Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 8.8MB
- Sample260702-alcjsagv3j
- SHA256 cdfdb27359fb22a264e7f4bbea2d91cec095c5cfb75a006c5c059bdb6b83f414
- MD5 3cbfc32df1e5429ba28e105d61fb4196
- SHA1 08b216a04988b17f012de21100fd323c4cf1849e
- SHA512 ae0ed70ba429dbd2ac872045818f7b6e14012ffdcda5ce0dd81f791fb32237102aaae9e6eecf482d86a0180d4e5557d5c5d5a458ff6831fd83bce123ebac9b77
- SSDEEP 98304:+tOY2v8UVkoS5Y4BE9gP4v+XuNHQ4pQBrwnRf3QMNljTD35pT:+1kxS5gS0dqknpxTjppT
- TLSH T114968C03EC9515E9C1AEA63189B29253BB717C481B2273D32B90F6396F77BD0AD79340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c568-177.dat INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/files/0x000d00000001c563-207.dat INDICATOR_SUSPICIOUS_EXE_DiscordURL - Executes dropped EXE 9 IoCs
pid Process 1980 wruntimehelp.exe 2808 vmcomputex.exe 4124 start.exe 1292 vmcomputex.exe 204 id.exe 3268 vmcomputex.exe 1480 vmcomputex.exe 1952 vmcomputex.exe 5928 vmcomputex.exe - Loads dropped DLL 64 IoCs
pid Process 1292 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 2808 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 1292 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 2808 vmcomputex.exe 2808 vmcomputex.exe 1292 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 2808 vmcomputex.exe 3268 vmcomputex.exe 3268 vmcomputex.exe 2808 vmcomputex.exe 2808 vmcomputex.exe 2808 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 1480 vmcomputex.exe 2808 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 1952 vmcomputex.exe 5928 vmcomputex.exe 5928 vmcomputex.exe 5928 vmcomputex.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 5476 icacls.exe 2588 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsRuntimeHelper = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\ListSync\\settings\\Syncx\\wruntimehelp.exe" 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\vmcomputex_rCURRENT.log vmcomputex.exe File opened for modification C:\Windows\SystemTemp\shared_memory-rs\shmem_BEF25903873CA604 vmcomputex.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5008 PING.EXE 240 cmd.exe - Kills process with taskkill 1 IoCs
pid Process 3832 taskkill.exe - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 5008 PING.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2808 vmcomputex.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe 1980 wruntimehelp.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1480 vmcomputex.exe Token: SeDebugPrivilege 3832 taskkill.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2808 vmcomputex.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2808 vmcomputex.exe 2808 vmcomputex.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1980 1040 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 88 PID 1980 wrote to memory of 2808 1980 wruntimehelp.exe 89 PID 1980 wrote to memory of 4124 1980 wruntimehelp.exe 90 PID 4124 wrote to memory of 1292 4124 start.exe 91 PID 1040 wrote to memory of 204 1040 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 92 PID 1040 wrote to memory of 240 1040 2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93 PID 204 wrote to memory of 3268 204 id.exe 95 PID 240 wrote to memory of 5008 240 cmd.exe 96 PID 2808 wrote to memory of 2588 2808 vmcomputex.exe 98 PID 2808 wrote to memory of 5476 2808 vmcomputex.exe 99 PID 2808 wrote to memory of 1480 2808 vmcomputex.exe 102 PID 2808 wrote to memory of 6036 2808 vmcomputex.exe 103 PID 6036 wrote to memory of 3832 6036 cmd.exe 106 PID 2808 wrote to memory of 1952 2808 vmcomputex.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Adds Run key to start application
