981b12e6a0cf4cadd66df5f7a54e105ea54bf509bea48476a0bd7500d8eec77e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
Size 55.9MB
Sample260814-e74ydavcqf
SHA256 981b12e6a0cf4cadd66df5f7a54e105ea54bf509bea48476a0bd7500d8eec77e
MD5 476894633807993885f5c34ecde61cb3
SHA1 130f506632e956a77e7d44c48d0d328ed7fbd5fc
SHA512 e43ff3eb2785307ecc1eb13b5070ce9e1645be2377237bb665fb04d09e04be15bd00c892b27b900d17b59623caf3ae198514d8a918499e99a1e73036588d46e2
SSDEEP 98304:xhL+bhL+bhLMhL+bhL+bhLMhL+bhL+bhLMhL+bhL+bhLMhL+bhL+bhLMhL+bhL+o:H
TLSH
T17BD76C49FA4650B2D82B01704C9BC2BB4770BD218B129AEFF789E33E5E33BD06635655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
4768	svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
5092	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCAABCACCAACBCBCCCACBCAACCCCABCBACABBCCACCBBABABBBABBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe"	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABAAACBBBBBCBCCABABBCAAAABBBACCBCBACCBCBACBCBBABCABCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe"	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3472	sc.exe
2800	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
2768	cmd.exe
312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
4768	svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
4768	svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
5092	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
5092	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
Token: SeDebugPrivilege	4768	svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
Token: SeDebugPrivilege	5092	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4128	4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe	102
PID 4128 wrote to memory of 3304	4128	cmd.exe	104
PID 4744 wrote to memory of 3548	4744	svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe	105
PID 3548 wrote to memory of 1136	3548	notepad.exe	106
PID 4264 wrote to memory of 2768	4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe	110
PID 2768 wrote to memory of 3472	2768	cmd.exe	112
PID 4264 wrote to memory of 312	4264	2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe	113
PID 312 wrote to memory of 2800	312	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_476894633807993885f5c34ecde61cb3_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABCBABCCABCCBCBBBCCCACCBCBBAAACAABBCBCAABAACAABABBACAABABABAABCCAABACACCBBAAAAABABBCCAACAABAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABCBABCCABCCBCBBBCCCACCBCBBAAACAABBCBCAABAACAABABBACAABABABAABCCAABACACCBBAAAAABABBCCAACAABAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAACBBCAACAAACCABCBBAABAAAACBCBAABBBABCBBCBCBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe" start= auto displayName= "UserDataSvc_ABAAACBBCAACAAACCABCBBAABAAAACBCBAABBBABCBBCBCBABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAACBBCAACAAACCABCBBAABAAAACBCBAABBBABCBBCBCBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe" start= auto displayName= "UserDataSvc_ABAAACBBCAACAAACCABCBBAABAAAACBCBAABBBABCBBCBCBABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAACBBCAACAAACCABCBBAABAAAACBCBAABBBABCBBCBCBABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAACBBCAACAAACCABCBBAABAAAACBCBAABBBABCBBCBCBABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABBCBACCBCCAAABCCACAACBCABBBBCBBACAACCCACBAACCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAACCAAACAAABABCCACAABCABBCCBCAACABABBBACBABCCCBBBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8136ef8ddc13a0f9686b5dee751652c4b162a1aac11fa453719ea06abcfb8987
MD5 567379dee1516f6a4ed13172a67b78f3
SHA1 7adea87fe9c398c744ae6b43ed3ca88df2dad520
SHA512 7402ec18fab5d8cdce91a7a3845b65ffae1b9622fe3a61c6cfe714317ef48ab6e49fca6f1cc12137a6009fe6596b773dcbf195ff7c6a00027df5c0b0b562bd84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 28c642e5e2afdb7e6f7838a663faad0b922f9a28d87e7af923447eea12c03eaa
MD5 d65b34a6885eadd59db93e12163cbf6f
SHA1 dec78517293bd69a3136ee9eb7f819f4547ba7b8
SHA512 2fc6e709c71c62486ad5c9ea54871c4bd4fa7b58d343c5be3dcafd0c0ae0c27f88cc5e56e1b4c26012ae8b4a0a7ca7d81b3a1331eb5ad1783765b81b1d705b06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 6ba1ac8ebea82762ad387d6ce3dd1e70f61bdc100cd5266ee4588345b8cb5d48
