517a937f1dd622d141bd49064bff12e227938c89a5ff9bd43b5ceb6d1be69964

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
Size 14.4MB
Sample260905-2z33fathlb
SHA256 517a937f1dd622d141bd49064bff12e227938c89a5ff9bd43b5ceb6d1be69964
MD5 8575ef9ef4c1ab44904708b620ef4163
SHA1 b6abcee9e24aaba9e0ebbcd3b9ca79f390075ead
SHA512 2f6b6e5a63c540a7b617bd92b5e0ffab96a44f18757c42b0343f238ec3ecd46fe6b795f1fdb954421c4bb7a81340939eacedde019759c789ab7830e54415f679
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+EUe+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+S:LKjKWQckVgtev5mnlNL
TLSH
T14DE63C0AF98740B1D92B51B00CCBE3BF8A60BB25C4128E77FB4ECB5FB936B515819255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
1452	svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe
2160	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCAABCAABABCCBBCABCCBCBACAABBCBCCACACBCBABAAACCCBBBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe"	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABBBCBCACCBACCCBACABBBCBBAACCBCCCABAABCACAABCBABBAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe"	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4576	sc.exe
4048	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2120	cmd.exe
2708	cmd.exe
4480	cmd.exe
3860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3636	schtasks.exe
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
1452	svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe
1452	svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
Token: SeDebugPrivilege	392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
Token: SeDebugPrivilege	1452	svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1296	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 4480	1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe	103
PID 4480 wrote to memory of 3636	4480	cmd.exe	105
PID 392 wrote to memory of 4688	392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe	106
PID 4688 wrote to memory of 2720	4688	notepad.exe	107
PID 1032 wrote to memory of 3860	1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe	111
PID 3860 wrote to memory of 4576	3860	cmd.exe	113
PID 1032 wrote to memory of 2120	1032	2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe	114
PID 2120 wrote to memory of 4048	2120	cmd.exe	116
PID 392 wrote to memory of 2708	392	svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe	118
PID 2708 wrote to memory of 2848	2708	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_8575ef9ef4c1ab44904708b620ef4163_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBCCBCCCBABBABCAABBABBAABBCCACABCCCBACAAAABBACBACCABABBCBCACAABCBBBBCCBBAAACCCACBCACABCBBCCAAAAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBCCBCCCBABBABCAABBABBAABBCCACABCCCBACAAAABBACBACCABABBCBCACAABCBBBBCCBBAAACCCACBCACABCBBCCAAAAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABBBAAAACCCCBACBBBCCBBABBACBCCACBACCBBCCBACBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe" start= auto displayName= "UserDataSvc_ACCABBBAAAACCCCBACBBBCCBBABBACBCCACBACCBBCCBACBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABBBAAAACCCCBACBBBCCBBABBACBCCACBACCBBCCBACBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe" start= auto displayName= "UserDataSvc_ACCABBBAAAACCCCBACBBBCCBBABBACBCCACBACCBBCCBACBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABBBAAAACCCCBACBBBCCBBABBACBCCACBACCBBCCBACBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABBBAAAACCCCBACBBBCCBBABBACBCCACBACCBBCCBACBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABAAACBAABCCABCBBCCBBCBACACCCCBCCBACAABBCCCCCBABACAAABCACBCAABABCBBABAAAACCCCBACCABCAAABACBABCAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABAAACBAABCCABCBBCCBBCBACACCCCBCCBACAABBCCCCCBABACAAABCACBCAABABCBBABAAAACCCCBACCABCAAABACBABCAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBAAABBCBBABBBABBBBCACCBBAAABACABBCABCCACCACBABBBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
1⤵
- Executes dropped EXE
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d8d708541b47d9a487f6f07f38b43a4df80b712fe39c28717d925c92b15fd2f
MD5 4e61c963c5315c091452370af16860b7
SHA1 86c90b0ec9188fe47bafa4704361915864981446
SHA512 7dda8f6e0fff4b921d3ec4d43cbf039c93b8d1b7d9f09042cd1cc0f1ac06651d06dcf640761100192522c3865246a2701da15506da81e7f920cb8bcba0fa1db1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14520e3f8219dcabf530661c20beca2f070e72f2ad97ec6bf1d3f76c64a0f691
MD5 3be0853d900dde34612683b849878581
SHA1 7246ada6233fff867d17054192317c54a6e2dc95
SHA512 c365d8ca0b6e75eb93e39a3a3d6374289dec274381b26e0b5fa0761f73d3ef65f2d62e80b43538970986dd345fc4d7d4fa651d37aad0f375339c9832d3483881
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dacb8fa3c165c177cb8469d16a72573a452ccdaa78459be5be34ee017c29be1c
MD5 45acc0d7e86b77da1f4c94bee13b6781
SHA1 87d500a0cfc69c3f40f0806cadcaefaab04a3020
SHA512 b20b0bfcd204d419c279db234a767a4ec471ce2738d349ba926b1c0b348bcb800ba40606f84ca3e1ca9e5f6152fe661cbbbd412259570e3ea9512a9830097452
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2ca01dbad54487e8d6bd517ff3948555927755cdf556422eda0809a317f1d9b
MD5 b55056d2deb5a377bc787f9348d4a507
SHA1 01cdd960f5bfb8a49a452ba2ed8a051275d99f4e
SHA512 047d57dacf0532c894398d87b3a16c27fd7b62114cd1a3e1f574567be53bec63ba6561eff953a6cc16c622dacb84b1595d0b2c6c82daf2bf528348064f71e0f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 abab98842fe4025660e92f37349e3458beaf1bb26cc379f8cb3b9b905f83a12a
MD5 8e5d37ca8103686ce8f21e6d17c2400c
SHA1 374912d6cf677953a6a85f9656998bd29905c855
SHA512 2686b2b59c24e721d95173125240b07a309e71e4f09d382a90bef640eb028ba8fe8d7d3d1da52743bd1a330f13bc2b816357c318201c8124de700a8245f673fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 793a212f427c1d3d4b4b134ded7472edd96cccca75194819c3b0a110daa32b61
MD5 8d9cc087781ff5f4b99b37481bf67693
SHA1 eee3ba8ce058af91039f9177cc4253979ac09cbe
SHA512 43c1c84d2113649ab6aaeec0da45c71e3b583d35fd7ad72c56ccdbed18eee21954b7231838e8a74554ad5d53aa3ca5fdd333f4dbe1208b9d3e267e4165243735
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1873941595b39e3afa293384e2b2eb1395f93fd649d63363883181046ac688f0
MD5 15cc88b66595476aa6bbab93e48ce1ef
SHA1 071b60804d43508ac663882470af0dbf9721fd12
SHA512 54e618f266d9c30c4ab1df4cc7728946b8b057f23c75e17e0637c9edc09f4714fd67f0125f32293f2c75ff3914f453d065c8c72811cf055593d0848edc720abd
MD5 SHA1 SHA512

