f5e567f971b608e5fa867ccde8eabe50
SHA1 54a8490cc4a09f10eea00a837dd96a74e268b11e
SHA512 8ae4113cc4f6f045447e5a1634a4ba847bef63df517115822c0314847badd5da2ca9c51dacbae4fc9cbe3fad85f4123f3946cca975e263429f572a5edf44f8a5
SSDEEP 196608:7KWQc0gEYnvLUKWQc0gEYnvLUKWQc0gEYnvLMdb:6cZEIv5cZEIv5cZEIv+
TLSH
T15AF69E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 31.3MB
SHA256 8b24677acbbb2875e45780de72018d10fe18f43b45ebf546fcf6d12c171a3699
MD5 e9c7fa1ec5a3ccf28fa85da2e1aae7dc
SHA1 53dc077588069c7122ca12bbacc2c74d07471e8b
SHA512 59218b3bc16e052d9867fa6190ae2632d595575eab840e8e84684101cb419a02e616ece0ee788bba891ee9c8c7a3a0fb0137dfc9c0034e1f415970cd25767875
SSDEEP 393216:6cZEIv5cZEIv5cZEIv5cZEIv5cZEIv5cZEIvi:DEIvgEIvgEIvgEIvgEIvgEIvi
TLSH
T158779E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 36.5MB
SHA256 124a74937a74ce60ee2ceccd1c9571bea0d6e786bceb6b66cc77434df9a4d51d
MD5 2e94a87505ff76a24546b614f6147491
SHA1 084888522143ef7096aaa8d961e2ae3c0961a32c
SHA512 ff5013c0d025675f42e85bb54d8805450a50515c0921c4df0458258ca97aa237eeb3e6c6a623ab220c249c41974ddafc062fd6968104140255b61d15c777b610
SSDEEP 393216:6cZEIv5cZEIv5cZEIv5cZEIv5cZEIv5cZEIv5cZEIvS:DEIvgEIvgEIvgEIvgEIvgEIvgEIvS
TLSH
T141879E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 41.6MB
SHA256 17b52f7fb14631e6e1075beb6b008b9374e53b4c9cce894bf42f416dacfce8f4
MD5 5be631a5ec2761453f7e8e014268d97d
SHA1 d19ca537f87b129ea634475e07957d5f9925d7c5
SHA512 9e27a9b6248f68f3f07718b540177f5b6637898a5181d59b2520c1696803a41b925a1209d03fe4efe0eb1a2440c3b6831b92d98fc0b6ecbb3ff748a4cce3dd82
SSDEEP 786432:DEIvgEIvgEIvgEIvgEIvgEIvgEIvgEIvB:bwwwwwwwB
TLSH
T115A79E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 46.8MB
SHA256 5a23cb1e7559b1cce3070348a2c9abda799c22070284d439dad54f70188aff12
MD5 414a8a5efb87270f8620f7515267e9d6
SHA1 bb0b4c2ec7f94b74c93c97dc008c721122fc865a
SHA512 9ad28d7fc082002424ed4cfb9316f0086939db113a08feb4d6a3c3609b1c71fa029c00f2ede880e92ac112d088f5643dbe343004bf37b5262568b2f1bb0ad63f
SSDEEP 786432:DEIvgEIvgEIvgEIvgEIvgEIvgEIvgEIvgEIvD:bwwwwwwwwD
TLSH
T1A1B79E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 896KB
SHA256 b0c2a8d0d85fafe3fef0047d209dffd28351598ff7d1c3591115ee724c57e05a
MD5 4d83d46c962b899bdc0c8ccc76b35ed5
SHA1 577dd27f3ac14feaf7b7b4f8fb975a5dabf86dea
SHA512 53f33a9977b39a96f620bf58702f6165dd60bc8fb513ba3335641c451dadada70da5f19f3499bf3342c7ec670426e869fab6cb6c8aca956809dad144a4f34e13
SSDEEP 24576:m9+EM0q9+EM0q9+EM0iExqatgl59+EM0q9+EM0q9+EM0iExqatgl5F:U+ES+ES+ETqatglT+ES+ES+ETqatglz
TLSH
T15C154B45F94680B2D82B01B14CCBD2FF4670BE218F128EEBF689A76F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6fd5ca9b7620853905a9ce17c01c6a39634b90999e895d22176f5df4ab2e4cf5
MD5 117aad184a4ac0caacd4a164dc9ddb11
SHA1 697bcc2f94ca7e74c7455a2d211be63e4b976ce1
SHA512 c051906720405887b43f3d962fa6de27571c8f98ccc110f9061970bbfb34ce3b87947ca4475f5ef43bf8f5a8161eddf2b606bac8b15bee0d9b1b0d0204cc1186
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 854c73e409b2f7e6ca58c4e830ca018e9b34342e68755c9f33e335efa096c1e2
MD5 380a9dd84da3befacea13d7161b4991a
SHA1 e755ce8a1478bf3dff027fd4fe8c555d94d9e5ea
SHA512 53c0d5f0bc667e25e26419a7696f50a2dd281ce54d60117c4e8be5e9d2b52b8d641b29732eecedb8f8e31a4459ec13f241fdd675b0a23c7b7b4a536c0f88e17f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8ea0230a40886cb8002b8b4228988c71f1379ef49728b911e52e226f205b878
MD5 b7bcc66fefa4f1b4a9b83a058682c90b
SHA1 15f53f7dbaff3b3612fe4a1c2a15344480535a02
SHA512 fbfbf29954849648237be49090d1f2f459c602e5ea9531cc04bf239b1d3d4dc3900cb8bff545e76d4f596e0694e55637861bccbcc88699946bc63d9f1747a5d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57ffb620c15abe8b02c7e57825e234970f1f4224551c34a2ea45b979178773b4
MD5 fe0396519acd5519f31a422f7e62bfba
SHA1 bc6923b89ad85ebb11f5e57ecced6fa6406ecdb3
SHA512 2479755cf70573135363f7a30a04e7ff2a75f9e365405c6326d5cf785d6ce4222ebc2d792f8013ba24f65195a50c0d87f4ee92814c3f8ac45925e2fec06560a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0253cbe2ee9fd50ea4a60d0e8dc96f76d041ef14e3be26f7dbdf0ac39f93a1ba
MD5 01c109afd8709a427566f2362bf92086
SHA1 4e1b956311b3b5ce0414617cda91b93b2ffd2d76
SHA512 be5675aabe2d0dc5738ab3ed3deaee4bf8c31f2576cd850cf149dc72da681b005fca0a3fee55530efb22b257e319caa374fe3683e0caba17a84086b2b8368856
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aadb4bc5a82f3a31dcad45bff3c6f1dc3a72cf6249a50e4ef4a6bf8cefec2b25
MD5 8cda089ed25c77213fecb11d10097ef9
SHA1 c9f0e41742aaac53d27099cd52965ffc2ecc2530
SHA512 dae89ad177dc28b3a9c7426f2873658913cb0bf254af5457844fa8161e25a54622cb97967abed4ffdf12e4b5c4e200ffbb10d37fbc523f99992aee778e48f6a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b1a9575bc95c8503986d1cc52c1b573c2ce64d782de55425be2d200a88bfd5c1
MD5 f352beb1dc8ff4f879c522d2c05708f2
SHA1 a22f6931373d85f54fbceeca1a83c511e6a9e474
SHA512 ea9ddc973ce11cf69c85950ad7e9a3287f365f34b77adf67595f3ab685dd1aa10a4c45dd0b590cc81931a17e86bb781d4ff1d1b71686d079374c449afc81aa96
MD5 SHA1 SHA512

