8a0db2a15289c583c812426f6336cebaac6585e9a84a4a2da5fbc495105a4c28

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 13.5MB
Sample260905-ghkvbavsdy
SHA256 8a0db2a15289c583c812426f6336cebaac6585e9a84a4a2da5fbc495105a4c28
MD5 7cb9135865bc723cee3dfbac455d86e5
SHA1 227fd4859f5cad6a184bf59a17c727c5db7439a5
SHA512 d99cf083d4af2d6e3a395cefa70d1f9121c58c97ea51ee4b6f2cd56f6e54028fed76560621c2b80761b09f8186363c9fb3601d174ab58956c67e433bee40720d
SSDEEP 49152:U+ES+Em+ES+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+EST:YccccccGKjKWQckVgtev5mnlNL
TLSH
T1A8E65C09F98700B1D87751B04DDBD2BF8A30BA2587128DEFE649C76B6933BE16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
4780	svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe
3328	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBCCCABBAACCBBCACCBBACCBCBBCBCBABAABACBABAACCBCBBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe"	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCBAAAABCBBAACABCBCCACAABCABCABCBBAACBBCAAACCAACBCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe"	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2588	sc.exe
2480	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2412	cmd.exe
4552	cmd.exe
972	cmd.exe
1144	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5124	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
4780	svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe
4780	svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
Token: SeDebugPrivilege	4780	svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 2412	252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 2412 wrote to memory of 5124	2412	cmd.exe	94
PID 1960 wrote to memory of 2552	1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe	95
PID 252 wrote to memory of 4552	252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 4552 wrote to memory of 2588	4552	cmd.exe	100
PID 252 wrote to memory of 972	252	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 972 wrote to memory of 2480	972	cmd.exe	103
PID 1960 wrote to memory of 1144	1960	svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe	105
PID 1144 wrote to memory of 3160	1144	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBABBABACBACCCACBBCCAACAABAACCCABBCCBCCBBBCBBAABABBAACACBAACCCBCBABCABACBABBBCACACBBCCCCBBCCACACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBABBABACBACCCACBBCCAACAABAACCCABBCCBCCBBBCBBAABABBAACACBAACCCBCBABCABACBABBBCACACBBCCCCBBCCACACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAACAAAAABBCCACCCCCABBBBBACBBBAABCACCCCBCBCACAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe" start= auto displayName= "UserDataSvc_ABAAACAAAAABBCCACCCCCABBBBBACBBBAABCACCCCBCBCACAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAACAAAAABBCCACCCCCABBBBBACBBBAABCACCCCBCBCACAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe" start= auto displayName= "UserDataSvc_ABAAACAAAAABBCCACCCCCABBBBBACBBBAABCACCCCBCBCACAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAACAAAAABBCCACCCCCABBBBBACBBBAABCACCCCBCBCACAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAACAAAAABBCCACCCCCABBBBBACBBBAABCACCCCBCBCACAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAACABAAAACCCABCCABCCABAACBABCACCBCCABCCCCAABBBBABAABAAAABBABCCBCBBCAAAACBCBBACCBACBACACBCCCCBBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAACABAAAACCCABCCABCCABAACBABCACCBCCABCCCCAABBBBABAABAAAABBABCCBCBBCAAAACBCBBACCBACBACACBCCCCBBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACABCBCABCACBBBCACBCBBBBCCBCABAACCABCACCCABBAAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
1⤵
- Executes dropped EXE
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c79704b6f4ae1bf4448cf0ec6f0f1c69f0938c21e84eb918e944786bc39b9ee3
MD5 7c3a6c0a6858625c198f23c7b837b5a7
SHA1 2015e0a7b22fd7f77e11b88e478462d143033b4b
SHA512 cbd81b1c1682c27b5bc3d2673110ef8dd149a95e2031f82a1a6506a9dcfda6fde2d8e500dd9c27ac7462f0d1954a137980188ad87cc8a3368268194cfa486ad9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6bfe18885ebe1d9d87701792904c57f710e09b826af3a4b71f4d44c9800f693
MD5 fb7fa3436582a87768a25a135c953cd5
SHA1 e0546f42f6c5a75a4761bdaacd1ad2a274fb7ba1
SHA512 e3df9b8313e0b359d24dd3fa785d9d34896ef000fc33b589e1debc390e192ca09e7b9b38c932d22fb17c48cf84fce5c1843d257b2c60742d60655f2e33247510
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 852bae1d1fd6fb65caf18ab2d425335641868404b32eef5ac6711d9db73ece97
MD5 0c3c219aabab864bf89ba3c363e21f6c
SHA1 934f3f9a1826535eb52254d6e9e9856307a9e031
SHA512 904ff2c8d4ff088498f7db947316b7173ef49adf4b39ef4590f53a8c921b98a6928cb674d6f75b842a99474f430b1b270e2c52a4dcdc934a514cb1d4e75af54f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73613c65d24d8b95b6b14967791f2f1c7f4f9edbcafaed4df06697d95f192ea1
MD5 50d95a2054f1541df36e5fc826c29202
SHA1 e30fc9c9e55d22b3592f6197793f9fbe9f1ffcb3
SHA512 027640211f194c108896516fcf26d2ee2edf12f764586f7169775bf8d0f972fe3352d6388bbaa9b7e692adfa9f858ac19f91ddcce289d62ab1806fe995b4b0f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 723fbe614aa09570bc030400f813466a8dacd2da7599ffc0de76ddd8a0e608c9
MD5 6d096bcbe416522ad94c7d064764a977
SHA1 a88d3a5cbf4e0420d7d725238bd36f37d7c0da8f
SHA512 7521f2424442818d369755c52ccc9cfb1d4e07ce08f013756dfac60bdada2010789b5c6fc359ff3956a6540973b447044e7bd928c251079f9967701e5c20a823
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5d519a2a5d411df93c0f3579862046e8fc3e9f927635084b0241e655955f2f49
MD5 8c5b18477c784988da69f62548dbffcf
SHA1 3edc456ea49210e90ad1ee3cd313d452a6fc8a59
SHA512 fe9144039b9b76e0ead940c1139af4bd603248249eb6da3e70ec41e439f6da05ec85388a84e0397578bd3fb4804e85610c9f9dfe2830611b0badf14a5f0e9a74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a6adca261574c1b7953fd0fd33d9eb6d073548a0a6540d505eecaa3c55b57745
MD5 f6ac12fd19084d6d7bf561da12b32421
SHA1 9d097e88d39c32758821b76b9de769b2d9e3c6b8
SHA512 3c87549d2995d9b7d0f3b8bc1e146a280b97df00f968e5ad45baa4dc7702488b0a520bf0bc99bf10a9c22751e610b8aebfc24a240514270f65d521c58e2a48f3
MD5 SHA1 SHA512

