2354bcf48500611ab00bb9b8333df9c7df65e70adff14f982b881de0c06dcd05

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
Size 1.9MB
Sample260813-blb4payfkc
SHA256 2354bcf48500611ab00bb9b8333df9c7df65e70adff14f982b881de0c06dcd05
MD5 4d91f4ac83156a5212d2a94a180b4f3f
SHA1 741c3d9111e33e676159801cb02b83cb7ff27fcb
SHA512 ebb02d1af5b4f7984e28ec08924e2d716887ce50e6523985e63ff1f4825c095375133e1bb4440c5e736fc54266e656a7ba406a5f023f9e60f504915b504d08bb
SSDEEP 49152:U+ES+ES+E2+ES+ES+EbY5K5+ES+ES+E2+ES+ES+EbY5KODd79WC2:O5i5Vp7U
TLSH
T1D7955C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
3360	svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe
4692	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABCCCCCBCCBBCBBCBACCBAAAAACCBCACCBBCACBBACBCCCBACBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe"	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACBCACCBCCBBBCCABBCBBBABBBBAABBBCBABCBACCBCABAAACCBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe"	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4624	sc.exe
1752	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3964	cmd.exe
1228	cmd.exe
1416	cmd.exe
1736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3932	schtasks.exe
3640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
4692	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
4692	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
3360	svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe
3360	svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
Token: SeDebugPrivilege	820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
Token: SeDebugPrivilege	4692	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
Token: SeDebugPrivilege	3360	svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4460	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3964	2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe	100
PID 3964 wrote to memory of 3932	3964	cmd.exe	102
PID 820 wrote to memory of 896	820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe	106
PID 896 wrote to memory of 4028	896	notepad.exe	107
PID 2636 wrote to memory of 1228	2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe	112
PID 1228 wrote to memory of 4624	1228	cmd.exe	114
PID 2636 wrote to memory of 1416	2636	2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe	115
PID 1416 wrote to memory of 1752	1416	cmd.exe	117
PID 820 wrote to memory of 1736	820	svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe	120
PID 1736 wrote to memory of 3640	1736	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_4d91f4ac83156a5212d2a94a180b4f3f_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBAABBBABBBAABACCCBCCBAABBBCBBABCBACBABCCCAAACACCBACCABCCABAACCACACBBAAABBBCBACABAABCCBBCCAAABAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBAABBBABBBAABACCCBCCBAABBBCBBABCBACBABCCCAAACACCBACCABCCABAACCACACBBAAABBBCBACABAABCCBBCCAAABAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBBBACCCBCCCACAABAAACABABBAACBCBCBBACAABAABCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe" start= auto displayName= "UserDataSvc_BBCCBBBACCCBCCCACAABAAACABABBAACBCBCBBACAABAABCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBBBACCCBCCCACAABAAACABABBAACBCBCBBACAABAABCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe" start= auto displayName= "UserDataSvc_BBCCBBBACCCBCCCACAABAAACABABBAACBCBCBBACAABAABCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBBBACCCBCCCACAABAAACABABBAACBCBCBBACAABAABCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBBBACCCBCCCACAABAAACABABBAACBCBCBBACAABAABCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABAAABBACBBBCBACAACABBCCACCCAAAABBABACCBBAACCACBAACCCBABACBBBBABBAABBACCBBBBAAABABABACABCBACBBCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABAAABBACBBBCBACAACABBCCACCCAAAABBABACCBBAACCACBAACCCBABACBBBBABBAABBACCBBBBAAABABABACABCBACBBCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBABABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e21dd93659a7e747779cacf61982b431e1328ae0a3e35ce928db0370a3918797