MD5 0ac3a862d8da3ddbe2edd2f1718fe334
SHA1 6c62d0033734186cbf561b82b6cd06eff5a555c4
SHA512 6bec2e0f4c6cedcfa24acaddd13f4a02af8afc4826d52714b4f2bbb5daeb6fe0119ac56d3758c0dee2bb5ec2d3c7b2105df557988b7b0bf91b6cf29f97649292
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl\qap`g`v~dtlq
Size 10B
SHA256 2a39a392c702763d104fbf6cecd7a0e4c2211a5ad1b68e2ec572ae025ff21760
MD5 d4738a5c5f64ecfe586d1526c405ebb8
SHA1 0429facae1a81c2004884d76a6c7657d0bea2d19
SHA512 deb24443b0682b032119631d69e54ec710ab8487839dc5c361ec301b46af026caf337b33eda3c5b9199d21a2200a64d3f149a4f58a931c6deb37f26024344c5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f77c8c8faeb8e4bad8d81efcbb7334cd507edf7e8dcfafde3c6e2a51efd1c8ae
MD5 93709c68d638e14d58cd8fa8417da3fd
SHA1 1155eaa0ffdc7c732970f8190dbcc5b09aecb775
SHA512 f9b82700688016d5ca0111302a6b8567030c1238a3704839895167cfcdc02442526698f0a22e0fec7cad5449a9627292283869c8a81604b16ece0cd7da258e2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 700203419e28f372fdc8ab56ccf98581b271639f1835a8b692d62842d394c4f3
MD5 0ef065da0faa2f7f6fdd4433fb278fe6
SHA1 25942d2f82e27db2d38163dd07dc312b7445d070
SHA512 9162bee2036a2ec0c3422ff02e49314f9d3fdee96bc0244a54bb02e561b40fd6bc62dfc57a330d79c305a64d56b0385c0a3bcd621045ef6d8a9fcbe9ac9e1975
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e461479241b87d8d217d344dacaaa6c97c0b6f029121029de7110f0e7ba84c3
MD5 b97f714ea7ae17db16fb732d4d3f0505
SHA1 1398251d44197c472da0e34d505855602a9397fe
SHA512 0d2767b3a5e95e6cc93ec0a4255fff85e0a332e8efeb05f0d6136597d4a9a804979d3d8da6e70136898eb9a159d2bfea28a628c5a11f62095febdf9961a89d6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba4ba786eb05673e493d84dbce7c99518e4dbe193a22625478fa669ab87cf276
MD5 ad948622d06d93a3f7d58a7a0b1a70a6
SHA1 27f35ea5c538b647f814cbf44d0992e42e0aad05
SHA512 dafdbf5ec7e78136c2d99b327e5c5f57f049a788f80d47fa26280e16da80511f6e45d7fc74a42c283557233fd42c2e8df7a4f1310b8c4a0bae481d15f4e21e57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a934203d7f3271060efd19a87f66cd40f116b7002281bc2635b8c12d4cf3e5a6
MD5 8ee3f7f00068d127e3e9dc3d625b0e89
SHA1 9b0fad9caa6cc3878f311f86fe51e0c9935b4daa
SHA512 f8d88f32410d5aea7a9c76135474a972a6c0be9c9f424332e91c2c9e5f4bef3fe81c615430625793c83a0789090958551a4e55398ebc829976e08439d2fd2c17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e4717a876d254cfb1f05bfa99b27e9495e7259c5c8512b08a9dceb2b027948a7
MD5 574e0d0a9cedbdf6fbc2f65aa574db7e
SHA1 4c68608f5803db3616c36d0d45bb714f0e722b12
SHA512 e07dfea4fe6c65cabf202d5e2013a7bfd40f69de00e36c5bfd486cce77baf25064b6afb24a498287facfe22ae4ab86358b6e28dc5186a76d02c61b7fd23b7ee6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 be7ac4624c5a57863a0d4a865aca2b716919a5ca5d8b5816efb5ed81bb695880
MD5 1c419f78adab9f03dca0868cc12bff92
SHA1 78acefa9e262bc4f320097b980ee81fd071a91f9
SHA512 7077549f8632b845275f389d52c6a6ce85b88db321afccd9afe52867a103f2737a891a97439434cea867d40eedd9bd22852c027cdbd90b2e8571bf26732c306c
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 6bec59b0adb00c77aaec0405c76ce6a30a1a6c17dc2c0fc92d3e1884b9546308
MD5 bac2eea652bea96e0ecd23d8fe97400e
SHA1 f478e07062dbc5b3c8267a615ee70eb2e1c9cdde
SHA512 0f58f0c69e14d02abd7d3e2da7446bfb73adfad46c894cd13d693ded57b8861d255b06a33ad1f326c1f4f133b2453f25b35bd415a38f4c8013b23c82f85e654e
TLSH
T1EE11CB50A8E5DC73FA33AC8B621E9BC21CF877DFA958AA04130843297E85D32DD594D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f94821bf42eb77e5399f658277a8c9d5df0e558a7ea72925feef754975b495a7
MD5 2d61432730c3c308fdc7aa31da0115ff
SHA1 5acd10c43ca23418f0ace59b14e3fc8a83be0234
SHA512 c5b21f2a1857ca46b7627353e955440851a3593b8f46eab4ec89c8f9a55fd343e0030d2aa129372d45f5322b2aa852851f2f8e148a16b711d4166bc41c10649c
TLSH
T12721DA5058E5CC73FA33AC8B621EDBC21CF877EFA95CAA04130946287E45D32DD594D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3548-59-0x0000000002D00000-0x0000000002D01000-memory.dmp

Download

memory/4264-0-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/4264-7-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/4744-36-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4768-72-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/5092-252-0x0000000000770000-0x0000000000791000-memory.dmp

Download