314de25a78db9db68afa7c7519da728e3819bfe67a70c68c3f2691833e44fe97

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Size 23.5MB
Sample260814-e83rpsvwct
SHA256 314de25a78db9db68afa7c7519da728e3819bfe67a70c68c3f2691833e44fe97
MD5 449db69d5b0f16d2bad8bba76ec44230
SHA1 ab2959a7d1c71b8cad6f3f10cd0b4dc87ebb3312
SHA512 e295d056db0562cbb12dfb7e914463c8c6879643f9fa6f3087ba9510bf2631912d55101ab550c6042fb74b2272a2325a7721bdd173e1185c9836adcc09a93314
SSDEEP 49152:U+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ESr:t00r00r00r00r00r00r00r00r00w
TLSH
T12C474B09F94780B2D82B017048CBD3BB4B70BE258B129AEBF78DD72EA9337D06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
5972	svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
2532	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABABAAAACAABBCABBCCABCBCAAABAACCCCBBCBAAAACACACCCCACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe"	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCAAACCABBBACAACBAABCBCCCCCCABCACCCBCABAACBCCBAAABBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe"	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4928	sc.exe
5804	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4992	cmd.exe
5148	cmd.exe
5600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
5972	svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
5972	svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
2532	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
2532	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
Token: SeDebugPrivilege	5972	svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
Token: SeDebugPrivilege	2532	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4992	4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe	92
PID 4992 wrote to memory of 5596	4992	cmd.exe	94
PID 268 wrote to memory of 6040	268	svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe	95
PID 4800 wrote to memory of 5148	4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe	98
PID 5148 wrote to memory of 4928	5148	cmd.exe	100
PID 4800 wrote to memory of 5600	4800	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe	101
PID 5600 wrote to memory of 5804	5600	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBBAABABACCBABACBBBCCBABAAACBCBAABBBBCBCBCBACCBCAABABAAAAABCBBACBBABCAACCCAACBACCBCCCABBAAAAABACCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBBAABABACCBABACBBBCCBABAAACBCBAABBBBCBCBCBACCBCAABABAAAAABCBBACBBABCAACCCAACBACCBCCCABBAAAAABACCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAABACABCACCABABBBCCBCABAABCCABCAABABCCBCCCBBCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe" start= auto displayName= "UserDataSvc_BBCAABACABCACCABABBBCCBCABAABCCABCAABABCCBCCCBBCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCAABACABCACCABABBBCCBCABAABCCABCAABABCCBCCCBBCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe" start= auto displayName= "UserDataSvc_BBCAABACABCACCABABBBCCBCABAABCCABCAABABCCBCCCBBCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAABACABCACCABABBBCCBCABAABCCABCAABABCCBCCCBBCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCAABACABCACCABABBBCCBCABAABCCABCAABABCCBCCCBBCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBBCACBAABBABBCCAAAABBBCACABCACBCABBBCABABABCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ea5458c2c5c295bc286fe142558703b18aa27e990577c64278f8f346f5b4e7f3
MD5 652d25780b1e721262173d07e1bc17a8
SHA1 4b9d6f932d41ac9dbefbec540c59e733b2651d39
SHA512 beae459d654907816be83d23eceb278e488a2b8906e339e1505b3bd4ae41d2ceeb76b2d49db36ca14e49611c110a2c3e6819bc0bb2f472724bfc2861f144c82c
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.3MB
SHA256 aefe66b729b5994726aa7dd4ce17ce6fc7c759f730b5cf32d342452639b58d3f
MD5 b35e683f509ba457bc675eb1e68dc280
SHA1 18724d0507b63e8d9679516c09611ab18b201607
SHA512 5a04f0dd407830fc914cad21fd5afab31e3c5c830dbf4f34421e30bffbce9a6af91e322477d055bacf138db74557e1b677dd31ba0e9a47306126d04d8004d887
SSDEEP 49152:U+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ESW:t00r00r00r00j
TLSH
T168B64B09FA4340B2D82B017148CBD3BB4B70BE258B129AEBF78DD72EA9337D06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 fdb1c2387e8305a3f56eec71664f2a279a5c1a4d8e84c1e47c94f9efb7b23763
MD5 25613073771b17949124959f249bba32
SHA1 ea53c7691fe1dc02e2c46d8e2d48268e35ac68ea
SHA512 5e79a93527dd47ec6fabca405f514162efa4f9d2a183e5eb8bdef11fc3fe2487c12782715be124b725af9e8f1d222707c6f4fbdf661fb7d4da4fbbfdeb8bddb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\qap`g`v~dtlq
Size 10B
SHA256 7e887a2a620e1526e85235122892273e51c1860aa1e8c27b6cfbff870a09f673
MD5 46411d35d1e21574bab6f3a562d8763b
SHA1 bcf4f49e65bec2bb37b2a5eb4bcbcc0c45229b4d
SHA512 af565a44e4cd50ad2c6d767d60290f47f9e2086f711dc7d545b4395b8e12080e919f932936cb8598db63d1bd79406aee05e6b926e3ec0f10839be61dda453b30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 209f47a70711cb658d354136ae2c08921e6e239aa94d81500a217a715144f35b
MD5 ebde9ddb1dc03957e6f8eccb1a32a4c5
SHA1 a7c4663516e49748bb80857b659df27c93e8cf41
SHA512 4abedf89e803e8224f4ed8fd45aebd40d9b378c71e15256f71703233d84a5b2ed9c9c3f155f7dd5fd33eeb829c27166a73e4ae7dc97b02a3e3425599332a9e53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1067be4b7ef8843d6a5c166beff9a2715776b4e96b02fbb0fdfae4b845f2104
MD5 f7002264d33cded826070776f5d56b59
SHA1 fbfcfd647a4531bba780c78e1fc52491e3ae6a34
SHA512 9efc6b238ba596476b6a3af43b6a26661d36b2c5b7071faebf9b9a02925f39c481dd8d0428cbdcc7fbe8f460cb8f89515ccc65f6e495fcd3a1c7642365b1ed15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5cacdd3d41d22c2e19ccdffa50bc33c6fb28a9c6c5b7117423bb0cd0713bb3ea
MD5 4574f026d3cb92f7f6c70b3cd5479902
SHA1 69af19c31ec400056ac28ef50469b85eb239a155
SHA512 ef484d6700b5927db4eba862f17bf1cbda4d13dce05ea405292cbf81f4186922c304745944c17c20e33f381e03a8aed2fd32d1d68553c9d8fa84296bd79fb36e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27755644b49b51238872f6f847b831c11b4715f4188742c69770dd9ed0c82134
MD5 bfad3a6734415ee375e3ef55fc3de750
SHA1 6cc68eb34a6d1130603fc9cd065ee5ce36ef9c6c
SHA512 b767df63ff4ba6ed95ff4979a9bf8f15673619d7fe6e0ead884562f08733fe28ff201995b9105f19afe26e327e150f23e0333cabaaf67e3d305415d397fbff1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b589397a090b1b3d50f7d497dca86f93b9aaa86eb2efc065e090173210256dd6
MD5 7845e75424840a37947cb5a31e4aa3ba
SHA1 19a054ad94778fce337036ed42fbea8ce6edf0e1
SHA512 4e9871919590465f31044542180cf160941a3c95c4d195aff9f0ccf519c882b4d05284db350df12aa5c9f1adb55137e84e5218ca20ce9cf79e5d410281fa9f23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cc5979a8ade345217c14a538b9fde273be7c667f8d61507ea11e3bd722700448
MD5 38575ac401f9002b007aa72f3ccff9f4
SHA1 65af59e933204756a8728657006c5a47fc7be347
SHA512 08176aaa2fcdd0e191710cb7611ded19ab1e8da4d3df3b3a14e6f0c0cf03aaad10c85acb67b1f962a953fdf0f57015480ebaf9bed4f4a304463ca8e97ccde93f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 24633dc9cd5f3a28179c6784f14b5af331fca338c3acd908490ba0d4feffbc6a
MD5 f781a1b63d13ae4c633ed8baafdcbde3
SHA1 3c0d337e9503a77a779fca03db7677e42ebe0806
SHA512 bf4ebeb07ae187a21fc06458f3fddfe7d301c9b60580d948ff92fae7a8596c7d21bda3e1635511c5b3824c3d2dd5a93bf5c5ffbe75d27148e3bd5e85420d40df
MD5 SHA1 SHA512

