0876c0228fea2b0f06b7ed4644b440ce40032adb7a40867e76d5274524a3058b

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 12.5MB
Sample260717-fm9tkabs8l
SHA256 0876c0228fea2b0f06b7ed4644b440ce40032adb7a40867e76d5274524a3058b
MD5 e7c6f259d313295420de29de50641913
SHA1 287223f9f1874c1c769ca779e0280447fdc1a5a9
SHA512 8f51431a3fc7934359899a0408294e5d839727a922d08a67e1757f0e67101198f1e92a46d331b1971dfe79f8805560b09020517dc1ba43b2d8a7f598b4b53804
SSDEEP 98304:6YOvX1jNyBBbfE1VYUHgjpucAsTOGfdSV6gR5CrE0:fOtNyBBrEUZbTOGfqR5C40
TLSH
T1E8D63947EC6505E9C1AE9175CA229613BB703C894B3023D36B60F6356F37BD0AEBA744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence spyware stealer trojan

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f0-23.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f0-23.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f0-23.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 2 IoCs

pid	Process
2988	FontCacheSvc.exe
1904	FontCacheSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCacheSvc = "C:\\Users\\Admin\\AppData\\Local\\fontdrv\\FontCacheSvc.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCacheSvc = "C:\\Users\\Admin\\AppData\\Local\\fontdrv\\FontCacheSvc.exe"	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
7	api.ipify.org
15	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3696	powershell.exe
204	powershell.exe
6076	powershell.exe
1784	powershell.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	FontCacheSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FontCacheSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FontCacheSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3696	powershell.exe
3696	powershell.exe
204	powershell.exe
204	powershell.exe
204	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
1784	powershell.exe
1784	powershell.exe
1784	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 4612	6024	2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 4612 wrote to memory of 3696	4612	2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 2988 wrote to memory of 1904	2988	FontCacheSvc.exe	95
PID 1904 wrote to memory of 204	1904	FontCacheSvc.exe	96
PID 4612 wrote to memory of 6076	4612	2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 1904 wrote to memory of 1784	1904	FontCacheSvc.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-17_e7c6f259d313295420de29de50641913_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784264444247052500.ps1
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784264446827827400.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6076

C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
  C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784264445831480700.ps1
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784264450912619900.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5c82c62eecc8fdec335cbc59f90f9f170ef4c8a90e93c9a8030184a9a59d988a
MD5 e924f7f31cd2be48c0d15fc53df4ee67
SHA1 80392075b8df1559874741c3bd851a1063826fc3
SHA512 8fce1f4667a64f27c56d9e8c3f4cbcea4df1aea5aea139089e3bec29f275f87b9892e9d05d3afb2a9ef839063eaa00946129a002c98c05c9dab7f6f0f7b2aee6
TLSH
T18B215733F3CD8615D899403A50CEAC1036B597DB40DECE5BAB84D548F43F699CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nxi5z0mg.jss.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxi5z0mg.jss.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

doc_1784264445644076600_CompleteUnpublish_xlsx

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445644076600_CompleteUnpublish_xlsx
Size 12KB
SHA256 35a5893c1b9187af24d000b5c258c2d31589f10d85cbbc1a6698729c0d7c7128
MD5 66ec8d2dd73f47a224bb6135a0c56682
SHA1 536f2b77243994f8d501ab073992b69190aedbea
SHA512 30462edae87e23f1cb19f2970aa1c51912aa3f90b53add14360832272b770cba7d73a6258cc12598e67efc0bbf1e05fe75157d4f84e5425a6a8831ec988e0ef5
SSDEEP 192:wc8mVo801b3Uqq2yU8GjOrpaFUlbVvevUqzQXpS0vES+C2U5NRoV1NWAnINEaoX:wc3z0l362yAjOrCUlM9z6pZlHC827aoX
TLSH
T12A429DA6D432141AE732D47E8D5E02E7564D72418E00BE65A825F17E326629FC3FF1EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445651190700_DebugSend_docx

