c0d1f19935e3bc08bf091f7f50f31e2d17635aeb74f465a0cc6a7be308dfc7d2

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Size 30.0MB
Sample260901-2bbchsswf1
SHA256 c0d1f19935e3bc08bf091f7f50f31e2d17635aeb74f465a0cc6a7be308dfc7d2
MD5 02d69a86ced6eed2d748061d3863b312
SHA1 fb9ac97268cfcec2cfd632bf6813b5bd110706d8
SHA512 6ae89d5078eeef12d6d7b36f9443636e218641efd61f8417c03bdf8b0ba56baff05f684f4c28d64834608b6562007556201ba1f97bf022a23b5dca34ecc601ba
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Egh:JOU/jIEeQfoR/IuOFVjUu5e
TLSH
T1F3674B05FD8684B1E97B01704CDBC2BE9530BE258B128AEFF689E72FA933BD15434615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
5332	svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe
3384	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBAABACACCBBCBBBCBACCBABBBCAACCBCBCCABBBBABCACBACACBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe"	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACAABCCABCBABCCCBBAABBABBACCACBAACCBACBBABABBCCBABBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe"	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2504	sc.exe
1932	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
788	cmd.exe
2364	cmd.exe
5324	cmd.exe
4556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4344	schtasks.exe
5280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
5332	svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe
5332	svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Token: SeDebugPrivilege	52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
Token: SeDebugPrivilege	5332	svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 788	1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	92
PID 788 wrote to memory of 4344	788	cmd.exe	94
PID 52 wrote to memory of 4824	52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe	95
PID 1132 wrote to memory of 2364	1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	98
PID 2364 wrote to memory of 1932	2364	cmd.exe	100
PID 1132 wrote to memory of 5324	1132	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	101
PID 5324 wrote to memory of 2504	5324	cmd.exe	103
PID 52 wrote to memory of 4556	52	svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe	105
PID 4556 wrote to memory of 5280	4556	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACACABACBAACCABBCCACBACCABBBCCCCBABACCCCBCBBAABBACBBAABBBBABABBABACAACACAAABACACCACBAACCCCCBBAABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACACABACBAACCABBCCACBACCABBBCCCCBABACCCCBCBBAABBACBBAABBBBABABBABACAACACAAABACACCACBAACCCCCBBAABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBAAAABABABAAAAABABBBCCACCCBCBACCBABAAACABCCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe" start= auto displayName= "UserDataSvc_BCACBAAAABABABAAAAABABBBCCACCCBCBACCBABAAACABCCBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBAAAABABABAAAAABABBBCCACCCBCBACCBABAAACABCCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe" start= auto displayName= "UserDataSvc_BCACBAAAABABABAAAAABABBBCCACCCBCBACCBABAAACABCCBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBAAAABABABAAAAABABBBCCACCCBCBACCBABAAACABCCBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBAAAABABABAAAAABABBBCCACCCBCBACCBABAAACABCCBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBBCCCCAACACAAAABBBBBCBACBACCCACABCBABAACCBAAAACACCAABBCABAABACACCCACBCBCACAACCCAAACBCCABBCCABBAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBBCCCCAACACAAAABBBBBCBACBACCCACABCBABAACCBAAAACACCAABBCABAABACACCCACBCBCACAACCCAAACBCCABBCCABBAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCABACCCBAAAACCCCBABBBCCCBACAABCAABBAAABCBCBAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
1⤵
- Executes dropped EXE
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6b3ecf7a5a3e973e0cbe3d4b9e9ba0a9f68224b3c4ad53dc91850ab2816658c
MD5 eb879c2d2ad53c3a25828816d1872b78
SHA1 ef3043b34d06acf1137172aee11467c51d0d34db
SHA512 88eb5881a99db6b179d4171d7d36240c566540367bb0abbf2357dedc35e7325ce78c5cb861a92fd41859fab63b491bf393b1178d38d2b5e8fa97bcb804fff12e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4216136ea0fec2300b6bb7621234db3973d403310c8a1186dcde92095c275dc
MD5 915702940387a5abf2bf45e865fa712f
SHA1 aba39592a169fe5f1be3bda44dcad725408d3fe2
SHA512 f96a3cca6e0ae30a15218206dbee100976bb9423782693ac6f1c52c6cc3daa02d35908108d0b5e4501726b28de390785542df4ddadb4da846446cae4a1c1263c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 abcb791c98a21b794810aca242a0019bf41f347d01842a42d547e5e593657a28
MD5 a01c3e8b6bc444a0f41c0c42c2079b04
SHA1 b1a8145363996c7f0f3e669e317d6e765eb3c7e2
SHA512 3d88db1894825ffc725fc7432b6b5ad05fbdd51100a9e1a3f2469efe697b9bcc00945261531ab3cba1a3e60c54cc0c39f04d60431af47c60ceb1993644c0eb2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b3fb92775a68f267ef4b4cd26749d832159917055fd3fe389b7ca15df3fb2e74
MD5 1e6d8055da78423695339675fcb9524b
SHA1 dffe43e256839a3939a42c9a7297073d34997ab7
SHA512 1cc232356c5a02af3178bc990dc67bf78378356fde4cf52df6330eac864f76c04b931695d16e6f095afd3b64a439b50cc225d729fd22b2d2bb0ead5a2146505d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8e3d6ce0726ea3ea8a8bb9c31ec0a046ab8f67b2ec55f3386a10600dd175c2b
MD5 bd3feaf2ecad0e6e6cf1356d7b2565e0
SHA1 163bd2b12eb42a8162601e5f1d720490040bc2fe
SHA512 45fb5f98891628826ad420fc170eb2ed30c6dac35897f8b3d1ca3819dbc419ba82341bc76e4a3b58f0d4150f394a8e89147f5eb47b2e7977ac33cc6f403fd9a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12eec33b56da9b5be7ad8f50946d0536307e9d97366687f63636f80218607c71
MD5 f4dc53e289fa54e08e7c8f820fc12b98
SHA1 62a074e8b4f60c7845aaa84ab3e90be46778dbf2
SHA512 5e323aaba4439c281a2def98f7574aec828a8d306e22211334251bb91d423c9472687c8a90507e400a1deb28bcaff0c31a25414c291c72c013f9141c41add577
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db99d4beee6c8ecbbf430138cc2a8b2423cf6d5be3b80a315ecc4d77d9400bb6
MD5 ab9ad4414a5dc201d568da9b1f6b800f
SHA1 b927bccf7983f7d8d22de38ffda2bd8a975ec2bb
SHA512 837da3a833289750701c9361d83200c2e89241c10f67ee4696712d56d11abcb43a371f6f7d1fd45170de5365a151edb16a061ec3f6aa7c4d8e77f05d90a2940a
MD5 SHA1 SHA512

