c5e3fe567177517fc29c6211bcf271f0349784aec5cfd43c6ca73db40111b0e3

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
Size 85.6MB
Sample260818-2sxbbasbla
SHA256 c5e3fe567177517fc29c6211bcf271f0349784aec5cfd43c6ca73db40111b0e3
MD5 e30b60caac52f540f74c927b48983510
SHA1 8be004f1945fb19069189e944d9d1407a8aeca62
SHA512 5268321ed6926640fbdfc5b9370818de4e84eed9395beb954e51f09d6ff343abec29849b08bf4cf12e34cee679e813edf95e9b6730b88e3a517eb942bccee612
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwMa8obnyMWmddjZ7xlo5F+ElwMV+ElwMV+EM:VrU5erU5erU5erU5erU5erU5erU5U
TLSH
T1B918E519B69884A1D82643388995815599727C211B218AFFFD78B32EEF3F9F09D3D730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
4888	svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
5560	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCACCBBBCCBCBBABCABABCACBBBCCACACACBBCBBABAACACACACBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe"	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCACABACABABCCBBBBABCBBBAABABBBBACAAAACACAABCBCCCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe"	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3220	sc.exe
2732	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2436	cmd.exe
3068	cmd.exe
5184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
4888	svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
4888	svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
5560	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
5560	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
Token: SeDebugPrivilege	4888	svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
Token: SeDebugPrivilege	5560	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 5184	2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe	91
PID 5184 wrote to memory of 1584	5184	cmd.exe	93
PID 3096 wrote to memory of 3608	3096	svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe	94
PID 2524 wrote to memory of 2436	2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe	97
PID 2436 wrote to memory of 3220	2436	cmd.exe	99
PID 2524 wrote to memory of 3068	2524	2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe	100
PID 3068 wrote to memory of 2732	3068	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_e30b60caac52f540f74c927b48983510_elex_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCAACAABBCCBAABCACCBBABAABCBAABBCAAACCCBACAAAABABBBCABCABABABACCAAAAABABBAABABBBAABBAACCCCABABBBBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCAACAABBCCBAABCACCBBABAABCBAABBCAAACCCBACAAAABABBBCABCABABABACCAAAAABABBAABABBBAABBAACCCCABABBBBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCABCCBCAAABCBACAAAABBBBBABCACCBCCCCBCBBACACCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe" start= auto displayName= "UserDataSvc_BCBCABCCBCAAABCBACAAAABBBBBABCACCBCCCCBCBBACACCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCABCCBCAAABCBACAAAABBBBBABCACCBCCCCBCBBACACCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe" start= auto displayName= "UserDataSvc_BCBCABCCBCAAABCBACAAAABBBBBABCACCBCCCCBCBBACACCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCABCCBCAAABCBACAAAABBBBBABCACCBCCCCBCBBACACCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCABCCBCAAABCBACAAAABBBBBABCACCBCCCCBCBBACACCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCACCCACABABCCBBBAACCAACBBBCBCCCBBABCBBBBBACCAABBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCABBAAACCAAACBBCBCBCBCBBACAAACABCCCBBCACBCACCBBCAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0d819c6df5aa64da4c688069b2c9b1754b045df1c1b671e29b7dea29d62905c2
MD5 0bcf477f971879df9c5153e807390cc0
SHA1 8f4d15851b4c9cea6ab58a8fd678a0971a95de34
SHA512 f74d885c0ede8934de1573311b00b7395e5d7447370781545e63219c4d057e6622a85851071368895057dbc93c91061771c96aec09679269d2d60111e1c09a11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\qap`g`v~dtlq
Size 10B
SHA256 66e1e0ce78a233407818abd0f9149bbd1467f223c4b9c6554a8fcb227d84a5d6
MD5 577e133f7494f870c342923ae4b9c523
SHA1 44e8d8d3eefc608c744ed7f2402a4f5e64bb054a
SHA512 dcea38a141cece65826078d83e7542f6045fe7059dc2d84837b942f23b205b9b2a06f820947a028ca6e7dfacda1d96776737eacc55c378c9e6624f1a41b8a13a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 b075d55235e275062832efec0fff2cd27bdbbcdb8fe2467b5be421bbf35833e7
MD5 26fef49e68ee1463413a74111d889c89
SHA1 6dc5118720676e84b24d736faad7faa268c82444
SHA512 96ea720688ede6cbcd4182770a8bc1edc8925b79a2ce78ad3ea164aabd8e2abb022e901b6cf7f9792080785ab0afed74544b49d521485a28ac20b263a8fcb5e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 345ce9a1931e12693d31cd52f8d71e1273cafee00ffc7ffb506693a5fcbf7752
MD5 866877c4fe0dfa6438361134d076ddc2
SHA1 890547c41198783723f7b3d71a223f3e00018133
SHA512 c2c9155e8220217faf1e2fe8eaefc723bfd5cb101bdb93ff78113d377a5d42f876ec614197ff78533f5a7ae376b2567d3a9b4217c65bc538219d1ed28909f680
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 216449db62355ba93b531d4e4b01f490bf4094db6692f766508493b72577ae99
MD5 78633fad08b82232a191974bb7c6a64f
SHA1 18b12266a7589c4d5fcaf53828d677224aa549a2
SHA512 1f00dd47196a6212aebde7ac47779b78349ccce225e0306c0c6b45f82bc86a6646945ff85b822000f3710a2430d6adaecb88b821a043183cd3803eb63d1a0f78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qap`g`v~dtlq
Size 10B
SHA256 bc481adaa52b75068d0261f49d44c6f14de5cd770f253b7e0dfedb90ac639254
MD5 c28b2b53dd7d6c1e69fbaf8e2cebffb2
SHA1 94a6d63ab905ef3b95a7b7d362575b8dcb596223
SHA512 41039d63cf558281f7c6b979e581237a9116d0544feb4d311ae4b0d0940cf19a051ee86a2b9d5ff8fda2c8a5ded2e78a5b777fc9635484ff3d524f0a8cdb778d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f2514d1bd506ff0b4bb5bdc70d00271f4b48034b927ee49051c1277cce14b1be
MD5 f1c7d2ae36e43d948b5a60488512abbb
SHA1 3d9d0a75333639914897bdb2f15ac1e639d4b4f7
SHA512 a541c52f6319349def2cf0ec41a3ecff4d1309129bff5aae59a0006fc8b8b87d1435b4aadfba89c56f7b9df40b20abd07232f615dc1d1286f51a0324be24168e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0ebf5085655afde4ad3f269fc751c513d429ec078ed271707e3c9fa0d886203
MD5 cf5080d83492d38352d534f92a8b5dd0
SHA1 a4cbea06106e04cf1975557da0400a1ed69e4e6f
SHA512 98fb1fc7e6a92d5537eac69d350020e2b7873b350f9864ebd53b10789ad2bd218d6a4aff083f4495f97bfa68f41c524e453bd19eefb58f8b4c98ba7ebc0b7ad4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d2d6eddcae2adb52a25c8dd79b329c4111648c4c03075baf44e78cb41e4e912
MD5 8320fd990bc27ee962d7da7e45109265
SHA1 a3dff76572019a1f993e3601ebc6b4f04a68a17e
SHA512 f1ffb4edc51ef3cf7e7d54a5a38afad62b883d66242197578fbebf81a761179d1a1cf4fc3aa387fcc6e0aafdce3e97d4ddc41e7f195a29e1b55cb9a454a2ddef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8297aa00d01b6de0153b00782bc78ad7146c22c5e14a7c15365b870ccb0ece7
MD5 235b894926947b5c5a75364aa61a95a6
SHA1 71921d63df7900ac4a1bf7e10ed61071ed685ff3
SHA512 dfbc38b50760fb6311756703a6e55f0a4364a81e8c74058c04bf5ff2cf1d6ad728ca4115bd9ebf07d0472658e435884989c24291081839e9987d53a369fb18aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54a1c9b73d29c3c10270df4377e2fa7c2588719c969b9569f39603447b665772
MD5 83bc2633380fb23595604647f17d6154
SHA1 94d620438eddc3dce098b4f64ccb73cd90b54eb9
SHA512 3380f2b7a710838ba0ae78de1171d7eabcc9ba12ffeecdc446427f756ed2bd2f0212723e5a9bae7bcf3986ec0d04e98d1e724b1cca9a6e45cb988e5fe42c4813
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fe268fb6267d61f6cc6b91de58d8c9e40b0df65762857db6e207df7fe7fc440a
MD5 c4f510e12249627aa282f51ba94a025f
SHA1 6356d20932496c0e7ff3d96b2cf2d7ab1d01abbc
SHA512 0eda6e43e3732b4fa601d4fa8be38fa95dc6386f2472bf967c3875700de1d8e065ec646172f317ff448fa7b81d007f9df08de780a9ba81d53a15f7f409ee5985
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1f8ccdcfea2a8c41631588c0072d64aa5baf5292cc97f59a7e50a755df69db72
MD5 7811c42d83627174c7bcdc52ae95908b
SHA1 cf79e7e745415d480f5e0502198055523af8a696
SHA512 387dda428c8377234f3517c6fa26bce7722816083012f4b084a1327babdb7272895c619ce0ecffd857e150e6d93e15868bcae7734f902f9e7a0bf5ee815ae12d
TLSH
T19A11EC40E4F59823FC32788F632EEAE208F8379F6C546A192319531D739AC358E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ad8d2d069e55054eabf7050343a6b0291d55cfdb898fc5415e98cb1c02ed4644
MD5 51cf5219c341964225d79f3b20f6b27e
SHA1 35e472ba1607e711bc536a468c1b271307ded717
SHA512 f46c6d74f60f9231051c9c87309f98e1638077a64f75feeb44ec2381367aaa1ef5ee5c88333f030b8285e594b1a1f81480cb9b400013dced42e0b8cc4351cd72
TLSH
T19E21C040E4F5C823FC32A88F672EEAE20CF8379FAC546A192315631D7795C358E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2524-0-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2524-7-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3096-33-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4888-80-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/5560-773-0x0000000000870000-0x0000000000891000-memory.dmp

Download