Overview

overview

10

Static

static

10

2026-07-17...ch.exe

windows10-2004-x64

9

2026-07-17...ch.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 04:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 29.0MB
  • Sample260718-flgrdsgz5l
  • SHA256 478eeab0ff927be4821ebc3dc5d16a1eaa1d7c72e08bca22abccc35657218fa8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies registry key 1 TTPs 9 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 11 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5868
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:3384
    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -worker
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5136
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get UUID
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:716
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        3⤵
        • Views/modifies file attributes
        PID:5284
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2188
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\RuntimeBroker.exe
        3⤵
        • Views/modifies file attributes
        PID:1144
      • C:\Windows\system32\reg.exe
        reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Search Indexer"
        3⤵
        • Modifies registry key
        PID:5436
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Search Indexer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\RuntimeBroker.exe -loader \"C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\RuntimeBroker.exe\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:6124
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\lnkcreate-1036598.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        PID:2460
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get UUID
        3⤵
          PID:3360
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\↳ Windows Search Helper.lnk"
          3⤵
          • Views/modifies file attributes
          PID:5720
        • C:\Windows\system32\reg.exe
          reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Realtek HD Audio Universal Service" /f
          3⤵
          • Modifies registry key
          PID:3048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1080
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5056
        • C:\Windows\system32\reg.exe
          reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "OneDrive Standalone Updater" /f
          3⤵
          • Modifies registry key
          PID:4212
        • C:\Windows\system32\reg.exe
          reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Indexing Service" /f
          3⤵
          • Modifies registry key
          PID:2588
        • C:\Windows\system32\schtasks.exe
          schtasks /Create /TN RuntimeBrokerUpdate /TR \"C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\RuntimeBroker.exe\" /SC ONLOGON /RL HIGHEST /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2020
        • C:\Windows\system32\schtasks.exe
          schtasks /Create /TN RuntimeBrokerUpdateBoot /TR \"C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\RuntimeBroker.exe\" /SC ONSTART /RL HIGHEST /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4132
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\LocalState
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:872
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:5616
        • C:\Windows\system32\attrib.exe
          attrib -r C:\Windows\System32\drivers\etc\hosts
          3⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:4708
        • C:\Windows\system32\attrib.exe
          attrib +r C:\Windows\System32\drivers\etc\hosts
          3⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:1000
      • C:\Windows\system32\attrib.exe
        attrib +h "C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe"
        2⤵
        • Views/modifies file attributes
        PID:5016
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe
        2⤵
        • Views/modifies file attributes
        PID:5768
      • C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe
        "C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe"
        2⤵
        • Executes dropped EXE
        PID:1984
      • C:\Windows\system32\reg.exe
        reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Search Indexer"
        2⤵
        • Modifies registry key
        PID:1344
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Search Indexer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe -loader \"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe\"" /f
        2⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:4524
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\lnkcreate-134542.ps1
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4508
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe
      C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe
        2⤵
        • Views/modifies file attributes
        PID:4164
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe
        C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\RuntimeBroker.exe -worker
        2⤵
        • Executes dropped EXE
        PID:2136
      • C:\Windows\system32\attrib.exe
        attrib +h "C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe"
        2⤵
        • Views/modifies file attributes
        PID:3720
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\RuntimeBroker.exe
        2⤵
        • Views/modifies file attributes
        PID:556
      • C:\Windows\system32\reg.exe
        reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Search Indexer"
        2⤵
        • Modifies registry key
        PID:5896
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Search Indexer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\RuntimeBroker.exe -loader \"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\RuntimeBroker.exe\"" /f
        2⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:2224
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\lnkcreate-821893.ps1
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        PID:1068
      • C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe
        "C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe"
        2⤵
        • Executes dropped EXE
        PID:3772

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          3
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          2
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          2
          T1012

