2eee51eacb65bb4e6992a18da6219e6aff21b218122a1c76bc40742ddb011d7a

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
Size 4.2MB
Sample260907-dbt8maed55
SHA256 2eee51eacb65bb4e6992a18da6219e6aff21b218122a1c76bc40742ddb011d7a
MD5 5a4172249ec559826d683312ad14fc32
SHA1 9914509c2427a04c921c017cc7e350cce138c8de
SHA512 5b40d2580e6d800fd3eef4286e9032528de295ab65bc7924f8213a900908c14f06d720734af1c43f94e8af1057653b6c78410e198a351e3397e291b6c004cacf
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+ERC5KXpH+E7+ES+Em+Es+E7+ES+Em+Ec:a545vp7h
TLSH
T10E164B09FAC34071E97751B04CDBD3BE8D317E218B218EEFE749961A6932BD1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1380	svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
1180	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCBCBAAABBBBCCBCACBBACBBAAAACBAAACABBBABACBABCBBBBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe"	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCCCAACBCAAACCCCABAAACBABBCACCBAACBAACBBBABCCACAAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe"	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
948	sc.exe
5148	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5832	cmd.exe
1388	cmd.exe
3500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1380	svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
1380	svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
1180	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1180	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
Token: SeDebugPrivilege	1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
Token: SeDebugPrivilege	1380	svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
Token: SeDebugPrivilege	1180	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 5832	5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe	91
PID 5832 wrote to memory of 4308	5832	cmd.exe	93
PID 1452 wrote to memory of 3480	1452	svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe	94
PID 5852 wrote to memory of 1388	5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe	97
PID 1388 wrote to memory of 948	1388	cmd.exe	99
PID 5852 wrote to memory of 3500	5852	2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe	100
PID 3500 wrote to memory of 5148	3500	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_5a4172249ec559826d683312ad14fc32_amadey_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCAAACAAACACCCCCCACABBAACBCBACBBCABCBABBABBCACBBACCCABCAABCBCBCBCCAAABCACBBAACCBCACACBBCCACCCBAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCAAACAAACACCCCCCACABBAACBCBACBBCABCBABBABBCACBBACCCABCAABCBCBCBCCAAABCACBBAACCBCACACBBCCACCCBAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBCCCAABABABAAABCABBCACAABAABAACBBBACACCBBABCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe" start= auto displayName= "UserDataSvc_BBBCBCCCAABABABAAABCABBCACAABAABAACBBBACACCBBABCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBCCCAABABABAAABCABBCACAABAABAACBBBACACCBBABCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe" start= auto displayName= "UserDataSvc_BBBCBCCCAABABABAAABCABBCACAABAABAACBBBACACCBBABCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBCCCAABABABAAABCABBCACAABAABAACBBBACACCBBABCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBCCCAABABABAAABCABBCACAABAABAACBBBACACCBBABCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBAABCCAABBABACCABCABCCCCCBACCABABCACAACCBBCCCABBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a1ce91403c454f23f90c4564d4cfb67cd32f035ea9de60a1308aa5f1af44ce34
