89cf578ba8ea1ba010c1a5ec06ca6fa28115e895e97ce1be2f82e23a4bded93e

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 7.2MB
Sample260827-ghctpsdn2v
SHA256 89cf578ba8ea1ba010c1a5ec06ca6fa28115e895e97ce1be2f82e23a4bded93e
MD5 f0b6661d2b0761355387275b7194a7a1
SHA1 330bfcb9b1911667cc02fb90fabf9ce189231cc1
SHA512 ba9815fca3e8d8b5351931b52c3932f37d84d51849f9afac1703b4761e51d4f0cad5c56f661ba1cd8129b615c89eaaa16c29347823898753c9743614e9d16c11
SSDEEP 49152:U+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatB:eGGGGGGGXKjKWQckVgtev5mnlNLd
TLSH
T137765A06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
5596	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
5328	svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCBAABACBAABCBCBBBBBAACCCBCCCAACABCABCABCBABBBABCCBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe"	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCCABCBBBBCCBCCCCCBBCBABBCABBCCAACCBCACAAACBCBACCABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe"	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3912	sc.exe
1208	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6068	cmd.exe
1984	cmd.exe
2040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
5328	svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe
5328	svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
Token: SeDebugPrivilege	5328	svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 6068	2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	96
PID 6068 wrote to memory of 852	6068	cmd.exe	98
PID 2852 wrote to memory of 2768	2852	svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe	101
PID 2672 wrote to memory of 1984	2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	102
PID 1984 wrote to memory of 3912	1984	cmd.exe	105
PID 2672 wrote to memory of 2040	2672	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	106
PID 2040 wrote to memory of 1208	2040	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABAACBBACCCCBBCBBCBCAABABAAABCCCBAAAAACABABABACBCCAAABBCBBCCBCCABBBCCCBACCBBBCBAABCCBBAACCCACCACACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABAACBBACCCCBBCBBCBCAABABAAABCCCBAAAAACABABABACBCCAAABBCBBCCBCCABBBCCCBACCBBBCBAABCCBBAACCCACCACACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBACCCAABAAACABABBABCCCAAAAABCACBCABCABBBAACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe" start= auto displayName= "UserDataSvc_CCBCBBACCCAABAAACABABBABCCCAAAAABCACBCABCABBBAACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBBACCCAABAAACABABBABCCCAAAAABCACBCABCABBBAACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe" start= auto displayName= "UserDataSvc_CCBCBBACCCAABAAACABABBABCCCAAAAABCACBCABCABBBAACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBACCCAABAAACABABBABCCCAAAAABCACBCABCABBBAACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBBACCCAABAAACABABBABCCCAAAAABCACBCABCABBBAACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
1⤵
- Executes dropped EXE
PID:5596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBABACCABABCAABBBBBBBACACBBBAABACAAAACBABABABAAAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 21.7MB
SHA256 67b8b2379f48be5eedc03246cb66a60ed924b6c2258b831ef992ef091ad6f99a
MD5 b7412fed65a0316cd040dc123354b830
SHA1 6a728126410a6e2bdba1c59aa53a0fdea9022254
SHA512 8a9e6b672348cad4fb7cd13cb643208551c55a949b2b0f1c0f2dd79b42c61d18656db48b7e96b1ad4e554d08cd12ace1654902a9db7b6d9564ffd11df18117d6
SSDEEP 196608:MKWQc0gEYnvLSKWQc0gEYnvLSKWQc0gEYnvLdO:FcZEIvHcZEIvHcZEIvo
TLSH
T148375B06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 1.1MB
SHA256 3e0853de3bb7d8625303f947b6f83aafd40e90bff444b921f340711eaeca5c67
MD5 73a1e9d344fc09e09b85666c295f59e9
SHA1 8df934e31b8645be31df3d9db80aa63ca8165895
SHA512 f34a1fc644f997a8d8f63cd2258fac6ca4102fae6cec2984f773bf4bb43e09b1c5709e36c203cbcfbdaf59dcf584e2b1d23ef012e008fc85656e5b9814fe24f2
SSDEEP 24576:m9+EM0akxqatgl8bI4Tiw2T9+EM0akxqatgl8bo:U+EDqatglRMiw2J+EDqatglX
TLSH
T196354B46BBC985A2E467123148A783A79BB1B8115F32D7CF6384933E5F337C0AA31B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 448KB
SHA256 ce0e5d99979c082bf7e808d18f207b2f8dd43bb5a7f722387131e6c50d002980
MD5 8da183cc3d27a4650b3c99f85184dad0
SHA1 dffd201b33ad5f6e734f889a251f0b34a7ea53d7
SHA512 8bce621bafa907d6c6b8bd5b4b9ce5488bbbadbc22bfe9586674f88076c38a8bba02f9497266d33fde614bb6fdf11031c93d337aab4b6f63c5ade011998677e2
SSDEEP 6144:m+dTTUFgEs3XojAdTofOiYlrOFzojDuUlMtq10Q8m7NNqM9N+hN1UFpfNS5iXjDR:mgUFgEsnojAl+ZeDuUlEqatglsLbIxL
TLSH
T184A44C86FA8681E2D4260231486743B75BB1FC115F26979F6388A37E5F337C0AB31B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6af6a6d407b1f3f3414e03e9419dfefc647d1f1825f545b6039874aeacaf0d14
MD5 62858377c7404999a65ba747fe51214c
SHA1 2871a24b3c4cb6ff8b822e7b42bce5503bb55a9a
SHA512 d98ae5406b7bc0736229ee95bc110f5e0054872ac4d93db6451ae5f2ea3160fb2b8ef375ba6c2b565bf91c0d6853f331c146d778e5a18d3f14266c935437b5fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfd836592003dd696b746cdfaef56fe68a52808d04400f22e3e77bfd869875e9
MD5 7f502f33c9fbdb50f8f4d06a82bba81f
SHA1 fc7567b76c5a9b4657a8890d22a7962ba910bcf1
SHA512 9046b3905054c907c874014dcf15e2051b4b81ebf8bae83d1c62f7e3d21b9d316233c1a4bf31bedec8e081fcc5d2b54b3e4475b361f7a1ec51dd89e580d04120
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60523c81f4bfd08efbf577e4845294dcc79bd4f3ed16661e747922f6f7be68a7
MD5 7b598df60f93c2e398894e923ea45b1e
SHA1 31af75978abd1a2cb079b8b3181f389d75bd96b3
SHA512 a841c291a8bbb0695282e3873ca21047a557269ff2f63e1f45333f437600290afa9a94175e201f49814f01573663fb0dbe94cbda3531a70294786239f6b64eed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37979356d3f5a702f8071c4f5aa0de62ae141d986f7d8da802d381050511e613
MD5 51f1f5a0457efe5bb3888a30f0f5e234
SHA1 0e873e84e8c2ef8bc9faa6784409fb036e637e5e
SHA512 8d88864bb02fa08dc741ac2f8547fca067efe37994dd8787bfa01069c963735abaa13db57766c2c38969a940baf371a43822bf8b53ac2cb2fd09fc29acc14842
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d83189799e6e4e0776ae6dcf5426ae22acc93c3809b3b6486b85415258d9ce8
MD5 89d410ad79d273526aaee87f1f710ad3
SHA1 65bcf1ffe870cd2862265ca88928c66ed73a03c4
SHA512 0597246329a7f44c97b69808ede4bb7126037a1d29b4119c01a452d3d733e422e84fa274d5ffff3c087e1908dabbd2f6aa1a5f82ecb90857e4a402a387797873
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60bd809e1c371da2655266818b962abfafcd5be8d454bd6af68d1b75bd12fe8a
MD5 23d5db4f17ed4bf1253791f9c1845009
SHA1 8fb05af60cefec549f0d6b0e9c4363be1f06b0db
SHA512 eb9cb13c5c7c4576f64177489d2298016ae0735af89a8581b5df850a78af90bd301bd4403c7c1b5738d038ae970e6495175363d19613a8ef513f80f8696d7583
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0b112dcf19c9d49444a9cfad4f472145e346ba84f13507f3e9b05285f3054f7b
MD5 1edae5b6159b7e38e515e35b6c8c6edd
SHA1 fbf05c5d6f502dd36c1f1b43f32da776d7712274
SHA512 9acf4e0ee7b7a0453a3c6cece35adf5f32735e9c1d9669624d76ac743660b7c63bf3bdf246037521e0127f8f1fcc00c81ad1f5a67971712f5764083b058e9151
MD5 SHA1 SHA512