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\wruntimehelp.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\wruntimehelp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T4⤵
- Modifies file permissions
PID:2588
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T4⤵
- Modifies file permissions
PID:5476
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe" --portable-service4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe" --run-as-system5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:5928
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe" --check-hwcodec-config4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\start.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\start.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe --get-id4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\id.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\id.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe --get-id3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3268
-
-
-
C:\Windows\system32\cmd.execmd.exe /c ping 127.0.0.1 -n 3 > nul && del /f /q C:\Users\Admin\AppData\Local\Temp\2026-07-01_3cbfc32df1e5429ba28e105d61fb4196_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5008
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\RustDesk\shared_memory_portable_service
- Size 23B
- SHA256 ea7e06c8ff85976dbb7cc52e9b014052773936fcfd03b041fe9fe1f06b0662ee
- MD5 68b1ba7b34fc1c3d3b0b692588c79eee
- SHA1 457f5f2cbb14f8a46617f1bedb7024e046865bc0
- SHA512 9aaf5a15385024d6e8d54196c5e543cff5312316393be4bc4623b4ab3d41d5d942a0ab26e33fd6177eed1f0f2c7eb51a28f410a1e05fb3ce6ff64a1ab87ddc04
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\desktop_drop_plugin.dll
- Size 330KB
- SHA256 be81b1c468bc09ce19ff3c60f93d7bcaf96ffc04fcf13d10b9d0c1e6ae0fe772
- MD5 c7c3f73c4c75cec6b6b3869e71ee6858
- SHA1 ad332cf21c121d57ccd8a9b91f3aaced326e46e1
- SHA512 1aa0193d04e3c88a0911b7a9a52343090b82a4930c8e133ba61fb659b8faf41f48fc088213f76b6bd73de9332be5d7a630f95d8c8be8d0226fb28af02539b0eb
- SSDEEP 6144:1R4/9uCIvoqJivCriaariRQiKPl0EyceSAFIm:1RvCIRi6DaG2iKPlRyBSAFIm
- TLSH T189745B19B7A554BAE167C53CC9A34945EBF2BC560BA0D6CB1390075A3F33BE0493E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\desktop_multi_window_plugin.dll
- Size 394KB
- SHA256 34ec912808f51647002f59c2050f429061b644311a793c1e070f41c9ca7c382a
- MD5 8e36dd29af32cf31338e0419601b25a4
- SHA1 6fc537e70aa7b871c4505fbab0debcd470dd370b
- SHA512 252bfbd30ed451bb0ad56242ab289fde84875590cc978650619ee1de4d53dc70ffddcd6fda68451e1c98b3219ebe8da436e7089289a2940307399e295d2a8958
- SSDEEP 6144:OEHBL7tynCkpHXh3mkPBBN2IGdkem5mgxEPwlMvOTn6nmFIf:R1iCkfFvN2DduxEPwlMvOT6mFIf
- TLSH T129846C2AFB6504B5E167C138C9774546DA727C8A4BA19BCF2394075A2F33FE04A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\file_selector_windows_plugin.dll
- Size 357KB
- SHA256 ffc341d54008c77b0d352baffda7dfa0872ead4d77ac36ed0171a9869f94e3af
- MD5 5cb636e1099a9de772ecfaa670bb13eb
- SHA1 d7b0ca034f86ceb39e7b1b205844f398eabe5153
- SHA512 8aeb12f7fbec311d0f65f218ad68a0e1dac678d0960122a8439944e621ea1c23f29cbc9493d102c4c9e0e4e6bf4fda7f9e66789a55627d8adbb76ad246b8bda5
