697d135a8386b3fb408e4d5b9e44d8b46b52cf49a29d69ea0a58a31aa461605d

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
Size 1.8MB
Sample260830-2w6ddstwgx
SHA256 697d135a8386b3fb408e4d5b9e44d8b46b52cf49a29d69ea0a58a31aa461605d
MD5 fc4ba4c646d6a21db8ab387497956e1c
SHA1 1e38677d2229f6067ad9d0b812315c568d0afae3
SHA512 2c8c12e3daa1979b7e11eebc25e0493dbf0b318adda03d0bef7e41017744aea66737b49370d8c97b7ad7df953f6337118831f8bc30d64c20dfbf6da2c4a3ee4e
SSDEEP 49152:U+ES+Eoj+ES+Eoj+ES+Eoj+ES+Eoj+ES+Eoj+ES+EophOH:s6
TLSH
T13D856C0AF58740B1D87B51704CDBD2BF8A31BE3186128EEBF68DC62F6932B915834B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
5356	svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe
564	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCCCBAACBABBBCCCCAAACAABBACCBABCBBCABCBAACAABACAAACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe"	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABBCCCBCBACBACABAACBAACCCBBBAAAAAABBBBABCCAAAAABABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe"	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4388	sc.exe
2444	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4580	cmd.exe
3812	cmd.exe
5484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
5356	svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe
5356	svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe
564	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
564	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
Token: SeDebugPrivilege	5356	svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe
Token: SeDebugPrivilege	564	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4580	2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe	92
PID 4580 wrote to memory of 4348	4580	cmd.exe	94
PID 4312 wrote to memory of 5828	4312	svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe	95
PID 2260 wrote to memory of 3812	2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe	98
PID 3812 wrote to memory of 4388	3812	cmd.exe	100
PID 2260 wrote to memory of 5484	2260	2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe	101
PID 5484 wrote to memory of 2444	5484	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fc4ba4c646d6a21db8ab387497956e1c_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCAABBCBCCAAAABBACBCCACBBBCCACABABACCCAABCABBCCBCCCABCCACBAACACBACCBCACCCABCCAAAAABBCCCABABACBCACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCAABBCBCCAAAABBACBCCACBBBCCACABABACCCAABCABBCCBCCCABCCACBAACACBACCBCACCCABCCAAAAABBCCCABABACBCACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBCACBCABCACCBABCCCAABCCBCBABABCACAAABCBAABABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe" start= auto displayName= "UserDataSvc_CABCBCACBCABCACCBABCCCAABCCBCBABABCACAAABCBAABABACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBCACBCABCACCBABCCCAABCCBCBABABCACAAABCBAABABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe" start= auto displayName= "UserDataSvc_CABCBCACBCABCACCBABCCCAABCCBCBABABCACAAABCBAABABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBCACBCABCACCBABCCCAABCCBCBABABCACAAABCBAABABACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBCACBCABCACCBABCCCAABCCBCBABABCACAAABCBAABABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCABBCCCAAACBCCACBCABCCAABAACCBBABCAAACCBAACBAABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 29f5f5d8cf39baeced2a9841f0003d4944aebc1df8ae22bbe5a8214e1bc33916
MD5 5f0b553c65608dbb683d6801d377d5ae
SHA1 991a672b61007d84873f6bc8146b5c7d395ce7ff
SHA512 39edf917b0b844eb47de5fefc02fa01cba088534d1c385c059d5deea9cc99b23dcd436ee482a9523e79cb4686abd5f280899ace80d9021c19368b6fe966a6706
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.4MB
SHA256 e40ea9ffb1397bdd7e09ab01093b0182fb070e27d502bb3039e7fbf085e52cf3
MD5 f245097aec3071d1e109b38c8ca271f4
SHA1 c03e64d777211e830eecb9e69aaf24d6f8e79c01
SHA512 163b65e7cb02043f5584493f432cc09482e5e884024779b533d9f112968fb05d6e4c3f0db083c1b0642fdffe202ef00781f48e5ba31f8f9774d1ce91555a0f9c
SSDEEP 49152:U+ES+Eoj+ES+Eoj+ES+Eoj+ES+Eoj+ES+Eoj+ES+EophO6gZ2HbbZt+jqpQ0CMw:s9gZ2Hb9t+2xw
TLSH
T116B59E16F58340B1E97701704C9BD2BA8E35BA3087118DEBE7C8DA2F7932BD16935B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\ca\qap`g`v~dtlq
Size 10B
SHA256 c77273a374cde5a5282189e19c008e033945ba16430e40d7bf31767f5dcb5812
MD5 a34064d0ac0bae19baccde505423a945
SHA1 3b7e69c190ae4616e9906c18152e2a5d9b391a35
SHA512 5fbe82ca45f9f13f20bf93133f360481a6dc75f8a55c2576c16ecbca748be3b8da1fc39440a35bdd70402eee82274f3001d6bc1dc044288ad6a8955410b55dc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\qap`g`v~dtlq
Size 10B
SHA256 98514046bb44fef238eec7d832a9aeb4277c808ea24f7cdd55d3274faa491921
MD5 3d09d1a543644d52ab4435fe9a7e3d6d
SHA1 5a4c3784bb6418fac8f025228c3fdb6efa33c2e9
SHA512 2eb4dfcb9ed2de815e971cd207dde71335834661d32900e4c2799b4f02cdec44300b95879f724df16fa6fcc51db229dd6237de1ef8665bd8fa596a8c03664b28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb2bcafa0295fa7df72d35fe84bf37b99bb541f60a8f5ed29202fcfd18420276
MD5 c9145a526bdbe38062d7db96e7deaf9b
SHA1 f0a7b61cf072dc8993998bf4001b399313182ddc
SHA512 4da32b96321acfff5d56ff3caa31c7297dc95f853988277ae19566b88b8ab5d150c70d7e3aadce2c8bb63e6a11c3937d004254202f1865d3e46727f88f74f3e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f5a540962959e3c3524ceed5dcfd0da0fb2ebcd39bdd9a7f5886b92b4dc476b
MD5 10def3cc0ee2ddf4bc01a0ae48705a1c
SHA1 0bbb97e14f79ebae9b46c9796235528f2ea8ced2
SHA512 b2c6258ee34ea37a9d0fdafe1f62e48377cab0ff2f58d4630e38bcc73de5fe515b5eeaacd7b3f390303489d4c88ffc5879a5e5cd2bdddfa2a60a20c12e8e56ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 03a7be73bfe0ff80952681910378374bc83022f3072d86dc5dc20b700a629541
MD5 59f50bc805924068fc7cbf3df4a998c4
SHA1 d33859184b791a75a1837c2056d5b4b4ef7f44ca
SHA512 0fadc9fc00770b53f7190b3c5c2edf9745fa42dad05c89822d3f6f9563c37c752b66e8adc9d7598c4626dc17e96aa3e1748b80aed7031967e82dd49bf95cb427
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d344940d833e6626a78d4d32c96b00291460abad6d5600c35634de73c8686153
MD5 25285aad4342785d1e35740341dd20d7
SHA1 65d8eb1c47adf23afdd5c30c01b312a89bf7b686
SHA512 0e646335116461f9300d0e070db185edb6ecb6ff1805cc8d6877aac85dfd4208b4159dd069503a53aaf79401b987aecca6b5b001da78796591f090b92d55f4b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14f528a239bf3416a8410a12ce50408c0cec567f4679a7225a69cbc471732876
MD5 76e342b2c8b823bb23b1d9e2d3f4f723
SHA1 6540a887a5970eec0e3a0a76bc5d7732997e3df1
SHA512 e71eb5153d93deb5846fd755cb8c38497c719e126f260b07fff7be0fbeb74600e61f673ee26b286b9d0242556bf5f96a372435fb28a471d8c82e3d2903c2edbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 266813dbad7509e17c0c7ecfcadc8d17af47bd4dd0e3e99023a4d440c70edf0e
MD5 7d33af07dc106efb1fc47872376e3d46
SHA1 65afd43eee7ffa1b0f5dfb62e32f5f0545705d0e
SHA512 4660f5345889e6edc7d6dcf8a328e9f421a744971d7c12e0f814d3cc7b60df8b61fa9e06371e5bfee21331cb4426858a770a09c017246ccf760df7a11a979207
MD5 SHA1 SHA512