MD5 562ea51995b27c707e80a58da770f927
SHA1 d9c85621c8016dd75b7487c0c852a245bb1e12da
SHA512 ec7e422abad11f8ccb0c6a1c8490b704b4bf4da78729fc9a8d2282fa91b662e22effa6f39ab114ddba74ae9336b3bc13d6a6af90ba80628ae307188b2f4cd409
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\EventTranscript\qap`g`v~dtlq
Size 10B
SHA256 8c7c21c1eb1fd4e6d2eab6b3b10a1246205d5defa5934beea3868b991dbcb8a9
MD5 f14095637e8e7044685a9750ae14c32a
SHA1 da98ff6cafd898fabc1d526e840f4e372e8a2c2f
SHA512 1a1065f9d01d6ffc830f002084a529d2d894d8ceaa293f4c2438c3ecb71fe5a51dafef21979274e0e3859ce8a6391a78f8040562f280413dd0f139fc970254a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 9908c5b762c27ff97a05e6573e88f2c7151590335ad0e8698164010721a38caf
MD5 d5d9559e457233035c3e0ed6262edc6d
SHA1 a10e4e6d07fcad52e4faeaacffc5be1b40987f55
SHA512 28e4a5ced832146605e04ca2031efdaeb50b898eecffe2a1d24d8ffc071453e063c6152781ed302656473a4d54d5a4910ed917902115e726be8ebc625f7173f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 21c1b7ec2629059071fb053a897a80fc3b824a15a010781cb29159e9638a3f9c
MD5 8d95dc5314bf62f7bbb0f29f5beb3967
SHA1 aea35e979369787892dd02f96e5fbe9667aeb40b
SHA512 a75f3059e949d708a7d09c86e3423552b7bbcbf3ba375b37eae7c981f625b1de528bd0f57c19554456188b4a25a296c93747908c889c99d39f3140c3016df492
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 3e48564ff990033bc8b1439e7e770380acd5509c89880b8599da74200121c72b
MD5 1043d2959cfac1832ee2cd0c2765737d
SHA1 69d0a489d481942ef62808feb0be9dec389e502e
SHA512 f6e7fba1a853d0e484527f6d36e15d20ae1a4de3df8cb64766071186bccaa55e81118f4fbb3e1a2a9ab0706028d0ed112a79da54a6903592300ffb85bedf35fd
MD5 SHA1 SHA512

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 24.5MB
SHA256 f18046a4d18113730308ced38fea494b63ee4135184aa895fe3592a662c3ae5a
MD5 a7b28eb0c1d78b575ebbfc3e3993b1f8
SHA1 f37103ba74572eb03a585e8594b2a1b5ee646944
SHA512 a27658e93b71dcd287a0b1afcbb5aba7c1555d060e61d88a34c26f621e169e1a0a69dfce9d92b2213391966b5887263f41b740ffebc966552556354c730b85f3
SSDEEP 786432:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i50Xh:QXh
TLSH
T179475C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 9.6MB
SHA256 3d198e4bb2890219df455f4acde225c75004fc925464eebb256f701065b6b3f1
MD5 9ea174cbdc5e0e2ae60136079adc20da
SHA1 312c4a75e2af76b8fd14ceb5c27f7f9aac27e911
SHA512 d6296dcb40084d3c5c2539c39a27e5386d6ce5d96a56029a3d932b0538f400891a9bf9ee5b679ea4e4dc553bd7274924dc2652dd47d92b4e10785f697cf59d9a
SSDEEP 98304:O5i5Vp7/5i5Vp7/5i5Vp7/5i5Vp7/5i5Vp7oN9X1:O5i5r/5i5r/5i5r/5i5r/5i5roXF
TLSH
T12AA65D19FB825071E93755B04CDFD3FA5D307A2047218AEFF649E71A6D22BE0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 22.6MB
SHA256 c35ab90ab10dbf2f3ceb061ddabef73d5ec254b798970fbc12bc9af996b773e4
MD5 0b94f8fbe3b02d4ac6407c35696a64c3
SHA1 2eb4e13ad3d53bbb37f9c83902d2338cfdb88ffb
SHA512 69c00a94b0b080ad28e5e90ac25a025db727213be8fa3831661f68616443e0bd0779cec1b360e5aa6207081661d81bae5833df72ac4674e69028fcce3223f227
SSDEEP 393216:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i50Xl:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5iW
