4a15f89b8cc697d739ce272bd75e8e82927ea5b0e55d6fa6fe51283db70b0e94

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
Size 15.5MB
Sample260815-kllgsshj9x
SHA256 4a15f89b8cc697d739ce272bd75e8e82927ea5b0e55d6fa6fe51283db70b0e94
MD5 fc4a5ff1a3a2a934914cf2b8d0467e13
SHA1 b19b230a786f4afce6edc85e2148ef33ce7c2dd9
SHA512 61e309cd2b0a52740ec0fa4e75456ad89980ad021429968cd84ade6492e2c780c9dd00dd768a62e4adf4713048bee37c1c2be29351cc02f7cfc70be5346ad17d
SSDEEP 49152:U+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ESU:s7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1B7F61909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1592	svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe
1968	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCCBACACACCABABCBBACBBCCBBBACCAACAACBBBCBBBACCCCBACCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe"	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBACCBCCACCAACCACCBBACCAACBACBCCCABCBACAABBCCABABCCABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe"	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2076	sc.exe
2196	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
4260	cmd.exe
4912	cmd.exe
3352	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
872	schtasks.exe
3328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1592	svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe
1592	svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
Token: SeDebugPrivilege	1592	svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2716	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2420	1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe	98
PID 2420 wrote to memory of 872	2420	cmd.exe	100
PID 1896 wrote to memory of 3492	1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe	102
PID 3492 wrote to memory of 4284	3492	notepad.exe	103
PID 1764 wrote to memory of 4260	1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe	107
PID 4260 wrote to memory of 2076	4260	cmd.exe	109
PID 1764 wrote to memory of 4912	1764	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe	110
PID 4912 wrote to memory of 2196	4912	cmd.exe	112
PID 1896 wrote to memory of 3352	1896	svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe	114
PID 3352 wrote to memory of 3328	3352	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCCCAABBCBCCCCCCAABBAACCACACBCBABAAABABAABACBCCAABCCABCAACABACCAABAAABBAABCABABBBCABCABBCCBACBAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCCCAABBCBCCCCCCAABBAACCACACBCBABAAABABAABACBCCAABCCABCAACABACCAABAAABBAABCABABBBCABCABBCCBACBAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACCCCAAABBABACACCCABABBACCBCABACACCBCABBCBAAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe" start= auto displayName= "UserDataSvc_ACBACCCCAAABBABACACCCABABBACCBCABACACCBCABBCBAAABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACCCCAAABBABACACCCABABBACCBCABACACCBCABBCBAAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe" start= auto displayName= "UserDataSvc_ACBACCCCAAABBABACACCCABABBACCBCABACACCBCABBCBAAABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACCCCAAABBABACACCCABABBACCBCABACACCBCABBCBAAABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACCCCAAABBABACACCCABABBACCBCABACACCBCABBCBAAABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBBCBBBBABCAAAAACBAAAABBACBBACABBBBCACCBCCABAABBCCBBAAACBBBABABAAAAABABCBBACCCBBBCAAACBAABBCBCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBBCBBBBABCAAAAACBAAAABBACBBACABBBBCACCBCCABAABBCCBBAAACBBBABABAAAAABABCBBACCCBBBCAAACBAABBCBCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBAAAABCCBCCAABACBBACBBBBACAAABABACACBBBBACBABACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
1⤵
- Executes dropped EXE
PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1126eefe6991491ff498bb5f5a975221112442b3d9f3797f1057a1c8dcc3c1e
MD5 cbc30b236b8dbcfd8287b181f39c773d
SHA1 6c6d247c975b0ee23ca4d97a57a7acc4b623fc24
SHA512 15b453b07f1df5f1c81c0f177882780f4381f5375e1ac649385fbce1c24ca975ca8572b1820b49eb0953b099481d9306540fba0331b7e659bd13410e24af8635
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57ba5df7a42c4f678280c4028b19646e083148928c1ab873d4b70c2d0dea4059
MD5 5728753a4bf501a6f11bb197dcdff502
SHA1 a28578a51865b61cf53715b796bb722312267d2f
SHA512 1d408efb23e8aa94e52e7412cdd85b1adb560e14f1c399676ff056c52eddc69b2fefd3c198e87e7ce61770f416ca653ee82ff17f0159c837436eb152176f26c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a9145e229a8f94a393d87362279f0a0ca36a6c3f02d9c8198868f9b35ddb5d7
MD5 25f4827dd855e2231bed9cf050881d07
SHA1 7e4ee3b1d6bdff23af0f0c65d2f2a3fe061386f2
SHA512 fa4fc479c743c9a8d2b020f973efd0f3bb4f85dcb5ef0784341b8540d9e7f34c2f185301b3daba6411e7dc620d752a54f8957ef0ecf0985ad9a3e8c8e7ed5ae0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 513f3a6a483cee6f3e0b2f21f9f33c94b9818de33076785be5935c9f83f730b2
MD5 e64921c321e885709951af1c25783f82
SHA1 d97d588a6f5c93e6af2753b413ff3f5aa58eb4d1
SHA512 c78bc349a568212e58d3bc36db6e3664913d0d277e1a13c51e37753877aee33d9897e543ae1ff86bd1afb0ed6f14ea149609a6440211743bf2a29f013ab5c51d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3d5872ac56e970b2cfa30d955ce6d79ee9f38c67f4a7382f19260387e87ef60
MD5 d1cdf87c1e0571890f8eebe1a31d124b
SHA1 8e4fa5e4304e487a9ac46c3336327381453e20cd
SHA512 faac28f155ca6a5103e3fd4381441c6cfb766dca54b48b9e6a7d9d2782aa11a422cce1c782b5899306ecc6d5d746a9ffb8fd11369b9c53550d5448644d54d03b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eab24887c93fc5c440ffdb675b1116a6fc427c3f24149d1b25c1fb368e5d6197
MD5 f28f009bd03cd693156b4bb1b28da0b9
SHA1 598e5e7e95926ae12235c99525b524c005001f66
SHA512 69d9796c3f275027a85ddd8859934007e19a501cdc51d567092a4a1f93c17603d28da591add98c8f9fd00294f90ab3130b08b1594378791f72ba21f7ae7aef1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1bf4742770cefa7f34fca8df2609e5bc01b9091cebde252817fe82d31475b5ab
MD5 92e44c36077bd485eeb3d241308cc571
SHA1 96bb71873560aa8250ab00ab1aa9e0df2a7e8828
SHA512 fb9febdbcd66027d0e816b4623c5a29d6011637449db078dee92da5a42dc273c65c6ddef6be728d75e286a55e1d20469bc94f2b4960dd67f0a5b5989cb72c6fc
MD5 SHA1 SHA512