- SSDEEP 6144:dRDPe8/AlvCObbV7jMiW0zBOHpxI9z6H4x7xJsWb7xFIe8:XClvCQVjW0UpCh77xJsKxFIe8
- TLSH T19F746D1AFBA854B5E167C178CDA78945EBB27C460B6096CF23A0075A2F33FE0593E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\flutter_custom_cursor_plugin.dll
- Size 320KB
- SHA256 1d61d14e6d97d18a12441c8431e197828a440225404952be179ef745ec8b2871
- MD5 b9ea507cc85f1a224deefc6c6f52032a
- SHA1 895c334aad842f372f20ca9085958ab21753a5e1
- SHA512 4e4da628f46ab606996d79e1dad32677914628541a93a9ffdf32140e3a1c9d1bf06ee4e2a4ea364c3a084c6355dc972ba7097d8aee1fae60244d39c607738098
- SSDEEP 6144:ylvCz6DzEUctTvKfyNPEUK467qaE8gWu5pFIE:QvCz0+TGytEU67qaE8gLPFIE
- TLSH T12D645B1AF7A414BAE167813CCD974945EBF27C524BA4D6CB0390069E3F27BE44A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\flutter_gpu_texture_renderer_plugin.dll
- Size 352KB
- SHA256 6c907d7d38d2d693169beb6444196d446ec212ed59d9d5fcb667e2fc26d91a22
- MD5 1f349fc460c53f7cd6020802b72b5610
- SHA1 7f245b844eb057f634e2e666918de09a38ccdcd7
- SHA512 08afc4c84930135fd16f601534b741e6dcfc4ee0d29dbc16dec33560a02c8f9a3b2cad774a3dcb889a87c01b6814bac5806a2cb4c803bbc650918c8fef59ce4b
- SSDEEP 6144:/IqQVCx2DdJ9kzqMeOtvQVSUiOoEg7TgoswQFIK:7QVCxMJ+zUOWVSUiOw7TgoOFIK
- TLSH T1A4747D1AFBA454B9E167C138C9674945E7B27C460B609BCF13A40B5A2F37FE0893E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\flutter_windows.dll
- Size 17.2MB
- SHA256 6c8815f27c90aa3dca424b8b8ada0fb561d27df2a1997b991cb9480c7de0ba34
- MD5 a6d0f5c147db1779c5e748fa5f61ffae
- SHA1 a94045c485b1cb457961bb729b042f0dc9a13058
- SHA512 4311c41648ae9297d82d95a76a1b44af40c46189e981fa6b9aa5c41f07945cadd9b120755f40a574c90395ddad70f72dae91bb73d33a4a4f832bce924ced4ccb
- SSDEEP 98304:6r9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rXO:uffggz7Q35r36YriN707eJ
- TLSH T1CE078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\id.exe
- Size 8.5MB
- SHA256 b4f9ee025e4cecf9857629c836f77ccb4c86cf8fc7c7ad4872095f9b72ae67a2
- MD5 44ccce41c04fa3d8b437149e2da07c7c
- SHA1 8cfd0fd8bc62ca1b09cb0b17bf72e2cdb5a52014
- SHA512 26cd8b0e8f62358294eae48e879b75ce6f496055c91d044e5a0f747222ccedc71d0b0a7195b99f54c66aba3a174c86a314e9cdc2bade19f180cacced99b75912
- SSDEEP 98304:rEOOYBOu91BVTKV3vE/RR44HRy9QWgWcJ+LTkseniYaN:r6wLte8r44xwQML4s
- TLSH T1B2968C43EC5919E9C5AEA23189B392127B717C490B3263C72B90F2396FB7BD06D79350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\librustdesk.dll
- Size 33.7MB
- SHA256 a0ffce6f5a9959caa29c036e46d6b8c1961dc4d09f1a6840f2df1d5277d1be58
- MD5 299605417f21abdf015b13d11283f72b
- SHA1 a2b45f33857f5cdeb49ccf7d3471002815c13466
- SHA512 0bfd2a00df7bc2afac79cc532420fb18da02af7ae13de0f61c3bcea9bf6376890176f027149c5364be2a4d027566956b2b265a0bd7a85ca73a9e40354ade38fe
- SSDEEP 393216:MLeVEzLeop6U1YKCbvVzwdtaTBDy86jgx6Akdfo65N69At/sboOHX4sKYAKY1r+X:MFzppjrtUR48GPs/h
- TLSH T1F4777C46F25651E8C02AE574826B6E22F7B13C4D43316BEB1BE44A213E63BD05B3F785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\screen_retriever_plugin.dll
- Size 524KB
- SHA256 240fad88c14b3d7f8eb9ea11698a23f64114a03aa94322c92722e334bf56a9e5
- MD5 fa3927c3319a8ef979b2b5a4a0d1b818
- SHA1 8585dd359139a349ff6b668cb17621efae085327
- SHA512 2c1a4499d784a8d95408f5e43b7d59de5135670f91f8a4f7b8a4daca1d7e69bab8b82b3795aee49141d195e8cb7d61781d1802e9a77c0a8fdac6b217bcb8072a
- SSDEEP 6144:YvM4Cn7osApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf82m9oz7w3f4sbsFI0:YpCn85AizXjjT3+LDfaoz7w3fxbsFI0
