a0e2de0ee5baa1f0453b897fb0bf30d506e0ee6fc59f61176c3f223d6d249083

Analysis

max time kernel
152s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
Size 97.0MB
Sample260825-rz96mstdqb
SHA256 a0e2de0ee5baa1f0453b897fb0bf30d506e0ee6fc59f61176c3f223d6d249083
MD5 41fec869471c43528b0448e2990a0831
SHA1 1c5ef91a350984bd998209d8a235dec0b9013127
SHA512 4a8532eb36b6484e4a9faf5b8309403189c0bc7d95b7c13d7e896b9bf39e088ee765c58fe74c1b8739826b4507269f208efc43851fb966a8ae0e7ba52e6c61ef
SSDEEP 49152:U+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+Ej+E7+ES+ES+ED:e
TLSH
T19C282A09F94340B1D92B51F04DCFE3BF8A60BB2586128EF7FB4DCB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
2052	svchost_CAABBBABCCAACBCBCACBCAACBCABCCBABACCBCCBBCBABACBBBBAACB.exe
2344	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABBBBABCBBBBCCBCCBCAACBCCACACBBBABBBABBBBBABABCCBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe"	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABBCCACCBCCABACAACACCCCBBBAAAABACCAABBCAAAABCABCBACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABBBABCCAACBCBCACBCAACBCABCCBABACCBCCBBCBABACBBBBAACB.exe"	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1084	sc.exe
2528	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2516	cmd.exe
5456	cmd.exe
1988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABBBABCCAACBCBCACBCAACBCABCCBABACCBCCBBCBABACBBBBAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
2344	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
2344	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
Token: SeDebugPrivilege	2344	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 5456	3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe	92
PID 5456 wrote to memory of 1528	5456	cmd.exe	94
PID 3948 wrote to memory of 4112	3948	svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe	95
PID 3360 wrote to memory of 1988	3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe	98
PID 1988 wrote to memory of 1084	1988	cmd.exe	100
PID 3360 wrote to memory of 2516	3360	2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe	101
PID 2516 wrote to memory of 2528	2516	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_41fec869471c43528b0448e2990a0831_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABACACBACAAABBABAAACBCBBCBABCABABACCCABAAAAABABABBCBBABCBABBCABABBBBCCCABCBCACCCBACAACABBCCAABBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABACACBACAAABBABAAACBCBBCBABCABABACCCABAAAAABABABBCBBABCBABBCABABBBBCCCABCBCACCCBACAACABBCCAABBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABCCBBBAACCBAAABCCBCCABBBBAABCABACBAABBAABBCCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe" start= auto displayName= "UserDataSvc_CBABCCBBBAACCBAAABCCBCCABBBBAABCABACBAABBAABBCCCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABCCBBBAACCBAAABCCBCCABBBBAABCABACBAABBAABBCCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe" start= auto displayName= "UserDataSvc_CBABCCBBBAACCBAAABCCBCCABBBBAABCABACBAABBAABBCCCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABCCBBBAACCBAAABCCBCCABBBBAABCABACBAABBAABBCCCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABCCBBBAACCBAAABCCBCCABBBBAABCABACBAABBAABBCCCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABCCAACBCBCACBCAACBCABCCBABACCBCCBBCBABACBBBBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABCCAACBCBCACBCAACBCABCCBABACCBCCBBCBABACBBBBAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCAABCABBACBAAAABCABBBACBACACBACBBCCCAACCACBCAABCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c10210ad3c27102322064bb5981e9ec1350c6627dedf7e886263a534e394c4c2
MD5 25d3312470685cff191a91186ecbac79
SHA1 8c6ed0be0db3d19244714b12b0c1f3cd53cfbdb1
SHA512 a979fbc00573a946cc221a9c8e7f453666a9ec7426837afe217711f30bc3b345c9588d15f277b4997d09f31eafc139a3bf879c1ad1c52ad058e4ae479201fd74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 8719944f5a73eb31febab6724bec8f74ff99441a5dd7a3a5236256c52c1a54a9
MD5 27095e90054eaa107f24109ffcca3aa9
SHA1 85da423c12cdae47a86c7e4e2cc44e1b0d5e240c
SHA512 e36df4c9d5e92666e1888b92be145dcf9f88837cbd1e2d1f070f3a75dde6104317fe57ebd82f1fbd7f7d7540d9dbc8d83953f59bc568cef5b7ede8f9e2e8821e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 00302eedfaa26cebd430842f27b0353a26788492593f6d48bfcf891cf4d15e18
MD5 8dcd75ba2eaee6ab17b9fc6cbd99d443
SHA1 088072e8ddd4f697089c0ffef9921900cf810507
