8a8c3931ed62a59fde131cad4597d33fddec24471fba1a4e72964748da850ce7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
Size 31.0MB
Sample260810-ce9baade56
SHA256 8a8c3931ed62a59fde131cad4597d33fddec24471fba1a4e72964748da850ce7
MD5 bcce510c9d7b065c16c9efb888008b45
SHA1 a64428c0129d552734868de8241059bebb6ad048
SHA512 92b3bbd29019f86d9674240dedf85a21c101b7f1b9b439d4816a0e70575f92c2438bb38a60815b931e231df1a8849c6ca69293adafdbe7ea5e7152484d4b7b37
SSDEEP 786432:7hasQhasQhasQhasQhasQhasQhasQhasA:l
TLSH
T192676D287ED08176F473557189BBE7A9A52578226F044ECFA2C5130E4D37BD2AD30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
4316	svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe
3328	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACABBBCBBCCAABBCBCACCABBBBABCCCCAAABABABCAABACBBCCCBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe"	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABAABCCCBBABCAABCAAAACBCBACAAABCABCACBACCCABBBCABBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe"	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4952	sc.exe
3384	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
956	cmd.exe
1988	cmd.exe
2984	cmd.exe
2248	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2928	schtasks.exe
1524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
4316	svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe
4316	svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
Token: SeDebugPrivilege	4316	svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 956	560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe	96
PID 956 wrote to memory of 2928	956	cmd.exe	98
PID 572 wrote to memory of 4300	572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe	99
PID 4300 wrote to memory of 4368	4300	notepad.exe	100
PID 560 wrote to memory of 1988	560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe	104
PID 1988 wrote to memory of 4952	1988	cmd.exe	106
PID 560 wrote to memory of 2984	560	2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe	107
PID 2984 wrote to memory of 3384	2984	cmd.exe	109
PID 572 wrote to memory of 2248	572	svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe	111
PID 2248 wrote to memory of 1524	2248	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bcce510c9d7b065c16c9efb888008b45_elex_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACACBACCBBCACBCBCCAAAABACAAABACBBBAACABCBBBAABABBAACCAABCACBABCAABAAACBBABBCCCCCACBBAACCAACBCCABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACACBACCBBCACBCBCCAAAABACAAABACBBBAACABCBBBAABABBAACCAABCACBABCAABAAACBBABBCCCCCACBBAACCAACBCCABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCBACBCCACCBBACABCCACACABCBACCBABBACACBBCBCBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe" start= auto displayName= "UserDataSvc_ACBBCBACBCCACCBBACABCCACACABCBACCBABBACACBBCBCBCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCBACBCCACCBBACABCCACACABCBACCBABBACACBBCBCBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe" start= auto displayName= "UserDataSvc_ACBBCBACBCCACCBBACABCCACACABCBACCBABBACACBBCBCBCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCBACBCCACCBBACABCCACACABCBACCBABBACACBBCBCBCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCBACBCCACCBBACABCCACACABCBACCBABBACACBBCBCBCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBCBCAACBACABAAAAABCABBCABCCACBCCACCACBCBCACBACAABCBCBAABCABCBBABBACCCCABBBBCCACBAACBBBCCBBBACBCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBCBCAACBACABAAAAABCABBCABCCACBCCACCACBCBCACBACAABCBCBAABCABCBBABBACCCCABBBBCCACBAACBBBCCBBBACBCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCCCCCCCCBACAACACBAACCAAACABBCABAAABBCACCABCCBCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
1⤵
- Executes dropped EXE
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ddaab248266bc76581404fea3b0fb6457d361a3e30fa28d745a4ac89c9660b5a
MD5 e9e2190119b17580819ee9927b104b89
SHA1 b82629722cc16d4b767bb21068398056d7812734
SHA512 6ca4d6dd1a1941832142a80ee3ecb98e79d039dd5b65f288c0207e8d20cc678a38dec9bd592528a864fe210aca176196e1ea6bc0892167437e67f3b1d6deeac8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07036a88d22cc37e70f0ca82b41b414418d415c61d68efa872758f02cbfc6a51
MD5 61f3e6fd6b0b8ec92b805b088cd8b7cb
SHA1 8346f9fae3768ae2c5639bb5f2d762699ec427b5
SHA512 55042ad6df2a041b9ab88a3ca48ecf9aa6098d90e392657b0472d32602019f193af73d0dd19449b5c104a83a7949dab6f9d3839b9f4814a82cfdf491455a6880
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 978d2a0aae3b1c685257d99b94feff7f8416bd3b509b5aa7334450422f0c4eaf
MD5 6529ab61283a6e07c479e142dbe2aa56
SHA1 2d9047dd2101f2ca3706703ddcebd6ad6d32b1f5
SHA512 e9f7ab36f3a8aa7bee9abb601ad93ad4d90641a56ae3c5df12eb854572444df1e1ed5fab16e39722f76b4ec038d452036e641d9a9578bded23a92ad450d5c300
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 deb38fbc23b7ff27caa359326cc52285c1c43fa49eff99df9690340a5ce20f22
MD5 ce1d2513a28bdb8796b5c1ca074c6529
SHA1 7ad22ca7cbca143f68fe6e809a5bf468d7302bef
SHA512 752937fe754ae567c1b4415c6b85ffeb807974fa16f53fbe00c0b8d15e1cfb94630fc752f6ae79ebb6b7145a8a1637a21e99e69b9083da774b84fd5028453fbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 11d4173faf868a959edb9c8eaadc9a81d0ebbf7e9fd738c4b8d31d2eb98dea0f
MD5 7d5523acaa5a6f1e208b3b96dba20b46
SHA1 18f19d20fa528aec424872fc18bace2b5da5e390
SHA512 271a69cf80a8a08d8a1e80e2f715649eb5cd2c51aa09774c5a17b4739d1bcadde638cbf3f27367ffbb70cfc7b369da9ab2ecaa768f37be7f7b93f9e7acc9005f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c84dcf320c3f6318ced0f807df6996401ed30d2cc480ff924600f07d99f3de85
MD5 d3d5892979cbb7c3e5b4583cdd8a07a6
SHA1 0c1e9a1f248c79ddcd189fca13b48ce76756c1c4
SHA512 ddd6e1403661a79a7de542b3447151edf192fb422a24df39fc882caa4ccbffd29468df03449bf5cbd67d09160ad75f325130fa011d7505304fe50d859c2718c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de81a0bbed14cc87d5e9111f2711230f3278722c199483cd04b9fd70b1fc8f2b
MD5 c7d47ee23f902c8bb3511d2ae3ccc9eb
SHA1 bd819d849a355680362ee02860d62c1265b1e44d
SHA512 92fd7abc1adf86f96d14d85b11e669c3de7628ddfd6b2f50f79e6e39768be994636b5ba446fab76b5dcd55969fa5e945a545cc3c76166141ea7fe2fe94631c3b
MD5 SHA1 SHA512

