3f24403ee0500c5d8621664b8d45a358bb8e48b80b107aa6a9aba61f4e798f7f

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Size 12.5MB
Sample260910-clx7laef44
SHA256 3f24403ee0500c5d8621664b8d45a358bb8e48b80b107aa6a9aba61f4e798f7f
MD5 e1c2d33648f39541dc067dbb69669309
SHA1 7db224ce2aa0b70817379f80d596758f76625bcd
SHA512 bccd444366798b6bfdac8519c51f60fedbfbc0775cded79f47c44ca5149dac04509ca799ee34dc242703b7b9abfa80816a1d8153fc2c4b94bcf8071672bc070c
SSDEEP 49152:U+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESwqp+ES+ES+ED+ES+E7+ES+ES+E7+ES+EG:K
TLSH
T1A0D66D14F9E60C72E5BB11B10DE7E27E0D30BB258225D9DBFA8D874F7823B905426792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
4940	svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe
5016	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBACCCACCAACCBCBBAAACCBACCACBABACCCACCBCABCBACACCCCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe"	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACAACABBAABBCACBBCCAAABCCACAACABACCBCAAAABCABAAACABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe"	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2320	sc.exe
2484	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4972	cmd.exe
1640	cmd.exe
5244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
4940	svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe
4940	svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe
5016	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
5016	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Token: SeDebugPrivilege	1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
Token: SeDebugPrivilege	4940	svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe
Token: SeDebugPrivilege	5016	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4972	4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe	92
PID 4972 wrote to memory of 1836	4972	cmd.exe	94
PID 1732 wrote to memory of 2972	1732	svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe	95
PID 4392 wrote to memory of 1640	4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe	98
PID 1640 wrote to memory of 2320	1640	cmd.exe	100
PID 4392 wrote to memory of 5244	4392	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe	101
PID 5244 wrote to memory of 2484	5244	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAAACCBBCBCCCBBBCBCBBCACBBCBABAAACCCCBAAACCBAAABACACCABACCCCBCAAABCCAAABBAAABACABACCBAAAABABCBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAAACCBBCBCCCBBBCBCBBCACBBCBABAAACCCCBAAACCBAAABACACCABACCCCBCAAABCCAAABBAAABACABACCBAAAABABCBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACBABBAABCBABAACCCBACAABBAAACCCBBABCCCCABACAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe" start= auto displayName= "UserDataSvc_CACACBABBAABCBABAACCCBACAABBAAACCCBBABCCCCABACAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACBABBAABCBABAACCCBACAABBAAACCCBBABCCCCABACAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe" start= auto displayName= "UserDataSvc_CACACBABBAABCBABAACCCBACAABBAAACCCBBABCCCCABACAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACBABBAABCBABAACCCBACAABBAAACCCBBABCCCCABACAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACBABBAABCBABAACCCBACAABBAAACCCBBABCCCCABACAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCABABCCACBCAABBABACBBCBAABBABBBBCCBAAACBAACBACBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.1MB
SHA256 6efda2d2088b11b98d38460132c53aa573c52d1fd78e0ff171f96044d81cf29d
MD5 fa6e1d868eec5d63a5b32e8f04786525
SHA1 cf8883ec18641136d0957c805706ef7bac6d0775
SHA512 6f9e8ce24cff66ee9e82109cf52d4c84db25656020da07bed01b117ba53f462c34dd47ad00b712cbbfb418ec25827770461f76a552023923b215be590506113c
SSDEEP 49152:U+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESwqp+ES+ES+ED+ES+E7+ES+ES+E7+ES+E8:NgZ2Hb9t+2xa
TLSH
T120D66D14F9E60C72E5BB11B10DE7E27E0D30BB258225D9DAFA8D874F7833B905426792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 8a6649099305c4470ec8cbf88138402e1ebc2e102df1d78630bb5fe4aae76655
MD5 44d20384d2e4e5af51aa6a5bbe5118c1
SHA1 75a21066420410906a045e0de8c29212ab51cf9f
SHA512 2952643dce3b235a4fca1298ff7def98d2cd65b3a9c69b6f7e3dbddfcf49a0e3bfa3ff53e7dcb3c425d35171d949a3e060e16b4608ea86b49523f8ce74ecaa6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\qap`g`v~dtlq
Size 10B
SHA256 498bf9eb9cbb6163d6c11de2fdb9c360ce6633b3e54c05ad3854fd8f544e1514
MD5 ce952b8e92692c074484e9cf0178b16c
SHA1 ce1e21fe0698d78191fd9a5e455845f67c68f253
SHA512 98ac1ec8e4c5fc9de356aa0aed02374651999b2652dff2c13d69061ebc7135d88bb297c0198a8e77d35e9de254366e0bebd9c17a01c1f58a27c6f1df9a72b6f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ddca3e94e036b4704da2a2fa32783f9cb535cbbb4e887e4851ed07f4147ddad
MD5 a035dad9082bb085208099da564e37ae
SHA1 857c4a0b7718a8842b598a59c5491808d1dafc47
SHA512 8125dfc549b969a08140836da79c1a8a886ec52b84b4e05a7935ba9bd959ada43497ec71c710f4872468e6028856580de2f14a0bc406ba7590cb5ea3be00c3e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1532a3e3433bded4a3d444bfa895c32ce8840c47ff55aeea66ec20e81f46fe7d
MD5 e64efb2a3a8a04d99fdb6c42cc8c1ba5
SHA1 55efcde485912c4a4237d7205479ca517e38db04
SHA512 04a627fb4d8eb82862a54ee7f600bc54429874d556b4c8b32675a5d1639f1de48bdda7502e21f492761d33b78307633bbd127ce26b8667a3f830988cbf8e25d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed04faf6f14ea2a8ee49993fd393d81b9c2711639db3d28f162a075bd2ec82e8
MD5 b0d0a4cb6df3cd2ecb1d70c10e8f4604
SHA1 f20c5f8c87885d6d930242e3f2ffa00336c78ceb
SHA512 5289c08e115bbfe39b95381e836d8bbf9204bc47b0a1147c6ccb1be29f9d29d568cfb4e6a4f1de632ecdb799dcadcc49ec8e1d9628befe656a186479f74c91c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6072aab6144b3da2642b2440b38036de0e1ee0b351ebd21ec682ad14951b34d
MD5 cb4fa3a1b24fb6287537163dc8d1ccac
SHA1 3206a7c7f9f27a44d45cbca9c7eeb940a0a7ae13
SHA512 d74e7094954a0486cb42112293deffe7aa188927a9756cf0ac0f55bce5573332a189edea56498a6d76dccb66f4c2a2d6b23ad18891ffee7a8002c1517f51744a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ff6f8bc604afe4815502e532e67332422f498d0dc6e4242fb0f1aaeeb51bf6b
MD5 229be2b45f20f9329586bc54f5f5af42
SHA1 5882b4980a346905efc2e7cc5d7855058bdd939a
SHA512 f63917530b509d07f837259a476c2edff7a939fd3b9476a2e53d4ae32db169cbc2abc8518e3679794f32df942333d7549c740e45bf1c7f50edaa8621571be4a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4c0991b77195869db93d91a08da9b5bb9c12033db18540812842aa4a86ba1ad
MD5 655e677451f52227a334aa1646c2cfcd
SHA1 43a1082a7c78723168b15537109125222fe72400
SHA512 8f36a47d8b904851f73ff3510020efb90743ab43c4087b5d556aa3886375cf0decb4d2f31a7f74b197f9d9e655264380ba2827407741bb099f2b0c309d8d0208
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b666008f7b3e353a26b0e5cd2d8fbd7e69f4a599504d471d6d269390f33aea70
MD5 10e2cd3dc6259c23336ae514bc1e0761
SHA1 6a3d8e086598dea0a757f34c9331b5d8ee4d7d33
SHA512 c0de7b0b62104b8ba8ac50666e1563539729dca1f4c6742923d194dbaa606f5f98bc5ba231fc5b94523a152666bb3fbad7048703fe9d7cf0f684a5737b53705f
MD5 SHA1 SHA512