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445651190700_DebugSend_docx
Size 19KB
SHA256 e19b16d4c7747e4a80517e820c13286de42a37ed0dc336a9cb2995d67ff515d6
MD5 b36b0d38816b062329f8e144ed0a51c3
SHA1 23af1333256b47b6d217bc6be481fa1703925790
SHA512 a8919a42aaaee095673e6cc83555173a20d7bcaef75b1303eed473890cb22c962575b691fdc73dae6957737a05ef67c04eb31625ee8431c9641b7fe736178a91
SSDEEP 384:aPUcRoKlAWmswu2ND/TZrpFtTbGyRTdNxt/ZtNNY+VzJzIFHDJifS3F:X0mswuynTiyRDxllNYGItDj1
TLSH
T1D392A038D3119860EDA39579B02106FAD32895827E62D88632BFFDDD432FED1075B58D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445718769700_DismountReceive_txt

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445718769700_DismountReceive_txt
Size 992KB
SHA256 f2f2161991b17eba7f7c3b7a43e09013df3707f0bbb133f3b85c88960e6c101c
MD5 cf8eb67e2b6060eee0cfdd3f1a036368
SHA1 6fc6d8a7ece22e272fac829796c5d6ef63fa4f53
SHA512 5989b8db2fc090cd1ba49b13de09dd42768e09090577037197b7dabe3c7c867a9344190521a2f96c6906178f6a357ed741444747141874947552cec3ab360a58
SSDEEP 24576:roPpBu/uQc1s4o4P1kVpIsMuUU0R8ClsShw723MpVgf:riXvQc1s4Xd2pIsMut23hw72cpVgf
TLSH
T1EA2533085E6CD16BC1CD5830CF672AD4455D322CB62AFED0F575334A8D3B7ABA90A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445730233200_InvokeExpand_docx

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445730233200_InvokeExpand_docx
Size 15KB
SHA256 c85bcff38288ce54b87856a951bd786be13933ccb1950f21595769d548aa22b8
MD5 a8c989a62c54b4f02007ed2c3175ff9d
SHA1 3fb55b2adc2a85cee2f931e405644b6bdebe27b4
SHA512 9146e4f3024dc3ded6f3ddc5ec28dd4f9d9186d973f666a2d6a3b8dee3f9f03ff1acc258bd4b81614e8c1091446d2962d03720bc4d72a0bc8ed266e295e1f6aa
SSDEEP 384:ajRjdnSh+heJdNxt/ZtNNV6DIFHDJmFL3k:ijdnSVxllNqItDm0
TLSH
T11E62BF30EAA86834F7934A3CE01E01F7F458E4427A96E50730BEF95E8562F631717A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445780845100_UninstallSubmit_pdf

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445780845100_UninstallSubmit_pdf
Size 645KB
SHA256 bbdaf58f07a583d9f3192fa50892065318582b02afa28d2e657d64d681046fa6
MD5 732c7b4e781d512ad4c559dfd5a00875
SHA1 3fb49f3bffbf79bc89ae5becfd0782f48292406e
SHA512 a5ede0f2e3c4faf050db4a3b1e13d686123b45555c072160dbec3d0fbab3ffd133579e252549853f0574d771809d008460a3494cd90718cdfc0736a3bdade4d1
SSDEEP 12288:M95/rAUWVt2Kr7eREfu6VKzGB9UQBWa4r4Cm2pDpjb7dDLmCvKXX/UV:M9prAUWVZr7cEfzuGjbga972phBXbKnk
TLSH
T1D4E433C138379852E551F43AF8B67D3D06908C6D6B496BDE205EF1BB2A2058FCA87F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445801770900_BlockTrace_doc