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 cf7a6ee5633934fc30e25c47f4a043cb621b4d666bedf6dcfa2c900ea6ec86ac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 bada888aac8cb830f67a81b1bc12aed9dd949ed14ce4e0f4a8975586f0bc90b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 545804662875039d9ea177eba00f0878173a24490cc6b4759f91fac066fe0329
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 365dfcd26ebe0022bd86403e08dffef01cd1ad078dc95d0b9ba6ff5c94d841cf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 4667aa98cd226c8c7ae9f39ca1438189dd8ee2ece3b6d95fbede3aac1121d03f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          • Size 29.0MB
          • SHA256 478eeab0ff927be4821ebc3dc5d16a1eaa1d7c72e08bca22abccc35657218fa8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_g341h5mg.raq.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g341h5mg.raq.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lnkcreate-1036598.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\lnkcreate-1036598.ps1
          • Size 347B
          • SHA256 4e7af36e58fe54868e065c7ac91bc87ae686a507a40920aa19491da09287e256
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lnkcreate-134542.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\lnkcreate-134542.ps1
          • Size 362B
          • SHA256 379588bf0b7752b3f11bc87b126cfb67a5d4d6d716b2cde7b832d1a785da0aa6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lnkcreate-821893.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\lnkcreate-821893.ps1
          • Size 369B
          • SHA256 ebffd2433899092d8c459db97e9593978e7bcffd6e0eef1692586ab8121e727a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 563B
          • SHA256 e7d116021f18b680b9e7196d20eb653070071294e42dd0ac02b39c7589ce58b4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 615B
          • SHA256 38a4dbc18cba730f87d01fd5b0464cec20828c8a311a616d51cd0d11925229e4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 810B
          • SHA256 3ece9eb52a933d40014c8211c7b886864aee1b19f0c27c08ea046784222751a5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 1KB
          • SHA256 16e295ae84a834f93ba5635c02defb7219f8b5a83650a179d8511e504e8a3979
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 1KB
          • SHA256 0db30b742250def2fa6fb393a226fab669d20b393b3446cdf1c5a553a320779c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 1KB
          • SHA256 0930487a640cc90ef4efab7b5ec4b036d645f8a411172b3a7b87dd370f7c1850
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 1KB
          • SHA256 11323400c80305924eb336ebd26ad06f6fc4f83fee3885d355ce96dfa921752a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vr_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\vr_debug.log
          • Size 537B
          • SHA256 0cba31db09a5cd28b9a713c41b8d023a817b4ed19bb35a51066228328581b4ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Void Runner.exe
          • Path C:\Users\Admin\AppData\Local\VoidRunnerGame\Void Runner.exe
          • Size 2.0MB
          • SHA256 d5a3235b6ea0d9e8233c9d1f35fa18fa13ca974d69835c0d3db04695619da369
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ↳ Windows Search Helper.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\↳ Windows Search Helper.lnk
          • Size 1KB
          • SHA256 4162aa2da895ca48a460d21e8c75d878615cd44cf6dac91a8dcf9c70d25f3b99
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ↳ Windows Search Helper.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\↳ Windows Search Helper.lnk
          • Size 1KB
          • SHA256 b22ce455e50a27aea3917c39ff17ed50ae1152133d9e534e6f700f5c9eb900c0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hosts
          • Path C:\Windows\System32\drivers\etc\hosts
          • Size 2KB
          • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/716-35-0x0000028C678A0000-0x0000028C678AA000-memory.dmp
          Download

          memory/716-34-0x0000028C675D0000-0x0000028C67682000-memory.dmp
          Download

          memory/716-33-0x0000028C675B0000-0x0000028C675CE000-memory.dmp
          Download

          memory/716-36-0x0000028C67B50000-0x0000028C67B7A000-memory.dmp
          Download

          memory/716-37-0x0000028C67B50000-0x0000028C67B74000-memory.dmp
          Download

          memory/872-114-0x000001A0664F0000-0x000001A0665A2000-memory.dmp
          Download

          memory/1080-99-0x000001ECCF4D0000-0x000001ECCF582000-memory.dmp
          Download

          memory/4508-24-0x000001325A870000-0x000001325A892000-memory.dmp
          Download

          memory/5056-103-0x0000029F71EF0000-0x0000029F71FA2000-memory.dmp
          Download