9e3f12c7f9c9ec944aa310119434a9b1edaaa9212a67ced9df96a75cb96857cf

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
Size 6.5MB
Sample260816-fmhebabd23
SHA256 9e3f12c7f9c9ec944aa310119434a9b1edaaa9212a67ced9df96a75cb96857cf
MD5 230c5181efc166f0f5ccfc47e8e184e6
SHA1 0c7d46745b3b2ea38bdcb88b5e2a67790c5b6efe
SHA512 0c78eff76ffd761c9bf7210708246148b21fd17e7aa289c5d1d1f2b614d7101652465a26f02a52da97bc4a4babb329052c9e636bc445aa1ab89109657ada7796
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+EsY52+ES+E2+ES+ES+ES+ES+EsY52+ES+E2+ES+ES+Ea:W5I5I5I5I5I5I5I5I54
TLSH
T194662B1DFA8350A1DA2751F04CCBD2FF9D60772183214EFBFA09DB1A6927AE1A43D245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
5632	svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
2764	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCABBCBCCCCCCBCABCBAACBCBCAACBBABBABBABAABABCACBAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe"	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCBCACAABBBCABACBCCACACBCCCCACAABBAACBBCBCBACABCCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe"	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5668	sc.exe
948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1384	cmd.exe
2556	cmd.exe
5144	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
5632	svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
5632	svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
2764	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
2764	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
Token: SeDebugPrivilege	5632	svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
Token: SeDebugPrivilege	2764	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2556	4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe	92
PID 2556 wrote to memory of 3008	2556	cmd.exe	94
PID 5656 wrote to memory of 4500	5656	svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe	95
PID 4132 wrote to memory of 5144	4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe	98
PID 5144 wrote to memory of 5668	5144	cmd.exe	100
PID 4132 wrote to memory of 1384	4132	2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe	101
PID 1384 wrote to memory of 948	1384	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_230c5181efc166f0f5ccfc47e8e184e6_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBCBABABBCABABBAAACBBBCBABCACACCCBCBCACAAABAACCBCCBCBBCBBCACAACCACACABCACAACACCBBBACBBCCCCBAABBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBCBABABBCABABBAAACBBBCBABCACACCCBCBCACAAABAACCBCCBCBBCBBCACAACCACACABCACAACACCBBBACBBCCCCBAABBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCCBACABBCCACABBACACBCBABCBCBCCBCCCCBBABCABCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe" start= auto displayName= "UserDataSvc_CCCBCCBACABBCCACABBACACBCBABCBCBCCBCCCCBBABCABCBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBCCBACABBCCACABBACACBCBABCBCBCCBCCCCBBABCABCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe" start= auto displayName= "UserDataSvc_CCCBCCBACABBCCACABBACACBCBABCBCBCCBCCCCBBABCABCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCCBACABBCCACABBACACBCBABCBCBCCBCCCCBBABCABCBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBCCBACABBCCACABBACACBCBABCBCBCCBCCCCBBABCABCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABAABCBCCCABBBBACCACCBABBBBACBAACCCAABBBABABAAAABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5c18440ae42f74934f9e37208bcb66cef7040ed5e1794f026ec407579385b2a0
MD5 6c20e69861f0dd1a3014d980aacede06
SHA1 d0b77652234f265d5f41a5c81d698e350a544641
SHA512 1e203df8bbc94959d62f8b0ad397d25100283b75f09fd91b551249719b6c3aa5f6caffe3e81ee5419a10493af60d628e2ffae80631af37837fcc5a9ebd373cd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\qap`g`v~dtlq
Size 10B
SHA256 cb7a7436d517cf18a69c20e6911143ee01afcc07bad5fb97df13a4fb5a1bdece
MD5 a27198e30c0c775649e6ff1267ce38f9
SHA1 a4dd7ab58c955c6d4d10074d08af22c5a42c5649
SHA512 692cf8c84e355296bf1190c135e1ff6eca87e63e713bbfcbed9aa69d6a3a476f79f32ebb899519473f01c3057c0f28a3d02b1503a4c4012fa651c1b7dd01be89
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 7.1MB
SHA256 21cbf51a5445ce252db0e790cb447859564e9c55c13ee2e7174918647d7adaef
MD5 d8996718f2561b896cb18a41ae6770dc
SHA1 24d3c71f630ba3c54f130e000616c56a79af1b55
SHA512 317a955bd6c04e5b0354b94a8e58b5ed16af53058678e5bbcdea8e6b6cee7430fa52891d63595549d37e7cf848fff91430247b09d1550c0be5bfcb8beabf1384
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+EsY52+ES+E2+ES+ES+ES+ES+EsY52+ES+E2+ES+ES+EH:W5I5I5I5I5I5I5I5I53gZ2Hb9t+2xR
TLSH
T145763B1DFA8350A1DA2751F04CCBD2FF9D60772083114EFBFA49EB1A6927AE1A43D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\uk\qap`g`v~dtlq
Size 10B
SHA256 2f7fd849a9ab974075dc37eb4caa9533b6b9e583ec4afdc9d70d4bb04cfbdcea
MD5 3e0808288681a56190d1f4972b81d706
SHA1 d9d98817c641360f6dcb83e172f0e060d47aafa1
SHA512 05e0b70877b4533047f8ffb8415a7b1cbc67fce3e179fafb133968f86b42ecc22ad1f056aef59879d1e619b289c10f643a435895e2f08400b537f2219a2ee0b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\qap`g`v~dtlq
Size 10B
SHA256 8da3cdc18fda57e18a3729f8c5fabd03f4a8fbabbd2ea9ef63f218e1dd29fdd7
MD5 7dfd859fc69ae8d0c5796bf7e00a9a4e
SHA1 ce772208b7bcdb169a9ba9298630fe1af0f16ff2
SHA512 6220e2636be7b80743e64d5194f61c022c852d1723a44edba110e4868499e15571bf6cbb63a119bc4b2dee9533494055bf1411d8d24b418be6949ef1cde898ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f49a3c1a48ec96c95e92617121c87c299fa53964f878b62af5911631a33ae5e
MD5 083d39f1a8adcbd472262fe297a81e4c
SHA1 2e418a646eb025c48acb28777f56fd6fa5709dc2
SHA512 5baa9a2f0d6a2131aee3063dfda74cbc3b7e2f70bd0ce12eec78c55f5f8908d8f23f4ac2f058942fca94637bc45e1126a08ab426a493e78bc559c9fa757193a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1d6d5436646d4e7c8f258777aca84f9456478e7fb89885ae6db849a216d791d
MD5 aa61c115173278558f2e847617a3188c
SHA1 3301c54c4d9ee249550028e47e28ffe2dbc606b0
SHA512 d02007f29ea675413bbd4743f86a554128f288b938c36caaa2098a1cbc119031b3c5ec0540befd052999650d0d0296fee8992a4062b7210060f4606d576da40f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f453544167716cb2158093b1010a3de04c054d7c843955e6fd0f9cc88c7484e4
MD5 a619938c61250ddeb5f838d67ceacdb3
SHA1 f52afe407d8d82c822cc4eedbd68d57c7731ebed
SHA512 65ec17dcdf2e7034c2bf37e2bb799755d7743d90f8d45ae903b1e02f0a1f5f04693cde8af0f400dfc896ffac0dbdcac7c2d0cba157b547e9c856a6545ddc010a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 313145db07f877bc2078eee9cc711d4b46b8b6c42401109517845adb2f33db8b
MD5 851dc873542d87b69eed6fe49cff6550
SHA1 1cc2395b4b6e0005c8eb97a1cf6b81d4b8274e45
SHA512 8c9b5967f132ba68b44f75fb986a53101422221ee5e46e15615f9cb44a64c678a1155ae15e1f34e9255f59c8715f61f3b3ffefba1529e7255f08e797fe3f5fd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5e804f5ab66e65cf059598a6ed9385c1e5cc6ad133aab7f9d45c6b20e5fe3483
MD5 cddb546af61bcc2ffd40a39ad448178c
SHA1 965bb391b4f253ca23f9f1cd83c934ad31a15746
SHA512 f9ecc17c17175bfd95411985c821cbed061242a2b0b724d6c5de86193c8ed5b821b558f5d15d33d6e5a0a62803566757f7208f1104ef738175c0f61ac78a1927
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd1bd92fb5fedce1903093c5e89f41952949fcae458d827395a5a2476e3e05bb
MD5 72cc975a2471f95f03958f29f6353af8
SHA1 207cecb0e25e9b7bb28f3edbc98cc7a395e165a3
SHA512 77a7703477403ba6991d58a754f46394f260c680d01aa4d372cfc9790a6bcbca09d4bab7c4a66fbb96a5eb6ff2796c53eaa64edfa48d352ad64cfa0940d582d3
MD5 SHA1 SHA512

