c2876cae841bc43183d6ec715b9b3c2e258594379639a28ef16d1d98ef2a93ed

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
Size 3.6MB
Sample260912-laf9datakh
SHA256 c2876cae841bc43183d6ec715b9b3c2e258594379639a28ef16d1d98ef2a93ed
MD5 69c7d3497e2aca7ab2d7896908c8a7ae
SHA1 92695a5f8e295cf88fe70f447195761a0c83ac55
SHA512 122964522673ead51e0c68828ae122b4e53edc9146a3b0d86e8a0714031a96f676b6f18cc06ac98def9231e9b4f476091a96aa0e7d1d3f2d209cbe63f8ab2d02
SSDEEP 49152:U+ES+E2+ES+E5HY+ES+E2+ES+E5HY+ES+E2+ES+E5HQ+ES+E2+ES+E5HY+ES+E2R:Rp7K
TLSH
T125065C05FA8650B1E97741B04DDBD27E8A30BE2187118EFFE789D62B9D32BD06834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
6096	svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
2084	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCABAACABABCCCCBACCAAABCABABBCBABBABCAACCBCAACCBAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe"	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBCCABBABBAABCBABAAACBCCCBCAAABCBABAAABCCCABCCAAABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe"	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5984	sc.exe
3564	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2552	cmd.exe
5628	cmd.exe
2500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
6096	svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
6096	svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
2084	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
2084	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
Token: SeDebugPrivilege	6096	svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
Token: SeDebugPrivilege	2084	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2552	832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe	88
PID 2552 wrote to memory of 5764	2552	cmd.exe	90
PID 2420 wrote to memory of 5272	2420	svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe	91
PID 832 wrote to memory of 5628	832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe	94
PID 5628 wrote to memory of 5984	5628	cmd.exe	96
PID 832 wrote to memory of 2500	832	2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe	97
PID 2500 wrote to memory of 3564	2500	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_69c7d3497e2aca7ab2d7896908c8a7ae_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCABAABABABCACBAAACAAAABACCBCAABCCBAABBBABCCCCBBBBACCBBCCBBCBCACBBAABAACCCCCACCABBCBABBCCAACCACBCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCABAABABABCACBAAACAAAABACCBCAABCCBAABBBABCCCCBBBBACCBBCCBBCBCACBBAABAACCCCCACCABBCBABBCCAACCACBCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCCBBBCBAAAABCCAABCCCCCABCBCBCAACABCBACAAACCCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe" start= auto displayName= "UserDataSvc_CABCCBBBCBAAAABCCAABCCCCCABCBCBCAACABCBACAAACCCABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCCBBBCBAAAABCCAABCCCCCABCBCBCAACABCBACAAACCCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe" start= auto displayName= "UserDataSvc_CABCCBBBCBAAAABCCAABCCCCCABCBCBCAACABCBACAAACCCABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCCBBBCBAAAABCCAABCCCCCABCBCBCAACABCBACAAACCCABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCCBBBCBAAAABCCAABCCCCCABCBCBCAACABCBACAAACCCABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCACBCAAABACCBCABBAABCACCBCBABACACBCACAACCABCCBCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 3864867daf4cd63fe0cea439dd17b0a3eb62003d6ff97a5d884d7773f7680b73