TLSH
T1F1375C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 11.5MB
SHA256 1d42bf405d741d89b97d898f7ce9a02ae69f620aabe48be74fb69eba507d0edf
MD5 94fdbbe1dd3d506ee86600c55654d3fe
SHA1 05e121f374f3f1511b33f39ea0cebdecb53d3e63
SHA512 99b79c374762c9ccaf7706522563229d0760f4b810b454994c08c843b215b1c2e73d2009bd82ba78676be5a0521531d4e6cd567a5c4f854304c104d9ca90d76b
SSDEEP 196608:O5i5r/5i5r/5i5r/5i5r/5i5r/5i5roXT:O5i5T5i5T5i5T5i5T5i5T5i50XT
TLSH
T190C65D19FB825071E93755B04CDFD3FA5D307A2047218AEFF649E71A6D22BE0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 13.3MB
SHA256 20546d04a55b5e29fd226c2f27997ca028dde1f4d4de48c5decadd27cb619190
MD5 2d4f24797d3f08c2437e066d05724708
SHA1 6422a51a875e281715d731c09fa69460e75082a0
SHA512 21196ef94d24d0b293fe10f4c33e4aec243b1d367de384d64299e5c32e64e4d388f9aa60125a14373bdedc61892dc1f9fea75ba4c64eb1eb7741a81c929347a1
SSDEEP 196608:O5i5r/5i5r/5i5r/5i5r/5i5r/5i5r/5i5roXc:O5i5T5i5T5i5T5i5T5i5T5i5T5i50Xc
TLSH
T187E65C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 15.2MB
SHA256 b4a70ad86f9ff5ed1b1fc073abc2a05cce9b98d742334fcd27b44a31fe62e36f
MD5 246c8625ae9c56c6f0f9b56a3fb5d59e
SHA1 79abfa683c22903c5fcfe20cba7d8ea7b2685f2d
SHA512 5a7341f1c0fc9549efa82ecfa8ae36046b76a99d4d2d31925a784ca02428d1eefbb3dd88d0ac23c606c6602e82968d0ed33d66b554735efed23ce3f8ac1be79b
SSDEEP 393216:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i50Xy:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5id
TLSH
T1BBF65C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 17.0MB
SHA256 3446facad8ded93f138f45fb7f1f553f313604567f2265722684d589d860c5e3
MD5 ae4a926812f37fad20caebcf5be5429b
SHA1 17bb50c039ce90062b49cf5502cb3fc24b7170ea
SHA512 95ad85dd0b47a3d3e6dab9be63356b7ca1099acf1aeab450a98b29f3f57f87fe4d1905e44eb0dc5891bda8546476ac52b9586c571df7d1fb41499503b86088c4
SSDEEP 393216:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i50XU:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i+
TLSH
T132075C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 18.9MB
SHA256 79eb218abc06f1fdc95d24406e98e2bd15efaa94291f87f54bc6584cec531b41
MD5 8a76826a971ae9dcf76b3d61664321d8
SHA1 80594de7a97d434b3d36e402b1f0839db81cb757
SHA512 5befe3efaf9d48183fa19b2ac468a502a0426be886984fb16ae723e80275d3fe46167dc0c9a652271a8405af65996793e0c74ab7198b7749ec9a79a87fd6a85c
SSDEEP 393216:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i5T5i50Xp:O5i5T5i5T5i5T5i5T5i5T5i5T5i5T5iK
TLSH
T12D175C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bcdaf7549941dd04219030e9a331219213190ddbf872d2c2bf749e480739c4a
MD5 413a7957ce91e88079a44629840ae0b1
SHA1 d6a4e1cdfbe8aa1ddabc71549c58835676aa9e0e
SHA512 f6d3db767787c5dd3abbf46d70b89fae9c603e573e34f0b2ef48ccdfa20a99d437ba2a3466ebd0c06bf7fbbcfd9cb59563762f0110039e47d09c2104c5301f89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f150e9bcf595ab1e4694e8e46d9dffeb151555bac74b2182e45372e1a4deb860
MD5 de20f39bff06697d30471bef075221b4
SHA1 7fd95f2c56224fc552ee9cbba70a771d3a7c6673
SHA512 e6c51a0f919d67462c9bffd43ab8d6c7aba0eb5767363d2254af88a1f8b6cdb224c8f9f24f51aacce5d1bd82a0cb25908f92cf3e521ba9350419c4ba86cde391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c122a7dc764db39eae67ed87937d8bad8558655edd43fd055ad6e82f62bf7382
MD5 cc6dc55cc456ac78d0dead11b8e49d68
SHA1 70de2130fefa69d230d30aeb7019a77cb867c4d5
SHA512 efe26436e46f7a8d50910651e9f30f8fa6e1d8f22fb9d20d02f959067eaa809f0c20addf2d1eeab6015a62d6df5d60191741a0cc25afc8b56d0cc04a91a4cc16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f177837d813665f7b75b621b4c47123c45fda57b69edb71f0a366686f7aebad8
