d30c6e7aae8c5da622cd8f712c9b6edd9c81abbbe84c5efd11730c407059aab0

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 11.4MB
Sample260907-2nyctavyas
SHA256 d30c6e7aae8c5da622cd8f712c9b6edd9c81abbbe84c5efd11730c407059aab0
MD5 5260059421b245fde4a98e67b26d47f1
SHA1 b4f0c3ac7503650dbc08d1019cc79317e61d35af
SHA512 fddffe81220ef7fc7d60ec27112afe88df523ec984404bb7f54a87b47fa98e636aa24b8171940d824990f951ec6514019dabece4d2155af3feaa33f5179ab5f1
SSDEEP 98304:saa8aa8aa8aa8aa8aa8aa4KjKWQckVgtev5mnlNL:QKWQc0gEYnvL
TLSH
T17CC67D49F94650B2D82701B14CDFD2FF4670BD208F128AEBF689E32E6933BD05636695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
2032	svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe
4568	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACABBCACAACCBACABACCBBBBCCCCBAAABCABCBCCBABBBACACBBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe"	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBACCCCAABCABAAAABCCBCCAAABBBBCABBBACBCBABBCCABACCCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe"	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1320	sc.exe
828	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2068	cmd.exe
4512	cmd.exe
2428	cmd.exe
4748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2260	schtasks.exe
5636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
2032	svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe
2032	svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
Token: SeDebugPrivilege	2032	svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2068	2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 2068 wrote to memory of 5636	2068	cmd.exe	94
PID 708 wrote to memory of 2280	708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe	95
PID 2532 wrote to memory of 4512	2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 4512 wrote to memory of 1320	4512	cmd.exe	100
PID 2532 wrote to memory of 2428	2532	2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 2428 wrote to memory of 828	2428	cmd.exe	103
PID 708 wrote to memory of 4748	708	svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe	105
PID 4748 wrote to memory of 2260	4748	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_5260059421b245fde4a98e67b26d47f1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCCAAABAAACABABABCCAACAAAAACACABBBABBCABBAACAABBAACAAACCAAAACBBBCBABCACABACABCACCAACCAABBBBCACBCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCCAAABAAACABABABCCAACAAAAACACABBBABBCABBAACAABBAACAAACCAAAACBBBCBABCACABACABCACCAACCAABBBBCACBCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCACBBBACCCACABABCCABACBAACCBAACACBCBAACBACAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe" start= auto displayName= "UserDataSvc_BBCCACBBBACCCACABABCCABACBAACCBAACACBCBAACBACAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCACBBBACCCACABABCCABACBAACCBAACACBCBAACBACAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe" start= auto displayName= "UserDataSvc_BBCCACBBBACCCACABABCCABACBAACCBAACACBCBAACBACAAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCACBBBACCCACABABCCABACBAACCBAACACBCBAACBACAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCACBBBACCCACABABCCABACBAACCBAACACBCBAACBACAAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBCCBCBBCBBBBBCAAABBACCACBBAACBAACABCACCBCCAABCBCBBCCBCBBBAAABBCCCCBCCBBCBBCACCBABABCBBBCCCCBAACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBCCBCBBCBBBBBCAAABBACCACBBAACBAACABCACCBCCAABCBCBBCCBCBBBAAABBCCCCBCCBBCBBCACCBABABCBBBCCCCBAACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBAAACABCCCACCBCCAAAACBBBCCCABBBABAABCBAAABCCCCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
1⤵
- Executes dropped EXE
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1887fea1f638f73ba462d334ade7711722e3454ddab6f333df246ca5205bb76d
MD5 64ed73c749d49c856272df17e84d036f
SHA1 78c391a58f8bf2824dd886c5a02ff0dd11f73224
SHA512 fd7725ff3a6097fc2105785ba5301d94f935aca9d1156b1a5c4ded2c7fddc2747535098a97ff2e57428a86e2b253cd23e2cbc16c828db180e27631da58a77c33
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32fdf9fe79a41abb77f600b3e62c0124da1190966b6da4d8c89a1c1216809cbc
MD5 ef029cdb94f2558f2424895eaa5125c9
SHA1 f4a370ccac5606db4cb1942d7ee33e2dcaa188a3
SHA512 0a24d7915472566e7dd97919af1a4c2650426deea21e87dc0ec1b45b3fd7f396e6a84b65be916480f690ff8f8ef77cc1b933a9acb58a5ec512fbfeffb56a376f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d4096807c5f517d97204cd5819f6485639d8baa49a015be7a195769e1fa9f4b
MD5 e029076cd61e09bf6af3515c366a07c5
SHA1 e10782fa8f215af9833b747c8d53ffeca889aea2
SHA512 1aea71d7bd4578b93a0d746c36f848940a387e7973a77028e333c0aeb6a626607f7eb801b2c9fa8b1ad6cb555919ac19a8a2ff5e5373d2650f1ea24c592b2596
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db87dd05b26d46d7c99d0f2659600bd873cfbe85372edf64b35ed4caa0ea78b4
MD5 a2b14fec17ba042f93b43183b3a6be93
SHA1 6133865e048a4813d6af991bbffc77361465644a
SHA512 67b49be039aba038c6a98b9e85e0f6a6151f18cfc3a082279df2315c1f98e171b78d8b15b2f4f56255adb1ed74df173a88a0e6ba64b347195e69f972b0f6a4cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 649ad4b2104c204b4cba6b2bdfb4e8576e3f18a71dbac0e7a9f11c3b816cf8d0
MD5 4a493788b40ed0c48baec1672bf3930f
SHA1 869d3e66b2ef5572d455f259637c47f2f8810259
SHA512 70b0a089d6a6d21c867320104593d91df5813b28ce2d815c5742caded4183e97bbbacddf4b9cee7e1091fa67c5819b58ac5b8ee8cf83a536be9b2adeb5969014
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5acce90dbcea1badc4ab0bdb348900aa1683bcae3efd0a63dceae19f8c6dfcc0
MD5 51dc4f68dc25adbeee71a3aebfef0e47
SHA1 55e837787170accb59e28f517cdb4f174d309d1e
SHA512 7805f36ba9b9db68ec84886f1e5e5d14ece937592f5efaab65d720815706dd8000dafd8a070e0955c1caa6cd17f6f7b4592b419533be812924117db010ef8a8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd7eb146f42afe9d7522833e68c26ed5876e355ec0b3af842627e95620140d3f
MD5 d23845aa3b891d19b98444c9aa9b3553
SHA1 68ec4401436627127bb3aa2c90d8703092ddc06e
SHA512 e14e0ebd8d127898bd9387dc48ea621c789fd2301a4b5e457e4ae1f41356c87e95f39b12a2c8ad47b971a81cfc4bb27f13b4b13b29e5c508cf27e049b82eb6d2
MD5 SHA1 SHA512