MD5 7922295c4b929d4ddcd31198032f60ee
SHA1 5174852c7e10621c87bbdc49933dc51881150e58
SHA512 ce2d3a7d93761d2a6534dfd1cb807a3d198faad7327974b765410979bf10d0cc14dcf0935b4cb3efee5a178ceab060afcd0cacdcb755d4fb66bc7a3c3ccbc0f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 151e026b9cdd05800ce2a12b87728e07f4bf79fa38a36a0b393d1b54cfcd3439
MD5 9007feb050798e44a6abc2747c88ef70
SHA1 562a5a155d2e4b6cdf4e111f715f964dd6e09bfc
SHA512 4f4b763206edb0b7aae5aa3e58c14a01d4bf809355ed7749bbc012e993ef7f75023e7413924af2f4cf9703420b2c149b4182370a61f6fe15392bc2bbb70bf4cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 daeb88aeac5d4233692b1b73faba30d2d36c5c270f3ed7933de8de568f6e4923
MD5 1b8ee03589fa882315d7ff137faf8104
SHA1 57cdc71f95dbad2f6176c3fa395cad4f4a5ebdfb
SHA512 8ed0ed628cbf113491eb96769bb1794df8e60570dde16cc3d42c602d84bfccfe1b03b5a6d240ec336e9e101665893063230952fc2e751442f8dd53391c8c891e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\qap`g`v~dtlq
Size 10B
SHA256 14af667a6a9f370337a51d07dc13bb9742e4ebae08df9b159a614da17ae8af23
MD5 fb702f8d61fd0c8aa71283a47bac184d
SHA1 3d76cfac16c4278e4824527483914a9094800138
SHA512 09c7e705615b2ef3577d8d6370447be8d8a85aa6f4ff5d8c9068878fba155d41f34f9113f0bef9ad7ddc367ea98bc18c658feda2c38caf607719e49b809333cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\qap`g`v~dtlq
Size 10B
SHA256 014f2e1314bd84d360bde47c727afdceb4499c78a5a67bf90b0d4af8534e23ce
MD5 653328acf7ffc834572e29b56eb16ecd
SHA1 b1eed18c8b61a13e91a018d5653a515ce82fd1cd
SHA512 8e75391948e5c5cc6a58fa968351032c1163b969d8db39068892d9cdbaf87735a22b25a0bc72ec5d8706e03fcb89cc8203dd4dfee1dbb7ab596b87148c8f1582
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 262bef48bbf192e3e29adc1864b1eab8b01845cb85c66635204524b06bf79d15
MD5 57675a3f1c759bcd8f6b27f36eea3c40
SHA1 ed4322ada28054ceda18f0553778239b7bb012d2
SHA512 9797803d9003fb69fe3ebcae866af7ca50c7a59e83799694296a3f6ed247507710fddbd8bd34b5c69257a59e6f58eb75711c4340d0f0a77a5af6bcaf6bf607a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23e7f0f5d57daa700d93e4c27d80b6c0e30e0c066786145888a07cf7b1daa347
MD5 a52489a1d8dd16034e1a76ffe4f173b5
SHA1 c5472472176971d51bfc62193597c7cdacc1ff92
SHA512 c5ca04d905e16e12d78a86b23c9b9bae148b0444567ebeb8d27b5517e368fbafc6ab35a6f6dfb87041992422a7d6249e29bf091ce1f18032a6a689670c4a691f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dced658101a8800cb577f5a0ff508cdd6056ed0df3582eb72ba762ebbc064a80
MD5 677844fdf17342a37319e747a51c34a6
SHA1 f50daa1c04f1fbb669439acfa22a355509761b50
SHA512 728ef88281e9ec261b267eec9e75ba989bbbfb4d562120c823623aef9a70d026a53a323a0e4137ddd04329682ce3ea81b37e50fc58cddd441c15d35c1403d18c
MD5 SHA1 SHA512

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 25.6MB
SHA256 40b64da4ec49824dd301ff8a0a2e0de94a82871d0c11ad9bce83dc59107eff54
MD5 59981afbba90bc5dc14c1de1a076a93a
SHA1 ca75e86638ffddb1e272cf025ba214c66ad0d5a1
SHA512 ba049898bf67d15a4adb7b375e4a45f775ce12e465d79a7e69fa72b1798efb6cab7f0e1eac1c2ccf077524040aa625f86e10494d701a2232b2274896d0ffa0c6
SSDEEP 49152:U+ES+E2+ES+E5HY+ES+E2+ES+E5HY+ES+E2+ES+E5HQ+ES+E2+ES+E5HY+ES+E2q:Rp7Wp7Wp7Wp7Wp7Wp7Wp79
TLSH
T152475C05FA8650B1E97741B04DDBD27E8A30BE2187118EFFE789D62B9D32BD06834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 11.6MB
