759d2f8f57cbc589efa9dbdf75df9708d29f68f2d5b88855c0ca94dac456fd15

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Size 5.7MB
Sample260814-e9efhavwew
SHA256 759d2f8f57cbc589efa9dbdf75df9708d29f68f2d5b88855c0ca94dac456fd15
MD5 43690212e65dc21ba6e54e9638b993c6
SHA1 ad066ed32f8d77885da690487bde868cd4215112
SHA512 cc294cec5bdce5561b101549ff5e0864a1e654ca3bfb35a3ebbad82805f9ec92d1484c9cb8d365299b51f09d6c233409418904062964045c65bca49a14b782d0
SSDEEP 49152:U+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2vd:V
TLSH
T1D756F80977FD4854F5F7B23489B28659DAB2B8915B32C7DF5280823D0E73AE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
4308	svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
3940	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCACBCCACAAABCACCCCCCACACABBCCCABCCAAAABBAABCBAACACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe"	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBBCBBBCAABCCBCBCCBBBACCABCACCACABACBBAABABABCBBAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe"	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
760	sc.exe
2384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1516	cmd.exe
4568	cmd.exe
5920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
4308	svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
4308	svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
3940	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
3940	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
Token: SeDebugPrivilege	4308	svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
Token: SeDebugPrivilege	3940	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1516	4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe	92
PID 1516 wrote to memory of 4092	1516	cmd.exe	94
PID 4416 wrote to memory of 2804	4416	svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe	95
PID 4888 wrote to memory of 4568	4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe	98
PID 4568 wrote to memory of 760	4568	cmd.exe	100
PID 4888 wrote to memory of 5920	4888	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe	101
PID 5920 wrote to memory of 2384	5920	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCACBAABABACCBABBBAABACBBCABACABBABCAAAABCBACCBACABBABBBBBABCCCBAACBCCCCCCABABABBCABBCCBCACBBCABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCACBAABABACCBABBBAABACBBCABACABBABCAAAABCBACCBACABBABBBBBABCCCBAACBCCCCCCABABABBCABBCCBCACBBCABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBBABBABACCAACBCBBAACCACBCCBACBBACBBCACACACCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe" start= auto displayName= "UserDataSvc_BCBBBBABBABACCAACBCBBAACCACBCCBACBBACBBCACACACCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBBABBABACCAACBCBBAACCACBCCBACBBACBBCACACACCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe" start= auto displayName= "UserDataSvc_BCBBBBABBABACCAACBCBBAACCACBCCBACBBACBBCACACACCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBBABBABACCAACBCBBAACCACBCCBACBBACBBCACACACCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBBABBABACCAACBCBBAACCACBCCBACBBACBBCACACACCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBAAAAAAAAABBBBACAAABBBCAAABAABCCCCBAACBCCCAABACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ef081e8e05f9f6bb1a766c3a6a6f2a29499d597d481d19689ed8dea86212190d
MD5 d6f57dd332f54a6834677f031df98b30
SHA1 057759591c0f82d54ded36cc265b44f8b8b52b82
SHA512 3065957395c62efbe56fdffd166b70be42ff35815ab5ee62788a8fb7ccb55987c45feabb6f9607df59689e208c99207537ff105fd88cb35c2d75d42aad190150
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.3MB
SHA256 1f6ec58515c493fc7fd7c0650d6b0b468b779b7ab7989d75c8743f8a9bfcdfa5
MD5 d7279dd59395b641c95be389a2b64d0f
SHA1 98bb5783643871cfb7589a787d1dd80ec0a6ba89
SHA512 a59b9e93c23df1803459c5588c419fcc67c43b3d8c36df3a2eb636142c9dfb7123f8891ca27f29059fe83bcee5ec169728561a625687db948eaa8ffdc161b764
SSDEEP 49152:U+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2v2:kgZ2Hb9t+2xx
TLSH
T14366190977FD0854F5F3B23589B18669DAB2B8615B32C7DF5280823D0E73AE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\qap`g`v~dtlq
Size 10B
SHA256 e13760ea7dee514af1914268861c1a62db270b755513dd05ca5e34a2f0b8d3a0
MD5 a0a7d8c0b097c3c55baf6cdf44895b53
SHA1 baffae061730212a43e23215123dcf2837d09d90
SHA512 aec8e96543dcdd2f2fec0ed4e37065efa9293dd7da2c6e9ca3453a193713ee9edb7e3587442f50d4c491ddbb987225eebc2c2c7ac586c5de54bed186261443e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\qap`g`v~dtlq
Size 10B
SHA256 dbdd897ad4d4b8dc037b810eb4cf1bae1aa27aec221e3bc1bcd50ef6ee8f4228
MD5 eb152507de6886ea896bf24c5dfd744e
SHA1 adf74c8c24f24848c588d989941332cf7e4b7573
SHA512 e859a67aa3bb08f4d31f0674a594b4b8852780edd700dfd1facd49fe1f4e9ad86ec560fd9a26bda271b119b2ada1cb9a828eee0e019a76104be839915c6491ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1067be4b7ef8843d6a5c166beff9a2715776b4e96b02fbb0fdfae4b845f2104
MD5 f7002264d33cded826070776f5d56b59
SHA1 fbfcfd647a4531bba780c78e1fc52491e3ae6a34
SHA512 9efc6b238ba596476b6a3af43b6a26661d36b2c5b7071faebf9b9a02925f39c481dd8d0428cbdcc7fbe8f460cb8f89515ccc65f6e495fcd3a1c7642365b1ed15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73ee5afcc480cba0de0274da725437a0d06a703af64e4a4074b7d2295b863a82
MD5 8a139335a3d535cc6246e6d938c33e82
SHA1 4440fdcc2594238da26e5b9ebf7655cab7ebee11
SHA512 da8352967d9e1e0b3daafd158b104a21d3137058e2cde210e9b6bc1997a20476083921b1e109c11449ad54d12ee33f66d1a3e963c73e95fbdd1385b2eda1faa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 709ce8ea860360d9e5dfbc1f1afd83f4f4b3c58d232dfbd011c91f2996aca79b
MD5 418dc8d7802f97bc460b8dbbc0be384d
SHA1 eb08b63a81589f9eff8227113e2ce91a0e366410
SHA512 3ebd91cd6cb58dffe0bf665036f6bedf071059cdcefce07a2e0f68582abe3370ba74610364e20fd2ded72bb4716c8756b15a56dfe1fc3d124191aa17c124d515
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eca0dc218328c3e7d5e537faef762decb32b7e6b3b567ce831164abb12c69806
MD5 25a3591198b7cdf2aabfd22578dee825
SHA1 ccf2bd0cad96f73790b4ad52971981efe3d3118e
SHA512 49469a9fe11731b0548454a6576bce8b3b7d603768c63cb15ae5a09a53664d73f764d60ce8120eab39599460b0d791ff313334d979e2aea9f926bbfef809a5f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf4cc5fe516bd1c0b070cc2114dae6202d51fbd098eb75977e80a2cb8693b2c7
MD5 b5656946a7a863198c5a83530a7652bd
SHA1 615a66017caeda98119c7d2b120d6d27247845fd
SHA512 d903edcfaa2ccb0063c78fb30611d63dd8708952ff494eb4a9446f29b8615e35661d5315594ba9dfca6cb76b3465e32f90ddbc6a8a28b822c13d4fe557c9bb7b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5cacdd3d41d22c2e19ccdffa50bc33c6fb28a9c6c5b7117423bb0cd0713bb3ea
MD5 4574f026d3cb92f7f6c70b3cd5479902
SHA1 69af19c31ec400056ac28ef50469b85eb239a155
SHA512 ef484d6700b5927db4eba862f17bf1cbda4d13dce05ea405292cbf81f4186922c304745944c17c20e33f381e03a8aed2fd32d1d68553c9d8fa84296bd79fb36e
MD5 SHA1 SHA512

