4e0769095369eea85b6e91eeb99eff5e766ce5f52015018824e463c310e09dba

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 49.7MB
Sample260814-d73jwafa36
SHA256 4e0769095369eea85b6e91eeb99eff5e766ce5f52015018824e463c310e09dba
MD5 9fcffb065690f45363680a845e3daee9
SHA1 edc86760d9bed3219f3d5d91e5e74ac4f22ea5f8
SHA512 50a5a9af5ae16f1920e422b4031a2dc6f99e24e442382c730fec1bfbc21d060ac316d683575ca5cc321bf8a54b79e199cc9bf4a006d0f5e30fee4f8c8b4a0ee0
SSDEEP 98304:8aUxbRaUxbRalaUxbRaUxbRalaUxbRaUxbRalaUxbRaUxbRalaUxbRaUxbRaQKjf:/KWQc0gEYnvLj
TLSH
T150B72A49F94380B2D82B01B148CBD3BF4A70BA258B128EEBF74D876F6933BD06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
5384	svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe
2956	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCCBBBBBBABCCBAABAAAABACCBBBACCCAACACCCAACABBAAABBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe"	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBCAAABABACBCACBBCBCCAACBCAACAABBBCCBCAAABCBABCBBBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe"	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5996	sc.exe
5612	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3824	cmd.exe
1592	cmd.exe
1656	cmd.exe
2332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
928	schtasks.exe
2148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
5384	svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe
5384	svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
Token: SeDebugPrivilege	5384	svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 3824	5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 3824 wrote to memory of 928	3824	cmd.exe	94
PID 1860 wrote to memory of 2788	1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe	95
PID 5228 wrote to memory of 1592	5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 1592 wrote to memory of 5996	1592	cmd.exe	100
PID 5228 wrote to memory of 1656	5228	2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 1656 wrote to memory of 5612	1656	cmd.exe	103
PID 1860 wrote to memory of 2332	1860	svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe	105
PID 2332 wrote to memory of 2148	2332	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_9fcffb065690f45363680a845e3daee9_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCBACBCAABCABABAABABBBCCACCCCABBACCBBBBAAACBABCACACABACBBCACACBBCCBABCAABCBBCCBBBBABBCCBACBCBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCBACBCAABCABABAABABBBCCACCCCABBACCBBBBAAACBABCACACABACBBCACACBBCCBABCAABCBBCCBBBBABBCCBACBCBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBBCBCCABCBACAAAABAAAACABCCBAAACCCBBABBABCBBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe" start= auto displayName= "UserDataSvc_CCCCBBCBCCABCBACAAAABAAAACABCCBAAACCCBBABBABCBBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBBCBCCABCBACAAAABAAAACABCCBAAACCCBBABBABCBBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe" start= auto displayName= "UserDataSvc_CCCCBBCBCCABCBACAAAABAAAACABCCBAAACCCBBABBABCBBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBBCBCCABCBACAAAABAAAACABCCBAAACCCBBABBABCBBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBBCBCCABCBACAAAABAAAACABCCBAAACCCBBABBABCBBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCACABBBBBACABBBACACCCBBBCABBAACACCAAACCBBACCBBCBCACBCBACCAABCCACBACABACBCABCAABCCABCAABACAACACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCACABBBBBACABBBACACCCBBBCABBAACACCAAACCBBACCBBCBCACBCBACCAABCCACBACABACBCABCAABCCABCAABACAACACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCCBAAAABBAACAACABAACCAACBCCCABCAABCBCBCABCABACBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
1⤵
- Executes dropped EXE
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21a8152eb6a7ad9e9d4dff134f7b597828023568e2b02d7f260190e40b662af0
MD5 0fbc808cdc8fad5f8c8daaa60e633d27
SHA1 f0943c1eec501b9ae16546c8cace3784c9403fc2
SHA512 b82ccab102926cc79788b04b16cad846e0eae5ce14ee24c3ae9408bdbe180ba6564a865945556e1ac4ee4d416d2933f7880b23ba1ed0d427c14cfab3558895f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f4f3a8a0af95175953700e960983f16dee90ce4ff4536bba9a2993741bfd46a
MD5 41fbd512f502560a9fddfb9f980b327c
SHA1 0ddbd8e4b1dcd329e65e2719a5c8545929c7736f
SHA512 5b43eeb68ba9413901394a3a563dcce9e0d187be895f4d14cd5ebdf5cb052bda2883d59a6181db155dd2161b13b2a11c2864c2c21e0a28944728c9e32a4982c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ea42e287d99c5cf01a43211223623a9cd8a117c87ad5262ece2f98ca9cc01a9
MD5 d17af7a6b9b41ff1290fe68ac2e85733
SHA1 8011fbe8fea48d093ab7f180f12128e2618a857f
SHA512 3bd3e47bdb07b48a7bbc6f1279d78c40eb2c68a0fcb35fb7e985ae337b854571727e124c5d632fd329b87b5cb3d34bfbf1fbbae6326c96bbb997ab97aabe3402
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4bdc084049217a5ad3c69105b5115b198bdfd6eeff1ca0581a63e03e6e0c84a
MD5 44afcd876043fb43378a0b63a1ff65ca
SHA1 dff520aa0c079d5e7bd72c7c0e1f6931b982ce01
SHA512 346aa557e81ba6d7d570900a2238b18496535668614b9705f3cfa6dc945c7ebe668d367367052a1b08acf3d8e1a3b1fdb908bde015241102f0f9beefa438b33e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5d075440ee77b207e138d0098b626502d1517b4a475826ebcf6d4b0f7672021
MD5 0a9393dcfa94a297a479099becba0bfa
SHA1 6217325475ab4d8011c7613e83fda29998bef252
SHA512 a314b69f7be6b1ea9a0cd32b190a2ef209bf7a436eb15dc1bf0ed59ee1fa7bf27ec11fe220b7cdb6e90fd9d1bcd6f39866418ac727186c5fd4a46974c2bc3f4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a63213b2bb51a4fc348a9a8b18a6071eff1bbc92f5adc477160aadb0b894345a
MD5 ce6b2d76df052a0a16d23ace8c5f5130
SHA1 4926029636f1abf69c93b93348f72c28ee200103
SHA512 2eaf3f7a366e51a600c081d0fea87cdb5770da495a38c15fab10ebe3065d2e1a0fde9f887c0df90a6c226ee9cac19c94316943ab84adc5a8544cdf58a69c1871
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8c5afdc5f77f897dc85940255b97f327b69db61e69a46b4e5ecdd870267135f3
MD5 e04f7d2d0ae77a11f0c58f218b8198e2
SHA1 f87c7e4ba73315e3f193b57872c2df558de81b4d
SHA512 44778b53b22a4367f45d8daf98b377f25150fb524787caa77b624a7ab5c14e5223b84fbec04d74da72ef3c531e84cfede7181a537ab593e35fc684ff1af63550
MD5 SHA1 SHA512