- TLSH T1AFB46C2AE6AC43B5E167D138C9534606F7B1B84A576196CF43E00AAE2F677F04A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\start.exe
- Size 8.8MB
- SHA256 e0e3be774984880b3612ba9b13a0e34b1aeb8106fd746cd00e323debc007eb62
- MD5 a4ad2e16197f70999643e5ffc0276671
- SHA1 20c612181666388602ec2496a84e8b61d7348910
- SHA512 672cdb12d219d369ccde6ad16eb31b01d92ec9ac7fe83b2f4e6b56b978434e5c209624d62674bc38d9a4fe898dee67afff937e36f440005cd703b9661af3b7d7
- SSDEEP 98304:JKxIPF0ywPpLZtC2vKAPAEz+ISzkWXvSpFc67xUY9kij7wLCk/N:JDN3wPpbFvKEz+ISBXvSpFc0veIAB
- TLSH T1A9968C03EC5515EAC1AEA27189B79613BB317C484B3223D72B60F2386E77BD4AD79344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\texture_rgba_renderer_plugin.dll
- Size 329KB
- SHA256 ebb8d94be6f10b512528d6fc31d020948ca2ea3289426aa6e3cd9a87c724efd7
- MD5 f83bc966c270708d0f14df0e2a0ba8ad
- SHA1 bff5e16d569fb24b4bfcd6642e0258cc27d34f78
- SHA512 d90abce576a5ace7c4f7a3234fb8a346cdf070012baaedfc65b099c5edef2d22ec64a9f561f5277bea5eaa695751dcd0add78e3c501929cf6232f28ceaacf56e
- SSDEEP 6144:2n6gHCyvN6xlody6G1iYpCyV7VMhQNXqauFI+Rm:2PCyVhybroyV7VMhQuFI+Rm
- TLSH T1D3745B19F7A914B5E167857CC9A34A46EBB27C460BA0E6CF13A0075A3F33BE0593E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\uni_links_desktop_plugin.dll
- Size 528KB
- SHA256 c31572f1707e22b27e97ebafe3c92cce941306e53bf77c2958021356140c0b88
- MD5 a55af646a7c4352edab2a35ba23e1fbf
- SHA1 e19de6fa9a2a450f0fe28a3db8440a10d7213af4
- SHA512 3b7e2af41f4be6aa56050d4e8870ba7efa8efa124433e873adcf2c009224beb974ec802be0867496c940a9f3eac09ca4269d5afe182ff8ccfd77e47560e0966e
- SSDEEP 12288:hM0P1Cz3uvbsZwx9AS7ryQao7qaE8BBMFIw:hM0P1CUMwDjoo7qaE8BSFIw
- TLSH T113B47D29F6AC43B5E167E178C9934906E7B1B84A1761A7CF43E046AA1F277F04A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\url_launcher_windows_plugin.dll
- Size 333KB
- SHA256 9beb9e86b6100bd6d4a31df82cb6f5dbd198e69ffd9c7e6f9283a012b362b1de
- MD5 b35305d379176a67d8f2bbcaad8752dc
- SHA1 f4610a7c3e0f39fb2ebed16cf8a8850f7cdceb60
- SHA512 dfe55a96b34ae5d6d1e5f73f03e5e7892e3aad437fd64e9175dced1b5a1bcd7715a39bdc5d3ecfa6d2f5f151e83cc13d5f7a5199f196f69a12f76b0cdd2466db
- SSDEEP 6144:Q7uWnMFCDOlYgxWprJc0XuM5i7V6bdXFIz:lWnMFChgUpO0+M5i7V6bFFIz
- TLSH T1DC746B1AF7A554B9E167C13CC9634945EBB2BC564BA0D6CF1390065A3F37BE08A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\vmcomputex.exe
- Size 356KB
- SHA256 28986d70ccecfb1ef5bd60681c179078ebf60e7c01d7df8584db5e7caa37b5bd
- MD5 6a28e7f3e77f3df1c1b0cd305127d97a
- SHA1 0371f0093166eccbcda18b7029b132830d53b3f1
- SHA512 06bff8e3a25c937246e3dd04b14160b82950cdec1e6a45b1aa869ff5c00df28d70dc22c343323a24d7e38616416ffd9239559f32d9ab030abd9dee7dc0757bab
- SSDEEP 6144:OebSY1I7C/kpanQo06Up3Qou01bv53m0EjW0VqYQDoFIw:EC/zL0r3QCbdm0EjW0VqYmoFIw
- TLSH T1C5747E19FBA414F9E1678538CD564945EA727C4A0BB1D7CF23940B9A2F33AE04D3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\window_manager_plugin.dll
- Size 554KB
- SHA256 da39507a7a397f7b2514060bf0de43b2e4b0de285c2c22036ec5cb321362b0db
- MD5 0513541272231637e24b69c3a3dbd09a
- SHA1 73a3c8cbc20cfeb9f53a35fc4ff1ae8f829a92df
- SHA512 e418626c8796900231b18f0c6d7ca1e16f751a65df435a6179ddfd797601174a43b3c60bf5051430922692daa756bcb951042419c55a9b4e0c9c868eabc40e4e
- SSDEEP 6144:swzVkCweCWO/sEymFhtaJiXpzvMWd374w2yZRpgRVKtc51YY//3YxKlaPqaEOcT1:hNCWO0EJzeWp9t61vQKlaPqaEOcTGFIZ
- TLSH T190C47D2AA7A843B5E167D178C9434606E7B1B8465761A7CF03E05AAB2F277F04B3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\window_size_plugin.dll