Submit Download

svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAAABCABACCACBACACBBBBCBABAAAACCBBCBAAACCCBCCABABBCB.exe
Size 1.8MB
SHA256 697d135a8386b3fb408e4d5b9e44d8b46b52cf49a29d69ea0a58a31aa461605d
MD5 fc4ba4c646d6a21db8ab387497956e1c
SHA1 1e38677d2229f6067ad9d0b812315c568d0afae3
SHA512 2c8c12e3daa1979b7e11eebc25e0493dbf0b318adda03d0bef7e41017744aea66737b49370d8c97b7ad7df953f6337118831f8bc30d64c20dfbf6da2c4a3ee4e
SSDEEP 49152:U+ES+Eoj+ES+Eoj+ES+Eoj+ES+Eoj+ES+Eoj+ES+EophOH:s6
TLSH
T13D856C0AF58740B1D87B51704CDBD2BF8A31BE3186128EEBF68DC62F6932B915834B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 09833b6729bd1863dff215c84fb0747c182e9c358f7e78d143c12da1223defa8
MD5 9414b6dbbb8041dc179c64459913404f
SHA1 5f4a787791946f95a8dee67309544d9d1556e4de
SHA512 a81eadcfccdc98bbbcb2c255f6efdfa6c8b8d0c7405da11ba4c9d9ed2facca623976d44bbaa0f105cf96892b0483697fdcdfeefd2b13bcc9c6dfb4f4b3355202
TLSH
T18E012852A0E9D8E7FD372CDB652BD8670CE036DEA858BA181318422C7794C718E558F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fc2eb33ea0c633b290ca0207601f303799d031e31ee62a7cc698033e1a4d1047
MD5 af55f4e49fe68c4c1f63c3bb83d2d3f9
SHA1 7589885e3c07c2880e8bd6cd92d66f11a2b5299b
SHA512 5986c23169c70f85c708aabc7b215a71bc897f5e0b4d868c682128e5b4e1aaf9a2ea6df808e6829578b6ba7e7785f02931472e3e786e705a5822e5b02486a666
TLSH
T147213D52A0E9C8E3FD372CCB752AD9570CF036DED858BA18131882287795C728E558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-543-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/2260-0-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2260-7-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4312-33-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/4312-23-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/5356-70-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/5356-1340-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download