9fbc522dff1519d87c92a2476fc818ebfb97ce382bb11d75ef0e943865fbbd6d

Analysis

max time kernel
126s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Size 15.3MB
Sample260910-ffsayaybme
SHA256 9fbc522dff1519d87c92a2476fc818ebfb97ce382bb11d75ef0e943865fbbd6d
MD5 76ac0f3d091b6dd243e31c12ea13c689
SHA1 9cbc7779b38c3062b37280bacf736997df00b4ee
SHA512 97ee5a7f37d381e05be3aa096fffc71fcc1432a1be20df7791af7c2204e27793377b8f15c0caae43611cc09cc570b91b613ce822fb275b2171cd66aea4d40508
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+E0:W
TLSH
T116F61A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAABCAACACBCBBABBABBCCBCCBABABCCAAAABACBACCABCBABCCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe"	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1608	sc.exe
3540	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4892	cmd.exe
1072	cmd.exe
2912	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4264	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
4264	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
4264	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
4264	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Token: SeDebugPrivilege	4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4892	4264	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe	92
PID 4892 wrote to memory of 5328	4892	cmd.exe	94
PID 4216 wrote to memory of 5124	4216	svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBAABCAACCBACCACCABCACABACBBBCBBABCCCACACAAAABCCABBCCAACBBBAABABACBBCABBCCBAAABCCCBBCAAACBCACCCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBAABCAACCBACCACCABCACABACBBBCBBABCCCACACAAAABCCABBCCAACBBBAABABACBBCABBCCBAAABCCCBBCAAACBCACCCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAABCABCBBCABAACABCAAABAABBCBCCAACAAABBBBBBCBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe" start= auto displayName= "UserDataSvc_ACAABCABCBBCABAACABCAAABAABBCBCCAACAAABBBBBBCBBBBBB"
  2⤵
  - Executes a command shell one-liner
  PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAABCABCBBCABAACABCAAABAABBCBCCAACAAABBBBBBCBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe" start= auto displayName= "UserDataSvc_ACAABCABCBBCABAACABCAAABAABBCBCCAACAAABBBBBBCBBBBBB"
    3⤵
    - Launches sc.exe
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAABCABCBBCABAACABCAAABAABBCBCCAACAAABBBBBBCBBBBBB"
  2⤵
  - Executes a command shell one-liner
  PID:2912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAABCABCBBCABAACABCAAABAABBCBCCAACAAABBBBBBCBBBBBB"
    3⤵
    - Launches sc.exe
    PID:3540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCACABABCABCCCACBABABBACCACABCAABCCCBCAABCCBCACBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCACABABCABCCCACBABABBACCACABCAABCCCBCAABCCBCACBACB.exe
1⤵
PID:1452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 be869bd804aa67df38fe65f10e075d85cae912cd81620f0b40725acf13604bdc
MD5 96039a4225a7d9cf0fbe5496e6f6d659
SHA1 65b573a189a407a43879afc6446afa0f45f6c8a0
SHA512 f3e64129248a421d2801937f1dc285f2b30862a30353a904cae38e24e18c56741bff56c6d9e64583c414d01a3e8b305014c005c98ee8be667ce5bc28c3b6519c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 ccec1fff145852282f1044caff0bb5b2e4e04f79ea4c3e01afbbda0a325a62af