SHA256 5ef5aa596df91673e31523819ad2cab857b2c8a7521fa1a9124cbeb8ef795988
MD5 6ef4bb16eb136295bd514c48682d280c
SHA1 54fb42b46839f58be7e7db6b2366c9a65d6457ea
SHA512 1eaf7bb22f9c224fd4a03400a979fbe01f95c3cda604100ddc580b7dd87f9c144bed99d7e023f581ba22994fb44c26753e73b086fbaac553e9a796f61a02f531
SSDEEP 49152:U+ES+E2+ES+E5HY+ES+E2+ES+E5HY+ES+E2+ES+E5HQ+ES+E2+ES+E5HY+ES+E2b:Rp7Wp7Wp7UZKP1EmWrGm
TLSH
T186C66D09FA8650B1E97741B04DDBD27E8A30BE2187114EFFE788D67B9D32BD06834A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 22.4MB
SHA256 5c1b16f9fe2b2c1f53a7071363bc8e68e36f6a50e919eb551fb15962a9967fe7
MD5 6e4f48b7c2860264f9dc801a601addeb
SHA1 eba7791b87eb93d23cce7dd45f0d1325b7551a8f
SHA512 b7486c5768ddf8f9146dc48760690d41f067ae21aa8cd0f6d8b55df1b44fade4b0e2ff8bdb30876a495e65efc03f6a907e08d924dfc2a63ba16b0f6c120d982b
SSDEEP 49152:U+ES+E2+ES+E5HY+ES+E2+ES+E5HY+ES+E2+ES+E5HQ+ES+E2+ES+E5HY+ES+E2R:Rp7Wp7Wp7Wp7Wp7Wp7UZKP1EmWrGr
TLSH
T1AB375D05FA8650B1E97741B04DDBD27E8A30BE2187118EFFE788D66B9D32BD06834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 256KB
SHA256 7b28fd3a56807fe6de19cd9f10ddc98dafc3b01def3eb72f8c922c6f92f1c91d
MD5 e4d1895fb3cbda960a5e9426d2cf6bbe
SHA1 fa6f63359f2cf82a4b93f36672b5624d6cff2a97
SHA512 3acb7380903bdd0533697d619095f2603ca2b7b37d72dbc43e07b222be92d5223b0e3b9e00e30c5b83713a0c9d9db7f02a5c2a397e4d06ae60f8d31b39ff018a
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdL+dTTUFgEs3XojAdw:mgUFgEsnojA9gUFgEsnojAJgUFgEsnox
TLSH
T1E8442A09FD4340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 192KB
SHA256 d64c17c057f0ee829b500749efc3d120aabb1e17f4038bbd5815e602748da5fd
MD5 1e18a843c1aa255ed866a9e890210ba1
SHA1 f93e3d163b3a5815090bc9630a886899025d51b2
SHA512 d7a68038054c6762724674b9584d914a48fbaf62cbf52a44c49d5298942d9a94a2a26b60c0ab0bbd0c0c442ec0d1dda0adcd1f2888ebe829191b6ebddf8900a4
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13XojAdoBdtpUtI9C:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAR
TLSH
T185140909F94344B1DD2B50B04CCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 960KB
SHA256 7084d1a616de7ccfbb6e515bcb2986fff21f88ac2847bb62b0e363b817187007
MD5 cc4569ecc26817fc8318c02b5e71c6a0
SHA1 83c3a6020d4ff43f0ce29f0ee17110f87e307f0d
SHA512 fcb093509ca88c462ad6ec73aaf39cf207461c8722fda727e8a935e8219a18ca6e3b230248e51df1948073c12119607d90b9e1108ce825b77dfc410502b89a16
SSDEEP 24576:m9+EM0q9+EM0O9+EM0q9+E5LLUh9+EM0q9+EM0O9+EM0q9+E5Lq:U+ES+E2+ES+E5HY+ES+E2+ES+E5e
TLSH
T1E4256D09F98750B1D97B40B04DCBD3BF8A30BE2186114EFBE78DD62B6933B916834A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.exe

Path C:\Users\Admin\Downloads\SwitchSet.exe
Size 36.8MB
SHA256 35dd3648d0d87d3c364510b62ecd7f5203009ff7dcab2ea42834c76eab03c85a
MD5 65b67efc0d2662999edcdcf5e7fb3538
SHA1 7e2f59af980dff1b7419515a2e13cefcd55c468c
SHA512 69e1b615b2eeaf1040840131caeba3629840c2e49f5c6d64cbfc5ee778e0ebc503f4357e173a36f41455f06dd69fa65a3d23443d5d03a81f86fb917ab3f85832
SSDEEP 98304:Rp7Wp7Wp7Wp7Wp7Wp7Wp7Wp7Wp7Wp7UZKP1EmWrGj:Xkkkkkkkkkv1Emey
TLSH
T1BE875D05FA8650B1E97741B04DDBD27E8A30BE2187118EFFE788D66B9D32BD06834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7628db27bfbb081d34dc980bed7a120c0b64956389522de592c8cc100fb8121a
MD5 52d4dfb29f0a0c24c50303578addec4b
SHA1 a72a0b1e94f8498a92fbda60e88e45b3f4c7ba90