Submit Download

svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBABCABABCCCACCCCCACCBAACBAAABBCACCBACCCBBCAAAACBCBB.exe
Size 13.5MB
SHA256 8a0db2a15289c583c812426f6336cebaac6585e9a84a4a2da5fbc495105a4c28
MD5 7cb9135865bc723cee3dfbac455d86e5
SHA1 227fd4859f5cad6a184bf59a17c727c5db7439a5
SHA512 d99cf083d4af2d6e3a395cefa70d1f9121c58c97ea51ee4b6f2cd56f6e54028fed76560621c2b80761b09f8186363c9fb3601d174ab58956c67e433bee40720d
SSDEEP 49152:U+ES+Em+ES+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+EST:YccccccGKjKWQckVgtev5mnlNL
TLSH
T1A8E65C09F98700B1D87751B04DDBD2BF8A30BA2587128DEFE649C76B6933BE16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 50c5fdd76d60ae83edda9810d1562e94b77be1422f863bc9982b77dcb5828962
MD5 7b9748b2616c6ef913ec33576fdea82e
SHA1 23dfb8a8b0f77988bc0e24c961bb43022a350c65
SHA512 387fbc19175ee652c96380324646260e27fd3c15056aa20521c381e9ae734ec1e259de1cb4a3a7ceef51141e96ee7e61e87eaf9609a11db947f0074296044b39
TLSH
T11011C451E0A7DC63F17128CF5525CAD708E47B8B9C58FB9463480218BB15C39AF164F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 21100b89289c9a0407bf90b90749bcd7386e47acb36976a9760a7e26238ef817
MD5 1d7519b7f7c18e9cca4dc2575b4fbc73
SHA1 6f5e4db8ffb949e6dfd0360477aec19cb09743ab
SHA512 85001efda811771c3b69cebfb742aacba280f73da275d24d31f6cb858f491c655bf544b928085500a5116df56799ec45b4fa3b76b10d4a9d7a477756e557a5ac
TLSH
T1C611D821F0A7CC63F17268CF5525CAD70CA47B8BDC58AB84934C4218BB55C39AF164F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-6-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/1960-32-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3328-74-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4780-67-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/4780-87-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download