aba60df332f912fe6692593cdcf4f11cdcd851d69111542ddf3b0f595b4c0bf6

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 64.7MB
Sample260819-ejmdesdk7w
SHA256 aba60df332f912fe6692593cdcf4f11cdcd851d69111542ddf3b0f595b4c0bf6
MD5 ea87f14902908f276a99417bf6dde5d0
SHA1 f7939404c41f694901a64b563daf386368fc2213
SHA512 2467689457a9dcfdaef0db28a5ffa80c57b381c8060073f08cbc65c2a37839f45ed33503fe7466eabc2d7cfe95f3db550a1d56b4bf114e2b1b51b875e602dbb4
SSDEEP 98304:x+4jx+4jx+4jpOU/jIEeQfoR/IuOFVjUu5Z:djdjdjpFIF0wuv
TLSH
T151E75C09F94340B1D92B11B04DCBD2BF8A70BE2587128EF7FA4DDB1B7A32BA16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
3304	svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
1628	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBABCBBACBCCBBAACACBCBABABCBCAAABCCCCBAAACABCBAABCCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe"	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACCCACBBCBBAABBCCBCACACBCBABAAABABCABCCABBABBCBBCCBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe"	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4276	sc.exe
456	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe
4240	cmd.exe
3884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
3304	svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
3304	svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
1628	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
1628	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
Token: SeDebugPrivilege	3304	svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
Token: SeDebugPrivilege	1628	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 5012	3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 5012 wrote to memory of 3024	5012	cmd.exe	98
PID 4080 wrote to memory of 3436	4080	svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe	99
PID 3436 wrote to memory of 2508	3436	notepad.exe	100
PID 3548 wrote to memory of 4240	3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	104
PID 4240 wrote to memory of 4276	4240	cmd.exe	106
PID 3548 wrote to memory of 3884	3548	2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	107
PID 3884 wrote to memory of 456	3884	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ea87f14902908f276a99417bf6dde5d0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBCBAABCAACCAACAACABAABBCCABACACBBCCBCABABAACBABACBCBABABABACCACBACBACAACABCBBABABCAACBCACACCBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBCBAABCAACCAACAACABAABBCCABACACBBCCBCABABAACBABACBCBABABABACCACBACBACAACABCBBABABCAACBCACACCBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABACBCACBBBBBBBCBACAACCCAAAABCABBBCBAAACBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe" start= auto displayName= "UserDataSvc_BBACABACBCACBBBBBBBCBACAACCCAAAABCABBBCBAAACBBBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABACBCACBBBBBBBCBACAACCCAAAABCABBBCBAAACBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe" start= auto displayName= "UserDataSvc_BBACABACBCACBBBBBBBCBACAACCCAAAABCABBBCBAAACBBBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABACBCACBBBBBBBCBACAACCCAAAABCABBBCBAAACBBBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACABACBCACBBBBBBBCBACAACCCAAAABCABBBCBAAACBBBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBABBBCAAACABBCCBABCBAACBBCCBBCCCACCBBBCAAAABABAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACAABBCCBCAABCBBCCAACBACACBBABCCCACACBBCCBCACAACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f86e74eba054f62d00d2efacca34985a37ff6a1a5e07bbf4e5517e0b0631e4ba
MD5 eea4c623bb77ad4da08c667b4fbdffa1
SHA1 9a153721c46de0c79b675e3bdf20568eb37ea32b
SHA512 e649a77dd176c0ba8d7068ce5964d120d30013b99e6e99f484dbae5f5cae45a7c29381ccfaec80dc393695a685fbd97a693355c6066bad1e11cab44e22304a30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 dafcb749427ab53ebedbbc0b1066aebeb1b1e1a0394a50b278988734400c58a6
MD5 53437355801c00f2a041ac078b80db88
SHA1 55d0867471444897bd184c0962fe8127fc9b83ee
SHA512 b976c90f61c6191f109d47c79767814bdccd1bed22136543954c8b0bd4e9dd9e8bed3d01eb9e7125bd615d2b24f718058b9d627613740150be283b60f42a1209
