4c28789b41b7a90a8d313036bbeecf4ab02764370cafef1a3d551ba81a0cbaaf

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Size 43.8MB
Sample260818-d1c1msdn31
SHA256 4c28789b41b7a90a8d313036bbeecf4ab02764370cafef1a3d551ba81a0cbaaf
MD5 42eff1c0d2a8a6f597c2091f1b3704f7
SHA1 f544bce1694ff168499e0803d55dbf2e47cca0e7
SHA512 69761342b66cbc7dcd6ed538ab8aa1c8640cedd8e0ed1575d8bba37b87bae966a37ff18135df90bc9bdd7e28c54233782b8ea879c45e4d0d1f3f59e38b35a03e
SSDEEP 393216:Yhtu5tnxmahiTTWe5unX3Csc4cKf7lNEMhr+nC0ztt4z10zn4kFVFqq+sKVE6z4C:YhE5FxdhifnESif7hjq2zjkQqj9Zf4Mm
TLSH
T1B7A7D009F94340B1D92B51B04DCFE2BF8A60BB2587128EF7FA4DCB5B6933BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
1716	svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe
4316	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBBBCCCACBABCACCABCCBBCCBCBBACCCCBCBBCAAACCCCCBCABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe"	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCACCBAACCBCBCCABABACABACBAACABBBACCCBACBCACCCCCAACAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe"	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5548	sc.exe
3756	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe
1140	cmd.exe
5028	cmd.exe
2816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5588	schtasks.exe
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
1716	svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe
1716	svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Token: SeDebugPrivilege	6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
Token: SeDebugPrivilege	1716	svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1260	3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	92
PID 1260 wrote to memory of 5588	1260	cmd.exe	94
PID 6096 wrote to memory of 4416	6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe	95
PID 3804 wrote to memory of 1140	3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	98
PID 1140 wrote to memory of 3756	1140	cmd.exe	100
PID 3804 wrote to memory of 5028	3804	2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	101
PID 5028 wrote to memory of 5548	5028	cmd.exe	103
PID 6096 wrote to memory of 2816	6096	svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe	105
PID 2816 wrote to memory of 1480	2816	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_42eff1c0d2a8a6f597c2091f1b3704f7_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABABCAACCCBACABBCACACACBCCBCCAABBBAACBCCABBBAABCCACCACABBAABBAAAAACABABBBACCCABACBAACCAACAACCBBBBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABABCAACCCBACABBCACACACBCCBCCAABBBAACBCCABBBAABCCACCACABBAABBAAAAACABABBBACCCABACBAACCAACAACCBBBBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBCABBBABACACCBAABCBAAABBCABCCAABBCBABCCAABAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe" start= auto displayName= "UserDataSvc_ACCBBCABBBABACACCBAABCBAAABBCABCCAABBCBABCCAABAACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBCABBBABACACCBAABCBAAABBCABCCAABBCBABCCAABAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe" start= auto displayName= "UserDataSvc_ACCBBCABBBABACACCBAABCBAAABBCABCCAABBCBABCCAABAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBCABBBABACACCBAABCBAAABBCABCCAABBCBABCCAABAACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBCABBBABACACCBAABCBAAABBCABCCAABBCBABCCAABAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACBABACBBBAACBBBCACBACAACBCCBCBAAAACAACAABCBACAABACBBBCBCCAAAACBAAAAAAACCABBACCBCBBBBBBCBCAACBAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACBABACBBBAACBBBCACBACAACBCCBCBAAAACAACAABCBACAABACBBBCBCCAAAACBAAAAAAACCABBACCBCBBBBBBCBCAACBAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCBCABAABBBABCCCBABCBAABAACCABCBCAACCBBCAABBCAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
1⤵
- Executes dropped EXE
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab9d167ef3b6813f0fdb15bb3c0e265d3f0f374eb6c8b90857bab9e01136f25e
MD5 4e66664daf84bafafcfab43a6d52198d
SHA1 4e982fc3a51d71bf238f0a60d4e757e9d339b137
SHA512 6acbc1fa59311f019c7d0e73ae167f2e6597835a846f1ac8692e250376b5c9a9737a439ebc2bc6a7620c0f4acf9f037574e34f36d0d87f961f17a049cca4f269
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c61a0e5406140987cbbc7b7eade6c3a13c22a8de943f06d90e0dfe8661931ed6
MD5 40147082d250d023606802db5f81add9
SHA1 394875e801966cda3cdcf7b4886493cdbd48b9c3
SHA512 605d6c890e7aa345b929d18e820545f8d6777ba06ebf95c582429fe9586b205aecb2a7c8f932eeb4d64e56f98ab403c29d4920096c485565ecdfaac3c897019c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1fbba65cd61a7d0c5e96fefbbcdda35f3069963f15ef1f76ddbc354ce8a3c69
MD5 42d1bcfce2ba3a7688a23dde2a2c8db2
SHA1 be098d3b2242de211c9445ac963e053237fac1bd
SHA512 d65a27606d976ca1076422511869af9434358fefac612867f2e0f932d7af6332827bcb3606cc3eb0c0759eed7a7a4a704458adfac53758e04d3c0ae8533a985a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2ab6cb709268e7e0bf3ec775b2c9c02aab40cbbd385bf4d862009d3b04f4dea
MD5 585016d69d547834cbec5e2b369c2a40
SHA1 094475d417b506b53369357679917c1e363d42e3
SHA512 65a31ce4b7c18623ff3feeaadefdfeb6a16b458e3fc68329c172917c390fcdb9d09d071ee7baebc81e14726bc30df765d750cce70a1ab0293345b7ec12e953db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b3b183ee694bfa4149679d8c277032791ab5909be73a429a79f88bcfd1205da9
MD5 16f1a2fbc24c27058c656077f496031c
SHA1 5c009ac2e5a79014a068832cd01f45aa167b0b55
SHA512 2ae8b64722f32ddf773cff066b93e55e984f88e3925dcb15e9803287f30a954d0aeda485272b8c90361cadb3a2c2e5fd64e29a82101ab7c4f4efe36e13631484
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bfbbe11b2451323f6491204ebd3f3d0938745301a74cb3314459e3002f44a08e
MD5 9f79cebf82b99d0f788de4b6455346b1
SHA1 48ce910fb4994776bcba7e2a405001aa14a7476b
SHA512 9ee5e10ac957295c7e1211b369d3f15302655a09d81dd9f3af2cbcb5fb07990108fb3fa33e9805242c9192f0235bc0184fbd3f21790b85b6f955ecdb3c969b64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7c2110399693faa2728d6eed43e891bf07feba4c9956fbf4681e7adcf71c44be
MD5 7e793508bfbc7cab0267144cd16a34de
SHA1 32f78f037c2502aa1058ac5480b37254f84b3b42
SHA512 7518b3f94143f0c5cf82976e1606cc57309e1d3d2d77ad1fa889e0813efb5e162db31f06ef55fc077c81ad5575b34ea5fd6f6a44b326a3e87ef0c1c42d933305
MD5 SHA1 SHA512