Submit Download

svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBBBBCCBABACCBBCABBBCCCCABBACCBBABCAACACCABCABCCAB.exe
Size 5.2MB
SHA256 cb08d34bba4891bbde39f879cf0f52082e76c81f045c44d68d53f7fdc437e936
MD5 097b99a4c90978729520aa8b4f0b276b
SHA1 99b56bfe1f4b0cde42ec054b6d0541a2df69ca00
SHA512 4c82089d3520ebe45809e39d19758bca2fcb5398127b31ffb0124fe3768e05804663cfb1aa9a8514f455e6b80e4983099d973464d8db680869160dd72936d866
SSDEEP 49152:U+ES+ES+ETqatglT+ES+ES+ETqatglT+ES+ES+ETqatglT+ES+ES+ETqatglT+E1:oggggggggHKjKWQckVgtev5mnlNLG
TLSH
T12B469E45F94680B2D82B01B14CDFD2FF4670BE218F128AEBF689A72F6933BD05235655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d967a7fb1691a50f68af9fd59620e6df155ba1db96833e76e42b49f329817083
MD5 fe0e01bef800cdd2bed634d077e3fd01
SHA1 292a430dd9465f8986f02a3b1dea6a43504a397b
SHA512 aa7f00db86a51ed102433017300b9b3e79ab602aff158cace7f110b2c65081638e0125bdf8f2c16c90998924dc6876449a36a86aef0ae0c82cc231ad793198a3
TLSH
T1BC11CA6070A6E877E432E88B622DEEDF08D42FEA9968FB2513094118A769C750E114F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2712-109-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/4604-101-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5456-71-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5456-32-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5456-50-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5456-110-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5960-85-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5960-33-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5960-10-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5960-21-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5960-59-0x0000000000480000-0x00000000004A1000-memory.dmp

Download