fc5f319dfc987917716130ddb3f891e27d130f44a6279610a895de9a4830e2a3

General

Target
2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 27.8MB
Sample260925-v2cvpsscka
SHA256 fc5f319dfc987917716130ddb3f891e27d130f44a6279610a895de9a4830e2a3
MD5 f04c96cb1f177a516f9053f68926cbf3
SHA1 91476cbe2b0cca159b501b07c133834c5c5ac4c3
SHA512 c371e27424c7ec7ef5cd23d6b2d42cd99e18ba975d594d312abb353db011149592ebc5ddcb6d2de5d1fb3cff18c8ea0c67276946565d9aa55ae1a75f2a80b442
SSDEEP 393216:eJYgH5a37Kxg06wAOcX9PmGTfDfp+RrAVwTRy/2Nv21RDq:ex+Gx8pGk8bdRv2PD
TLSH
T1E457E14BFE6129DAC1AD5F30CAD5A411B6B07C880F2227CB1AA4F2A15F75BD09D35F18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c55d-22.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c55c-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c55c-5.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 5 IoCs

pid	Process
5148	browser_diag.exe
2524	extractor.exe
4396	desktop_wallet.exe
4700	socialgame.exe
6052	docs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
2	api.gofile.io

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5148	browser_diag.exe
5148	browser_diag.exe
5148	browser_diag.exe
5148	browser_diag.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	browser_diag.exe
Token: SeDebugPrivilege	5148	browser_diag.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 5148	5336	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 5336 wrote to memory of 2524	5336	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 5336 wrote to memory of 4396	5336	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 5336 wrote to memory of 4700	5336	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 5336 wrote to memory of 6052	5336	2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_f04c96cb1f177a516f9053f68926cbf3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\browser_diag.exe
  C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\browser_diag.exe --outdir C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\results
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\extractor.exe
  C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\extractor.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\desktop_wallet.exe
  C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\desktop_wallet.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\socialgame.exe
  C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\socialgame.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\docs.exe
  C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\docs.exe
  2⤵
  - Executes dropped EXE
  PID:6052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

browser_diag.exe

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\browser_diag.exe
Size 7.1MB
SHA256 341d0029f724ae74ccc54eb3652f98328473a7e3793368824e4f8ee4f4827f0b
MD5 9e8136da09a9cde234b93b2056cb1571
SHA1 97ff7f0beb60ab6293dfaa24607d66151c98a8d4
SHA512 eb2b72dc41f1d6498938d4fd597eb9007c16df4e76f16dd69e300639b2833605fd40494a8a6a9c521eb9b0182c7a8a5816f4a259901535362dabf5b031916bcf
SSDEEP 49152:dJa3qLNzqaZ0gc8wu1aDu36UBN3cqhMM5AggPcwD8zbyOeeloRODU2QLdlGeLksN:dJO4Bgg/MXwU2Lort02
TLSH
T1BB765B47ECB501E5C0AAD176C6668512BB713C894F3063D36B50BA392F37BD0AEB9B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_wallet.exe

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\desktop_wallet.exe
Size 3.3MB
SHA256 11d2f9780ead944482b2b5c7090cf7d698a1776a0241d812b4f49fb179c4ded9
MD5 5a72c1f0dc5cfc18eafcfc0e53684346
SHA1 22cac0d503d87107ad67d855660e4f2fc89e65c8
SHA512 295c4e227014bd22b489aa045eeed47fb77a885f636eb79658d25737d6c9b7ad0c6238f4e0e87d72708e6a82e0e2f9a64931deadf163d44e60c912fe5446d5ae
SSDEEP 49152:s8AcNHpSZAuXNMzD8nRigDkeAaV8Cm4RMZ4WXg3UdiEP:s8tUpsjX/i
TLSH
T1DBF57C07BC9504E9C0AE933689B6995A7B35BC480B3123E72F50B6383FB6BD06C79754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

docs.exe

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\docs.exe
Size 3.4MB
SHA256 6e1d390226dfc8ac4155106d667e46b4ba43f8087f36ded8efb50ec07718a34f
MD5 f6ff2850d8b32bb21e29a8e21b29fc98
SHA1 8c7e7429e08e10423b70db56ca53468677e1448f
SHA512 faee7dd6d91b7e6d34fcf35b7ebb0907214cf85e7c9d0ab3302da574b9fefb266bec79e407c8735577e43b8808b91b498dbfce4158da5e36e77a8eb7ada22399
SSDEEP 49152:ql5i1Pqe1MDgg3V/jqMTVNfWVHcKFIMEeD2ZGiw:ql015hqFW1FVEeD2Z
TLSH
T1B1F58D07FCA504E9C0AE933189A796963B75BC480B3223E72F60B6782F76BE05D75714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extractor.exe