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445801770900_BlockTrace_doc
Size 923KB
SHA256 acae5a9f7575c7e77ddc85016f39dd63b416bcbf800bd5f0816cfef3d145cda8
MD5 9ffdbbea48a1190cc02dbdd35338303a
SHA1 4535e64c3d554c58b60ecbb5cb5d828b58ac7e27
SHA512 13e93ab1fc963033606823fb3563b9f5f3e30c62e6da6544a1a6368f13600a083ca0268a0dabc04f27a8b0b2ba144d6fc708da6e69de081b26d6c7b38f40454a
SSDEEP 24576:mqa7cirK/612H+sAJLRI4tBTk4NPaXxOS5patFc0KAsrrQ:m97X912Hu9RLPTZP6xZKtl
TLSH
T17E15332309042A25F79CE387F9EDDA1D41D3AA557CAE2FC31B0A4B774CAE2D11B1C592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445866570800_ConvertResize_odt

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445866570800_ConvertResize_odt
Size 824KB
SHA256 bc98c9977834db0a83947ef825815505d8996016bb3c9faa49a1a61269fbffde
MD5 def48862a75b19acbd2dc555aed71304
SHA1 fc45b32bee1ffbc20cd6056d3fcffbdb407d5830
SHA512 0cbb8b2561996a54de8384302efa71d026c8175455e62cd970775074e2db45a8aa6f674573549fe1277c625fb85a226d89cc09fc67f4c53ec70cc9cc638b3eb1
SSDEEP 24576:xSV+Oh+6o0zfCwr+WKV33jfTjSSt7Nf+lVzUy:x5OQVKC4vKVnzb7poUy
TLSH
T1260533AAC571B0508CDED849488ED3C7CA0EBC8146684E8E12BFD1CCFB54E8D5D7B656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445866570800_EditResolve_docx

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445866570800_EditResolve_docx
Size 14KB
SHA256 b070dd76e8112c2791e1781d13d920d1c9f0739dfb68ec2401a26a729e73497d
MD5 195c276fceee261e62ffc7601d63a8c1
SHA1 34ff910e84a23a1ab795786ce1655df0f2677e6f
SHA512 c1a644d3c9ce95530523b8535e077490c1b795678cca2ce45630f0dbdb98d1d213d29f4babdcad963b267d773369ce7fdadc0edbdf2c4b4bbcbb1b2f459650de
SSDEEP 384:aAolLinQy3EQddNxt/ZtNNHj/IFHDJgB17p:gNuQy3EQdxllNHj/ItDGDN
TLSH
T10162AF3DDD426870DFE34E78902E46F6E12C64827A916907309EAA1FD177B9A070BA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264445925719900_MeasureEnable_csv

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264445925719900_MeasureEnable_csv
Size 725KB
SHA256 818083ec44e19ae2ca5adf9c2c67042756d043890ea8bdaf6d2a410e76887821
MD5 7bd50aef5a6e5d9d39820a8a4a655a21
SHA1 ed534ea97e4d0f272f2a32bff517f2cd5cee9f67
SHA512 3abc27452e78d98875feb358cf70cadb43bf5bf8a91db496ac79996477159db2622d38f39aa3c17b21ef6a0c51eb4bf1f0e48e00e5f34682062b17bba3579e67
SSDEEP 12288:JcefUkKkF5QzMilUya+Fu4T3YB+SwHGVEnF5AE+Pdxz6izXJPM6pknj7iIdAtl:u0ZF5mMilbR/T3wrunF1+lxzxzZ+viIc
TLSH
T109F433F6051F6B033A4EF873B19DA385B609B158DFD95728449FE922E70474F188E2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264446021394100_NewDisable_pdf

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264446021394100_NewDisable_pdf
Size 1.2MB
SHA256 3c3c35574110afc99c6de8b71e1ed56db0ec960b447f33a1d26495f4af0bb5a8
MD5 5a0becd7a2a5710c440ddc6b2b5abf9e
SHA1 d77ba8065301970648dfe648acd7e5910d178e7f
SHA512 26889b84611e958e6ee679027226f7d9501ff1cf0a4bb7084b32676dd22720ed996b4b6a695f7ee132d4ad4062dbc3fb9e3fcc29e11a93501492b557ca93fdf2
SSDEEP 24576:Vs7UdwqOleCWDMqRqxc3DErAZ/xt6WRXIEtjurtwIcpmY3P9k5SBCiOnADEndl:iqwqONWDM/czr6upj2qk5wCiOPndl
TLSH
T15E5533F8E7C69B458521E7598FA4B9C82FC86566A23D3637EB44F43CA64EC1D3134238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264446524506400_ReceiveUse_xlsx