Submit Download

svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBCBBBBBCBBBCBACACCCCABCBCCAABBBBCAACBAABACCBCACAC.exe
Size 30.0MB
SHA256 c0d1f19935e3bc08bf091f7f50f31e2d17635aeb74f465a0cc6a7be308dfc7d2
MD5 02d69a86ced6eed2d748061d3863b312
SHA1 fb9ac97268cfcec2cfd632bf6813b5bd110706d8
SHA512 6ae89d5078eeef12d6d7b36f9443636e218641efd61f8417c03bdf8b0ba56baff05f684f4c28d64834608b6562007556201ba1f97bf022a23b5dca34ecc601ba
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Egh:JOU/jIEeQfoR/IuOFVjUu5e
TLSH
T1F3674B05FD8684B1E97B01704CDBC2BE9530BE258B128AEFF689E72FA933BD15434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cc4614164705f5c3cc841eff2837d8122152cdf62858f6ba56381371c78b74ce
MD5 53526e7d27c7c0a73ae86c64dcd3027e
SHA1 d242d611cd2eeef175b3dc958dd48ca4f76df881
SHA512 474e36aabb92fb2c35683171ba5978a26e1ff04fdbc2aef66986b900a5005816d050b2196077e01bbbb39e980834a08aaa2ee488eb2e756a1e3d95c499d451f5
TLSH
T14D11C46170F9D013F2333CC2D235EADB5C953BDB6894AB9C2B4C8118A745C698D16CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 aef7fd7830026e0e2d11da64d0e6a8dedff8252c6255fa94f8eea98b19f0af92
MD5 d39aa7d2af4c9298f9f04be1b9cdd07a
SHA1 a129271a18d7cb93d799acb9b9e700aae921dda8
SHA512 816c02d3872c970391c0daa7f6ae7aa268a16047e9e364632400dc4a5d8d4501017da5ef09fb0c2c77228797465404b5d1e217849b77a5ee3a230ad6d160f149
TLSH
T17411653170E9D427F2236CC6A139FAD75C953BDBA8989B482B4C8118A785C798D16CE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/52-33-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/1132-6-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/3384-82-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5332-63-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/5332-87-0x0000000000710000-0x0000000000731000-memory.dmp

Download