Submit Download

svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACBBCBCBAABCCCBAACBBAACBAACACABBCABBAACBBCCBAAABBB.exe
Size 11.4MB
SHA256 d30c6e7aae8c5da622cd8f712c9b6edd9c81abbbe84c5efd11730c407059aab0
MD5 5260059421b245fde4a98e67b26d47f1
SHA1 b4f0c3ac7503650dbc08d1019cc79317e61d35af
SHA512 fddffe81220ef7fc7d60ec27112afe88df523ec984404bb7f54a87b47fa98e636aa24b8171940d824990f951ec6514019dabece4d2155af3feaa33f5179ab5f1
SSDEEP 98304:saa8aa8aa8aa8aa8aa8aa4KjKWQckVgtev5mnlNL:QKWQc0gEYnvL
TLSH
T17CC67D49F94650B2D82701B14CDFD2FF4670BD208F128AEBF689E32E6933BD05636695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3a7a0b61fe6788814edecafe663d4dd5d21e7dfd2495967cf25eaca63819b011
MD5 2c16ef7eaeb0ac34c30e925b83129f36
SHA1 b31eac8ab6d10776a2754cd43a8f1955317c59bb
SHA512 89b22d28c303cee9ecd52004aab32510c42825c43e5559af3811e6881df2b77af80d102449b830e002481b089bb1aec2b6e5f31aa22551f154fddcaeae0fa9e5
TLSH
T16A11B651F0B6D853F1222C87DA1DDAD70C902B979998AF9C2214861CB799C7F8D258F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 570c4603c9538a2cfb56c2518600f21cef19fd2f04c7f270039c5fa18d32dbd4
MD5 15a241637d035d51695cade9e6e5e99a
SHA1 3664d403767a8e7985c086c89693cd4f97ff785e
SHA512 2eea21dbfabb9a40fea707a27947d08a3f2bf2ccea5b034e804b875075752cfc30dd6f325336a029f158a926cfbf11ed7eae181e5755ccc751db015db8bcf409
TLSH
T17A11A411F0B6C863F12268C79E19DAD70C943B9B99989A8812188618A799C7F8D29CF1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-32-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/2032-67-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/2032-87-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/2532-6-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/4568-74-0x0000000000360000-0x0000000000381000-memory.dmp

Download