- Size 522KB
- SHA256 38377a3f3f298859c718011f556480b34d907b44accb3bc14adc033340ec7e04
- MD5 306df770bfc2c0204345b5298d107940
- SHA1 c166b276179728655dfd614814334464a892fd9a
- SHA512 f5c0d8d8a179b8de96533c9ec1bb40561576dec53cb408b871edcff1e4dbec10b43689206946d81f0eb439f76b36737057ecfd3674900eee042ac92b6212680a
- SSDEEP 6144:BX9eRCYbq2nHV0nNoEZP9KouXmCIz3JjjoI1ZiQfKxY8fMaYPqaqtPDILu2FIz:B0CYe1KoxF13KxY8vYPqaqtPaFIz
- TLSH T15FB46C29E7AC43B6E167D138C9534506FBB1784A576196CF03E046BA2F277E04A3F722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\Syncx\wruntimehelp.exe
- Size 1.2MB
- SHA256 58445ef070478a50b4f4e216812241d44ef1674afb209f5a77fa9fa64563ab91
- MD5 f3f01bd9cac56deaed85911aa71f4338
- SHA1 f6bbe654b4a1d404188c04bbc5d8b99ff065547d
- SHA512 746a387e330d3e012411a6530700f596eb9ff3b56299a31c159087d759ed5d1d1d2ffca944b2322f0397d8e1d19b092b0a9497de5359ccbef5e44bca7bf5eec3
- SSDEEP 24576:g2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBIv:FToMKvPQvOi8AmQNsrlLa
- TLSH T15C459F0773E7C1E8DE77C1FAC9614226EB31B8640B389ADB2590452EDF63AD05E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk.toml
- Size 999B
- SHA256 e339677a009c39d1f64d3ea8db3d637427697d509c1832a5c46b46f9a2138341
- MD5 8061da53b6d929973cd77ea0230bf8af
- SHA1 408cb92b54eaf1017f585d801ab6611e8ddf68e4
- SHA512 a30597f9da7142034a6fd3828047e27d2c190770d15d5fc8a2f8169033fc6e2ad1e15e4cecac3700f8526411c6d3077d6bf263c9c6de37413347dab2522d4948
- TLSH T155114F961D02B8C8610CDC74419E25058498BC23EC5AFD9A35AD48829F6D10E2FFDCBE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk2.toml
- Size 402B
- SHA256 777a375b35cc7d79e754cd9cd3dec620217c2d7d273f44a2d5ee2e40b6004397
- MD5 32f14b6d0c1a6807d78457e4041948cd
- SHA1 ec58574a2ce26a5447dd725b23f186496f96fea7
- SHA512 ea457405138b6a03717043195e1f8cacbc98d0d54d3d276865fd3a42e5c45ab17714d214d0cb972c5c9ec4a240572199448c1d28d1733737b847db3f7999ae23
- TLSH T101E0ABCACAB39EE0A5AB85E33435200C44559B70498B0C811653E26C21C195BD799C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk_default.toml
- Size 64B
- SHA256 b0f7d9fecd3c04ad4cd0d769372dd2623bce11a68e9f37ee0e698ac3f268880a
- MD5 a68852ae3726d54be7d6cd968bb25b84
- SHA1 6fea4dfbaca6e9c35e4918ef5f62a2e850a81041
- SHA512 109c6ad1bbef2da10565db326ed670b32e8c89656d6a05118f0d21bc71dbb72431602c67dfd8d8238a3e13066d95055a290d505088e9b05dbbdc13e23591c769
- TLSH T1D8A022208030030C00033220EC0F0A0E003EC33220A002C3080023CC00C3CC2F33222E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk_hwcodec.toml
- Size 1KB
- SHA256 3cd579ffe281ac3b95e28429c6784bc90fbc880aaa698862e300052df4dc37bd
- MD5 37edbda512ff5d02c00f87ab4fad134b
- SHA1 f4ff5cc51be337de3e62239c8d6b03f8ea79c056
- SHA512 a0827f89586583f26b49745572846647b3e76109df5a283a978dd192fb808477c71c86fb6c9e049c68cc8094c10851145879ca30a00e59b64c644f71793ac998
- TLSH T1A3319460CA602CA70D5E31E8EB9E8217BB5000D75EEC3E527BAC454E9F5CA1E5837B0D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk_local.toml
- Size 1KB
- SHA256 ce6f760ff7af2d557ae42452c806f732a74e0a203efc0fc8ef1e616ff048bb42
- MD5 924aed25005525741b86b521bb7cb688
- SHA1 201e0614a63cbd9c4786f167565638914c7d73bc
- SHA512 d27d7a3c5224d7d513046c67d406c74921b08d7f284046169233af1cfa39b5a014ae52e90402caff9f6ceb041db23bed66512662e6338f2e1a79f66c33210eee
- TLSH T1FB216575932A94FB9417681FDB47138B0D36D63227237580F27C264D0EE60D8E677687
- MD5 SHA1 SHA512 TLSH