b05ac51fb15325698391c75efb85a21fc79c00820068e715cb0b7460576e8314

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 14.7MB
Sample260814-fe3ehsvxex
SHA256 b05ac51fb15325698391c75efb85a21fc79c00820068e715cb0b7460576e8314
MD5 3455349eb248cf34e00e68050d020981
SHA1 3140909f43c34a5caeadc8b7a882cd743ae0298c
SHA512 7f4d51b7c0e159146cb1380cc98960787f7489a82eb0a036ec81b92226b4f035b63ce9406cab389f0e0d5faa0f3c937da0262928ef4767cbd3b31c096c52621e
SSDEEP 98304:gXhhh/Xhhh/Xhhh/Xhhh/Xhhh/Xhhh/Xhhh/XhhhCKjKWQckVgtev5mnlNLU:kKWQc0gEYnvLU
TLSH
T1D2F65C86FA46C1B3D41B0232489B83F75B70B8155F16A79B7398A37E5E337C0A332695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
1844	svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
4764	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACCABCBAABABACCACACBCAACAABCBBAAABAABBABABBACACAAAAABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe"	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABBCCCBBACCCBCBCCCBBCACCBABBACCBBABCABCBBABCBBCCCCACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe"	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3816	sc.exe
1248	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe
464	cmd.exe
812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
1844	svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
1844	svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
4764	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
4764	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
Token: SeDebugPrivilege	1844	svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
Token: SeDebugPrivilege	4764	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
776	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 464	2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 464 wrote to memory of 2220	464	cmd.exe	100
PID 2120 wrote to memory of 3012	2120	svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe	101
PID 3012 wrote to memory of 900	3012	notepad.exe	102
PID 2800 wrote to memory of 812	2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	106
PID 812 wrote to memory of 3816	812	cmd.exe	108
PID 2800 wrote to memory of 3692	2800	2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	109
PID 3692 wrote to memory of 1248	3692	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_3455349eb248cf34e00e68050d020981_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCAACACABCABCBBBCCCCBCCCCBBCABACBCCBBACCBBBCACBBBAACCABABCCBACBCBCBCBAABCBABCCBCBBBCAACABCCCBCCBBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCAACACABCABCBBBCCCCBCCCCBBCABACBCCBBACCBBBCACBBBAACCABABCCBACBCBCBCBAABCBABCCBCBBBCAACABCCCBCCBBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCBCCACCBCCBBCBBCBAACBCABBAABCCBCCBBCACBCBBBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe" start= auto displayName= "UserDataSvc_BBABCBCCACCBCCBBCBBCBAACBCABBAABCCBCCBBCACBCBBBBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABCBCCACCBCCBBCBBCBAACBCABBAABCCBCCBBCACBCBBBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe" start= auto displayName= "UserDataSvc_BBABCBCCACCBCCBBCBBCBAACBCABBAABCCBCCBBCACBCBBBBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABCBCCACCBCCBBCBBCBAACBCABBAABCCBCCBBCACBCBBBBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABCBCCACCBCCBBCBBCBAACBCABBAABCCBCCBBCACBCBBBBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCABCBCBAACCBBBAACBAABCBABABBCACBCBBAABCBCBACAAACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c7e53ae02c53a634f5ef89f1f90de4f200fdb8e3ff6c1e706be59b4a1b85b586
MD5 4069d8dc3c9104312ecd39afe284a1a3
SHA1 d1d96c11d47dd63bc963a20fa29711198e9f3d38
SHA512 05ce21caf857bb380130bc0a4e96523ec7c19049359de7b1063a9414776be186acd65d9030a62ccf0a23c1bd258e244437db0bb0fd347db42f6644f666fc32b1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.5MB
SHA256 b0ce0fd2728ae52a75bec47849bae7bfd1cf85d184757e661f3ec699927efa30
MD5 45c33f94777e9e643daccc820b57d776
SHA1 b5618db4dbd31947b60ab07b23ea673eec9d6877
SHA512 33daefd8cfdaff2a16719033b7bf98e966891e8bf15658fc0bc0bec03d86044a43e67ac36de234f093d37ccdd09f4b55b40213f11928f78929fac165c72b3faf
SSDEEP 49152:U+E3qatgly+E3qatglS+E3qatglS+E3qatglS+E3qatglPA+E3qatgly+E3qatgI:gXhhh/Xhhh/Xhhh/Xhhh/XhhhR
TLSH
T180963C86FA46C1B3D41B0232489B93F75B70B8155F16A79B7398A37E5E337C0A332694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 f3a1ed5b72ebcb865f3db97479e19aa1bd314fa31caa5b050eb4f4ff390ce2b3
MD5 f09ee69ee1a13599fbdb07adeb2a58cf
SHA1 1e20f3b4d6f0c17f2a0bf4591813f91d8bf83043
SHA512 d2b3807394ca7f78dcced5685349074664edb1d3637974e5ac587c2a3e0404d81a32338cb6c6851fbea4d3b41759f438b030b998c9bba1ff6e19c4f525c28a80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3187f04fbf5e5a0d4869416768c9642b3857af27178d5f1898b2aa4e843cd5e1
MD5 d8da600e5600615a634f92639ec9b355
SHA1 e38501892e549aef136625866c88d046dc628061
SHA512 1c443773fbf6aec055d9ca3f6a9411c12a2bfb3b191ad3a42421607d56fef4509e586da7c03a6a198ed4a271a8780cfa793434e0c6ded7cdc7ad8de946cd4eda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df8b8c712d4e9508d80f65bf996fdfc3aead36b4080916faeede33ee72a2adbe
MD5 594a059a8482b6843cb8d7020295b607
SHA1 e9ff27d05f7063d4c74017114a98479b7820ff76
SHA512 6b6a4f34e906834a7d6822a93feeb5fd88f423d92ccffa46d2ee6a6a79d9cf73f68baa1248117378e1fe98a7916004ad5c8a916aee363e2833b9fb992e426fd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9aa7ec8628992810918d14b98d035eaa819ca1975faf14f93795546def9b53f
MD5 ee846d54c96af3407a13f7c3b2e84dda
SHA1 31dd2680abc432c99d0013846877ce9108c6aca8
SHA512 142c64b21cecd02aa144657bb82610a13de60d504af3c03e14938abec62985af7e39b5d0b146df97b821630877730208af7eb8e9422e2a8b5858fa14e67d770f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 360a1eedee9265532b77ec0a7d728dd7268241a60ced1ec79e37d5da9cf92a32
MD5 3049004d8160e91e634319a7872e10e4
SHA1 b0999a45eff2c049bba349c20dc8e81bbed6d4c6
SHA512 8b68fd17b9cdbf57aaf3e6f8adac1dc161f1de906a67b1faff6ea6dbb2d16e95d273dde2f3541b2c1cd4d8ef48c553cb14c0e567f9ae7b25191115b234bf0677
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8066cfb27cd0878b6e26fea174da6f0fc4ea0e951b36b50e47ea2ff90f1732e2
MD5 dfe2c4f5e570a66a3f29d67d3e106eef
SHA1 0d284ee6c0869edc0f5d54d5aef71fb0ef4958c5
SHA512 2c6c14b64b43fb3e9d1f656b763b0a03c5eaacb623282f5a000c1de487eb13f683812db2b61c9b5289362800e588e30467dc0ab7081fe1894704d7b13fd0777a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 500bbbce24dabda553689b4de247dbea8301506e9addb59c0b7d83b31e1aa8b4
MD5 a970e2ade50e5713b541723c8db92cc9
SHA1 9e1dfe539f4ff6127a5c98c4427dcb4ead2750c9
SHA512 111bc0395b392594f47f4875069aa93e4aa38d5487737fd67dfd379e0517eb35af67122f00e44d47a5c8584f25efc710e4d55255aa7a161f8aaf3a956a8c4b1e
MD5 SHA1 SHA512