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264446524506400_ReceiveUse_xlsx
Size 11KB
SHA256 0b35b513f57e971799386e8ca601d88bc527ce552aeac33d7abe7f66c7bee4e3
MD5 71403b74a46f4bd8bd7bfd04ea5c0df1
SHA1 0bc41f77cd839b0a19b6029c1650b6b926485a97
SHA512 f7b1fa9c41dc91c27f216fcc424d3c0ff525b321ad7df2058a43e7f11d791f9343d856a1d2d5e00be7e0b06a314e8c906471577d0276de869f5e5a4833479614
SSDEEP 192:wc8mVCbGkb3UdPzmCl/xaFUlbVvevUqzQXpS0hP+Fih8iM8HUGuao+:wc3js30zmCkUlM9z6pxW80Guao+
TLSH
T187429E3EE01144AFDB67897E863A10E1B54DA054978539C8A422F02E6ED13B313E72DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264446539784300_SearchDismount_odt

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264446539784300_SearchDismount_odt
Size 527KB
SHA256 9de971e68ec11d7319ee6860417db5cbed74ab43f1e742059acdbceeb5011369
MD5 899514ec6c6696f2d774df55b5b02ba4
SHA1 e53e76094e63163bc01c7b308a23a0f328957ca0
SHA512 5e3288588c5da3e540f2719b33db6ce13125457d29916c19ceceea02a71e7290a903aabf22f61a2388c3d0fa779e1f9cebb2ca31044627c3105266920d35cdd0
SSDEEP 12288:8OSfigEJKDLzf05Mv2aw8Crub6kudbzmQSUdHPPKH:8OMigEJ4zf05Mv2aw8Idb6PMXKH
TLSH
T1B7B4235DFE1C2F26DAF982B412887AD15F25830FBDA2D8F45B629160C93FF8E441E518
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264446750429300_UnlockSubmit_xlsx

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264446750429300_UnlockSubmit_xlsx
Size 956KB
SHA256 2f531b2fe43d2ac048d3cada66e9a0eccf5713aa64bcaea4a3ca9ec0466e56be
MD5 ac67d7eac212e82e64c533bf224321a4
SHA1 efb9d1e098560e200fb05dbaf9fec6ff3ba2e27c
SHA512 99ceeb3401959ab1ac743ecd1b0394d5e7bb74a02a4ded544d99917c84872a71a4b82f37755498536feedf0796747d13a0e9ca6eff9c6dc212026344b41f4877
SSDEEP 24576:/0FtciOideNoIIb6jlzj85X8bmGKlMcT2r1hZ6t1:St3Yw6J/85X8Zcyr1hZ6D
TLSH
T18225336331E07FC364E38AAD816413DFE531DC21A620A0D771D9A5FFE52DE02325796A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264446793613200_BackupOpen_mpeg

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264446793613200_BackupOpen_mpeg
Size 341KB
SHA256 b92ed2ce5515eec844b615b77c1b1372d0bd895320008caf2606accf40203e8f
MD5 9cb22bbb34877d79cad37ea7fb2a07b9
SHA1 995420ff5c8558aa34779b7d980b805d83c4fae4
SHA512 67186398105d211c0b4b7b12fd3959604421d96b1ddf2d4a2661828b205d580015ce7184d651f180b1fdb8fb564f00990355506ec0a75d97561dfec8d9fe46e7
SSDEEP 6144:zRACaOOy9y2p2fCAz2xyIAL7YXvqBTFqaOZ+FFtVvWpn8TKO0lI1k/R0Tz7R:lACb3y2mCAz2gIAnPBJJUWtV4mKO0lEh
TLSH
T1B77423946F7B8CF27352963442E67B2130EA59A5230D457F808ACBC1F487EDD925F1B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264450579647100_ExpandBackup_cfg