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\qap`g`v~dtlq
Size 10B
SHA256 37f1bff8f57638b23b18b788b90893a1fce39fdace302fb68ede12b0df2c3838
MD5 5d7862a40312c7e9484d3339109a6511
SHA1 aab5c840c438a6d368848f059ea519b9664ed588
SHA512 07480227a45b59ccff13862b1e2e284a6f90eeb8a9e667e07266a3072d1c5c7cab2ddd161b16a6ef1315ef0a8a5d9ce24cab032fd0a12b23ab73d04249038a90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded\qap`g`v~dtlq
Size 10B
SHA256 732837b10d9e0398bd6144e191e87819012e7aee717ac104a55f2b8e7ab3390f
MD5 1d31ed45ee32c9954d29a23a509a1c61
SHA1 b500e099263d453619c989c0c5deafb73bae4d8c
SHA512 da917bbf47c66334d5e88d43ee1b241ec92688ab98e4b63c4fc2c4dd9d230b65c7912c99e90a7bfc1aa4055bcaa2a22ce0102a19334968f9ee832fca9bdc7fd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 a19300827bde6c0ed86a8b9f400b5b73b3a69c5a3087a43ee492b294fadf78a6
MD5 550dcbf1539f1b659911f2cfa9202554
SHA1 ec9895fed2b9d92e0cf10e7f415016aa0bf5563a
SHA512 3542d6a49ad9ab95a285dddc23a06f4347b6ed951a82f34ea805fc4901200fa846ea5284e8261290d85aae2bdf4fd8a978d674fd0d369deebb19f92e32a41af2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d152fa2e2887a23697f0984d1f6e9a138bc9d668797fe4a9d364bd86e7fb377c
MD5 37151099bd510ee1986388ac126019f9
SHA1 eb2f44ee352c57a9d98549727684ce9eeca663c3
SHA512 ba7bea98543f062982d4c0463f5c4732741515d743dd392e4ad6d544c97ee71ff2f988a80a27bb0e68c115f6c6523940fe9274bd76aeb47f3146cf56f4b57d20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fe3e1c942ec393343a69cef2be74acaaf6532a1e9f9f8a60f35e72ea14a27a32
MD5 348462070011542ce24456359e8fcb50
SHA1 77ddb1242df888d7beb3442355ab22dc6f5238cb
SHA512 e5f584e4296cd01f6c54ac6e903f2d1c86be90c622fd99fc271129e7bcdabcabe7a9f3c8d0523f53db10d2c194a7a03e8e53a3d1c778a1489215c6f8ad9dc1f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 da96c31f7a6c7c29916feb5cecc4d3baef24f2c871e582e6bdb7a21d8a321c8f
MD5 4b3e2edb4d987c4f19a54a1e342b02fd
SHA1 ed5cfcc90e4261c0cbf93162a9f5a2f0f1500d82
SHA512 785f3afa85cf28b6a431a753a1756d7ba25c1d260ec6773a88a6d0d66fc46e5b9ab26495588c416b770649ae6f3e4bb208438be33f75c296507e8de9fae8e4a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f8fefc830097768b36bdb816ea6a5e01c41e557644e91947bea2aa62024d32ac
MD5 92f7b3b1ec3a0573d20cc9e3e7a70789
SHA1 2bae0a554f37e268acb2113c1446e7639c9807a9
SHA512 6ad2ff48f4a3ff1f843958f0966385b7cdc31c3c00d92bc7575acc19c74446d9e527fc8233bf2bd0240d8ef6aaf8f7db8d72887e46292c5bb3c19194020f9cd3
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5a7e2cd3e5b3e2022ca3c57d8519a75ace2e6c2e28653205442cebe6303a1f64
MD5 958361dd1e07d42ce3242e3154761791
SHA1 6492dc61baab21846d340d361e6a9cad55599153
SHA512 7605231e87eea3d01048e8e901cfd4e0e37278abffe4126b39e966b01165f018f4749a663598480f14efc7852e85f2e79d0fcd88fb2b780415b1d21900ee2243
TLSH
T14221F551F4B5C827F832A8CB532D9BC39CD8775FA89C9A4423099109AB84C73CD0D4D3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 756807facb487e30a1b0ba347f51a02d5b0ab5e3199c3f13476f5b104664322e
MD5 8d5b5ea6ca7e737b735357dcb5a3e598
SHA1 bb19be439b1f6db73a86fe46ec6dc091250cadd6
SHA512 4993e392604ea3576321d2fba57605176545b27cd6f627bed3d47ae1f480e16e8b26e6c561cf71a2e9123e832066bb93864ad4cede35e146f8e673b7373b6954
TLSH
T12E11D351B4B5D827F832A8CA532D9BC39CD8775F689C9A0523059109A794C76CD0D8D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1628-704-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/3304-99-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/3436-74-0x00000000029D0000-0x00000000029D1000-memory.dmp

Download

memory/3548-0-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/3548-110-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/3548-49-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/3548-24-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/3548-11-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/4080-72-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/4080-50-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/4080-47-0x0000000000810000-0x0000000000831000-memory.dmp

Download