00d9eb3d2148af4dc4c1bdf8972748e7887b051b1cbbebdfdaf8ae0d9f3cc2c9

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 40.3MB
Sample260826-lr8pyscf44
SHA256 00d9eb3d2148af4dc4c1bdf8972748e7887b051b1cbbebdfdaf8ae0d9f3cc2c9
MD5 c87f7b13963b568af6199866a3405e08
SHA1 4d1c48249e53fd80272b3bce72650c6d4c57c52b
SHA512 828b01200f5128b13bb53b69d9e6bbb6d9ce2cbd006ac398eeef3e7e75b296c8113d4fa3915b2da8255a612ad0eee34dc6ec519e0b5566d3cc94faa2547d65fd
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+EV:vKjKWQckVgtev5mnlNLS
TLSH
T160972A09F94344B1D92B51B04DCFE3BF8A60BB2583128DF7FA4ECB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
2124	svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe
5708	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCACCBCABAABCBCAABCBACCCABBBAAACBABACCBCBABCBBAABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe"	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCABCBABBBCCCBAAABCCCBABACABCABBAAAAAABCCCBABBACBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe"	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3984	sc.exe
1760	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1872	cmd.exe
432	cmd.exe
760	cmd.exe
3692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5756	schtasks.exe
4980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
2124	svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe
2124	svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
Token: SeDebugPrivilege	2124	svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 760	2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	91
PID 760 wrote to memory of 5756	760	cmd.exe	93
PID 5016 wrote to memory of 4668	5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe	94
PID 2256 wrote to memory of 3692	2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 3692 wrote to memory of 3984	3692	cmd.exe	99
PID 2256 wrote to memory of 1872	2256	2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 1872 wrote to memory of 1760	1872	cmd.exe	102
PID 5016 wrote to memory of 432	5016	svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe	104
PID 432 wrote to memory of 4980	432	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_c87f7b13963b568af6199866a3405e08_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBABBBBABCACABBCABCCBCACBAAACAABBBABCCAABBACAAACCABBCACCCACAABBBAAAABBAABCCBCBCAACAACBBCAABBCBBACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBABBBBABCACABBCABCCBCACBAAACAABBBABCCAABBACAAACCABBCACCCACAABBBAAAABBAABCCBCBCAACAACBBCAABBCBBACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBCBCCABCACCCBCBBACCACBCBBCBCABACCCCBABBABABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe" start= auto displayName= "UserDataSvc_BABBCBCCABCACCCBCBBACCACBCBBCBCABACCCCBABBABABCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBCBCCABCACCCBCBBACCACBCBBCBCABACCCCBABBABABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe" start= auto displayName= "UserDataSvc_BABBCBCCABCACCCBCBBACCACBCBBCBCABACCCCBABBABABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBCBCCABCACCCBCBBACCACBCBBCBCABACCCCBABBABABCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBCBCCABCACCCBCBBACCACBCBBCBCABACCCCBABBABABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBABCCACBBCABAACCCCBACACCBCBCAAACCCCBCBBBACABABCABBACCCAAACAACBBCCCCAABABBACAAACBBCBBCCABBACBBBABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBABCCACBBCABAACCCCBACACCBCBCAAACCCCBCBBBACABABCABBACCCAAACAACBBCCCCAABABBACAAACBBCBBCCABBACBBBABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBABABAACCACBBBBABBACACBABBAACCBBCACBACABABCABBABBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
1⤵
- Executes dropped EXE
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 908f03e124c6ed270fa1e70ca93149f4c888a77a6eccc16a3595d9ee47e4d3b7
MD5 3b2dc7dbfe41c5f869ba6ce89af2c2a0
SHA1 1f9b447f45859fd31e7b6ceffccd846a41ff0f2b
SHA512 ef827ac0c8bb86c8dfdf72c9a0874dfe6a20147df48cad7b0c66e10bc4ab323c2eddfa5b46c397fe1d2548da758c92a49cb94ada6ea4401f8e0c0eb99a734a62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16937b3a7d1be1c85073f4322fa90b06e2c3543634c785d3d49fb1e6f6deedb9
MD5 2b4fb611fa7e919466d979a49b4471f0
SHA1 46fbb0a5ee0d1afa4cc26df869ae05d9b8ce25e6
SHA512 c5ffc8c2d464facb1342f98a8840fdfdcfe3001327f04a0bca67d42c10bebb4d70cca0763f1f19e83ba5635b7e36532d877df1a471146839a467f15864462009
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6cc0909d21985c5f1c1d7136e7ee6f98bd238a1f99ea34a870bfae35a8003773
MD5 4e9b20719dba83f868e54cc8843b4adf
SHA1 91d82b6847e5cd2003f142da50beb7c6f5151ef9
SHA512 95b0377b8e2f5addff49fdeb6a3547d9a313b0942f791fa743123f901906f22b4a31550daaa64e331d046752d2ab9e1f79993014352d5524e1831d2f4b57fa61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 600efbf1d615d32f145a40488dca813c7bc869194aec85b400e3f0a336b4edc3
MD5 02897fe0147532a23b2545ad652e1c46
SHA1 6bda64b2a1741f155deaf178b899ef04aa3e4cf1
SHA512 d35c16dd2a25b972806c0e3b10ea1d7de6de0ecb77d9d8a66fde7d0a462397c96df7e62bea05b3cdbddb81c803b794be98acaf74eb5e9f8f65c603d056f8944a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 31400ef139953c5924f6f6c7c5a41b23c02c97e485a104ff3d94e0686147ee60
MD5 1feec672b080b995c10c3275ffbbc0cb
SHA1 8d756a6df6041adeecca84f0ea43127065ef16c6
SHA512 44b0dd70f90016886bffb9c9ed35c56c6048e3d5c265da7c5cf3b4bd1960044d3e458a41863bb38a4d67d703c1c69a21305abb8cdbaf63a550675c00cca9365a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7616a08c3a5ba026a5016a5321887d8dd32552e5b26d7db989d8ddacdb87a8b2
MD5 433d670361e5a862ac9aafce857a35a1
SHA1 f50729c0daed3a5bceefd3fd4e67012074208866
SHA512 9c4ede7344abb574d491f0ebc7ab2af6196319d52518d28a0a45cdf2e59862b05a6479cc014f9d323dc51fabdbe1224f54bb93c7b4c4d2dc006c8953fcc3bdf0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 404fe8fb705d5fbf824188854e09fc1aad3211ea7f58ffa1a31620e85661dfa0
MD5 69700cb80b9aa89e6fade7621b44f46c
SHA1 4ac9bf1b889f8eb2df3fc6a8bb62452aac9e7658
SHA512 652345808aab7cd6c6a88f1d8f350942f13719d18f2eec8af2b98ed907d71ce4abeaaa48943b01aefd359d9c5d0e3389b1df487205f34342aac65839af53dae6
MD5 SHA1 SHA512