SHA512 8cb1d31c67da6dc157a0a5b26710e875c85681fbde5e27ce9384ff935c68a7ef3f20a2e3ba89490b3792cf8c78aba7899f95c636814169ef4ddb293fa86f5629
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 6fdb72a5e751e2f8121b705b02e6f45f1a0973c006d4d7d682e459d607ca35bb
MD5 071fea02dba936cb40718be9d2490882
SHA1 55cd90d9f76775f569b4c909f006bbd9cc55a46a
SHA512 5ab7e245b255749203655bf203da4cd3af0d2911761816398214f7b21d9841e33c6d31d6a21f56de135ab19f01049688bae2f61ca610415eca15ef03c443385e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 df140ba0379da4ff784e7cae778ec416992e6fde1418e1e1f2bffa0eaefeb951
MD5 5e0e9311aa026fd2971fce697f8b2665
SHA1 7f0678ff3ba5d924145de3a8b0f3b5c0ae80b21b
SHA512 8338f8781173237dff668d56de192f343367c28cdb994df4b5ee51748fa836f8b78c494b7acbad6271ee1da4fa4b51f9c9cd4dc5ba64c37647f4f41d7df1397f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 24956cb6f313e3e7cb20a345e8f0c3f9ff342f6903eeb207b83b43d015576814
MD5 29837e847280fe8b20557047d64e2caf
SHA1 9fff972dbb96e2cc66bd9774f521d29de8da1643
SHA512 9bc964d78dc88c819c84913afa3cc58fe6c5e88f8c579e361f71c6e53a6a4545c51f8afb612ae89788f6a3b423b0fa9e49cfa457503130be2d5ec128debb6831
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\qap`g`v~dtlq
Size 10B
SHA256 a38423a85fe260cc912526f201edbaa41f8e8ae031ed939b8e32f8863ecaaec4
MD5 211b04696ab644d6adb51ace56ba0d23
SHA1 0d677d6f6804fa3bb383106670c58f00d3366165
SHA512 212dd8db9bd32d3e0beedd6c63ad15ce893d607d9eb0d8e8db176391e7ad47a4ada79ad09b21999bcc7ace812f120d264be04a1bf1b695598d51047bf0437c89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\LockWatch\qap`g`v~dtlq
Size 10B
SHA256 2520c50d0a48b073e25c5ff9c87d85a1948837ec50b37e48154ce72cd67ee041
MD5 bede0b085a674bcdc31f2ad11a8c8be8
SHA1 4f59d63c90052efc5114c5bd9f725e4133ec4815
SHA512 ba03c0fd4f7284fd99cb6e2fa02113d849072c331a04a14ef490126dcf0a671966714d6b7f4789e296d0a9f2a513034fe009160aca735007e1c1230463ad3306
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 030bdfb92a259ae691aca99be7ee597799f21c091f6cad1cec7c69b2ef9045c8
MD5 62d2311d0fba128a22cf4c4e79475685
SHA1 90f49f4755c50e460a82918c8868902909f38cd7
SHA512 f96e9bce7c2570d104b571014739f9074810f6eea2d4953d6790d16f8eb7ac96b70cfbbc0a861c4ac4bb45477c2c2a84abefe85b8bc729619f770c79d7130733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf2e590842e7425a77ebdf230ff24b8fb4182ea0ae4bde932245ac925cbd0ba3
MD5 178c64c9218f1f67b24037ca17671999
SHA1 b867cb55d45a177ee9354162bfaafc4e110e8ce3
SHA512 7504b4da9fefc9f26aaa20277a25bd30b8e2e89fc57f1917324b27d7a94881b92e00b36ab2e53a9e3080e850431921ceb160e49e76866b636d3895de192e42a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 382d4597e3556b0e191140285bd79b832df6be64211f09551be9f0faab50ca35
MD5 7cf4014353a8b2dc413d3608781b97f0
SHA1 896acc64a7cbe4f15398c687d1dade4d6ebb8db3
SHA512 2e138febf6bece2bd67023bf7f1257731ad084961118b9a630ff0d132fd5466804765f8d673b677192a1a2f7142f512958c48b833788ee47c6e12111cd109889
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3aa19543b64bad025e17b36c0f42a62b28958ec519654915a95c6937ca6ce0b
MD5 bf5eec29af421a8d6b5270b80d60a7f9
SHA1 b22170b2322582d7c755a369d31ff2b5cd3d6b89
SHA512 1560a77f1e8ee0c179523b9a3df2a3acde720c831c3a2a75e662f36bb7e045ab85a0abdfb2301c08354f67950daaca862755818cc91911e75ee69d7bba79e7e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f640cbe5b849e34030ac59f8c7b3ed7157303bee2fcf51e305fa9030157c7c9
MD5 44595bc66dcac190d06e42b691eb7eac
SHA1 706804f3393bb81c558462389f5cd9dd15d94c77
SHA512 c8fe70ab4c5f9647f0785305b38f438b166767346fd727b74279e49c1be8abfd2687c98868f94480fc8f684ac316f87019ac5bd874840b14c1d7654442af433b
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2d047972010fb3b94d01ddbae1d43a486835509de6f92db8248e9c4e0df3032a
MD5 0fa71b2d67a9967c750c3112352dd6c4
SHA1 464e7f673de075af5e0b716c9f76afcdf212afea
SHA512 133459493d5e1cb51718afefc3ef523f160173b3a301a6883d76447549658e63bf48be161e4e0a9e8854c7fae29b640697ca4247430fa155ddd397e06026bc2c
TLSH
T15311C152F0F5DC27E47328CFAA56CD862DE036DE5C986E9423098618F7DDC318D958E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2052-70-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2344-963-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/3360-0-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/3360-7-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/3948-33-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/3948-23-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download