cf7157c6a6cefb245e0073704c46681cdd8e5ea991697f7091db00ef513ae75e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
Size 771KB
Sample260814-e2yt6scp3w
SHA256 cf7157c6a6cefb245e0073704c46681cdd8e5ea991697f7091db00ef513ae75e
MD5 53d28e970cabb494bbc4783a2f4e129e
SHA1 b4c07a4052a5919101abb1128b6d7faa41020945
SHA512 03c6915157656ddc696183d82a9e5c130fb84f5ed1bccd73ca0cae5a50af101af5e8d787b161a1afea8711c33c03cc065fd48f7c4ac5c6e55b46234521bd6766
SSDEEP 24576:m9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0r:U+EG+EG+EG+EG+EG+EG+EG+EG+E5
TLSH
T104F40909FD4344B1D92B51B04DCFE3BF8A60BB25C4128EB6FB4ECB5BB923B215818655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
1404	svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe
4476	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCACBBCCABBCCBCBABABBCCCBCACBABACBBACAAACCACAABAACCCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe"	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCAACCBCBBCBABABBCCABAABCCCACACBCABBBBCABACBBCCBACBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe"	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2852	sc.exe
4208	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4592	cmd.exe
400	cmd.exe
1388	cmd.exe
5032	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2640	schtasks.exe
3488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
1404	svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe
1404	svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
Token: SeDebugPrivilege	440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
Token: SeDebugPrivilege	1404	svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4252	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 1388	2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe	100
PID 1388 wrote to memory of 2640	1388	cmd.exe	102
PID 440 wrote to memory of 3700	440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe	106
PID 3700 wrote to memory of 3348	3700	notepad.exe	107
PID 2760 wrote to memory of 5032	2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe	111
PID 5032 wrote to memory of 2852	5032	cmd.exe	113
PID 2760 wrote to memory of 4592	2760	2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe	114
PID 4592 wrote to memory of 4208	4592	cmd.exe	116
PID 440 wrote to memory of 400	440	svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe	118
PID 400 wrote to memory of 3488	400	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_53d28e970cabb494bbc4783a2f4e129e_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCAAAACAACABAABCABAABAABCCCABBCABBBBBABCCBBCACCBCCBBBACCBCCAAAAABBACCBABBBACBBBCBACCCCCACBCACACCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCAAAACAACABAABCABAABAABCCCABBCABBBBBABCCBBCACCBCCBBBACCBCCAAAAABBACCBABBBACBBBCBACCCCCACBCACACCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCAAAAAABAABBCABCCACABCCCBCCAABBCABCCBAACBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe" start= auto displayName= "UserDataSvc_ACABCAAAAAABAABBCABCCACABCCCBCCAABBCABCCBAACBCAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCAAAAAABAABBCABCCACABCCCBCCAABBCABCCBAACBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe" start= auto displayName= "UserDataSvc_ACABCAAAAAABAABBCABCCACABCCCBCCAABBCABCCBAACBCAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCAAAAAABAABBCABCCACABCCCBCCAABBCABCCBAACBCAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCAAAAAABAABBCABCCACABCCCBCCAABBCABCCBAACBCAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAAABCCABCBAACBCAACAABCACCBBACBBBABBABCABCCBBABCAAABCCABBBACCBAACBBAAACCBAAACBCBCABACBBBAABBBBBCCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAAABCCABCBAACBCAACAABCACCBBACBBBABBABCABCCBBABCAAABCCABBBACCBAACBBAAACCBAAACBCBCABACBBBAABBBBBCCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBBAACACABCCBABCBBACABCAACCBBCACBAACACACBAABCBCBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
1⤵
- Executes dropped EXE
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab57e17b9780e241983dc5d7cf7b11043c2feb181d309bfff4085689bf3f8754
MD5 a20f190bae06ac94198a69ec08597277
SHA1 de147135da02d9d07fdf84993751577bd0b0b7f3
SHA512 31716efa8c02f007564b7052ce500a537bb8d59780fd0c9ab9713133dccc32718061a999a55b70ec5a3575ac98565f06b0942af9e0de19ff37dd166be2e9c261
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 efd1959887287767ea898fd7252ee297f309a29f4c20e3b9f9664ce3a92f95d3
MD5 a9293c116083e8f601aba793d79842f1
SHA1 dbe9f6a5d401a547af7568f2227c67a57394456b
SHA512 e17a4dbf0936b17e4fb538721ac0e50b70a0840f897514fc110c6952c51509430f2899ab3a85edbfe257ebb3e80cf5abbc3832f2ae3426bfc9239d229a8efefc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 931006cd4d6b6aa787ee5cb97ca669a26a473a023c3673b3b52083cdc40614a3
MD5 6a575fcd475fb21daa5cbaecf16f0ec4
SHA1 e7c5ba6dc4a825bf58125096095aa41f4636992a
SHA512 e840b529e2098e71d9d4ae1fe8811960314e3f0b1738880dd3884bd8081173762792879758fc204dd35198d0c48ad416fe28f16e93e1830207596e6b27439d01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebf3574ca67b9b21e05f9c569f94330900de7d40d591b9e19882fd62109f94a6
MD5 39cce74cc6fdf3a0edb09207594b4a56
SHA1 2f80582c6d800fda3c64e69c3a414759bd2093f6
SHA512 654f80190a00c678ea64c89f500fe653f428e63e1e6ef6ad5a2b231a377d1f5bd55d3964da6b5a12520819e01bd2f0d2056c465380eb4ef639b10d54747c6d18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c83de0206c3bf77ae6ccbb589744f3b942854e1ca01a6f021e1ee79bdfa26e9a
MD5 1c1f77f2a34799f78402d710fc40ecb8
SHA1 ed814c2686962aba1b4d36412326f3fb40faed40
SHA512 2e863bde850d1b3fb8780b9029d57e7235e556bb6d4e50b708fa842ef4045d02ea2515494423b1868643edbef1b696b4e5e5eab2ec14bc375e301c03c4985814
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 68522b07f1bd61ec8adaddf986ab9853691af4c620454a99554bae1ca53ac076
MD5 1c646a1a3ce6fba159dba2e5d5d17564
SHA1 38b9dd9266694f5ac6cc2023c4c1f85eaa8af3f4
SHA512 def66270672a7df55df1b5c8226c9607f700db35343934e1cbffb930ed46021172151e8dfdd72d83c28299791b8e84ff4df9f1689e1d280c7093f846161ead4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4ea101c0ffb24ae94018407c34b7f0ecee664fb3e401b587f654cc724dfaa1e9
MD5 1afe8b198ab03114667a5e7d3fca4d77
SHA1 d3a81dde03f0fa61dcc1ddb9b58f09ccee8e8341
SHA512 e81245eeb4eaa200510e685b2b5a61d8ab3c373252a093edbbf489cda1e72d76cfa8b2e4983778f185f7172b3d2e873352c3c9ce9e6327eaeb8678084df1df49
MD5 SHA1 SHA512