Submit Download

svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCBBCBCBBCAABCCBBCBAACBBBCBABCAAACAAAABBABBACACCC.exe
Size 40.3MB
SHA256 00d9eb3d2148af4dc4c1bdf8972748e7887b051b1cbbebdfdaf8ae0d9f3cc2c9
MD5 c87f7b13963b568af6199866a3405e08
SHA1 4d1c48249e53fd80272b3bce72650c6d4c57c52b
SHA512 828b01200f5128b13bb53b69d9e6bbb6d9ce2cbd006ac398eeef3e7e75b296c8113d4fa3915b2da8255a612ad0eee34dc6ec519e0b5566d3cc94faa2547d65fd
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+EV:vKjKWQckVgtev5mnlNLS
TLSH
T160972A09F94344B1D92B51B04DCFE3BF8A60BB2583128DF7FA4ECB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c4fbbcd2d887bce5755af366c6d56d627eeddb89b1ea9d02deb87c751467b677
MD5 fef47da7d47aac81e2795844565b9952
SHA1 297b4c30a5204e12ac774daac0e6eb13572d2888
SHA512 0ef8a4fc8514f80062889342f185b78733bae936dd8106f7f8ef1b0fcd3f057c6172705ffbb7bd440404e2fec9e29928aa7d8954705f777b011e0e3cf7f467d9
TLSH
T10B112B31D0F5C853F532288BA619DEC21DAD764798EC6A08930A0618FBDDC348D991E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ed4fd1a27c8552ef109f08a5c653310654d9ffbf1c89cd1468e3737254fa55ad
MD5 2393f1451fc598cc0e413f5ff2bd5ba2
SHA1 53fb37372d28aaaf00db80dce930ee3ed6a1f613
SHA512 8a76cf7efa7d7be9dc531c2068add6af6d93acd294d0159b4504c1971a30ae80b0de7a59960ed4b701f229db19250c6d22c7b21f989c5605c2edc18dd0b3fc6c
TLSH
T1A011C331E0F5CC53B63268CBAA19DEC21DAD774B98EC6A08930A4618FBDDC35CD591E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2124-63-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/2124-87-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/2256-6-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/5016-32-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/5708-82-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download