2e62b9c53afd60e4225f01e1efda375e291b0cf56afe4f2f8f98979cb2c5795f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Size 855KB
Sample260813-a6vabsgr21
SHA256 2e62b9c53afd60e4225f01e1efda375e291b0cf56afe4f2f8f98979cb2c5795f
MD5 7d39a17472ca36074583dd9d27576d05
SHA1 2840a589d1c5d6900f47403068580f1edf03587c
SHA512 2295220e47200113a67b127508dd83bf26d408306fbe64f814637a951ddab0c81dae72c68e2ec9de8c59ee224795136fe78f3ec02c975d2a9a66fccb8804fd30
SSDEEP 24576:m9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0Y:U+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+EC
TLSH
T10F152A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
1480	svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe
4916	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBCBACBABCBCABABACCACBAAACBACCBCCBBCBBBBCAACACCBAABBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe"	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAAACBCACABCCACCACAACBBCCACBCBAAABCCCABBCBBCAAABBCBAACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe"	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4608	sc.exe
1200	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3644	cmd.exe
4512	cmd.exe
1240	cmd.exe
2812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4452	schtasks.exe
3724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
1480	svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe
1480	svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Token: SeDebugPrivilege	3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
Token: SeDebugPrivilege	1480	svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3644	4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe	111
PID 3644 wrote to memory of 4452	3644	cmd.exe	113
PID 3716 wrote to memory of 1140	3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe	114
PID 1140 wrote to memory of 4272	1140	notepad.exe	115
PID 4164 wrote to memory of 4512	4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe	120
PID 4512 wrote to memory of 4608	4512	cmd.exe	122
PID 4164 wrote to memory of 1240	4164	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe	123
PID 1240 wrote to memory of 1200	1240	cmd.exe	125
PID 3716 wrote to memory of 2812	3716	svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe	128
PID 2812 wrote to memory of 3724	2812	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAAABCABBAAACACCAAACBAACCACBBABACACCCAAACABBCACCAACBCCABCBCACBBBABCABBABBACBACABACAABBAACCCCCABBAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAAABCABBAAACACCAAACBAACCACBBABACACCCAAACABBCACCAACBCCABCBCACBBBABCABBABBACBACABACAABBAACCCCCABBAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBCBAABABBACCCABACBAABBCBCBCBBBBABABCAACBABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe" start= auto displayName= "UserDataSvc_BCABBCBAABABBACCCABACBAABBCBCBCBBBBABABCAACBABCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBCBAABABBACCCABACBAABBCBCBCBBBBABABCAACBABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe" start= auto displayName= "UserDataSvc_BCABBCBAABABBACCCABACBAABBCBCBCBBBBABABCAACBABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABBCBAABABBACCCABACBAABBCBCBCBBBBABABCAACBABCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABBCBAABABBACCCABACBAABBCBCBCBBBBABABCAACBABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCAACABBBCBCBCCACABBCCAABCCACAAAAACACABACACCBCAACBCABCCCCBCBBCCAABCBCCACBAACCBACCABBCBCCCCAABAABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCAACABBBCBCBCCACABBCCAABCCACAAAAACACABACACCBCAACBCABCCCCBCBBCCAABCBCCACBAACCBACCABBCBCCCCAABAABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCBBCBBBACAAABBBAACACBBBACABABACBAABABABACBACBCCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
1⤵
- Executes dropped EXE
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1112f6c63f3f296fbb851db78dc85ad73980ad8ecd177aa508bde00eb0f7779
MD5 3815a8adc6ea477626dc0b6d81e2c4c6
SHA1 facf1204fd59cba14adaee187de70e739a837147
SHA512 9b4942f63007c98731582a0cb40ff1c06cf1c03afd0a684b67ec7f9839521d2af85b175fd09d11cb5b981716402dc9503501b182b35e2d455d340b77d2a3d913
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a6a8b9ad6145655fa513845e48cd846f81eeb5aeb5567200f598ed5fba80cff
MD5 2c1ea985f7f4488d6b7f346518beb452
SHA1 7452100a5a31efd282ca3818d0d8f4694a28ef5b
SHA512 66b4c5744abab4d7dfb62e4b8e5a8b03124c6b0d925c832df66c4803bcc6028ad6210e89dc27f43e3b7bd544cb347ab060be0c883043110d7a4c799322ad98c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59046ef4a941c72ba5274d31f37186b52ba893dd9586198c08709cf913bdf368
MD5 8ac464e98f0c3ad326142a78020c758b
SHA1 96692f259e314ea8ce8dcdb0cf638bf48f589ea5
SHA512 4e39344ccdf1cc62c2201344bb306b92c1b0d6075b5ec64f24ca7b667e1c4e655e4d5a53a86be0a6616aedc075dcb03af3cd9a22710dc956773f4acd68e2bfbf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 347bd4ee44a3a997ac7a8829b5b22dd310f0f0e65d85da8e3258b563b08b76cd
MD5 53443faa91ff79e8c00c3aa0b4ca8e93
SHA1 e0074089403420bc2d5abaef008c28c192b4a345
SHA512 aedf91259767041e3569a1e319abbc6d4e33c8f236def40b094220d429b7aca9a318b85c7b9df1937e1f5666bb165eaa48ad3eff246c8865944a9d875d245ef1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3a49dca71a9dd8569409b27093b3dd1d70108769c8e8d998fd112d58c907b9d
MD5 5a47d861c0f28251e0c5ed850a344a80
SHA1 efefa1bc05f9037351fefcb45e1686cc1439c2ba
SHA512 1b54fdf3290b90683934212a64c2e199288ab29ddac634825936036965c9b4137d3655915ba81f255ef0181a63cc36b7fecfb388c436320393cc486ef1773a90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4b3ea291550573d12e76cbb891d0678ec751f8107e75d27fbf00b84dc10292b4
MD5 32726264ae5e59c21632e055377fead0
SHA1 c97a80dd7ca5aaad6d13c4f236f91a53168882dc
SHA512 460ea97a0b1e710b8549e89980ed1907d7c09df188c1ba33ef5137215f1f8195e0d5a97e9eb53eb12a62161cdc8d049ee0f53fcd70c0d3e166d774c32fc7565a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9dd57cafea675a981ca12cbb96f9e13ce082683d5be678a039744eab941b22cb
MD5 c7091d7e0eea19601bdf7c1a86013e97
SHA1 7e64a61feea7d9debe326d3108c5f13015be782d
SHA512 a18c3953e7a6ba6fb157e9eff128e4f6d63ac27d584a8f90e00935a56d845e5f82e965a586e2722c451f43414845b0a9005858f594dc74bb3373a1a85eda90c3
MD5 SHA1 SHA512