Submit Download

svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCBCCACCBBABCABBBBABCCCACCAACCBBCAABACCCCACCCABCA.exe
Size 771KB
SHA256 cf7157c6a6cefb245e0073704c46681cdd8e5ea991697f7091db00ef513ae75e
MD5 53d28e970cabb494bbc4783a2f4e129e
SHA1 b4c07a4052a5919101abb1128b6d7faa41020945
SHA512 03c6915157656ddc696183d82a9e5c130fb84f5ed1bccd73ca0cae5a50af101af5e8d787b161a1afea8711c33c03cc065fd48f7c4ac5c6e55b46234521bd6766
SSDEEP 24576:m9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0S9+EM0r:U+EG+EG+EG+EG+EG+EG+EG+EG+E5
TLSH
T104F40909FD4344B1D92B51B04DCFE3BF8A60BB25C4128EB6FB4ECB5BB923B215818655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 d30f860c47f6d17c8f04d397e1ff3320328716ddc80fcf1c05eaf80f208432ba
MD5 a471590c1da67da820bf4cd37f33002f
SHA1 08ddab19a96272ee1bb2f022752af24749d497e0
SHA512 fb416cc2650d39bff1209e733db7803843ee1e01460d3336e09db78633f20a9b8925a4d118f8e6b69d7afd33e5a0bae80b91e424f144ad7af8b634d33039ff8f
TLSH
T1C0014950DCE6E873FD33A8DF5619CB821CF4764BAC947A802308432D6F54E318E514E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f95045fb51cd143bc6c40a9c846931ee34451ae95c1be600ef998b75581c0bfd
MD5 42496052cfbb4e6dd583cde63d33d030
SHA1 e2f03c6aeaafd3fbe6348ffa3a74cb4e9d4462c5
SHA512 6d19308bffd422e75186a117c8d7b7421b0e110ef198c234fda49b117621f013c5bb4043d82805a9b1254f7cdf88677c31f926d4594a30899e45c80bf66c6216
TLSH
T18C11DB60D8E6E877F9336CCB5A29CB921CB4739FAC98694013094318BFA4D318D554F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-35-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/1404-71-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1404-95-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2760-6-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/3700-59-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/4476-81-0x0000000000060000-0x0000000000081000-memory.dmp

Download