904f43af2f3814347d1a6e5a20bbf1cec915ddf359d21f037afa0cf6b4de19dd

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
Size 2.3MB
Sample260827-j2nreseq9v
SHA256 904f43af2f3814347d1a6e5a20bbf1cec915ddf359d21f037afa0cf6b4de19dd
MD5 ce9b90fee6c5e6eaa39ac54938632a72
SHA1 2f583120bd949bea4c6f6a25b171714ceef2988a
SHA512 0bd1f0d5e39fe0f14ffc8ff5756fbb846f098466f56e9e024cc3db9e8a3470918139a42aed59355fe64a1129bb9c371da9e6bb51276c1ce949f87ff2e86efd85
SSDEEP 49152:U+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEb:v
TLSH
T19FB58D06F98780B5D86B00B00DCBD2FFCA31BF61C5114EEBF78C9A5F6932B915524A69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
5436	svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
960	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABBCBACACBABCCACBCBACBCAABAACACACAAACBAAACBCBAAAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe"	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBCBACCCABCAABCABBACACAAAABCABABACCCBCACABABCCACBCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe"	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5704	sc.exe
3324	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4500	cmd.exe
5592	cmd.exe
5836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
5436	svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
5436	svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
960	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
960	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
Token: SeDebugPrivilege	5436	svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
Token: SeDebugPrivilege	960	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 5592	3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe	92
PID 5592 wrote to memory of 5468	5592	cmd.exe	94
PID 236 wrote to memory of 1004	236	svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe	95
PID 3956 wrote to memory of 5836	3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe	98
PID 5836 wrote to memory of 5704	5836	cmd.exe	100
PID 3956 wrote to memory of 4500	3956	2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe	101
PID 4500 wrote to memory of 3324	4500	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ce9b90fee6c5e6eaa39ac54938632a72_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAAACBCBBCBBAACBCACCCBBAABAABBABCBACBBACBBCCACAACAACACAAAACBBACCBACBCCAAABACCAAACBACCACBBCCBABAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAAACBCBBCBBAACBCACCCBBAABAABBABCBACBBACBBCCACAACAACACAAAACBBACCBACBCCAAABACCAAACBACCACBBCCBABAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABAACACCAACABCCABACAABACCBCBBABABCBBCCACCABCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe" start= auto displayName= "UserDataSvc_ACBCABAACACCAACABCCABACAABACCBCBBABABCBBCCACCABCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCABAACACCAACABCCABACAABACCBCBBABABCBBCCACCABCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe" start= auto displayName= "UserDataSvc_ACBCABAACACCAACABCCABACAABACCBCBBABABCBBCCACCABCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABAACACCAACABCCABACAABACCBCBBABABCBBCCACCABCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCABAACACCAACABCCABACAABACCBCBBABABCBBCCACCABCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBCCBBBABAACAACCBBCBCCCBBBBACAABCCABBBCCCCABBBCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 71c8aae203e8405f0c97c78c2a0593a4134f874424b3182379634d998f21fb61
MD5 e075022314e5e150caaba45c402d817e
SHA1 c6681fa5936023c2d52d40d79379b0bd7c1524bd
SHA512 d3cabd8ebf2c6ef767d0cf17440d8ad800f34f7fa58440cfea4cf88c98bb03dd4358624838d7e7334d288925725bd094059cc0ccaf1beada1f6ef8b01f11ed59
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.9MB
SHA256 9c9f096581249b3b01cdc9f899d44f3734b53251df463a36418dbbd5d2d32d00
MD5 fb3a4511a87d692abe903f019dc5bed2
SHA1 87aabf0d5a2772c32185edc5f21dc8d7c0b2b595
SHA512 349d1dc89be26c51212ca099e07c625ef67bdc47ee49fb7a00472a4f1fecd85bf989ba805e4c7cdecb93c278934e2ad6684e93c9d39559d2c6d6db520f3cc864
SSDEEP 49152:U+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EE+gZ2HbbZt+jqpQ0CM4:igZ2Hb9t+2x4
TLSH
T123E5AD12F5838072E97B00B04C9BD2BE8E35BF2186118DEBF7CC9A1F7932B915535666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 c220ef35603fb7a2932ddba936e2717f23c43bd44ee72bc88c4d8a490dab4777
MD5 ab80e5dacd379582f55fc508cc9aeec7
SHA1 4c6f571bcba75330b8e75c0a482f6c5d6f665bb3
SHA512 8e568b6bd77e3cabe4929ac43162ed1145043fe3814e4090a942aa03ba8974c73fd746365045738616322c758a458a1c110f542409ef8645950a6f57c8455ec9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\qap`g`v~dtlq
Size 10B
SHA256 990e54343d2c3ef6b8efe4fd2b6fb37ac2da089eb9e7c77a71258fa280f0856b
MD5 5d57fa5ceee4bf16998655ce768ccf19
SHA1 76382f14901c82947f956dd61e84a8349022b0fa
SHA512 d29462cb68479f3ed42c8d284f865f12e1164cb8157a9bcac9fa304915ae78ba1bf4ab9965078c248448cd599d48c2ba8fa056cc65566682ee07f93c8e377f96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26fa5e006cefb49041baf19e827daf8399e08071aeb4e3def5521d94e3288b90
MD5 c5d4b216fb283658dc83def3f0a60f02
SHA1 f4b179576e6118b7d3b95dc16478c1ac0dddbd86
SHA512 fb8bfbdbf7eb335c00418807e6fd1503b4621227bb8df4b51fe48336ed67eb9d48d5759886d4fcfad7ab5e1528e18b9a2291af0a408155a0d50ad73ffa3126a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6fbffe107cf2371ee070ef62f704b4c1148a56bef3713f52e869a09347608f0d
MD5 cba4b61ecea7bb00cc85a73e8631fef4
SHA1 f277105951e92683be0afcffe83afd0e3b0a4d12
SHA512 58b95ae543023c8924066211c32b3a54397dcdb71904ccd026b064843153fe4a8abd69b8d637b5ebcd201aefa085a78375b30d6a6d365e1fbc7a5f5bb547088d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3b9908861bd8db03a067686341e22c4b6bada2d968c36f90ebfa40f5a59aa1d
MD5 7520b0b20a995aeb66b5ca6453b02b63
SHA1 744711d5536db629baf8078f5642c27967d79a7c
SHA512 8cd538a3baa5cda493d1c4da437ec97f3ffd84077e46e15c47120e291170a2f5a0d1d92d9f153572d7723c15be550c4400696618571335e5a466d405d6ad72d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a38d4eef282157f2687a7c7fa13bde4694fdb1b502299c14892bff6b79e4828
MD5 f26732d0aa8b51621e403fc562fafd27
SHA1 b1402fa3feda2e59dad3b7dffdf4fd4a9f8e7ee9
SHA512 b896838891ad753433606a8cd9759d36a180d5d91b99de38adef89060dbd7cecc5c1cae204f01a07758e415abd20332d8aa403012e4b70bbcd8fc7447d1c9d0a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67cfac49ce67c5b93ff01ac2cefae88630716ebce60046478d5c218ac59d55a8
MD5 98e508b383131cbebd8404daaf77fca6
SHA1 1fad93c1a3b148380e88a072db88a0f11229b7e8
SHA512 da408c82bd0ae1a851533b2ae22a828ec5a7dcd275c12829f3ab2ec6297b9a6676806bf3b21e8b2e42f1b0d152ba5c472f3823f97db09d99da7ea050beaec852
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a1c51183e7b5eb02e2ee4d43823457532e4613d4ba910de05d3989339b308421
MD5 50ba159e7e65c81b16b4716b9a0ef4a3
SHA1 5c73dfccf7c917314ae04ac57dbeed9ddb01f022
SHA512 8608799188451b81c91d6ac41415ca4d9217e2ac9be11d1b2629be5c415f145d7b525469b79b45011485e807aff4d16be3ba35a4d3bba6f83a7475b15e08fb18
MD5 SHA1 SHA512

