0f6edbbfc12ca4086e9c20b07577f0262ba3be2e18664de7aeb120be48eeabcf

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 24.3MB
Sample260819-b4ebrsvaja
SHA256 0f6edbbfc12ca4086e9c20b07577f0262ba3be2e18664de7aeb120be48eeabcf
MD5 715c3c67431fba4a07cd4fa40d166dac
SHA1 c171a79ef73738d3e5d91d4ee3c7c38f305f7c98
SHA512 6668ba4adb4c987ecacc12fdbbddd077215d36670019b7c3d353b07da0cf22a1d9e2e12c0d110ea9ba1754297eb06c62f6baf78aa536233f55fdf8174c37401c
SSDEEP 49152:U+E2+ES+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+E:5KjKWQckVgtev5mnlNL6
TLSH
T1EF475C09F94340F1D92B50B04DCFD3BF8A60BB2586128DFBFB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
4176	svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe
5020	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABBBBABACACABACACAACCBCBCBCBCCBABCACBBCBACCCABBBCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe"	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCCABAACABBCCCCAACBCBBBCABBAABBACABCCCCCBBCACABCCCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe"	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5884	sc.exe
4432	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5936	cmd.exe
2720	cmd.exe
5744	cmd.exe
3212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5880	schtasks.exe
4156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
4176	svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe
4176	svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
Token: SeDebugPrivilege	4176	svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5936	4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	91
PID 5936 wrote to memory of 5880	5936	cmd.exe	93
PID 4112 wrote to memory of 4708	4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe	94
PID 4168 wrote to memory of 2720	4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 2720 wrote to memory of 5884	2720	cmd.exe	99
PID 4168 wrote to memory of 5744	4168	2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 5744 wrote to memory of 4432	5744	cmd.exe	102
PID 4112 wrote to memory of 3212	4112	svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe	104
PID 3212 wrote to memory of 4156	3212	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_715c3c67431fba4a07cd4fa40d166dac_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABABACAAABBCABABBABBCBBCCCBAAACBBBAABBABCBABABAABACCABACACABABAABBAABCCBCBBBABABBCBBCACAABABABAACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABABACAAABBCABABBABBCBBCCCBAAACBBBAABBABCBABABAABACCABACACABABAABBAABCCBCBBBABABBCBBCACAABABABAACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCACABCCACBAACACACCCBCABACBBAAACCCBCCBCCBBCBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe" start= auto displayName= "UserDataSvc_BACCACABCCACBAACACACCCBCABACBBAAACCCBCCBCCBBCBABABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCACABCCACBAACACACCCBCABACBBAAACCCBCCBCCBBCBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe" start= auto displayName= "UserDataSvc_BACCACABCCACBAACACACCCBCABACBBAAACCCBCCBCCBBCBABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCACABCCACBAACACACCCBCABACBBAAACCCBCCBCCBBCBABABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCACABCCACBAACACACCCBCABACBBAAACCCBCCBCCBBCBABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCBACACCAABBCCCBBCACBBBACBCBCAABBCBBAAABCABCACBBAACCAACACACCCBBCABBABAAABACCACACCAAABAAABACCBAABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCBACACCAABBCCCBBCACBBBACBCBCAABBCBBAAABCABCACBBAACCAACACACCCBBCABBABAAABACCACACCAAABAAABACCBAABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBABBBBCBABBBBBCBBABACCABBAAAAABAACAACCCBBBCAAABABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
1⤵
- Executes dropped EXE
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1db0f4e38febe25df4af24bc229e83b89209c66c9182ec4b1c006b60e1bff9b
MD5 29d9612c1ed27f108a33ff0ea4146797
SHA1 fab0c0e5e31391471d53f4871ed31351cef93f50
SHA512 26cd0bfe475fed75a025316cf895d74efccfb89b376c95676217a687a235cf89f46ac6798fba444604810a297b77272cde3ec447377a67ebeed5eae2efb890bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8084e5427da2b5844c0d2ec3cef24d360ea41d40a7d1a6290b6218152a9ac2a
MD5 d2114912be50afc0ef438532670fb360
SHA1 6dcd25b5aadfe39f1e6c499c2cb41aea20b96992
SHA512 b9c16330a969f11f5caf4047c9212e32d51b9a10f381854ebc54ea6ad41dab02c9f938197de2219fb6a4d51ffd508ccab8a534b5408074b32005c4e9ef20c0f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 caa07558c2b365795b0402b646807c0a19152644c293065a138016788db28537
MD5 fefc1b4cb7013523a23c8bfbe760e277
SHA1 ea60eb23c1e078dd894a425e70b7aceea625158d
SHA512 2989339b534e7b2c39ed0b5b1b48315ad92d5a0a71bfadd0f7ff4d14a82dc87eace8c82e1facb359edc4e439adc235c135e488961725c0c3f2acf713fb9672a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f0648af9bd930fbb2cc821a6102ca8bedfd0c38c4cce7176bf9c547a993b6ecb
MD5 6c10e1be5ed7ce3cdb80edbee862fae6
SHA1 f6372875b698980ecc3f9b38e1470f3cc64386b6
SHA512 5a0155c977e18d6c71eab740f16b00ced1dcb3a5b1a713296882f528d244c8ab774c99d31e808ec90736eefae6ceda131eb3b3a1863c642b6dcdc2b09afd8ef3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c8a0f3e916341f5f405936f67d20247dcae420d0797686e60e1183d1e1d8e5b
MD5 9b61912953446e67a9d4fb477f9dca2a
SHA1 b350007c66f2c2d22a1d920770504bb1e9baba97
SHA512 cc8fa48795e59c8ba2bb065debc51bd7450168dc22c6fb8aba6d8ba4945227a71c11fd84bc539d0d25dda6a6c80b30b65f0cf8dd383a5d63ee41fc16543aadf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af4b0d8860db9cbad1d27cfcfe89d8366ce209ad4e9d15a60c25785691d4d009
MD5 806f4919152d66fe88dc2178a2a493f4
SHA1 1d6f22333e28fdbcca14288e3e2cb7cbe0bcc578
SHA512 1bbb6e4aea530dc4c9edabbf40634fd582703c522ed018b71cb0c3199158871f69fb615b1630081e4d6ae05a6864b2422416d8225a3ee097fcc26cd4918de093
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d90437bf979445aa7c3c5f70b39ecfd99583f867907ffd4837baa29a114a533b
MD5 4f8dcabcbd5b25a1985a8ceffb3146a2
SHA1 0630242c80b3f407659ecaf56d7ef045961932c6
SHA512 b50b67f98b67332b82cb472485f321cecd084a46f9a1a90db9ec98aea5019cc4aa90ad5449377e710223f27289de0736cf1394a70a7c0d4bc5d3392a2157d1cf
MD5 SHA1 SHA512