MD5 533fbb21a376e899fe9fd287fa918b8f
SHA1 cb76a4d425119cd6eeb1fdad36c705f52a18c57f
SHA512 ac02900301c8c97f08888e8733d781460664c64daf4c290f5a0b610b44fba9541058d7de659fce03b67b79fe3f086a63d8ac19836c9650c6618d9a1004cd212f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 918a1a8b701cdb96ab1854ceaf8055b0003b2e78857082b4fbb5a3e18790c2f2
MD5 3865a96f887dc74f8eec18721797c5b7
SHA1 d5197aa457f952d3f5804ee88958d28c430deee8
SHA512 88767ac2326ff5b9bd2b47bda2c10a976acdd5dcbfa666fb556840834894176ed9f673a80195319e9beae31206b8e2f32aef6acfd33ab79ac7f40c67b0a7ed85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dc534c59cffbc802baef8fe94fd4f8b283a10ebe9ae8d109bbbb03996ac889a2
MD5 5d4d49f290d27129e92ef23c46aa44ea
SHA1 894143457e20b4c42edc294eeb580e649d6f5417
SHA512 980a45a9ca0c2b9129c525bf030198da5f9a0bd9a8e6e7416320e01ad9a9ea248980b07d5ca718685a4ca435e8db98e8683d840842222afa5567ee70b2c7c8da
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCAAABBCCBACCBACBCABBCBBAABAABBABBBBCABACAAABCCABBB.exe
Size 1.9MB
SHA256 2354bcf48500611ab00bb9b8333df9c7df65e70adff14f982b881de0c06dcd05
MD5 4d91f4ac83156a5212d2a94a180b4f3f
SHA1 741c3d9111e33e676159801cb02b83cb7ff27fcb
SHA512 ebb02d1af5b4f7984e28ec08924e2d716887ce50e6523985e63ff1f4825c095375133e1bb4440c5e736fc54266e656a7ba406a5f023f9e60f504915b504d08bb
SSDEEP 49152:U+ES+ES+E2+ES+ES+EbY5K5+ES+ES+E2+ES+ES+EbY5KODd79WC2:O5i5Vp7U
TLSH
T1D7955C19FB825071E93755B04CDFD3FA9D307A2047218AEFF649E71A6D22BD0A839316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 c9d7447ea5196512dc007e4edc3aaafea9c2382b9669e38048bd294bb449e523
MD5 fedd62b83aaf7c0f5ee6e9653c91728d
SHA1 43f83b653dc03fbf7f1bcf8dcc5a2f6987d3accf
SHA512 50effce4bc32984025a556fa8a0bdf5f213d5c238e99def4e407dfc666fcad5fd9db82e26cbaef3153091027669eba07bcf62b357dd420f37cee3be69abd7329
TLSH
T11C01FE41B4D5D893E93324DB772A4BC25CD83B8BAC6C6A08330D4219A7C9C738F154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c50c16c5c17a0a986323b3399a49b2c924477a0626b67608196592a0c8d2d8ef
MD5 0d482d22c2aad70807e1ee4386e31f7e
SHA1 38ebe44829b57b32c7e63eecc7aa96dcbe697c33
SHA512 5650817d2f013efda381552d14db1f7338cde7d9c81df3ad18528bd178d882446153071647a294b274a94d78bbef62f3d8e8d66e6becf7ef4a3b6ecfd7a8093d
TLSH
T19121BC51F4D5CC93E93364CBB72A9BC25C98379BAC6C5A08330D8619A6D9C73CE058E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a07ddf7df345ac5ad614fcba6b7a0e2581b0a177a6c4100dee9a5fb84ba9b988
MD5 cc7c674b5aec564d97258a0277e66f4d
SHA1 b561992bbab5d6d983d88985a97ca8502caf81da
SHA512 91703bd09f3ee95d8c97e0a0a8d77042a02735013329f57b1aae86d8453187a761361a3d3dd75656b66947ecfe7b440ca9886b68c416a6c7edbea627cd74cff8
TLSH
T12C21DE41F4D5D893E93364CB732A8BC35CD83B9BAC6C6A18330D421AA6C9C738F154E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-98-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/820-73-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/820-49-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/896-77-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/2636-74-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2636-101-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2636-50-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2636-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2636-23-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3360-91-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3360-2794-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/4692-2191-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download