2c1116f9ca0a600efe63334eb411f9eeeba919f1fa9b543bd20c1a0acf2ae41c

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 18.4MB
Sample260813-e65hhszyas
SHA256 2c1116f9ca0a600efe63334eb411f9eeeba919f1fa9b543bd20c1a0acf2ae41c
MD5 77de1e13a1cebe773cbb5fb1aa99a871
SHA1 b74d89c2e684276c21b680e70bb73d132c0af729
SHA512 0392da8dbe14822f586d55cb9731fb91411f4c84610f558c10588a976b314588c313e0f33d9ad9c4bcb9557f6b4b42a97b7b99183ea30e6e6ae4563d6733cceb
SSDEEP 98304:LViVqViVqViVqViVqViVqViVqViVqViVqViVwKjKWQckVgtev5mnlNLz:YKWQc0gEYnvLz
TLSH
T1DF178D40FAD58873E07B02724CA792B60E71BE254F25D28FB699A35E6E337C05633791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
1540	svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
1192	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACAABBABBCAACBABABBBBCACCABBAABACAABBCAACBCCCCAAACCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe"	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBACBABBBCCABACAACABCABACCBBBCBCBACBACBABBCCBAABACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe"	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4136	sc.exe
3676	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
412	cmd.exe
1172	cmd.exe
1664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
1540	svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
1540	svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
1192	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
1192	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
Token: SeDebugPrivilege	1540	svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
Token: SeDebugPrivilege	1192	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 412	2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	96
PID 412 wrote to memory of 3596	412	cmd.exe	98
PID 3292 wrote to memory of 2552	3292	svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe	100
PID 2552 wrote to memory of 3864	2552	notepad.exe	101
PID 2120 wrote to memory of 1172	2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	105
PID 1172 wrote to memory of 4136	1172	cmd.exe	107
PID 2120 wrote to memory of 1664	2120	2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	108
PID 1664 wrote to memory of 3676	1664	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_77de1e13a1cebe773cbb5fb1aa99a871_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBBAACBBBACACBCCBACCAABCCBABCACABBCBCCAACABBABBCBABCABAABAACACCABCCBACBCBBCABACBBCCBCBBCBCBBABBABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBBAACBBBACACBCCBACCAABCCBABCACABBCBCCAACABBABBCBABCABAABAACACCABCCBACBCBBCABACBBCCBCBBCBCBBABBABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCACACBACCBABAACABBCBAAACBAAAABCAAAACCBAACBBBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe" start= auto displayName= "UserDataSvc_BCBCACACBACCBABAACABBCBAAACBAAAABCAAAACCBAACBBBBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCACACBACCBABAACABBCBAAACBAAAABCAAAACCBAACBBBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe" start= auto displayName= "UserDataSvc_BCBCACACBACCBABAACABBCBAAACBAAAABCAAAACCBAACBBBBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCACACBACCBABAACABBCBAAACBAAAABCAAAACCBAACBBBBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCACACBACCBABAACABBCBAAACBAAAABCAAAACCBAACBBBBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABAACCBCBBCBBABCABABABCBBAAACCCACABBCABBBBBBBBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d4e1c1da4b82017bc7c880100d409be2ef015e1c7eddc5a39ca02d31f90562f2
MD5 19a4b84fb3eb270c3dfecd46640dd6ac
SHA1 8675334cbe7900f14530c9518c371ada4f72604e
SHA512 083a028ece054af6a803388acfb1175525a7cdf4152211697c06862df89df587c82e146864694e7457c3ea22c58d1961bb436c85d3fb6f1b7029af8d085c664c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\it-IT\qap`g`v~dtlq
Size 10B
SHA256 c3e12ccf17765859bd1d06fefe0ef67cbaebc76392a7577d07609ac18cd9beb8
MD5 08e54e97330d488a2fa942490a58b2fc
SHA1 fbce1de49126c9310c45b83b31445330b1dfe239
SHA512 5666e7d1656e276eca4a519a84415ffe1a178cb8d5fdf324b02db88d0bfa8ff4490c3316e3ac7a50898fa4deebb9f7c7f30effe9555254be249e00a7c7af7e9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab20d5c9e1b8ee782ebe14ab759ab20fd2afccad13472c10cf186c01aed22316
MD5 4f69d63e2bafbbe244b4af73e17a5f0b
SHA1 23e61ab0793b1bac2c816ef475580246b0c4daf6
SHA512 854ebd3549c1dd1f0e940f6a79658de34803c11bac5e564331ffe43b26c6789d9c05c6c2b03d54782c3e6257f65c64b820a1f3106c39d1063a0ca87a9aeace2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 63322bbacb5ac0e265c6a6ca0ac398a5205e790b40dae0b87f0b219c0f503d8a
MD5 af1e7e7177cbe6d962587556291e4f77
SHA1 3e8ae53d37b0d9f23049c0438891c13f82d70b46
SHA512 92cfffa43855ed3fc047e27437c44fa39bd475ae5696bbaccb6bbd0245e557323bd926c8c26491525e1dbc2a300347b1dcbdfa19d979ab3cdfe5bfa9efe878da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d05d51d446dc78924454d8e20789a42d18db8eafd6408290ddcc68903b703345
MD5 785f6916eae347f054977da160e2a6bf
SHA1 6704b33445425a42c9302d2ea1077a17880a1083
SHA512 19b345144d758b0182538bf665b6a3ea04267bf5d68a6f53916e85eaae57caa6e22f130b47a4fda5b0ca00a4e308d528e9429f0282e13f6aab5f6967c84f9a93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0b2a029a94854e68ca467fbe5d8933fd340e846f9f41fcb2f0cd0b32e040e4bc
MD5 dae6d1650195f6b2a8802cfe8ea9d16f
SHA1 08bf12b3f8f87532e68a27948406105412dcda88
SHA512 94d7026823efb6f1a0e4f7b4a5919a56caad1f8d637b6bd122eb0f2833e6fac941d3c05277906e325545c4b6eda0d4303ea71595df2ef0c7dd4813319be4905f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8f10eb1119c659037450739090d375a091d87aa641d68e839905dfdcd4bbcf6b
MD5 a52a67c139c0b509916371fa941338d4
SHA1 7ac48e3dfc7457d790ef861bf52fbf9f023636ce
SHA512 5c141e0decc180e32517f1242c512bd4fe4b6a436ab0951a9ddcb4b5581f9e1e2868bdcb5445e14f9bf519930680496fd80c0e7a69cb0c19abd9f599ae3af26a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8a9ea42ae09d094f7c9df0ab26a83d2953cc83ea841dea6e3c971e33275deeed
MD5 48c9c1b2e67c77788ea4d8e3347f3014
SHA1 ea0125dba531bc1604a07aeb148d5cf090371be6
SHA512 ef33b4d930578ab41378a1612224ac22772f8ae810d3d585f36256d53382572f45946b57012b139240df4efd7a8360f09cb15ea36a989db4d0663a7e6ac01236
MD5 SHA1 SHA512