Submit Download

svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACBCACBACCCBBACCABCBAABAABCABCCACBCABACCACBACCABBBC.exe
Size 12.5MB
SHA256 3f24403ee0500c5d8621664b8d45a358bb8e48b80b107aa6a9aba61f4e798f7f
MD5 e1c2d33648f39541dc067dbb69669309
SHA1 7db224ce2aa0b70817379f80d596758f76625bcd
SHA512 bccd444366798b6bfdac8519c51f60fedbfbc0775cded79f47c44ca5149dac04509ca799ee34dc242703b7b9abfa80816a1d8153fc2c4b94bcf8071672bc070c
SSDEEP 49152:U+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESwqp+ES+ES+ED+ES+E7+ES+ES+E7+ES+EG:K
TLSH
T1A0D66D14F9E60C72E5BB11B10DE7E27E0D30BB258225D9DBFA8D874F7823B905426792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 81f1e2797eae88daf660c10ebaf2e8b2babae91ac45b071de1db8259c5c2d9ff
MD5 c148336be4d4de241406a83d786b9983
SHA1 656e50477041c7f748e2cd1dff6a97061b697393
SHA512 8abfab41ba45f128d609d94a8c8e43e1f300f9e268313bcc8974e7042dc2158bdb21e74dbcb5ed8d7e7f42acb764489e7cd623b6e95d9531235016d1bfb4291d
TLSH
T1BA11B255B075D893F030A4D667258E9608D437DF687CAF5423098218FA99C35DF158E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e3838a9bf8d3bec6caae9c8be9dee09ffc77fad88d669f64d29338810302afd0
MD5 86e2c04b8a17a5c5d434f297d3d70515
SHA1 1f8e376bff97be2b14c474836952c2c285760f53
SHA512 2a82a2bde27c5541c5e80ec63a88999e4c765c216896dd9d313e294416d1c630e0856b559928a0b8ca12da2e6f303f8600bfaf9d05b0972745c4cd1ba3212dd9
TLSH
T1FE21CD54B0B5D863F030A8D66729CA9A08E837DF687CAF5423098218FB99C35DF158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1732-33-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4392-0-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4392-7-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4940-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5016-75-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download