MD5 e77786995b670b03a70a05a4a0eeb076
SHA1 622c2b4d47d616232698e39509b5dcd65e440b66
SHA512 0a8a8eaba743d355a0770513b1d840e99ae1b0e661fd47867e28b5655b6a04648de7c6d500a997a2a6b992e375525556f0603ff2c59d1876477a3abd0c959e22
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.1MB
SHA256 7171e94a439fbd341a3b50c7ad2f84f1637137b9f0493e653b3ea769171ce4f8
MD5 31bc30b694d263a71176cd63f1e35150
SHA1 01d03e5d6ba8fc50b6a26c4d8e16e943b8c25a0f
SHA512 3d183193cc7cceaf2af7336f7da71c843baad48affcbfe68fcd3c28e0c8682adb78c600b2976a081212448ff3b7ab318da038372f6349653f0dfc1b65e00353b
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+EC:k
TLSH
T188E51909F94340B1D92B51F04DCFE3BF8A60BB2586128EF7FB4ECB5BA523B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\de\qap`g`v~dtlq
Size 10B
SHA256 604778607bee46b803828dd3ec6f6a5d62ceb0ebc3c6fe68971307743da29a69
MD5 422b785a8cf36324a0a97ddecf6776ef
SHA1 57f74b888352e32e73d974e52d954e9b7e586554
SHA512 16493bc0e8ed93cd76c94734f4ff835b4bac1cc69c30f18e81e30e14bf6a0efb57a1c7fdf42f31050d140311d107441ca0e26eb9d883c13cc2db8ac49249c127
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 78342d65f2337ae1c04e0703e0efc7e964e0f0b7d5de5f1b13fdde40bb357483
MD5 ead854402384293b5b1bdd2bbb8f9e9f
SHA1 f9513f81122b4528a544a8a8fa4c2551c6170cef
SHA512 b013a3e197f97997ea1e10868ba1ecca2f3aefe6113584a58c27d7758ac5b40271c2a3023049d547de005f192b92594549a289241acad1dfa41113aefb456af6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29c475d8e6eb41aeb0f84447dc2461e927962c44fe3b639783fa99b08bf78e4b
MD5 dd3c8fda696c9d5de3eaa21c76b77d10
SHA1 4979ac361029a569e53997d36240e5f02e5ecb3b
SHA512 195463d4fe9d7aa3e0a82f8abc04e012f7b357cc6e8945e65abe264b63637fc2f0eac8aed3d05eab0a1e651d2a85538e7261b6759faf1bc2fc65cbbdc534404b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2362823990f0a3a0a8612779376177df889e96e7725e8c2bc5a1c3bc92b77b75
MD5 b50c88cdc6df7ac9f4ff05f97c29f169
SHA1 3bfbdf0d7b6d2892fa950ac39996e40a10d15918
SHA512 f3bd28a3193d53a87c3f20baaf845e617a26fe2ed6649617635dc53c8785c6a92411677d05c36039b554cc1710bc094f2e74fe9ef2f1ef23ecc1029febe46d40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d52fb3f6d0db8557dad66f8ae9af6b2779aad3ef161e9736fe851451bf447f95
MD5 c8b340241a212bd3cedaec18b2b4ba4e
SHA1 a53f61f1d266dabd997ae63a4b3b73e69b9502ae
SHA512 f9c44d0602431026f8de9a296f2a57f14c53eef4ae9bebc1f6231ab2e5cbabbb22dfb836292e134aa0fb3e35e4c79b4d77dbfd9e2ab727c294d285a92b315dcb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8db5b4ed405f15a39975741981bff0835629793606ea579b994a4ead689ed7a6
MD5 8111162343a7f47513468eabef1f73d7
SHA1 518eae73a4a5302e642f97f5b1f1091541b1c9b9
SHA512 f3ea7ab6c37b58a596248fba1c870ac5a2e82883f8d0bbca6eda87dc47379a0e9f108cddc10be6ffdaa76eb66f0653db50c07a93d92ec186a862042d2cb98c1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5f8ca5c5f656d6e030f1f24065850d9473271538544a0819c086b65f88c003e6
MD5 eb7b9d432d90453c7b2d1f9d40831f49
SHA1 4fdaa7fac3d119e403b62d80c7fd65ac22c103d8
SHA512 98164e260142df0e17d0c8cc24f0ca219b6dbd895e13a3be3a381fe0a4d10b4a4ae992f4ac94a4ad57241e37d3bd5d619a8a084070d2eb1293e207c5f2128976