Submit Download

svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAAACACAACBBBCBBCBCACACCCBCCCCCACAAAACCCCCABBABCAC.exe
Size 31.0MB
SHA256 8a8c3931ed62a59fde131cad4597d33fddec24471fba1a4e72964748da850ce7
MD5 bcce510c9d7b065c16c9efb888008b45
SHA1 a64428c0129d552734868de8241059bebb6ad048
SHA512 92b3bbd29019f86d9674240dedf85a21c101b7f1b9b439d4816a0e70575f92c2438bb38a60815b931e231df1a8849c6ca69293adafdbe7ea5e7152484d4b7b37
SSDEEP 786432:7hasQhasQhasQhasQhasQhasQhasQhasA:l
TLSH
T192676D287ED08176F473557189BBE7A9A52578226F044ECFA2C5130E4D37BD2AD30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 91cb8e3afefc7a77de6f86ab31a13a3e4e3f1f35c29e1bd95976cc10ba019c21
MD5 4852785cf40ded16d70a92096d7bf20a
SHA1 d4fc4016b2aa402e046d83780dedba33214f07d1
SHA512 5974346a7dd882fc3c0cd50f39978ef1753df60de6b1bd12c8943be5b171653cbb0adab01d1b9d92338d9c1898707dae0af9e06f1bb1d15229281c4d4aeef508
TLSH
T1CB11C465E5F9DC23F923A8DF552D6BB30CF4769FBC586E84224C4218AB90C32CE518D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ea7405312763eb01ac388a8ef3661f6bfa7617b0c3f7bfb96159359170a3ca32
MD5 8fb3779080aedef903d6a4cc1df7f544
SHA1 c6efe76668a57ad802335a51792bf042fbf21ace
SHA512 89ff5881df51a976c178b373acf9084df346f4b5b4192454a693d475ec6e54df3187c3d8cc51983584d3e2f5cf4a5a69def061043dc037f3917549b457aa003a
TLSH
T1AC119625E5F9DC23E923A8DF652DABF308E4769FBC585E44524C4218AF91C32CD514D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-6-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/572-35-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/3328-81-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4300-59-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Download

memory/4316-71-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4316-95-0x0000000000410000-0x0000000000431000-memory.dmp

Download