e2a969c7dcc629cd77618c7d9672df76aca5c8a2d86a41f5a3ee2e8b394e82a6

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 22.6MB
Sample260910-c9jdcavbre
SHA256 e2a969c7dcc629cd77618c7d9672df76aca5c8a2d86a41f5a3ee2e8b394e82a6
MD5 c987e7d615a425aa689b454421931119
SHA1 ba475bd182718a19b1fed54ede99a7bb752d4127
SHA512 0ab16ba1a36792e966c79fca7c59b544ce87638696b4e80260b60592b0adaa4ad3b63ac04a03f1eb7ad471b846bf394fc5b1dad614a680f08abc6187371e671c
SSDEEP 49152:U+EI+E3+E3+EI+E3+E3+EI+E3+E3+Eswqp+EI+E3+E3+EI+E3+E3+EI+E3+E3+E5:fKjKWQckVgtev5mnlNLw
TLSH
T19D378C04BAE68862E5B601700CA7C2F96931BE258F11C6DFB6C9B36F6D337C06136B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
5720	svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe
2212	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABCABCAAAABBCBBABCCACBBCACBACBACCCCACABABABABBCACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe"	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCBBCCCBABBABBCABAABBAACBAAABCAACBCAACBCCABCAACCAAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe"	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3196	sc.exe
2188	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4760	cmd.exe
716	cmd.exe
4836	cmd.exe
5100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1684	schtasks.exe
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
5720	svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe
5720	svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
Token: SeDebugPrivilege	5720	svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4760	4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 4760 wrote to memory of 1576	4760	cmd.exe	94
PID 5996 wrote to memory of 560	5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe	95
PID 4968 wrote to memory of 716	4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 716 wrote to memory of 3196	716	cmd.exe	100
PID 4968 wrote to memory of 4836	4968	2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 4836 wrote to memory of 2188	4836	cmd.exe	103
PID 5996 wrote to memory of 5100	5996	svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe	105
PID 5100 wrote to memory of 1684	5100	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c987e7d615a425aa689b454421931119_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCBABBABACBBCCCBCABBBBBBAABBBBCBBAAACAACCBCCBBAACAAACABCABCBCBCAABCBABBBCACABCCCABAACBCBBCBCCABBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCBABBABACBBCCCBCABBBBBBAABBBBCBBAAACAACCBCCBBAACAAACABCABCBCBCAABCBABBBCACABCCCABAACBCBBCBCCABBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBAAABCACABCCBBACACACCBACBCBACCCACAABCBACAACACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe" start= auto displayName= "UserDataSvc_ACCBAAABCACABCCBBACACACCBACBCBACCCACAABCBACAACACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBAAABCACABCCBBACACACCBACBCBACCCACAABCBACAACACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe" start= auto displayName= "UserDataSvc_ACCBAAABCACABCCBBACACACCBACBCBACCCACAABCBACAACACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBAAABCACABCCBBACACACCBACBCBACCCACAABCBACAACACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBAAABCACABCCBBACACACCBACBCBACCCACAABCBACAACACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCBCABAAABBBABCAAAAAAAACCCBACCBABCBACBAAAABBCBCBBBABBABBCCBBCBBBCABAABABCBABCACABABAACAABBBABCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCBCABAAABBBABCAAAAAAAACCCBACCBABCBACBAAAABBCBCBBBABBABBCCBBCBBBCABAABABCBABCACABABAACAABBBABCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBCBCBABBBBBABBAABACBCCBBABBBCBAAABBBCBBBBBCAAABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
1⤵
- Executes dropped EXE
PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14dc6c41dd7c0345c477c4603e25e06833a2fa483dda49aa0b2e9b506822ed6e
MD5 30be9f31f43c41d173d0455c775d84c1
SHA1 5268ca732408e59c0531d20b4be823d65e1ae9b0
SHA512 2a36e3591b948bb0f7d94cefdcfce5df9f001ffdc4a297cf81c5b6c515404d6fcac5a5b590b14b6a2f5c875d4ed6fa87417a173d693e0f3aea906081b4b7b800
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f23e8addc60702030aec36a23341a66aa8983c5c95cd37432ce9b97cbba4745b
MD5 e0e2593d5ef1fdff4240f51d9c10b571
SHA1 1fe2aa3e6c1b348679a9a4abdc73960f6a53c4d9
SHA512 c7691d8866bdca5237fcf8ca16edb669c769c3cce93446fae766909e2e4cd1ff5ec90b2d43de57b345f1391a140bcd6e7d0b567f2b3c5317a5d4e64f523f2179
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e434e7aba5a17e84b740262d87fc02971a70c9b881ac91f9acb5224ee0e56131
MD5 72c82f9b5e88fd090b4d9ccb7812a8d1
SHA1 4d4bbfe3f8c3319bacaf7593c9da08223871a58f
SHA512 1236105a8dff4c9e47a7da126d53ee95bf9d9a5fb97cd3f708b4c266f8546ce9bd7b18031774fe92c4f2b66d340e62d1dcd65e2f0f2b6ecf70c45ff58361adfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7fe367eccf8b6e167dcc58749d9dfbb0fed54bd31c98cbddca3647b31be69a92
MD5 9c0563abc387d82c081b0bc45c82a51f
SHA1 ebacd91ae95b51a5a4df51fd38cd514148b17a68
SHA512 84c5736204cd3544a51b667be795e103d5428085a4126e484914af183a4624a90b60c3935a395f95e0e20de91b695261f6320461d6922456c4a7c22d10df65b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bfd996f016fd0aae9fdb1d66cf9c7a51c47bdb96c93174e9b95c732d1b903759
MD5 fcaef1aa3b0abb87b5b8d0498ba3b2e8
SHA1 eb7bc0e05cab184b2b7c6afc145f702d2a956827
SHA512 d44fcc5721f1f965d5c44c02a98561747ffea6115e7ce41b4ab5cff062e9a4ab41e456fbd82c5b325316b018649783ba2d273738838bce1143c77ac82ba38c80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0bdb178e5db5f778ab33d8855bcbe5b620f17299d6c141a12932734c40c705f6
MD5 05c8ae46bcaf4dfe365fff3ac417544f
SHA1 b466fc573c0186aa60aa4b5854ad29d5bce2004d
SHA512 baad3e6693a36bb4824ece7b11263d7cc03ace7a36800544e15360b2f8b5f027d8d38a2d8f959ff77720000a32ec315632cef9faeff39595147e6b5fc50e2af9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd5a286694d7d9833cbd01336e2c37919f885c03ec115ec49feac7b0d1ba14b5
MD5 036612dc0828deaabda80b2cd9d916ec
SHA1 a7fc0a107fa4361f59e891e5176ba7cfcfca9e48
SHA512 d0f64d043bf9ae53be06e04dd756c3e56c43700100cd8601f336dd267d9fb440c562a6fb149b608ea051c216e3a120b629fa8cc89c645c7f19f6aa23ec14ff0f
MD5 SHA1 SHA512

