bafa9e763ce3aa20af081397a789aeb42b989964158f4400c3caef0edaec67bb

Analysis

max time kernel
151s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Size 51.9MB
Sample260906-wwpgzscf38
SHA256 bafa9e763ce3aa20af081397a789aeb42b989964158f4400c3caef0edaec67bb
MD5 c69ee67de2737f7be6370bcefad618c8
SHA1 f14c96a1a7b3648e08fa28b57476ac0077c3e54e
SHA512 bbeaa4cb6e6ce9b2337451cba17bbc32036c1f6f3273718028747edd0e05353c51692334bbbf0a3ec99e981dae7d994e1a61f3eb4c437b3e3a59e31be650267b
SSDEEP 49152:U+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+Et:Pp7Jp7Jp7dKjKWQckVgtev5mnlNL+
TLSH
T128C72A09FD4340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
2664	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
4612	svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBCCACABCCAAAAAABCABBCBABCBBABBBBBBAABBCCBBBAAACAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe"	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAAACAABCBCABBACBBABACCCBBACBCBCBABCCACBAAAABAAACBCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe"	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3416	sc.exe
2508	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
364	cmd.exe
5764	cmd.exe
2768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
4612	svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe
4612	svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe
2664	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
2664	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Token: SeDebugPrivilege	1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
Token: SeDebugPrivilege	4612	svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe
Token: SeDebugPrivilege	2664	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 5764	468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	92
PID 5764 wrote to memory of 4116	5764	cmd.exe	94
PID 1584 wrote to memory of 712	1584	svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe	95
PID 468 wrote to memory of 2768	468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	96
PID 2768 wrote to memory of 3416	2768	cmd.exe	98
PID 468 wrote to memory of 364	468	2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	99
PID 364 wrote to memory of 2508	364	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_c69ee67de2737f7be6370bcefad618c8_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCBCBABCBBACCACABCBAAABBCAAABBCCAACBABCAAACACBAABAABACCBBCCABCBCBCBCACAACBBCACBACBCBCACCCCBAABCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCBCBABCBBACCACABCBAAABBCAAABBCCAACBABCAAACACBAABAABACCBBCCABCBCBCBCACAACBBCACBACBCBCACCCCBAABCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAABCBACCCCCAABCCBABBCCABCBCBBBCCBAAABABCAACABACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe" start= auto displayName= "UserDataSvc_BBAABCBACCCCCAABCCBABBCCABCBCBBBCCBAAABABCAACABACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAABCBACCCCCAABCCBABBCCABCBCBBBCCBAAABABCAACABACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe" start= auto displayName= "UserDataSvc_BBAABCBACCCCCAABCCBABBCCABCBCBBBCCBAAABABCAACABACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAABCBACCCCCAABCCBABBCCABCBCBBBCCBAAABABCAACABACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAABCBACCCCCAABCCBABBCCABCBCBBBCCBAAABABCAACABACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBACCABBBBBCBACAABBBAABBBACABBABBCBBBABBAAAABACAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAACBACCCBABBCBCBBAAABBBCABBBBBBBCCCABCCBCACBAAACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e4c5467d3a9c2d615d53bd3ab7ed1de8969bd9473d2f263d677ae14e5460b3c6
MD5 954bc418b51e613576039084a1e416ad
SHA1 de8bb9034f614fdc8463fba1de4d68bbff7d7e56
SHA512 4a4ad5d4b3a1d7683d9391d7b1c46df8dd1c284831faefb4e12c5c7e88439f0623eb226a7ad57b0caa408d541db85ec0cfb1e88defbf117990a35f65b93f737c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 f9c9a16bca87beb3bbea3e01e3b58b1d2c3b782302097083aa7b467cdfa5961c
MD5 ffcf756ca1a060b9749e1b9554c433fa
SHA1 15505d67bffb41098d2574a7f9a768d43a2592db