Submit Download

svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCCACCBCABCACABACCACABAACBBCCBCBABBACABAABCCBCCC.exe
Size 15.5MB
SHA256 4a15f89b8cc697d739ce272bd75e8e82927ea5b0e55d6fa6fe51283db70b0e94
MD5 fc4a5ff1a3a2a934914cf2b8d0467e13
SHA1 b19b230a786f4afce6edc85e2148ef33ce7c2dd9
SHA512 61e309cd2b0a52740ec0fa4e75456ad89980ad021429968cd84ade6492e2c780c9dd00dd768a62e4adf4713048bee37c1c2be29351cc02f7cfc70be5346ad17d
SSDEEP 49152:U+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ESU:s7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1B7F61909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 86920544619de712be804bcb0150de0fa40d3944690022176234a31ccabc867b
MD5 c3a9dbcf10b4ad02611c5e887868c878
SHA1 f1f549ca4583179be9946ef6496603514942d0e5
SHA512 202b5aeccd7726717b05f6bf08f592e34afb304ab87b27fc07f667806538bc5b1ca86e964f9a7fa127182e6bc4227246a96aa713bb8fcfd1c1894905cd5bff1c
TLSH
T14A012611D4A5DC97FD3328CF9B09AB430CF43B97689C5E1433468228B7CAC31DD454A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ff1a4707e77559c7c51c1ce7e41503e48a1d812d091074fc60110c0f8d4c6833
MD5 4b44e671e19694fb250fdb59a731cb4a
SHA1 d87898971e1b90c1a967feeaaaa73948a2536ebb
SHA512 2bc7ce860f3d6be37e1126530e77459fe5b3cf58cc3f6797b1aa2c98c7de9d9cf9b1f0345a0ada7e01c8b9bd07d2dca797dd20973d6fe4df2c9dfcac57b9a080
TLSH
T17F110E22D494DCD7F93328CFDF19EB830CA43B9B989C5D10634A861877CAC31DD094A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1592-71-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/1592-95-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/1764-6-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1896-35-0x0000000000390000-0x00000000003B1000-memory.dmp

Download

memory/1968-81-0x0000000000390000-0x00000000003B1000-memory.dmp

Download

memory/3492-59-0x0000000001150000-0x0000000001151000-memory.dmp

Download