MD5 6b7958b653fbdce88de19e0b9f60dad3
SHA1 55513b253dd2bd92ecaf100085c44a9cd51253ad
SHA512 cca89e51e14239cbf0402d928487542d00f28a36b255f846ae07527a71494dbbc150a022a7bafff8d5a1bcc59062d7a0bbc60ce8c5681acd3505bd34278d2a6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 39e167a36c3cb4521857b3c93416e9c93c0d8fcfe4230866e95e17d47c01fadd
MD5 ce6f93c6e8fea2760ee03df4c9437d90
SHA1 d844bd056fb62ea3b1b3eb337e26b0cafa096d03
SHA512 5adb2c040d5da34e51b98d1b689061ac65f4253094c943c7fe559fce4877c0f0c82bbec24704bc9ce6193bb024dc0ae4ca7b6c851d84f9e3a68436c98181a6ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 35d70a9541dd6156e32dd0827096c03c65a34c502ba95d62ace196c3ddb56128
MD5 d9fca4e04e7e217023d1868b7dd954a8
SHA1 f273082cf0920343cc422c5cf290a6cc59fe74ad
SHA512 f6849cae2afdc8d1e7c2898bbf226ca884401a954ec0d4e6fa33c1c3d74c5998e5b01c6afa8e90e9179e04e174db4029668e5d1dc7b5568e9f226930e9c4ded4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\qap`g`v~dtlq
Size 10B
SHA256 9f69a70638aa01f893c7342ac9252b3b1147cacfd4c693eb1eeabbd2d97da1ea
MD5 a8d096ab549aa20d00344b70a780931d
SHA1 58b4fdb56aa39426c0484a3127b21c0f77a28a07
SHA512 870a10f8754387e47ec38ad5d185a3ded972f8927a7fb49410e3871da1b834dac646fddaa89144c0a592d41a55cf9f6bbae0226be6d2347341a6ff5b87bb1269
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\qap`g`v~dtlq
Size 10B
SHA256 51acc6b96fdab4cdb3422ace5c72a761addd741472e69de452f94300e5123a30
MD5 37a1d7a0e22bc54d8cf94879d2905caf
SHA1 1dc4c5c73c6bb30fe1cd538f9fc7368192d6fbe6
SHA512 69e5b5151969977d1bfc1cd74ff9b5bcbaad6db0d20403cb7516da98a2ffb63b61cd6a093d1bb3b432afc625c9520b0634ea6ba9349d0cc79f88c95eba285cc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\qap`g`v~dtlq
Size 10B
SHA256 21d182a17bbb07ae85c6b359f632586019268a35cb41479b27b96501b11bb72d
MD5 96615f48b0a4c81e396e3b99e8b0186a
SHA1 61ea5fc9c3cb60937ff23da0a6e675a60499ad9f
SHA512 c8f1d84fbaa2e930da486f016e119d0b47d2e73913abe4b51eb1ed3b8a750ecbb7aa4d785a8544e1de0208a2cca7ff6f4866a02fcfd1b516edc68849c852162f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ESE\qap`g`v~dtlq
Size 10B
SHA256 77a5a3a4eefa86da17da2162a59f75a82fc5015f6d041f68b23b81fb8a8b1c1b
MD5 8a8dd800d7b292b9a306f98d140806e6
SHA1 ed483e021df30e8259d81d3f8dfdf13701437f4b
SHA512 840b171ac4d05ac194c27144ab671c6b76390c6784c1bed6dab46c67a04b5325403a592474b166120c0fdacf1176b9d07ed5ea0842fc41d927e6ade76bb968d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 950fad4438ff9812bf54d47eabd26f965aaef66bf54f77d256b470fb2891920c
MD5 a14d1d6e9b41f30e5577262ee76a1281
SHA1 559fcd655fa5789ddedcb9d27b84f88fa86ea8e8
SHA512 63e5d583ea6e0e507b5198a3f70598dfe4efe7bebcb92b558f3c3179c08e41645190bb9bec00fcc694575961c1f5041c671d380e55c122ebea54022090544b31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4201dbbd7beca9b9f388c8d0f17de21793e8aec8aae70b605983c65dd7ac40cb
MD5 bbb0a0cad28084bca7e36fbe4353cc86
SHA1 660c43093eb1c06c86062f78477adf608121ed86
SHA512 e15dcfee224a46b08342af11f5292851a86277b0d355ad7695c5aa4595c1bbcfe4868ef534f5281d8556583617ecaae701b4a4ca33e8ec173d709dbf5e46bafb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79dbf3af3d6a26af98652832220628e9deb855c7c44bcf8995cb110b3cfb6bdb
MD5 5d559892fd939c4834e586aa0d8bec15
SHA1 d289b9139cea25e4c961e1360f21a36050abd1fd
SHA512 61bbbd42235f792015a5fb13dc8f5582ffc97d413fb625587da9bf74bb0d727f30e45c814117e95ae7af10c977b47e7be7b93169f31c8e4f4f6e42e9b07eb571