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264450579647100_ExpandBackup_cfg
Size 794KB
SHA256 81f9c5062524607059ae60a769e13f20e67733b7a1643a7980d07b6940b70b6d
MD5 6699007a6e7b4aff8dbdff3a6b62d66d
SHA1 d92f44d4abae1a2e4847e72dbda6cfe54089e93f
SHA512 90ba127399c30bb89277ef952ed6021d5e1be36b245d27949f2f701c2267ea66a459902c82dfc7b14d7b39076b7fcfa5d006df122c7e64a2ab5734287da6e107
SSDEEP 24576:vHOcOM1TFs36L3pOyLJ4vPaG1Ugk/fF7fkIm7hUpxmz:vSQa36lh4Xm3F7SH
TLSH
T1F6052332DF2DE3E12AF4E9185FE207930851B6EB74158596BBDF5A31D80824290FF794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_1784264450745031600_RestartBackup_vdw

Path C:\Users\Admin\AppData\Local\Temp\doc_1784264450745031600_RestartBackup_vdw
Size 1.4MB
SHA256 7007fd74fbde3f65dcc07728a1c882173d3a059ca89d4adef494ff8b89452522
MD5 89069057121d15befff612df3f2eb6de
SHA1 0d753c7bf9dbc4adbfb3dbd4c2e35a61790d82af
SHA512 a8dffea77ef8ab60dc615bc1ff950364773a8bfb5249f6c8274621e0b01fae42b094ce17e17f1a572a35028311713c3eb2505d4da124bb1546c578255e0ea2b8
SSDEEP 24576:0eQzlgEGXWRRNqJ5AJ+64qJQMtJuMVsOeIfGO46JhbSUuvY3f6yJUib5G:WzlRacK2JNJfVGo/epgPcOM
TLSH
T1C8653317E75484E86C2EF5DCA898A263FC7B23E45D7B3192291B23F167E50C2F46219C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ps_1784264444247052500.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps_1784264444247052500.ps1
Size 193B
SHA256 b460d5734bc056cb0c3db40e6114951d66f3112095a4454302268d20a288a61a
MD5 0520bbd7f245b806c7440b3b862d2960
SHA1 a111de2913dda3025fbc80a5535cf1fedcee0bb7
SHA512 6a680b3505cac7b8884dc253820c3592d0b551774abd094bf0aa8b5502dc4b29374e84d6d6af435d4d7da866952e4b6561c95a1489bfca098d21545b32fb6bee
TLSH
T13CC02283F2828AFB92E45266348E28008CE5A3CE102A12001301800016CA918E8EB2D6
MD5 SHA1 SHA512 TLSH

Submit Download

ps_1784264446827827400.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps_1784264446827827400.ps1
Size 526B
SHA256 afe2d018e6250566d352840f7e03b0ae5fc057818fe98dc25a92e7b31ef777c2
MD5 bcafc2bd589ccb5d8bacbbf829ee3b3b
SHA1 461f88c8adda6dc106739ba831d3907edec24fbe
SHA512 350a0f47024c5b2fbf745f7f4741ce89d0b54404751517b3705bc14f7f10626090f7819c96d5bca70a89110231cbc3944ee44c526cbfe75cc95b592e380388ea
TLSH
T103F0C9F52347C40486AC1C63AC5FD0C40E3442A22146B94E2ACCC635E319E3973B5394
MD5 SHA1 SHA512 TLSH

Submit Download

ps_1784264450912619900.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps_1784264450912619900.ps1
Size 526B
SHA256 d2fe2e2aa204c1090150d996b7f3df57622e36a3abd27f31fde1b60fc42e9fae
MD5 5c40b8ea07396ed45e3bc2c306b8994a
SHA1 07b9e2ec1dcd5aa3c80ce9be34b0428fdfbf0807
SHA512 9cc38e4684d8d2774e1bbe267684a4e78e1443e20d4c76d63b4ba13174effce920b8ed2844b30f882fbb31ba5178157fd8046116d0dffcbea1e8aec678206b9b
TLSH
T1A3F0C9F92343C4048AAC1C63AC5FD0C40E3042B22046B94E2ACCCA35E719E3973B9390
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_1784264446827827400.png