Submit Download

svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACCBACBBBACBCCAABCABBBACCAABACBACBABCBCBBBBABACBA.exe
Size 18.4MB
SHA256 2c1116f9ca0a600efe63334eb411f9eeeba919f1fa9b543bd20c1a0acf2ae41c
MD5 77de1e13a1cebe773cbb5fb1aa99a871
SHA1 b74d89c2e684276c21b680e70bb73d132c0af729
SHA512 0392da8dbe14822f586d55cb9731fb91411f4c84610f558c10588a976b314588c313e0f33d9ad9c4bcb9557f6b4b42a97b7b99183ea30e6e6ae4563d6733cceb
SSDEEP 98304:LViVqViVqViVqViVqViVqViVqViVqViVqViVwKjKWQckVgtev5mnlNLz:YKWQc0gEYnvLz
TLSH
T1DF178D40FAD58873E07B02724CA792B60E71BE254F25D28FB699A35E6E337C05633791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 970B
SHA256 d20de759a06318da4fb79bd19963c0a18af00a171117f8c465761fe01794f58d
MD5 270c87aa5839c59bf441cc9f8eea2308
SHA1 172e51649654a3d873f7f427b74f9328cd663f65
SHA512 1e6dddee886627d424f2675518462a13d8678be9ba80ac4b06f1328045e84cff82854f80502283e4d0e120ea53a575b71321a6b707229bc30f3fdead39103a15
TLSH
T18211E940A8E5D8F7EE3228D7F72BCAC21CEC37477558BA0823098219B759D738E590A1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 7d3c8ff6e33463eb4d9d07988f3c69c70c3c5c39c2e79e26dfea8437815a1ac9
MD5 4354d5bd168b2353c182b644b29dfbb4
SHA1 12456904d8306fcad0037095b7b653c8a77fa574
SHA512 95219b993e796250ccd8fbf9b4007c28613b802208b2dc11c52d69da8160199dca15c2f41706678ff4419f1d4c730b8315d3891e98e29f54437e4b02b3782bf5
TLSH
T12801FE50ACE5D8F7EE3228D7B71B8AC21CEC3747755CBA082309861DB759D738D59091
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1192-117-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/1540-115-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/2120-50-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2120-74-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2120-114-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2120-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2120-24-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2120-11-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2552-78-0x0000000005B20000-0x0000000005B21000-memory.dmp

Download

memory/3292-75-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3292-51-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3292-116-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3292-36-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download