3ffe9cb5c89a080fa291a52028368369e2dee78f511ec6de8835c894ab15227d

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 12.2MB
Sample260816-mwcczscg86
SHA256 3ffe9cb5c89a080fa291a52028368369e2dee78f511ec6de8835c894ab15227d
MD5 693ed5f3b6e8e6001a764ea41ae66bd7
SHA1 371f3b00788c4b898266a1eaf15f3585337d05ba
SHA512 e6af0547c79eb956f7b95a3497e159b472e42616c68af7826b857136d6937bf1ef6533ffe273c7bd68931850866826c9b2985253016ad8c48528bc30a97df53b
SSDEEP 49152:U+E7+ES+ES+ENiw2Pwqp+E7+ES+ES+ENiw2Pwqp+E7+ES+ES+ENiw2Pwqp+E7+EJ:MKjKWQckVgtev5mnlNL3
TLSH
T1D3D69C14B6FD0C22F1F721715DB2D6290C72BA668338D1CFA599875E6D33BC05836BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
6020	svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
1672	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABCBBCCCBCACACCCCABACACAAABACBABCCABCACAACCACABBCAABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe"	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBCBCBAABBCBCBACACAACACCBCBACCCBBACACBBBCBABABCCBBBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe"	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4404	sc.exe
1596	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe
2660	cmd.exe
5824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
6020	svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
6020	svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
1672	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
1672	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
Token: SeDebugPrivilege	6020	svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
Token: SeDebugPrivilege	1672	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2808	1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 2808 wrote to memory of 1324	2808	cmd.exe	94
PID 1764 wrote to memory of 4076	1764	svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe	95
PID 1320 wrote to memory of 2660	1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 2660 wrote to memory of 4404	2660	cmd.exe	100
PID 1320 wrote to memory of 5824	1320	2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 5824 wrote to memory of 1596	5824	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_693ed5f3b6e8e6001a764ea41ae66bd7_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBABBCBCAACBBBBBBCBACCCBCAACCBCCCBBCBCCBABABCBBAABACBBBABCCCCABBCBABBCBBCAAABCBCCACCCCBABBCABCBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBABBCBCAACBBBBBBCBACCCBCAACCBCCCBBCBCCBABABCBBAABACBBBABCCCCABBCBABBCBBCAAABCBCCACCCCBABBCABCBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBACABCBBCAAACAABCCBCBACABBACABCCCCCCAACAABACBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe" start= auto displayName= "UserDataSvc_BBBACABCBBCAAACAABCCBCBACABBACABCCCCCCAACAABACBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBACABCBBCAAACAABCCBCBACABBACABCCCCCCAACAABACBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe" start= auto displayName= "UserDataSvc_BBBACABCBBCAAACAABCCBCBACABBACABCCCCCCAACAABACBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBACABCBBCAAACAABCCBCBACABBACABCCCCCCAACAABACBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBACABCBBCAAACAABCCBCBACABBACABCCCCCCAACAABACBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACCACCABBABCACCACABBAACBCACAACABCBBCACBCABAACAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1637e0e78b4c14fb639b3c7dce45c21710ced2035dd4ff8f21b65e590397af1c
MD5 f2aeab9cd5ea88acc47b50b2be8feef4
SHA1 8987de098e2f882da4a72c1fa10d5c18bb8c1068
SHA512 c61437fc5f1406526c7003ec41cb5bb77e7ba52a123ce98faf209dbeaf854537a060f51895cb1cd7d3ea56dd91244f9ff00f99eefa08d03419f9dd58f347c854
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.6MB
SHA256 af6fe3f33daf66e74093903d1594b371fc172f1db3001892023cb749800850fe
MD5 a0f5dc6ddcadb56a02438faee63e1342
SHA1 298e5ebc43f796ca370679d12eaec9c8f7a4e3c3
SHA512 69157b019c35b9859d86f06eb607ec918d5819ec90f510c65f74de1d060de0e11fcb64f8ac8be26f5f7c47cfbd80d4ed1c153d0077dac6c46ff4f63df66a4e5f
SSDEEP 49152:U+E7+ES+ES+ENiw2Pwqp+E7+ES+ES+ENiw2Pwqp+E7+EK:Z
TLSH
T1E6C57B14BAF90C22E1BB21714DB2D6794C72BA658334C1CFB599875F6D33BC05836BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ad8933a497e08ffc5a5e227a5d7e1cdf8c075b1d1bb88adf33418e759fa75ff
MD5 7200204363ab7c935760fb58c3f6e04f
SHA1 50fdafec4c7ffdcc2589c1c05f7750c0fac5c972
SHA512 1fc3cbdd363ba9250cc6cbf7e52008ed5b1a3bd87daae91f1ffbcd853649eb327ff646cf9e034aa1dd82880280293dddf747d4f1d6be9169c71e5cbfe491d970
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be322731d5d8e5fc30f6743b5c1557ce21b9aa686a2167ea3890b9e6a0ce6548
MD5 f77055f23f5abf57e81064cf80492be3
SHA1 41a113b28cec66538c212908e45cc343b4df85b8
SHA512 57909b4fc622497c07b06020245ee85448f1b9808d3d232c7c30a067e7c58c625be1d37857c0cf438e87a6f6e29d295bd1afca96ba0fe7468b197995a7371e74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41cd0b8307274aafada395711af99241e0de773926c560834a84fff7bb912bb7
MD5 ca6c45718c1bd72d9c53a0cd85eb3707
SHA1 d5397b3f802e43ffe5b7e1db8430497d36c65147
SHA512 e228bc9769e6e12bb0a28c3d48fab5d1a9d714d0ecbce418b08728ec7a9e8607edd6bea7a558eb995f262e8d3c47a013abae49cd937aa3ce9280824b79a91f61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7f3f78027def4dbe07f32bedab1b5d9fe548f91925b286c2f70eb3b0146e6f8
MD5 d496af2f8d3fa0653b2491ebc0c9bb03
SHA1 5b4eb5fb9ce4668a9fd4e771b630f4dd15f993c2
SHA512 e7ddd57ca44cf841339d4ae17c32764fe4fb0bd0758414293d0802ba69053fa5dd41fb7ea2d4a9a89925466477247840d8cf205f95a5954ade5bac3bdd0b7669
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8722c17f24993e27d2218107092d620766c390429a0a5e21610e3dc681983266
MD5 e1ef4ec3b54ccdacccd83bc1c61bff1b
SHA1 74173ee4e682c020d1def5bec64b0ada8920dad4
SHA512 64616bfb758fc11322b3b0043a5a1d172c31118a062ab656597e467ddd4c1b0c3f1ea072ca13dc6f2396e0625643a6ba77e351965d7a7dc8eb62abd8a709158b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef3e33eafe48ed861a90e2168da512547ae9d0f62cfd453b94d13070a59968c3
MD5 5d91559c985043f42e51a92dd5f168f5
SHA1 6d0be1403b0a3845ea1e7dc3b8c514b5b149cbf8
SHA512 1474d413f7cbfdd3128eae121be7284970f486155503812a72dd32fd7e2678f090213ac6499117a520f0d33dec9d793371ebfeb50f8b9612cd220645d7029c5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 788adeda7c774b4a69e77d35fc96294bce9102481d7748000248a36efb0886b6
MD5 b2d96ef080bfd8c4bd017f02fac98e49
SHA1 899859f934ffda481181f2a20c912f882619c679
SHA512 582d3343f85d9cc66ba500714e11f0e67a66498cdb948cee0eb050111311638d1ceaee32c0ee1d9a524c02685b646605d19f80112e189ebe5a11d5bcc92aeb4f
MD5 SHA1 SHA512