SHA512 a23ead2aa44ff53cf37e4b39c39300f0c10a7f49b04fb7979c01b4f7c19d1b83ebba0ea0ab53dd3dce48c7e32fa1cfce2ffc1cd64c975e4eeb858448639e6bfc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 ecbb010aee8aa147e57599b771d84ebd1dadb8209094585400e429d887cc0efc
MD5 0efab7d68b3b84eb3b24044ca962954b
SHA1 e6347b5f5b67a6aa3015dcad9dbb3c00d25d0f1f
SHA512 918896083019985d793097b4d1b7d2c99937465ad5b5ed63235154d2be6ce14af1c7416eed2735dd36641932a96a86a442d0a7c2541252066cfd75a346c64731
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\qap`g`v~dtlq
Size 10B
SHA256 01e5f6164f57f896c6fda6f8d921d2cc452c7d440999ed0dc08f9dca6df4f1e2
MD5 41d8abf05bfbf14f13d5b179e6e6fbd3
SHA1 0b1bbfbc0037d3cfefc52158b641b7f3f15fb932
SHA512 6a92c65281f41a48d1b9213fcec1ce40872b90d52bedd17d5e01e07ff4c9945a81050dcc834548801def84c5ed72a8c31872c00703587732862cb071860553be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce58b664d388dde2b9aead4a456d3524d2264ff67635dae28249a99088063042
MD5 0b88929104449a40af13b487183b6034
SHA1 6ab2d16ca85762783e6a4e06c1f5c836353a72d7
SHA512 83622b345f93e60c1f90c1359e25b86cf0791a27a75456e21cd9e1401c2022246da791cdefc4c488884fd184325afcc952a87c2e6c992a17e781944e39330593
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d6ad6a74581314fa0706ec7d5602e5b22c1e4bf01eef8b10515b6bc174edc0f
MD5 f8ec4c8bb6764533b75362b2bd2d51e3
SHA1 99e66d9dc565e8f744be94c62a670ac69e8e5079
SHA512 1299ff65acd32bc56cbee4c6e3e474ee9604ca9e62e93f776c16e69632fad3afe9a958f2e93690ccd4f7b92085c3debb702e9a7c7c42736d5dddffbce33b5782
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1463f365bc5621461ed3ffe758496f36e8c006d3d75b4ffceb59ef3caa694b00
MD5 eaf8e64508fcc08b23397ad87deb08d6
SHA1 030d70f9bd5d71adc7b66d40499bded5e8ef4d09
SHA512 56ce6674484c959a1c5f9e5b2e5c103e5ccd82940d61371eb006b3c595b10bfdcea66f210247ea07e3c9e87fab55b94b1a552f50d916bec4826fc80ca5f76966
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f5cdbceac85f3e791bfdc1b3fd98eee2103ccec74e0bab2b4dd192ea44ed9990
MD5 0139acfc545eb2e4744f98aa1e764f20
SHA1 d762c5ac97b076be076ad5cc29a6efe00b153b4a
SHA512 3d30baea59f98aae831f087be5114559984595933bef2dc924c6571d1d3acad57970887293b5e888e4bb869503236b94efe8743de4aa15cf89259cebf85a93c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c74f38139a9c745ceaa3a7d695fcb7d5ffc9672e44684954956ecaf061dcca2
MD5 900ada9aa7eaf8e678f9fb9a19babfd8
SHA1 ba3943c25cb00edf2666dd3058ef5914bace634b
SHA512 258a7532cc837f58ab1995f9bb41adfa76d3bc6278bb218b068a25e6dfc30fac0525af6c66f9cffbe0fa7d44846ec2a30a9ad3ac09bb7a122f33d8a8a0c16ba9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0dd05adc69e42df44d01e41c7ac19c5094879c1df734708972faddd7f3bb9211
MD5 f4158ded253c7dd2d6d111f16e9ee9ff
SHA1 a08470a4baf5936de17ac53273d201ab8d0c5c37
SHA512 35c33c0397e804f2606929cee8c92067d201be2ee39763342f3328ad16f589ae624cd8f34d41e26808b035f5d6f125d32df51a7b95f242bed22c34309b87d1f2
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 775c9f867cf12ddf6a65960271c23bc4d000d315be1dba0290edc3cb78daff05
MD5 9a1aceba64bdaa19aba7728fd05c84ca
SHA1 2c5d5f7973819fac6f8dc06ea903ea86bc7325f7
SHA512 4d80bbb8b57cf1cfe44a81165806572c41bc0a61a700b35e011069f645d4fccc63c8868c574807499af4d924d1ab2c235ed2483d1723952c638e874242f8880a
TLSH
T1B1119855A0A9D8F3E0316487A739CED70C9C3B96A95CEF2423088199B7C5D346E1D0F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 75cb6de24a1e2a997dd93549d0c8cb72f909802819122be591949b536f858841
MD5 fba5cf8d90ad6a1cce1a080e24a130e7
SHA1 10826c30ff47470f874129929de7fa6f30fc1e80
SHA512 f871f90d9855a9c2c41f487537efaa205b337f5d36b2870da18ec2c9a1bba89e67f2500fe8efa333f6a01db4be8ea76b46597a615f09a6af7b5fde29a7e49414
TLSH
T15421A755A0A9C8F3E0316487A729DEC70C9C3B96A95CEF2423088199F7C9C346F1D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-6-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/1584-35-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1584-22-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2664-311-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2664-75-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4612-81-0x0000000000690000-0x00000000006B1000-memory.dmp

Download