Submit Download

svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBAACCACBACCCBBAACABACAACCAACBCBBAACBCCBABBACABCCBB.exe
Size 14.7MB
SHA256 b05ac51fb15325698391c75efb85a21fc79c00820068e715cb0b7460576e8314
MD5 3455349eb248cf34e00e68050d020981
SHA1 3140909f43c34a5caeadc8b7a882cd743ae0298c
SHA512 7f4d51b7c0e159146cb1380cc98960787f7489a82eb0a036ec81b92226b4f035b63ce9406cab389f0e0d5faa0f3c937da0262928ef4767cbd3b31c096c52621e
SSDEEP 98304:gXhhh/Xhhh/Xhhh/Xhhh/Xhhh/Xhhh/Xhhh/XhhhCKjKWQckVgtev5mnlNLU:kKWQc0gEYnvLU
TLSH
T1D2F65C86FA46C1B3D41B0232489B83F75B70B8155F16A79B7398A37E5E337C0A332695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 3c208f52b011c3b53df7752407a5936db87380f5d0327c44853df99927ec5c23
MD5 d58e0a26f542e7fc59de714bc478ef08
SHA1 3f73a7ca6cbdaa7fc287c4663d06b39e2aa24941
SHA512 b5448a822ef88e6bca85f2ef0a70c9e9251f33fcd109c5e4fbeadfc1771d8014d01aa9798d6225dc8d3046793793424280786afc5e804381cb410354ba872d58
TLSH
T11511B250A8E6D473F8226887862ADBD31CF4E6CF7C186A54234D4228ABD8D308D558F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 98d736a0ca48ad8e9ee875551f6d545c4e56f45eb5ed02ba55eddb81b6250b6c
MD5 1a11f79403fb28792f7aadd93e397b9d
SHA1 2bf76a83cc34f1ab85b6de27b2eb7e073f0315a2
SHA512 634c1373e9ab9577e93da7a3e9968c3d98d8948cd22350b5ccc1dfd134f6440369c408e199679e244028899fe8a71fd568edfe3b36772486dd8beb68061400b1
TLSH
T1EE219250A8E6D473F82269CB8629CBD21CF4F68F7C186A54234D4228ABE9D308D558B6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1844-87-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/2120-36-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2120-26-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2800-0-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/2800-7-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/3012-59-0x0000000002250000-0x0000000002251000-memory.dmp

Download

memory/4764-89-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download