Submit Download

svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAACCBBACCCABACCBBCBCAACCBCCBBCABCBACACCAABBAAABCBBC.exe
Size 5.7MB
SHA256 759d2f8f57cbc589efa9dbdf75df9708d29f68f2d5b88855c0ca94dac456fd15
MD5 43690212e65dc21ba6e54e9638b993c6
SHA1 ad066ed32f8d77885da690487bde868cd4215112
SHA512 cc294cec5bdce5561b101549ff5e0864a1e654ca3bfb35a3ebbad82805f9ec92d1484c9cb8d365299b51f09d6c233409418904062964045c65bca49a14b782d0
SSDEEP 49152:U+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2vd:V
TLSH
T1D756F80977FD4854F5F7B23489B28659DAB2B8915B32C7DF5280823D0E73AE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e95a0ff13e4e5940921f6a82cff65638d828b6a4c99719cc3d4fcb17cdf51ba6
MD5 fa9c99bac108793b05f6c30b173e513b
SHA1 2162cd9933cbc6ffc27e6bc492ee8dcb1d35405d
SHA512 6194ef7244397a65c2c4ff5be32d8fd4e227d24ab1cbfbf8b9e96eb712981bb837be537785af91adcef734ad474a69830294b0617a3bcf849350e287cf3344bc
TLSH
T132113D32ACE5CC77E833B8CB821D6B830CF5A29B64586A54230C8128BFC5D34CD59CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 afef6bfbd27f3db34781da4a45a18e56490ab2716df86ede92f47ea9cfb6a606
MD5 f8d2c65adcc2a0acccd875c147d85c88
SHA1 c19b47a8e8d81460b1fa2ec9aab741a908a85815
SHA512 b9e7c42755b51ca0daf3dbc65c4b376e46211ce3664754882622d7bacb2cd70915cbc526cb871c8c17d1898cfd24dd369219d7909206397fdec49bbf5c39b673
TLSH
T17A113B726CE5C877EC33A89B822D5B820CF5B69BA4586A94230881287EC5D34CD59CE6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3940-81-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/4308-78-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4416-33-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/4416-23-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/4888-0-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4888-7-0x0000000000480000-0x00000000004A1000-memory.dmp

Download