c7c8000238d05397b7d459ce78aef02dbba71efad3bfcf82206b0086a4eaa6bb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 3.7MB
Sample260814-e3mtascp6w
SHA256 c7c8000238d05397b7d459ce78aef02dbba71efad3bfcf82206b0086a4eaa6bb
MD5 520a038e617db6408b8b4a469360bac0
SHA1 35efcf5130962c76db5ae82fced04268517f00a6
SHA512 7fa3e3e93059778280648fad3023acbafe6c38446a02cc77b5aed8b519c9938467a7b7c7eac1bbadc728d3d27bc5500305fb693fb0fc8b2ad0e0ea4ec460c929
SSDEEP 49152:U+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+X:/KjKWQckVgtev5mnlNLg
TLSH
T1C706AE06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
5048	svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
2028	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCCBAABBBBBBCABCACCBBBABBCBBBCABAACCCAAABACCACBBBBCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe"	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBACCCBABCBBBAACBAACCCCACCAACAABBCABCCACBACAAABBBCCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe"	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3784	sc.exe
4932	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4188	cmd.exe
2292	cmd.exe
2328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
5048	svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
5048	svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
2028	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
2028	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
Token: SeDebugPrivilege	5048	svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
Token: SeDebugPrivilege	2028	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2328	2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 2328 wrote to memory of 2916	2328	cmd.exe	103
PID 3636 wrote to memory of 2876	3636	svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe	105
PID 2876 wrote to memory of 2352	2876	notepad.exe	106
PID 2636 wrote to memory of 4188	2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	111
PID 4188 wrote to memory of 3784	4188	cmd.exe	113
PID 2636 wrote to memory of 2292	2636	2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	114
PID 2292 wrote to memory of 4932	2292	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_520a038e617db6408b8b4a469360bac0_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABABBAABBCABBBBBBACBCBABAAABACBCCABCBBCABCCBCACCBCBACBBAABCACAAACBAABABBCACBBAAAACAABCCCBBABAABABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABABBAABBCABBBBBBACBCBABAAABACBCCABCBBCABCCBCACCBCBACBBAABCACAAACBAABABBCACBBAAAACAABCCCBBABAABABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe" start= auto displayName= "UserDataSvc_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe" start= auto displayName= "UserDataSvc_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2352

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBABCBCABCCCABBACCCBAAABBACCCBCBCAAAACCACABBCAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 18bdf708433cbb05798ebc782f101919195c66dd57d0bedd4c8545d71d4811f6
MD5 efde4e19b978eb980ce418f85a63ec32
SHA1 1747fa7ed4f0c5939972a1aa50cedab4384768f4
SHA512 7f2109daea7c4b6bb97f3c21089982dbf3d1865b9697ae7d85b54c01977bf6d45b3eb598ce8fe81b714591621794e54d6b1de825da064e4d937ce5cdd55eaf63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\qap`g`v~dtlq
Size 10B
SHA256 6329d8cfb1ab4689cd3d66847170431176c56e6126b683d31e98e579acf3dac5
MD5 4f713ea2163a18c343c7294ee5bdd7ba
SHA1 59c941e0c6da0aa3501b50910f9a97d09cd02061
SHA512 5e9318ba3e58eb027d396c9ec5c437c8bfb2e46677fc404e76a915b0ac4af2bfaddf6012a7b09e45ad4913c186676fcc1dc44794abd9cc4cc14e2fd49ca55e93
MD5 SHA1 SHA512

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 45.2MB