Path C:\Users\Admin\AppData\Local\Temp\screenshot_1784264446827827400.png
Size 449KB
SHA256 8dcb581bbf10df2aee71a6373c9aa8646657f904f83415a157d35cfb68b301bc
MD5 bba109a4cae1b976c74de4f9378c3d8a
SHA1 949d4e53660a7ad3ec587dc6d0850b079152df27
SHA512 b4057abb3a6e98b511c603f33c406e9762520e5c321ed558832c5cd26f6202de8917f1ce9dd97285348b44cbab087d648bd506d37c6995ca2cfcdc5b010d91f5
SSDEEP 12288:uWdWSTbjMmYgm8z4z9CcOHNZXwcXMjxffXiD05E:umb5Y2Ez9CjH//XMBIEE
TLSH
T106A4126EA5F1C90E9DCF65F786005EC60B75A28BE152442B8431311DAD26DBCB728F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 382B
SHA256 d9964c93c8cf06226994a0d56c3b01574402bc6e703d63e877b7aa13e170128e
MD5 38e247564a1815a1da3752e3bfacdbd2
SHA1 a04d1c5a7f4761d16745ed1fb73b6910a34bcd35
SHA512 3eabdec0000d08aed92d8ecb664c8e2d963923a5758b9f265ca70e8dd07c55ae9f49bd87e16aa074edb71ac8125f77d9b1af50f0093ce41f89bedcc9c18ec20a
TLSH
T1ADE092B443763CB33A83C687730233EB1B50E901460495381AAE0BB99AC2C55CA32627
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 440B
SHA256 b574140438f0e1830a32ec1897f406650a166e3cfce69f7d171d9435d043249c
MD5 86cb0f688a9ea4521387e156150e426f
SHA1 b234c053508058702c863a3cc6a366c921861a69
SHA512 9a1792a3492be651e9eadc9b34216533c7b13aa2707e9008409f75b39bbb9f809ed4e26b0453fccc210e7d981c622aa03d56cf80aba8cc6a812c9393d18a750d
TLSH
T171F0A76403B63CF23A83C686720733DB1750D8004704452819AA07B59DC1C558E32627
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 187B
SHA256 68d45ab77844ad76a483e94f23cf971856f9aeee07cb7e8e8ee3d27a9ff7204d
MD5 6dde1f034bb6140f2566a4ec5af65f7d
SHA1 2d91b0da1342243f4b58aff49d728118016ab849
SHA512 a255ae9925beaec557f5951e908cc67defcc9fa301b2009f898bea87d8efaee6243f2661721a29f7ac307fc10f69980ce9ddee397b03eb75e5eb6fa8440bfb6a
TLSH
T171C012A0537A2C732783C587B70133EB1B50ED000544962C09AD1AB55AC1C568B32217
MD5 SHA1 SHA512 TLSH

Submit Download

FontCacheSvc.exe

Path C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
Size 12.5MB
SHA256 0876c0228fea2b0f06b7ed4644b440ce40032adb7a40867e76d5274524a3058b
MD5 e7c6f259d313295420de29de50641913
SHA1 287223f9f1874c1c769ca779e0280447fdc1a5a9
SHA512 8f51431a3fc7934359899a0408294e5d839727a922d08a67e1757f0e67101198f1e92a46d331b1971dfe79f8805560b09020517dc1ba43b2d8a7f598b4b53804
SSDEEP 98304:6YOvX1jNyBBbfE1VYUHgjpucAsTOGfdSV6gR5CrE0:fOtNyBBrEUZbTOGfqR5C40
TLSH
T1E8D63947EC6505E9C1AE9175CA229613BB703C894B3023D36B60F6356F37BD0AEBA744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3696-5-0x00000277789E0000-0x0000027778A02000-memory.dmp

Download