Submit Download

svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCBBBBCBACAABCBABBCAAAABBACAACAAAAAABBABBBCBACCBCC.exe
Size 14.4MB
SHA256 517a937f1dd622d141bd49064bff12e227938c89a5ff9bd43b5ceb6d1be69964
MD5 8575ef9ef4c1ab44904708b620ef4163
SHA1 b6abcee9e24aaba9e0ebbcd3b9ca79f390075ead
SHA512 2f6b6e5a63c540a7b617bd92b5e0ffab96a44f18757c42b0343f238ec3ecd46fe6b795f1fdb954421c4bb7a81340939eacedde019759c789ab7830e54415f679
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+EUe+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+S:LKjKWQckVgtev5mnlNL
TLSH
T14DE63C0AF98740B1D92B51B00CCBE3BF8A60BB25C4128E77FB4ECB5FB936B515819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d0a8cbec1305458c9dfd7a9ddd95bd2042ddf7251066d914291733d27351d283
MD5 8c0565ab118978ef64b818c0de7529c0
SHA1 08b5f0a864bce32ac6d54a91c0cc1a2aed269dd4
SHA512 ae5d1824097ccd393e740652eef0e795e530b73b5f58343ce1eb1241e7f2d3bfb686426e4afd3aba398730835fb8b0496845ca97379c68a728e94b9fb144556b
TLSH
T18B11B26AE1B5D853E032A48B9319AFC70DDC3B976C5CAB2433494118EBC4C35CF190D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8e0c20846752b0cad334725d2eec2da2bb34a31f78a05130900809c4ad681863
MD5 711845b3727143b07c056ee3bcb01242
SHA1 399f17d6b29de2e604397cadcab52965280c3fba
SHA512 61bdbaa99b3b5d0ff5913770a1eb043131cad7ac825e29cfbfea8ecf11414839625d76d1242c031ceaed97eeeb48133b58fb1b7f00cb1d7bd6682a85010e116e
TLSH
T14E119265E0B5D853E132A4CB9319AFC70D9C3BA7AC5C9A20234D8508EBC5C35CE190E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-35-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/1032-6-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/1452-71-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/1452-89-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2160-91-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/4688-59-0x0000000002850000-0x0000000002851000-memory.dmp

Download