SHA256 7e456de291117c6785942a5ede50e49969fd8474998f56461073ab9de552f5a3
MD5 6673ea8c411e7d946ee87928c7dbe433
SHA1 1ae5efbf4f8e6df682dd0980b05735298e466c2f
SHA512 66849077c0d882165c0bb03e822f36d2fc470ce37b09aff1fd7d144f3252b1382028804b6e3f6a2eb8cf674579ff459fa0211602c4298f8aff7b64b326d69c25
SSDEEP 786432:8EIvREIvREIvREIvREIvREIvREIvREIvREIvREIvREIvREIvYXn:0lllllllllllYXn
TLSH
T12DA7AE06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 2.1MB
SHA256 ddefef663792aa283ec7e9ed256c80bbc6bad19752bbec0b9eac71b4b6990871
MD5 7b85004f7d7d491c8a8e2a77a250ca2a
SHA1 18c7b42c06496bd911d14254331b03db303409ac
SHA512 02da785ffebafe15f18de295f82265dae4d538bf92b0eda352df109df8107cc1a813df06548eb8e88634b31e5a0dbea2b2192fe1cd804a4ca364ca4902c6349d
SSDEEP 49152:U+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+EpT:j
TLSH
T1DCA53B0AF98340B1D86B14B04DCBD3FF8A71BF21C6128EB7E74DCB5B6932BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 26.6MB
SHA256 d1d5bda0566b8e28f769e0faac98e5a023e91e0573f93e21723bf0c21f47a3ac
MD5 f28f9531dc6bfbb52cb3ac8d26da2ddb
SHA1 931ff5bc479611d3a270cf243b74de7b97bf5cc4
SHA512 fd6e740f8b1790f1c93e979ae009e3467a9021d2868f5c2af3ea279076eb242309ebaa88213047901451249f8922076fb7ad8dafbc59c4e69842a8f6b6ff0f3f
SSDEEP 393216:NcZEIvkcZEIvkcZEIvkcZEIvkcZEIvkcZEIvkcZEIvYXt:8EIvREIvREIvREIvREIvREIvREIvYXt
TLSH
T18F57AE06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 30.3MB
SHA256 0223b4a698a25a52769f0e20a61a9d446e1d171fa18557ff609ee49dd88cbd5d
MD5 92b705329c6dcf36dbe60220afe2d476
SHA1 7283b1006dc9ead1c44a6d02b32bd2741f84eedb
SHA512 35e71b2c7b654e0a4d1b65974de9a365cb1c8e5cef5e862eeda3a5bce007ae99937c1d74e550806ed7930a7dde636286aca843b303c3ac4a5cb9c5ca492925ec
SSDEEP 786432:8EIvREIvREIvREIvREIvREIvREIvREIvYXU:0lllllllYXU
TLSH
T14967AE06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 34.0MB
SHA256 f011827e5cfc7e9fbf44f9afcb8888e28b769d653846abbff4f3dd088ed2fabd
MD5 986b0a1612a0d451d016bd2542f76958
SHA1 0abdf49cc3948941cad67e50189f032fb927ff92
SHA512 57c8473d230b74eae9ac6f8f641d08a0d8ca900fd12b12f067b64b15d964c8e4db718785747166bf4734cf7d59490ee73974c1cccde450a25785f2a43b747cdb
SSDEEP 786432:8EIvREIvREIvREIvREIvREIvREIvREIvREIvYX9:0llllllllYX9
TLSH
T13E77AE06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 21.2MB
SHA256 d33f65abfc963001932110f0f7cf0c575fd946e351840ab02497388a7afe5dda
MD5 c5b2cc884ffddb3c92d065af7b642d82
SHA1 7d4aed9fb328bdc7b17559b7b7bf7060a026cbae
SHA512 f31c12e1b66fc9820c2f01fc4039030800a791ccd8362d1a892dc50babcbd9bb0f61c8ba72017f61730eddcadf2ef044e966fc4967455756ca0105ba2f596432
SSDEEP 196608:EKWQc0gEYnvLJKWQc0gEYnvLJKWQc0gEYnvLJKWQc0gEYnvLJKWQc0gEYnvLJKK:NcZEIvkcZEIvkcZEIvkcZEIvkcZEIv9
TLSH
T1A5279E06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 699a28220bc2f7734ff772e24bed9813469c21af962c697eaa3c5bb5e689f127
MD5 1573622949f3264994a3acd7adb356a5
SHA1 3d0d5d2eb6f0703283b873cc216f91d87088d698
SHA512 2bf18c494c88c28625795a5a66b14c10737b9d372732da096acd09332c906dc4f61780b4851d440743e61a22e85e2461aa954a4ec45f59a934f36cecef8a0c22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce8d4fd61a1ae4953c49915addfae3f5bd04e14d1785ffeb1c96dfdcfa474a06
MD5 0a801e0320b1d4a85fc445c629de8641
SHA1 7778813a222b608191d77e4d108f317ba9a18325
SHA512 ec60bd76824b69dfb4e14ede1ce8ed9e13b1edce7278fa0950f404ff276c4053567fc1ea639585446bcc0403495df52d91122f4dd304e4da71807762e3c8c075
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6aefe1d0f480afb4a81b2f986137a4f6d69d739c432cfee74758145e20eaed8f
MD5 d55a4c715674a1b562555c6e3bd91753
SHA1 f102e376fc36ffe2f78aa2018fe0068fa1529262
SHA512 f9ad31138f808cd278df31b103d695e8a41e47c49c8f502a7af5043ad6c37c44ab7cb9c89eed7a14939b973514589db42b5eae7877a3f658d184177cc6248a9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb1a101d914823e9668c31a28e7e5d72faeedf44480c1b6d0757df889b5562c9
MD5 ae71c9370d492384258fdcc9052badd5
SHA1 e4e990992e5c9828f20826f07ed9b5171c23e954
SHA512 821bc8b3135dd54481d0aae0a18905f7808c5ce08e880ee65d739e97dbda6b87611a8705ac5e198f3d4434d9b6f9525173994357ab0cc38b86996d61af3d99c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 081b29f1bffa12f7000bebc148a87535a42f360e36832e4b6207b8e61d556c51
MD5 91b976237aa9b748a187b55b5862fb20
SHA1 ff4b485d1f7eecb204038041c247c85935974d19
SHA512 3c44877cbf6de71b59dc9d192d4d0e6f57f43f50d61c9f01bacbccc49e3786ea46c5c0bf4c241d6a37637396a6a454197e0783c76e06fd390e986af82d399b4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09821a51393ac5adcbfa08614980a29563417b6b57a3d9a6130d53dac0dc896c
MD5 94fbbbfe67a87351e6a175daa0e12668
SHA1 fed1bd60eb30226efbd45490059d87b45cb43356
SHA512 15065db0a830bbd69790f4e5fc129e182f5b126b9de08ab2a405a5b8a250086c82507b4f25cc3f80cb27d6aeffe236a2e132de3cfbfcffd25346af2d4c2cffbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8600a07a09db9f9f2509afa230ec1aa17a99171405c8286a5dbbae24076337c6
MD5 00401611500ccd8f4e112cd77a1350b5
SHA1 e2026d415173ebe5220ec9fb3257aad8e45894a4
SHA512 662f25d71eac3540d18750dfe56d15f4c98b8bad3ebeef4dfd4753a04cd4667ea62b53552f51816bb918310b8a77ba2177238bde6ba03fee1c75a31002815270
MD5 SHA1 SHA512

Submit Download

svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCCBCABACBBBCABABBBCBCAAABBCBCBACACCBCBACCCAAACAAC.exe
Size 3.7MB
SHA256 c7c8000238d05397b7d459ce78aef02dbba71efad3bfcf82206b0086a4eaa6bb
MD5 520a038e617db6408b8b4a469360bac0
SHA1 35efcf5130962c76db5ae82fced04268517f00a6
SHA512 7fa3e3e93059778280648fad3023acbafe6c38446a02cc77b5aed8b519c9938467a7b7c7eac1bbadc728d3d27bc5500305fb693fb0fc8b2ad0e0ea4ec460c929
SSDEEP 49152:U+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+X:/KjKWQckVgtev5mnlNLg
TLSH
T1C706AE06F98340B1D86B15B00CCBD3FF8A75BF21C6128EA7E74DCB5B7932BA19428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 71a4f87ed48d6ca247ce96e47e4d9e50aad6875a7b1f209c911fb55c6dbcfb20
MD5 2f46ac0dfad4b161ffdde7d748051c04
SHA1 e0424fd80b7860b73f0120ba2e260be36a6842ec
SHA512 85c425a648ac3d479092bcbdf5619f2126a757c4245b227300c0898bb73196c878541422f2ff010b9775881a48a9139d98b600ffc835e5ffa8cb428550028736
TLSH
T164110D60B8E69837F93268CB652EABD30CF4B797B8946E44230441286BE4D31CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8e72f45db13df4b843a6975373f5af76d1a9086ea7c032fe309e3ca788587f31
MD5 a34a7e15a46e57a02a9c31f25213df69
SHA1 2b6af24ef56e29e5d081d06e890b4976b702361f
SHA512 bca82ac8f51f978f782b5b10e747dda1427e2a3993b8427eed7abc0831ceb2a71d12dba939f57588a369a14104d46c8a5f2f2a99f49d3e6d6fa28ff7d20887cc
TLSH
T1FD210E50B8E59837F932A8CB651EABD30CF4B797A8946E441308412C7B95D31CE554D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2028-118-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/2636-23-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/2636-91-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/2636-10-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/2636-35-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/2636-69-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/2876-76-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/3636-116-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3636-36-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3636-51-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3636-75-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3636-70-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/5048-117-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/5048-96-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download