MD5 SHA1 SHA512

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 576KB
SHA256 6ac95d91f19ffbea166bc2caff10f88b8b608603c40e167378fd7d3ee0a1f889
MD5 6139e4401311aff3bc063de5708f9a8c
SHA1 f591b9c29c408ac44dee116112418f6a3f66e65c
SHA512 fff2c19f9a8754ae9db0d931f4420fe7d3a5ca76140d88eaed52e6ea991c7e65dc4f71e006f7c2ba7a3a0f37dc9b5d79d2b12dafbfeff904f2c8c9be2643beff
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojA9gUFgEsnojA9gDigUFgEsnojA9gcgUFgEsnojAKgUS:m9+EM0v9+EM0q9+EM0qT9+EM0qH9+EMZ
TLSH
T192C40909F94340B1DD2B50F04DCBE3BF8A60AB25C6128DF7FB4DCB5BA923BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 13.3MB
SHA256 64ddaa23b63138d3b859b4f4e816b44d10661a224b48f1cc09ada43ecb84e3bc
MD5 1a5d78b2ac2f82fd39aa1f3fd667795d
SHA1 2ffd6196b87ecce837219e3e10c7fc44a8a3c18e
SHA512 72c880edf46f10cac8960019aed2d5c639e0b479ad67a7e1d748d6cb16f6643d4b492c0fdc4d67a9f214b3eeac7503287cafea40877cd41db4f8abc7f51d47e0
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+ERC5KXpH+E7+ES+Em+Es+E7+ES+Em+ER:a545vp7Q545vp7Q545vp7njJPTMOm
TLSH
T1ADE65B09FAC34071E97751B04CDBD3BE8D317E218B218EEFE749961A6932BD1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 4.0MB
SHA256 223ab38b74b05895616cf977d6ea01d1047e90187354e575481483f9ed568a74
MD5 e2deddb1c8938932b46478565dc4c410
SHA1 3f3ad2400895d47ae5d1b0543a7b1be7e51613a3
SHA512 516990e4fd6548a7300a3ea63a524e3a679a7f43309c704898838a2efb4b35d2d8725f6534babb8a91b5a42ca6e59516ffff8d591d350ec972bb44e5d092ff63
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+ERC5KXpH+E7+ES+Em+Es+E7+ES+Em+E8:a545vp7H
TLSH
T14E163A09FAC34071E97751B04CDBD2BF8D31BE2187218EEFE749961A6932BD1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 30.1MB
SHA256 6008e417ddef90363afd1f71a81faa5f2d3a03ece21c7304a0d242e4677499a6
MD5 1879710f7f7612bc8fe42e111e8389a6
SHA1 1ab964e2c0b9992432436e0b4e1137f2122e549c
SHA512 e35058d01d873af6772bd883d9de95a9bb2ea645a049ad2fccb65ee5cc7c27702ae76ee3e80e32ff5c1ea05e0ba937c45712894c00d27b604e223550a9fba83a
SSDEEP 196608:a545NQ545NQ545NQ545NQ545NQ545NQ545NjJ4r:a545254525452545254525452545i
TLSH
T18F674B09FAC34071E97751B04CDBD3BE8D317E218B218EEFE749961A6932BD1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 2.6MB
SHA256 559d4d666656f0453403667fdddaac8a0909b10246c086c07b75151213c95131
MD5 fe5b6242785c5c81578f07678622e714
SHA1 0316cdf1b0c930c7d749799b8399eecbabae7904
SHA512 be49ef4722f6e0ba0019fde0fae1270b8250e6dda50dfc88516d6ffe315505d61dff2d7005e60c0bb14a0edcf9e8906bc22a4bac71a74353d838e75cc93d9093
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+ERC5KXpH+E7+ES+Em+Es+E7+ES+Eq:a5B
TLSH
T135C53C09FA834071E97B51B04CDBD3BF8970BE2187228EEBE74D971B6932B916438355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 256KB
SHA256 945b173e0c75f6f5f8ad499f806c152420b4e540fbb266b8b25bbd2fa0ba9e01
MD5 41c38d9864b89f53c3dfe7e5d3826c5b
SHA1 379da151bd630754f28cc7e6025336e962e5d536
SHA512 8e14d94160e972b907293c56c2783e0f7a2c858a062c38644676f8261a8d4a94fd985bb2240a7617c6248b7418112c369560dbbf23c6da3080e92d45f5e41da6
SSDEEP 6144:m+dTTUFgEs3XojAdI+dTTUFgEs3XojAdP+dTTUFgEs3XojAdu:mgUFgEsnojAKgUFgEsnojA9gUFgEsnoh
TLSH
T127441909FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 42.8MB
SHA256 1836a577fab66dc2e306b2bec4315e0368a0e56217f5f84fc56a9b6b440301d4
MD5 52f461f9eefa16ca873e6935d4f5ccb8
SHA1 bcb2b0cb12351c5e9c4f716a70bfcaf4209d5712
SHA512 e52201e7279fac0e9cda4b44384719291d09192cbfca4965f4dfa91264e95dec5c7379e50be0658b28fd46b5e1cac573d57cadc2cb8394c3153efd547b0f8693