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ca5aad5a6b148718da457212b95073be5ba609752cbf459a2f0364ade5e6682
MD5 08585cfd21b4fe89ae74f0d9e775c9a1
SHA1 1b3c6f1ec3118a54b9ac484da97cffa79ec20a2c
SHA512 3e628e3db7e033a08da1297216f843137ed3a03136eb68c8075f4f0d37283040561c7d76376e1c482a06a0516991ed6121ea7f1838b9b53bb8768250b20d1bf6
MD5 SHA1 SHA512

Submit Download

svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
Size 15.3MB
SHA256 9fbc522dff1519d87c92a2476fc818ebfb97ce382bb11d75ef0e943865fbbd6d
MD5 76ac0f3d091b6dd243e31c12ea13c689
SHA1 9cbc7779b38c3062b37280bacf736997df00b4ee
SHA512 97ee5a7f37d381e05be3aa096fffc71fcc1432a1be20df7791af7c2204e27793377b8f15c0caae43611cc09cc570b91b613ce822fb275b2171cd66aea4d40508
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+E0:W
TLSH
T116F61A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBBBCCCCCCBCAAABAACAABCBCABACAAABBBBABACCCCBAABACCC.exe
Size 9.7MB
SHA256 356b2c08828a0c27bfbdcc562dfac607973d90d53a2e47596e296c0a040b0084
MD5 197f3a9745375fe79a8672a94bfa0e0e
SHA1 91fdfe44803c0dab82a5c75e5206e7f10275acbb
SHA512 869b68a65099662fdc48d8ff0091a4f9707cbbcaff3d39a7ed83b2b7df7767e91a11cdfe9f95f6d922d4e13e1776c3a1d4be7639fa55e0feaedb09bd3400a6a4
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+EC:s
TLSH
T1E2A61A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBCACCACABABCABCCCACBABABBACCACABCAABCCCBCAABCCBCACBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCACABABCABCCCACBABABBACCACABCAABCCCBCAABCCBCACBACB.exe
Size 11.4MB
SHA256 5b2261a1d956a704fd5f444b273f78c512fb0f6ed13e7409745c9113fb82c5f7
MD5 84f23a00b197a7e468f3d54ba8bd37e8
SHA1 633982fac11551ae8cbe4fa2794f269276a0c493
SHA512 d0898f575b6d8d247cd6bc6cd5a795ed091d353ba205455d1623f233a1c9a523181cd62678b6942e6f67bac8f6b78d460600622b5511d49f8172b9801138bc63
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+EY:m
TLSH
T126C61A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 233f71387ba781c068455513859dbe21bb651c79597e9cf1cdc07ea7234a5420
MD5 b0c725964675da1b98a341715a44d1b3
SHA1 7a84c702a55f5f2daa9f130123ddc7313f0369ac
SHA512 a9bc0788cc08e74a0a1ece5932f9bad51c8e36eabe39dd59edb9ff8b4f96767909c0ef6aea08741711d0e4091d1e7081ec0e9cfe33d2b65a2fbedf3d5c5638f1
TLSH
T121112311F875CC63E03128C7652AEB6708B4339FFC9CAB50138E8118EB55E39DE550E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 88ef6925cf8663a404ea368d939f263db8706b8204f287427bc99deaa76a0b96
MD5 8a6c350d43c9e391f117a88da491d2c3
SHA1 582463a64bd720c2ad37965c662ad3974ee2799a
SHA512 55b3b780da086b7b72a82d7e1ec9b99850fe3a8641865364b1c709ec4e7cf1385a401930ba5bf2e21b8a4e2561debd62c00a425c4cd0157c73c2ed4086e28f40
TLSH
T12E212361F8B5C863E03129C76126EB6708B4379FF85CAB50128D8118EB59E39CE590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1452-79-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/4216-33-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4216-23-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4264-0-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/4264-7-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/5340-80-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download