Submit Download

svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCBAAACABCCCABCBBACCACBABBBBBBABCACBCCACAABBABCCA.exe
Size 7.2MB
SHA256 89cf578ba8ea1ba010c1a5ec06ca6fa28115e895e97ce1be2f82e23a4bded93e
MD5 f0b6661d2b0761355387275b7194a7a1
SHA1 330bfcb9b1911667cc02fb90fabf9ce189231cc1
SHA512 ba9815fca3e8d8b5351931b52c3932f37d84d51849f9afac1703b4761e51d4f0cad5c56f661ba1cd8129b615c89eaaa16c29347823898753c9743614e9d16c11
SSDEEP 49152:U+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatB:eGGGGGGGXKjKWQckVgtev5mnlNLd
TLSH
T137765A06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d0b969ce133aa99465b3f5637bb5e3ff145425850f6654ef73c32f5ffaa61302
MD5 442862d6f38567eec08500fed089e978
SHA1 f67dc9e316c71e82ec961e8d3a31d99b1c2963f9
SHA512 8880ca33871a0a0e2dbb625ec040c93d2f8cd5cb5e3e7d381fd2373c7a22016d15ba01591c7c12ac969508653cff6270837f2eb624deaf883bcdea84d56dc8f1
TLSH
T19911EB7190F6E487F57338C7E316E9C32CE8755B689C7A54230A8218BADDC31CD560B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2672-21-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2672-33-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2672-59-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2672-10-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2672-84-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2852-32-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/2852-71-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/2852-49-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/2852-110-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/5328-109-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/5596-101-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download