SSDEEP 786432:a545254525452545254525452545254525452545s:c
TLSH
T199A74B09FAC34071E97751B04CDBD3BE8D317E218B218EEFE749961A6932BD1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 89c7aa7946fed234058cdf700de0b9d7bcae0dac21a8b027f09a4cac14dee738
MD5 56535b0d3051b811c7c35ef773fe4eb0
SHA1 d9704f3b6e0945505ed0716a1cf19d9123b48eb4
SHA512 f2e2ec9786e59dc934e8b2faa09bd6f197be6049ce72d4b76759faaad809b21058b26dfa826d7ea32626c3a8eafe3af621d09c85cfa309b855b9719bc2affdd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9640b03137e35fa4b76ef6ed84b5fac561b49e16e08dbd673f90a7c0d54dc8fc
MD5 a104275e84ac34adf761b9212c74100b
SHA1 4c771849a1e8a9188948e8d4e7dad2bfb6a3e86d
SHA512 81a2cc8c80b8d5590e545e1d345f651243baaaf937759e3baf3d488d94e8a8a715c0ca905316d661c796c41fb5251ffe0dfc72f9210805ff8fe949b0a4c008f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 842fece92e097a6883c0ec6170b7b797278f8f48467ebb83656cf6ee82bd64f3
MD5 452e801486f6ab4bce908f723bd33483
SHA1 90d0aea655c8bbb6e188da9483c6f1f4c20aa278
SHA512 8b6fb262b67f6e22a25bfc1991a71546022d160f8d4886d08bcbc1d35c122446d8deb83d99baab1fad468b30724516387b71fc31504c9e5cc12289e2478210d7
MD5 SHA1 SHA512

Submit Download

svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCABCBBCBCCCCBABCBCBABBCACBACABABCACBAABBBBACBACAAC.exe
Size 4.2MB
SHA256 2eee51eacb65bb4e6992a18da6219e6aff21b218122a1c76bc40742ddb011d7a
MD5 5a4172249ec559826d683312ad14fc32
SHA1 9914509c2427a04c921c017cc7e350cce138c8de
SHA512 5b40d2580e6d800fd3eef4286e9032528de295ab65bc7924f8213a900908c14f06d720734af1c43f94e8af1057653b6c78410e198a351e3397e291b6c004cacf
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+ERC5KXpH+E7+ES+Em+Es+E7+ES+Em+Ec:a545vp7h
TLSH
T10E164B09FAC34071E97751B04CDBD3BE8D317E218B218EEFE749961A6932BD1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7fc81ad5a8729f732ac7ffe3463d65d57046a8567dca639a3bf9a7b841829aa6
MD5 ff1dd7e0f48a077e29238747b68e836d
SHA1 39b19607cb3563b33ec9b984ec099cb4d56b230c
SHA512 7e360d5153f8504dfaf39c0e3f0343d8520626b566b6632e47cd9ad6501cd255457054e7e52c1da16721c69b73513c4e1867e08c65282a4efaf5ed7279535c89
TLSH
T1CD210B50B075D863E130A58E993EDF6B0CF43BAA5DACEB58934D821C6715C3F8D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7156d6fe337d854840c177617fa878d829051e508c6c38921f712c0122497823
MD5 d5d56e47a81bbc32c73cf3be4ef269d5
SHA1 18fd22ff73599fc81c8e3da25285306b7c0ecc09
SHA512 b303a8621140fa8ffbe5da2e95c8728ce0c5607013d98f285525886b48b1f547d83d51aebde95715aee76a7fd3273a03dce10cb3488443bc2965a2e6122334ac
TLSH
T1BC112710F075D863E130A98E993EDE6B0CF43BAA5DACEB48934D821C6715C3F8D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-109-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1380-1023-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/1380-92-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/1452-48-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1452-102-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1452-70-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1452-33-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/5852-83-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5852-58-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5852-10-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5852-32-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5852-21-0x00000000006F0000-0x0000000000711000-memory.dmp

Download