Submit Download

svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABAABBBCABBCBBCAACACAABACABBCBCBBCCBAABACBCCBBCCBB.exe
Size 855KB
SHA256 2e62b9c53afd60e4225f01e1efda375e291b0cf56afe4f2f8f98979cb2c5795f
MD5 7d39a17472ca36074583dd9d27576d05
SHA1 2840a589d1c5d6900f47403068580f1edf03587c
SHA512 2295220e47200113a67b127508dd83bf26d408306fbe64f814637a951ddab0c81dae72c68e2ec9de8c59ee224795136fe78f3ec02c975d2a9a66fccb8804fd30
SSDEEP 24576:m9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0Y:U+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+EC
TLSH
T10F152A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a09f7de4473dc6481c9117d862c4f3e5c7b2d732e9fb42029900f201051446d7
MD5 3cd9d084033e32e0f07fa6721fd83234
SHA1 63a6bc75faa46c810194e8a716f596cc2dccae2c
SHA512 2e83572a5d1689dbb9f6e51968f2ad8a6202e353e1fda3ca8cef79520f578c5452055d612857df568f2763adb68d6ed789ef3ac396c24b24f0dcb4983d118681
TLSH
T16B113116D4F6DC43E97225CBF2265FC309D4329B689C6E082249820D7BCDC72CE194F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8a12886bc0f4bd6dacbc1f61e83528a593b80cbb1be0ea82ff81a31b7d993c66
MD5 7698d153724ea2b6cf636c440669a305
SHA1 8ed07afbd8ae4cb73f4f0e6c13ed0cca1b0f8dec
SHA512 02d3e1fb471abb2fb37743d39567c6eada686ac12ba170b6677e693db46f368f975fee30fa6b0fc92283a278caa56443638b247e5d72b3dd735870022d9c266e
TLSH
T1A311EE26E4F6DC93E97265CBB62A9BC20994339BA89C5A04134DC30D7B9DC73CD194F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-59-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Download

memory/1480-71-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/1480-89-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/3716-35-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4164-6-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/4916-91-0x0000000000910000-0x0000000000931000-memory.dmp

Download