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\extractor.exe
Size 4.3MB
SHA256 eb1c2d950f80b162bbed52befc32f20fbfd2c2bb63cc791ebb792d9e32448f7d
MD5 d90854c221aec5a2688496c799950c00
SHA1 27e6722d4037ced30748ba25967c4d00acd6ff52
SHA512 fa61815b0e9389407b54b5b992abe73d8a75d5765cd7540ef9b90e8a0d37c248087132d1621b56d34fc69e2d7e34217a078b455a9415e612ae3a5080f04b3990
SSDEEP 98304:1hydTHGOqdEFBbdn4dJ3auCx28XRp+ot4E:1UzGOvzdn4d78BYoe
TLSH
T1B1268C43EC9508F9C49DE7328AAA92563B35BC490B3163DB2E90B6783F727C15E79314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

socialgame.exe

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\modules\socialgame.exe
Size 3.4MB
SHA256 d836c1ab04b253e5036acc78cca61d6f89693f0851d57c5fe6e7c5250ddda391
MD5 df742d5f3a227489abae7a04e4166356
SHA1 dcccdefd7406884e52b3b8695c8fc853af42f43e
SHA512 1605d02db78ccbaf16bda4edf6df971f0d5bca5a0748e6d240be3eb511d69245c92ac1369a7a96cfb470a6f4573a9b260e79fc97736eb735482ccff14415d691
SSDEEP 49152:+6x5DT8lg4X/0e5Db7VWNWrTctHcR1+9aRt8VspJgE/5P6mmx4Dlm:+6TIeQYsnT8VspJzV
TLSH
T11FF58D07BDA504E9C0AE933189A79A573B75BC480B3223D72E50B6782FB3BD09D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extracted_data.json

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\results\20260925_182858\extracted_data.json
Size 4B
SHA256 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
MD5 37a6259cc0c1dae299a7866489dff0bd
SHA1 2be88ca4242c76e8253ac62474851065032d6833
SHA512 04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f
MD5 SHA1 SHA512

Submit Download

scan_result.json

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\results\20260925_182900\scan_result.json
Size 174B
SHA256 23b7ad904d5667b3789b6c808419edec2aee18074a080fdd1e10e39d919789b5
MD5 fe89ae8bc3ce1539bd2fa96dfbd3b4d9
SHA1 e9661006ae64f372234dfa98217883905e39ccc8
SHA512 9aa20ab6cbc087b6551a99675d4483cb8aa57825d021d44b80747e4848693a0236f2e485c9b4bf8644e225c8b2b684ea53e3ce1c29e7ec44d3a2cc11b95816a4
TLSH
T12CC080644520845163C1E17610D003132E775F5331353A0943DFE9C18B0A6B4246B509
MD5 SHA1 SHA512 TLSH

Submit Download

diagnostic.txt

Path C:\Users\Admin\AppData\Local\Temp\goodsoft_20260925_182857\results\diagnostic.txt
Size 3KB
SHA256 8f0a09a551503c431d939b948089322830cea38596ff6d287fd07e05b317c7ef
MD5 e24d37d07474cd6c952b63b67f027b77
SHA1 218f76e0783fbd86971784439c33d6dc87be3a1c
SHA512 6c6c50eafde91c6fea5a590f1629116713016b63feee54ed6a90a3b3cd16ff0995cefb8e168759471a810156d14ab8ccf9ddb0111c219a8d58dca172db8dcc6f
TLSH
T1F6715703E774940DAA02CC3B2C79F616CD41D504C76482B141C7685C3FFD66BED96B8A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads