fa5baffb54f2d0ab4e4e82180909db28a08b44e99429dee7629bd42d7a4b8ed8

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
Size 38.0MB
Sample260819-b4bkwathrh
SHA256 fa5baffb54f2d0ab4e4e82180909db28a08b44e99429dee7629bd42d7a4b8ed8
MD5 71b96c1467a11436c652c59ff1b84e8b
SHA1 145455bb1c6c1a9bc648bea125627c4428ed43bd
SHA512 457b3086e67037fad38ad8ed0124c5782aa3c64dc4f95a865c587ffff2797249335eab70dc599b5cbf503c81304f0a7b76f8b4b43825fcefd5f4df4b0a13cd31
SSDEEP 98304:jsNsfsNsfsNsfsNsfsNsfsNsfsNsfsNsfsNsM:e
TLSH
T175975C06F98740B2E83B01B04CDBD2FF8A70BE258A128EABF64DD71F6933B905535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
5276	svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe
3772	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBAACCCABBCBABCACBAACBACCBBBAAAAABBCBBABBABCCCCCAABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe"	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCABBCBBBCBBAACCBBBBACCCCBACAABACBBBABCBAABBBCCCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe"	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2028	sc.exe
1640	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4216	cmd.exe
4296	cmd.exe
5424	cmd.exe
5620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3364	schtasks.exe
3356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
5276	svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe
5276	svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
Token: SeDebugPrivilege	5276	svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4296	1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe	92
PID 4296 wrote to memory of 3364	4296	cmd.exe	94
PID 4260 wrote to memory of 1964	4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe	95
PID 1952 wrote to memory of 5424	1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe	98
PID 5424 wrote to memory of 1640	5424	cmd.exe	100
PID 1952 wrote to memory of 5620	1952	2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe	101
PID 5620 wrote to memory of 2028	5620	cmd.exe	103
PID 4260 wrote to memory of 4216	4260	svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe	105
PID 4216 wrote to memory of 3356	4216	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_71b96c1467a11436c652c59ff1b84e8b_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCABAABBCBCAABBCCCCBBCCBCABCABAACCAACAAACCACACBAAACBABCABBCAACAAABAABBCBBCCCABAAACCBCABAABCBBACABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCABAABBCBCAABBCCCCBBCCBCABCABAACCAACAAACCACACBAAACBABCABBCAACAAABAABBCBBCCCABAAACCBCABAABCBBACABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABBCABAABABCABBBABCCCCABBCBCBBBBCCCAAAAAACBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe" start= auto displayName= "UserDataSvc_ACBCABBCABAABABCABBBABCCCCABBCBCBBBBCCCAAAAAACBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCABBCABAABABCABBBABCCCCABBCBCBBBBCCCAAAAAACBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe" start= auto displayName= "UserDataSvc_ACBCABBCABAABABCABBBABCCCCABBCBCBBBBCCCAAAAAACBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABBCABAABABCABBBABCCCCABBCBCBBBBCCCAAAAAACBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCABBCABAABABCABBBABCCCCABBCBCBBBBCCCAAAAAACBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABCCAACCCCBBCCABABBCCCCCCBBABBBAACAAAAABCCACABCBBBCBCAABAAACCBCBACBABBABCBCACABBACAAACBBABAACCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABCCAACCCCBBCCABABBCCCCCCBBABBBAACAAAAABCCACABCBBBCBCAABAAACCBCBACBABBABCBCACABBACAAACBBABAACCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBACBCCCCBAAAABAACBBAACCBCCAABAACBAACBBBCCBABBCCCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
1⤵
- Executes dropped EXE
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c51a221ae8af14a03c5f4d0c3c1316ae3fcc37dd5940ab8310958fc985e02e94
MD5 1608ef152331672c3477c29fcc80c84c
SHA1 8ef16bdb043ad097af31e90460fcfddc11cd5feb
SHA512 96e9eb4883172ed3ae2cd8a7ce06a01350ea96e6fea1fdfe8485dd9becd45958c9f26cd88b58c39248b43c4b9c57e27712e37b98f751fec0502395e218d85cdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05d9067cd90520f8d558be8cc87194611b8f3d228d79aee57f2628808b28227e
MD5 9d30adb8b4583d15003210de73bccc20
SHA1 67731271cb72af83cc0ac265f3beb9d33a9cdfa2
SHA512 89c4eb263a577abfba87aa31b9b462b31936977815e596cd34fa78a03ac602fa31bea72935f4e1fa86929cfcb2a3cf370a2d3d6e07ac25d1959fd1cd071ad096
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c6ec7ea329e79e0370929d569987b92f39d2f2d9a7555657b5e5bb7dc5b9a6b
MD5 86bb3b6a1c855f6fc1dc270bb8c223a3
SHA1 66028e30a4eb71c03c84a8489655ba195831e7a0
SHA512 8323f8a1ff7674fd8c12c26bb291ab2e06e68c59d7692deb939aea6fb4f8b03af1510a245e73ef227884727bde7daedce9f1baa9def3d94fd97787f9a7cb2701
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22341b8de5e8f361dc91a13f488fb8b5e3675b9282dc8e3ff0dbfd4d4ae352d8
MD5 a228e3ab52443a101bc5ff6c010fdd99
SHA1 9474bc04a9b9c01bd7dc9fd3a592c5fb91bdeaf6
SHA512 d14c3b876fec46a00dd608b193d97bdd2f257efeed80fa3a99caa553858a2f27776f2e7e907f30037b84e2b086f7ca7dd6c9445fdc7f80894b88aefeea11408e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8421ce9ffb4cac26f4ea11fb37a96edef12bf0eb633ce85e03ec577051686d3
MD5 6a8ec65fc188beb8280f1bfc74e97a64
SHA1 f05df4518abc6f48c0ef7321bd2ce540f0647803
SHA512 10e3f039b43d244a9b69de382873e011a46b699625f10123ef415a9679abea7a24a7b53f13169f359becec5d8027fbb79a574b3801bdf453a2e5739adb267f5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d767acec262c5dc3235e6065083d0ab46f316d3f8a2dd5056d2e60753e316cc2
MD5 2b4a9f91edb0c33bc224342903a17f07
SHA1 eca81310ebfa2a5482883d3d83a5cf95795dc0fd
SHA512 c547825f374e23d79d6ddf8e56e0bce5c8f9ad08ae9c5f31d94976a4a9033b2221943f3fe9b4f1ae47c3de62733ca47eb34e20af917dc4d3ce744474eaec98a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a63c687bbd280179209765d68bf61a1bc59b5c729948c30fa1bbfbbcfecab7a
MD5 6cae37cb686e0d2b4867bbd49396a508
SHA1 0841fdc850b6a6ed42e7acee92bd6c35c207121c
SHA512 ec157a15988789d21c6c996990e3e0aa9ff70825ce6dcf0ac472231be299fc2f30f6c45fdf9dee47e58aaccd0bb4035081db5fb86c720e9c7e068c3254adfbfe
MD5 SHA1 SHA512

Submit Download

svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCAABACCABBCBBACACABBCCBCCABBBCCBBCBCCBCBCCCBABBABBB.exe
Size 38.0MB
SHA256 fa5baffb54f2d0ab4e4e82180909db28a08b44e99429dee7629bd42d7a4b8ed8
MD5 71b96c1467a11436c652c59ff1b84e8b
SHA1 145455bb1c6c1a9bc648bea125627c4428ed43bd
SHA512 457b3086e67037fad38ad8ed0124c5782aa3c64dc4f95a865c587ffff2797249335eab70dc599b5cbf503c81304f0a7b76f8b4b43825fcefd5f4df4b0a13cd31
SSDEEP 98304:jsNsfsNsfsNsfsNsfsNsfsNsfsNsfsNsfsNsM:e
TLSH
T175975C06F98740B2E83B01B04CDBD2FF8A70BE258A128EABF64DD71F6933B905535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 25595e45fe05ea4b06fe039d0fabf0f9ebae8ed8c61c6b58f16e1bd6f0216ce0
MD5 5fbc0535f27bba3e1cb8b268e694bc33
SHA1 68053304eb531dd60e1c0bbf6282444cfad1c35d
SHA512 7ad9af09281f1de97680247b5f919f1723c2c9e055dc303d1134c89507dc1f475dcf427b2e734190c8018b11f496c8543bcecfa69b0892479f85f16392e7cd32
TLSH
T1FB112330A4A5CC5BBD3268DF593DAA93CCD433DB542CAE44134C8218A7E9C724E218F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3ea876ef7874069f6fe758e5940cdae9fe46a1700397bbcd55036471a5a5be2a
MD5 4a9d0c8b9218152178e7bc8eb3fe15a9
SHA1 6047d3d8b250603c3e0f70e05a68f3e2eff90213
SHA512 9250cd021d500a601af97ee168ba4f8025089115bc5e6a19bd50608733f00a16846d19b21623711f8629d2e59389af9729266a0073fbb2fbbc0b9a4842c79fa2
TLSH
T13711D531E4A5CC5BF932A8DF593DEA92CC9433DB945CAA44134D8218A7E9C728D158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1952-6-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3772-73-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4260-33-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/5276-63-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/5276-87-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download