Submit Download

svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBACCAACBBACCCBCCBCBCAAABAACAAAAABBACBBBBAACCBCBA.exe
Size 12.2MB
SHA256 3ffe9cb5c89a080fa291a52028368369e2dee78f511ec6de8835c894ab15227d
MD5 693ed5f3b6e8e6001a764ea41ae66bd7
SHA1 371f3b00788c4b898266a1eaf15f3585337d05ba
SHA512 e6af0547c79eb956f7b95a3497e159b472e42616c68af7826b857136d6937bf1ef6533ffe273c7bd68931850866826c9b2985253016ad8c48528bc30a97df53b
SSDEEP 49152:U+E7+ES+ES+ENiw2Pwqp+E7+ES+ES+ENiw2Pwqp+E7+ES+ES+ENiw2Pwqp+E7+EJ:MKjKWQckVgtev5mnlNL3
TLSH
T1D3D69C14B6FD0C22F1F721715DB2D6290C72BA668338D1CFA599875E6D33BC05836BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b1e67a37160b841fb1a0db7ecee470725d0ee89f98138fe3527ca89d3eb7db12
MD5 18fb0bba4261dd7c6033e13df69e05bc
SHA1 304379d53541ec2cb58a50ddcfdd76650a9233ab
SHA512 039b25080035f1f6b48708e1e85cb9002bfb93965970cb1bad0bece1c3f0e264ed9e2f3ac7c3e26ac40b5c6001b4b2f981562ede54f9e35597143a9c1b5d46af
TLSH
T1A1112726D4E9CC13F9F2248B691E9F830DB5339BED9CAA285208131CB799D34CE154B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7446064201b6a75b2567820df8a04e039dfb8a5acba928f6441f63bdd09a9641
MD5 7de5c360c21d189393f2fc1cb4966b00
SHA1 355721ef1e91c85c8dc5bcd4b222b5ec435f4924
SHA512 850771a695869317ae5f8884d053d23ac18696c0fecaa6b67e06084a67df230b81ced785f075e15fb1ea60ee94e2e531332f6e3a7fd795de16baa31fdd04a77c
TLSH
T1A9213865E4EDCC53F9F2248B691E9F830DB5379FEC9C6A2822085218B799C34CE154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1320-0-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/1320-7-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/1672-84-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/1764-33-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/6020-64-0x0000000000370000-0x0000000000391000-memory.dmp

Download