Submit Download

svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBBCBBBAABAABABBBBBACCBAABCBABBCACACACBBBCAAABBACCC.exe
Size 6.5MB
SHA256 9e3f12c7f9c9ec944aa310119434a9b1edaaa9212a67ced9df96a75cb96857cf
MD5 230c5181efc166f0f5ccfc47e8e184e6
SHA1 0c7d46745b3b2ea38bdcb88b5e2a67790c5b6efe
SHA512 0c78eff76ffd761c9bf7210708246148b21fd17e7aa289c5d1d1f2b614d7101652465a26f02a52da97bc4a4babb329052c9e636bc445aa1ab89109657ada7796
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+EsY52+ES+E2+ES+ES+ES+ES+EsY52+ES+E2+ES+ES+Ea:W5I5I5I5I5I5I5I5I54
TLSH
T194662B1DFA8350A1DA2751F04CCBD2FF9D60772183214EFBFA09DB1A6927AE1A43D245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2b288c1026207b7d205f4cd6f4df4c67ac76244a97db52a9893037903b407754
MD5 c898e8a19efa25c192bd4201f735e7c3
SHA1 1032108e51884036fcde68c62c352a52ef96970f
SHA512 99e572be14d5b4c17ae21bcc67fe1534cf5b6e9b1ca118a13e9488bdc07de04f517ed3729b74969fd3ab6dbed5fe90191ad1965040342d53b875134ef22642ba
TLSH
T1C111A75195EBE493F872288BAA1DCFD30CEA778F185D7A5413099218E5DDC30CE1A4F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 07aab7b20e77fa2f029a1e5e27b6ee5a653654c2678897bedd7a50f201caec61
MD5 483edc1d673ccf9d3d4472413f0f3394
SHA1 0c7b6174d7a949a9f671772251c63d58071a5529
SHA512 7bde63465ec90d7ec22a46c58132d5c9c6cab326c3c7f443f83c3f6e22390e943d9032553cba37ac35e6aef7009f47933ac590c55dd06b23df0218ff971a4224
TLSH
T1D421A45195EBE493F87228CBA61DCFD30CEE778F585D6A5413099218E5DDC30CE1A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2764-81-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/4132-0-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4132-7-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5632-79-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/5656-33-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/5656-23-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download