Submit Download

svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABAAABCAACBBCBBCCAAABCABABCCCBCBBABBABABBCCAACBACB.exe
Size 2.3MB
SHA256 904f43af2f3814347d1a6e5a20bbf1cec915ddf359d21f037afa0cf6b4de19dd
MD5 ce9b90fee6c5e6eaa39ac54938632a72
SHA1 2f583120bd949bea4c6f6a25b171714ceef2988a
SHA512 0bd1f0d5e39fe0f14ffc8ff5756fbb846f098466f56e9e024cc3db9e8a3470918139a42aed59355fe64a1129bb9c371da9e6bb51276c1ce949f87ff2e86efd85
SSDEEP 49152:U+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEo+EEb:v
TLSH
T19FB58D06F98780B5D86B00B00DCBD2FFCA31BF61C5114EEBF78C9A5F6932B915524A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5e8815e8e7ffafe4a4c60df18efa775b2b5e12c8c3592a34c86bf863cda241e4
MD5 baf92bb2d106b0889855979cb9188312
SHA1 9a527dc968693c4277b7e547ecbb7f21fb9f86fe
SHA512 f953a676031644ca9e313d5df905d0978c1f81e9abb506d5ace140e95f08b4373cf0fb93bcf98b51aa932ac1195f2fde64d346195e19aeb65859c6c2973fcddf
TLSH
T1FC110A50E1F5D853E973689B9335CED318D437CA68786A18330A4218778DC316E5D1E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9a9d45d19e7b17f1149f5e66ba9c464a91316953bf2bd2a6179a59a749c54263
MD5 9d3f6eacf9fa88eeeeba3f08a576d8be
SHA1 700cffb783d2036aa812996f27013582c4ab53ab
SHA512 6ae05aee0ccf8dc1a1aa03f1bf7fedc5bcbcd4eb1a5640727947dfeabdb548e85aade6daf36b46fe36f66c93adf8c6b18feb5e810e3a4b6ddd6cb9ea6a889e8d
TLSH
T12F21D854E1F5D853E97368DB9335CDD318E8378A69786A14330A8218B7C9C31AE591E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-31-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/960-82-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/3956-0-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3956-7-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5436-78-0x0000000000680000-0x00000000006A1000-memory.dmp

Download