Submit Download

svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBCCACBBBACBCABBACAAAACBBCACABCCABCCBCAABBBCBBCBBB.exe
Size 24.3MB
SHA256 0f6edbbfc12ca4086e9c20b07577f0262ba3be2e18664de7aeb120be48eeabcf
MD5 715c3c67431fba4a07cd4fa40d166dac
SHA1 c171a79ef73738d3e5d91d4ee3c7c38f305f7c98
SHA512 6668ba4adb4c987ecacc12fdbbddd077215d36670019b7c3d353b07da0cf22a1d9e2e12c0d110ea9ba1754297eb06c62f6baf78aa536233f55fdf8174c37401c
SSDEEP 49152:U+E2+ES+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+E:5KjKWQckVgtev5mnlNL6
TLSH
T1EF475C09F94340F1D92B50B04DCFD3BF8A60BB2586128DFBFB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f1b31e5fec81cbce7a2b418670f3086ffec487c4d49bb9e05a76eb2ef303db9d
MD5 39e361ae7f95c981f18f81f2451cea9c
SHA1 15b35ec2cfcdd8c0fdd930ce9d60afdc9e42b591
SHA512 064ce2bea930c93b703ad61a9df07142d4e8ea90d29371ac7f43b22c86ebb2efe28163bcdbacbd6f830c10b739f97864634585cbcbf9fcc9e175b8aa4caf925c
TLSH
T176112B36E4A9DC93E932688BB72DDAC20DBC3657A89C6A411309811C6BC9C328D190F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3c014b0dad27642ca08d12e7d49001e4894a09c3f6d4cafde8627990310d3f65
MD5 30d9ab5fa4f5b8866ff57122a4950db0
SHA1 756ff7ddd69845b5fe130ca3aa25a2ffc2f32f00
SHA512 ed6578aca965d51c97cf0150623801d4ad8a38d9fc2c8b6bf47039f3ae6e17b47d2e9817ca22a1c650b1349b85e664c3f8017c6f55972f534b1bb7b8d6c19c0c
TLSH
T1C511F935E4E8DC93EA33A8C7B72DDAC20DBC339B989C694153198118A7C9C32CD094F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4112-32-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/4168-6-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4176-63-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/4176-87-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5020-82-0x0000000000260000-0x0000000000281000-memory.dmp

Download