Submit Download

svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBAACBCBBCABCBBCBCBCCAABCBCACCBAACACBAACABBAACABCBCB.exe
Size 43.8MB
SHA256 4c28789b41b7a90a8d313036bbeecf4ab02764370cafef1a3d551ba81a0cbaaf
MD5 42eff1c0d2a8a6f597c2091f1b3704f7
SHA1 f544bce1694ff168499e0803d55dbf2e47cca0e7
SHA512 69761342b66cbc7dcd6ed538ab8aa1c8640cedd8e0ed1575d8bba37b87bae966a37ff18135df90bc9bdd7e28c54233782b8ea879c45e4d0d1f3f59e38b35a03e
SSDEEP 393216:Yhtu5tnxmahiTTWe5unX3Csc4cKf7lNEMhr+nC0ztt4z10zn4kFVFqq+sKVE6z4C:YhE5FxdhifnESif7hjq2zjkQqj9Zf4Mm
TLSH
T1B7A7D009F94340B1D92B51B04DCFE2BF8A60BB2587128EF7FA4DCB5B6933BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 815037886d9db5f2eafc7ecbaa576cb7bc8fdde809103a17b3062c31767b070d
MD5 1a5740c6862cea3548e2fa0ee2e63480
SHA1 a316c89d536cf4074f40af0aee6c0869e4f33425
SHA512 55a92b1c1773d98efd42bd7c8b75a706aa59407775cd60e9981bbf823ae350a5d40222453edeac4595a7af18aa6923696bc57a67c1d17e81745db16efef5bbf0
TLSH
T1E811A761F4B6D837F933688F5129DBD208E026ABAD98AA58230D511CFBE58384E154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c6da3efee7404e5440649b4b2af1a09a3a95207af5424dd70bed6fb17d107fc4
MD5 59a63ea97dd641a3420aac6b712562af
SHA1 4258f45ee1c923307970955a788b8961fd659f76
SHA512 4724334a5c9ad9a63d1c48b77776d16ad4e63ec56595331b6be9300a2876c41a80d46aba69654f66a1731a02fd533e954158be2ca8121b690e34243207c4710f
TLSH
T1A8119331F4B6DC77F93368CB5529EBD20CA426ABED9C9A48130C9118FBE58394D154E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1716-63-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1716-87-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3804-6-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/4316-82-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/6096-32-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download