Submit Download

svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCCAACBBACBCBBBABCCBCCBCBABBBBABBABCBCACBCCBAAB.exe
Size 23.5MB
SHA256 314de25a78db9db68afa7c7519da728e3819bfe67a70c68c3f2691833e44fe97
MD5 449db69d5b0f16d2bad8bba76ec44230
SHA1 ab2959a7d1c71b8cad6f3f10cd0b4dc87ebb3312
SHA512 e295d056db0562cbb12dfb7e914463c8c6879643f9fa6f3087ba9510bf2631912d55101ab550c6042fb74b2272a2325a7721bdd173e1185c9836adcc09a93314
SSDEEP 49152:U+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ESr:t00r00r00r00r00r00r00r00r00w
TLSH
T12C474B09F94780B2D82B017048CBD3BB4B70BE258B129AEBF78DD72EA9337D06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 190d4646fc9fd38fe993081403cc935358412458b0a09fc938ec7d4839dcbac0
MD5 d636e30a3f82476e9662c3b80f508361
SHA1 6739af05a1f38551d94a7b17c40c036ac483e5df
SHA512 f791e7118ef3c87b54304c75d624437505fd32f025d5b64c18f3e17966854311b71b07037d0f37d001881a385aa8ebc2d19bca49c97b7bf13366778518a808b8
TLSH
T12C11EB40A8E6D877F931A886671ADBD30CB877879CDCAA1413054128FFC5D31CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0972af14ce157fdd591abd602c1da160d25bfd9e6cd6b9c99a9486de8efe5db5
MD5 6dd05ef5eabf6e82d615b445b8fe3912
SHA1 d242466801c8f1c7e30a4d8b50516acc013bc0e6
SHA512 387893dbe1b9f2074eb7fcc48b301cd6e14f0bfab164857082cd2d7c9df7d5c4f9350651735fd480689fc14e571ab6d99b603f5dc99a00bb0d92f8948452a63c
TLSH
T120210B40A8E5DC73E932A8D6671ADBD30CB9B787989CAA1413064128EFC5D31CD598E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/268-34-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/4800-0-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/4800-8-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/5972-64-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/5972-505-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download