Submit Download

svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACAAAAABBACBCBCBCAABAACBCACBACCBBBABCABACBACABBBAB.exe
Size 22.6MB
SHA256 e2a969c7dcc629cd77618c7d9672df76aca5c8a2d86a41f5a3ee2e8b394e82a6
MD5 c987e7d615a425aa689b454421931119
SHA1 ba475bd182718a19b1fed54ede99a7bb752d4127
SHA512 0ab16ba1a36792e966c79fca7c59b544ce87638696b4e80260b60592b0adaa4ad3b63ac04a03f1eb7ad471b846bf394fc5b1dad614a680f08abc6187371e671c
SSDEEP 49152:U+EI+E3+E3+EI+E3+E3+EI+E3+E3+Eswqp+EI+E3+E3+EI+E3+E3+EI+E3+E3+E5:fKjKWQckVgtev5mnlNLw
TLSH
T19D378C04BAE68862E5B601700CA7C2F96931BE258F11C6DFB6C9B36F6D337C06136B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a7bbbce962b105c5a4c037a5ed171ec2e1fa7129f4df162707b3bf385e4d57fe
MD5 9dc4afc77a0fb88b44cc69e35a355330
SHA1 d6b0a32522266b26313b88ddb0b9930a3d910f2f
SHA512 f291cbe2e268407b91183da9f0bf9f6abad7e59173bc74d476ff99dc62712dbc6d19d27bc2a30d8b1d4a881fc20f21716c296abc1c3b6429d017a4213da32a7a
TLSH
T10411A061B1B5DC17F032A4D693219FEA5CDC3797686CBF1423064518EACAC34DE294A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1ad4fe38a039fabe0eb66dad51adb52f5d3202e3d444fd775585b8345ca98df4
MD5 52bc06ffaf9b95e0bb8cfbdb7306703f
SHA1 e16f42138b19902893cefd47df3f08196524f570
SHA512 499b2d314067c7514d9a1142dc4fba3c89971515683ffa78837d64364fd9c2089044fd73d226a71329ebfa8c0cfcbdf25b25c46e187550d6ec9e2acebaea68b8
TLSH
T1FE11DF62B1B5CC63F032E4C69321DFE60CDC379B689CAF0453064518EADAC34CD294E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-82-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4968-6-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/5720-63-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/5720-87-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/5996-32-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download