Submit Download

svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABA.exe
Size 49.7MB
SHA256 4e0769095369eea85b6e91eeb99eff5e766ce5f52015018824e463c310e09dba
MD5 9fcffb065690f45363680a845e3daee9
SHA1 edc86760d9bed3219f3d5d91e5e74ac4f22ea5f8
SHA512 50a5a9af5ae16f1920e422b4031a2dc6f99e24e442382c730fec1bfbc21d060ac316d683575ca5cc321bf8a54b79e199cc9bf4a006d0f5e30fee4f8c8b4a0ee0
SSDEEP 98304:8aUxbRaUxbRalaUxbRaUxbRalaUxbRaUxbRalaUxbRaUxbRalaUxbRaUxbRaQKjf:/KWQc0gEYnvLj
TLSH
T150B72A49F94380B2D82B01B148CBD3BF4A70BA258B128EEBF74D876F6933BD06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 03c7a268134b2846bde096eff1aa1d16b8bc7fff9aa948a9abbb9f2f9405f7cc
MD5 9ff904dd179fc38295ba0eb2354f3eee
SHA1 e943a4413b15e277ebff51e32b720ee2580e20a6
SHA512 d184e4b62a26c6877edf22eb737e5d9651cf793e6ec9b602ea071b27ce78f4897863c1ac92d050a477eb185fe072c09420f066cf3b676fe3a26db3ec9a47f9f3
TLSH
T1FB11E361E4E5DC63F922289F512F9F920CF07B8FEC987A29630856286B95C328D114F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cf133f1ecd49ecce6f02bb59a464c6707554e9f4b47d13b28bbf137ab17d425d
MD5 8da74959a29691ef3d42ad726542d058
SHA1 ca9763b91e8b25a46355519600a3374bfe7da9f5
SHA512 81d9738b839dfe1b573f369e2a18504c3c30cbb021fb55a4becffd97930ab33aa629f3c7a37f8a400667d6c3d597380ad30638fa598c6df4f4431c78f21b868a
TLSH
T19F11C621E4E5DC63F9222CCF652EDB920CB07B9FDC986A15630856286B95C32CD154E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1860-32-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/2956-73-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/5228-6-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/5384-67-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5384-87-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download