SHA512 743dac368ef32bfdfdfca5e8e5062777e6a9bc12249c28f52d6820e44512f331c40e1c45f471389bbb600dec51b48329eddcb506bcbbee9cbd6f358c1d430075
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6db7753468572b9a67a599df3505286dbb3798a6d51cefc06b3c8d81405b163d
MD5 27d5327fe8edfe3a811eb37633f06985
SHA1 e51d56240c2cddc7301cdfe68ba7cafd3fad4c44
SHA512 e422a4f68b3af75d1ed11ac055c1a0ef62e6a83de98da6f5b0634cee105db3ddf61588b7d5a3aaf76a0d5f20ed3cee27ba6a1efab7c5e6d0422a51e02ac252a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 8d08256129fabfa196f6315c31471db3d480b59ea0a533dea05ef93830e74559
MD5 7c68387d336ce62b5a3cf4dbad564c8a
SHA1 93a78e3352f0689a924fb9b8486784c001a1360c
SHA512 4354776b6f125c9d0466a43a51dfe534e075c68ae13ae70fdea9411a8f0182966426c3bdc30b3603f25b243eeb8a92d06cab6fe75534aea3f2a2be8989e41fb3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Documents\qap`g`v~dtlq
Size 10B
SHA256 648128ce0a4021c33a11d63de195fc9212484213142e0787845b07f73fbb8985
MD5 19bcec4138d583ef4bec5b3d8ce5dddf
SHA1 f50bfecfff0011e95e13284662b23f46a9a0ce9f
SHA512 3e348b20b455e24264512b4e3b8167f6ea03760aa8a0ab991c818502d185991e4e56d95ad2ec12bc34dcefcbfe6c81b27a7fcd0333634d12389f29ddbffcc528
MD5 SHA1 SHA512

Submit Download

svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBACABACCBAACABCBBBCABBAABCCACBBCAAAAABCCACBAACAACBA.exe
Size 3.6MB
SHA256 c2876cae841bc43183d6ec715b9b3c2e258594379639a28ef16d1d98ef2a93ed
MD5 69c7d3497e2aca7ab2d7896908c8a7ae
SHA1 92695a5f8e295cf88fe70f447195761a0c83ac55
SHA512 122964522673ead51e0c68828ae122b4e53edc9146a3b0d86e8a0714031a96f676b6f18cc06ac98def9231e9b4f476091a96aa0e7d1d3f2d209cbe63f8ab2d02
SSDEEP 49152:U+ES+E2+ES+E5HY+ES+E2+ES+E5HY+ES+E2+ES+E5HQ+ES+E2+ES+E5HY+ES+E2R:Rp7K
TLSH
T125065C05FA8650B1E97741B04DDBD27E8A30BE2187118EFFE789D62B9D32BD06834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 8d739a1f1a7044ff9eccbe6c64039dc8507dedcda31a590803dbf3bb22ff58bf
MD5 fc7590a56c07f916e2dd093e78497175
SHA1 13c7b5118bd3234b211afeb30c6750ccc3008044
SHA512 3005cea546ccc1f913629985f88275c21ff3420e425aa185fa6dd5ff25fc1ccbc039ddce53c9906fef07a451d08fb8682fb257a6795b79640f873669a072641e
TLSH
T1231108A4B0A5CC23F1652CEB72658F560CE937BF986CAB8523C90218E7558398E214F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8f7fd52b9b706888fb67ddfcd822714e7b73e76ec2ff0c5a5097fcdc5291002a
MD5 a2e426e681250ae2babb76212db41082
SHA1 e6f997f7acc3a54cd7810fd9bf5b5a62b864b05b
SHA512 c2e42a0c6371bac5c7702965e63b014a4b0ca9526fd7513cc4fecb9909e09cbe7c05627499f154d74e38cb78998ad69163bf06fe3ac301e8fcef66ec73df237b
TLSH
T192113AA0B0A5CC13F1612CEB72658F570CE933FF5C6CAB8513890218F7558398E214F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/832-104-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/832-0-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/832-69-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/832-47-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/832-22-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/832-11-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/2084-107-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/2420-100-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/2420-68-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/2420-46-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/6096-101-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download