220816ae15e5d34a46de30eec0f36a802b526a21f7b4dbaafc4ac53c64bbaea4

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.5MB
Sample260925-v677easdqf
SHA256 220816ae15e5d34a46de30eec0f36a802b526a21f7b4dbaafc4ac53c64bbaea4
MD5 ee550f9000309bd4e4b8b597ba41838d
SHA1 ae15aedf050552fba240594e76522b9815038afa
SHA512 53f3d6c71b35dcdf42de5ab9e0392e3441ff02eeff1ef1b31686ae8edbe60e196c2a92d862b4a2f56c68b614b5443040bbfcc3badcc6963fb8680af2ee732750
SSDEEP 196608:S76X4oJAYNkEt1MXTNph9kNibvcFyXm2w:Sc4oJAYNkEt1MXTNph9k4bEFG
TLSH
T1DDA68C56E37800D4D4AAC2B8C7465253D771744A07B0ABEF1A90AEE12F37AE51E7F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
4	api.ipify.org
18	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5036	7z.exe
Token: 35	5036	7z.exe
Token: SeSecurityPrivilege	5036	7z.exe
Token: SeSecurityPrivilege	5036	7z.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 5036	1056	2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-p5fc7f97eb00ffd41" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\22f476-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22f476-Admin.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\22f476-Admin.7z
Size 7.7MB
SHA256 139a7db84788adbc35d0ac462819a2e60469eb9683d88068d5a69320fb7cb8ec
MD5 128c1b1d225b7fec04a1220ab9adf061
SHA1 3a4594d64c8880ed6f3e111345865f6b9d3e2c7c
SHA512 0b81b1d0ed42bfda6e648b0ff6cd2d1f7adb48b04e0fbce94a7235f0797de7cbbfacbdb359aee7c5bc5e5388270809cac1fc2d42436510a71b4929fec3d25059
SSDEEP 196608:P2wB8jA+nmpzKCYvlqlTI6XANq0DnSpRoDHElbuC:P2wqXnm9KCy806QgISpAE5z
TLSH
T1ED86337BAE05C386B3100ECBEC058D5369E6FF680ECA0012AC574B74ADF47965D9DCA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Browser\Firefox\Bookmarks.txt
Size 367B
SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
MD5 1e5809dc37fdb89a5f31aefd8d07e742
SHA1 7d7e459b5709f8480d7b4100ce232c2ce1e5d1ca
SHA512 e76ec273e7a47a9ef0bd69e36c44a601bc49a51005a2263c1f1d2c115c7702045e55a8d70518b750ae8fc4ad5aae23dcb116a5f322cd7f6922f52434e985128e
TLSH
T1F1E0D8A3627241EB4F018B1870297A16644B8708DFF959DEE046247244A93A440E6B4C
MD5 SHA1 SHA512 TLSH

Submit Download

DebugSync.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\DebugSync.xlsx
Size 9KB
SHA256 0c9edcdc375b97d1a0203d214729056e75a93e08054210e2b05587f9e0a68793
MD5 f02ae3ca2ec2860c8cc595f7442a8ec5
SHA1 bb5bebbb1fdbcbd80750b5ecec91523d1a53a0c3
SHA512 4f9de125e05637dcb3a438b24d345bbed7b0b4b0d14dd7a2e51a6297268e346d6e44b3b842217682b78d6fcee64f75b8bb20c28f2a955c07853e189de51647dc
SSDEEP 192:wc8mVeXNW7Eb3U4ruoIgaFUlbVvevUqzQXpS0+8akM686uTaoU:wc3aN93duoGUlM9z6pjak5hSaoU
TLSH
T1F2227C45F520903EC2E749BCD18E04C1B76C20614747B98B7C64F15E6B8229726AE3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountWait.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\DismountWait.rtf
Size 573KB
SHA256 178ebedeb59696c4218c24580e678d82a1316a2888021778202547f307997fce
MD5 855d260c5397e49db2595ae6e156c15e
SHA1 ab992535dd649328c8cbec1284a34152981504f5
SHA512 b129bb1f5c75126e1c7efcdb27874c5e37b5c5adb4a2b0d9ac0709efc2e498c9e40e4c31933193045d180102cc68533c7b23046b0fab11dde239ef861c6dbb16
SSDEEP 12288:F5+/yiMUPZP3+K0KLEmHT6QUth8+pQkWg1rijBYyD4fXPOY:v+aXUR3RYWW8o9WgEj34Hn
TLSH
T1B9C423E16D04B7CCD24BE1B9175B0817B7A680CFD992ABE757840DEC291FE20D44E29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatSend.docx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\FormatSend.docx
Size 18KB
SHA256 c354d6588c3c4dc6d3197caf555cc8dc8a22ee56989cf4cd2c87c139f86e620b
MD5 81ffa875c679329ba269ecca820853f0
SHA1 a845b7f6e17d87cf0e2c2a83dfe0a72b3455047c
SHA512 7cd169a67a62ded0f379eb33e17c59b4501c0d796ac6622b1baf4daa2013f6c31f23f4c5cf7fdfdd8abb2207d9cd45d3a7e274b96204bd0f10cde166020c4be2
SSDEEP 384:aIaUCiAJkht2CViao4ayHI3VudNxt/ZtNNUuIFH37TTjrD:3CiAJgnga75QVqxllNUuIt37TP3
TLSH
T1D982C075D244A638F592893CF0BB35F6F12D51427E6A48D330C977CF8305AA7634AD85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureDisable.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\MeasureDisable.rtf
Size 1.0MB
SHA256 ed81a38a1d3d8fa95d3e3bce2381fdef5f6a0667020c0e91e5f8a9cbd9dfbbdb
MD5 60f6799be246f8fbe480d0abe72d23e5
SHA1 9c78764e661093c270dfc55ed9d939bddba8dc34
SHA512 0e2c462179ff37f1bf58af71589661f79b6d8ce5d2ef4c32c5c5569762e2ad8d5fd0b790d862af5b74242dc237a684b89260434becb4c25901cd3af3a6154f77
SSDEEP 24576:mTAaFA+wBLk19/dOTjPQN75YyZuJbW7eT4tVEVnLzTAZ:mTK+kLkP16jPQN72yZuVW7EOVk8Z
TLSH
T1BD3533CADF6A0F909867F078BC15D57B0250E8FD4F3256E6242D5BBC1DAAB9070A311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectSplit.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\ProtectSplit.txt
Size 763KB
SHA256 13d3ffc5f6b0468b87bb2f4b660eb5c40ccad6ed2fdac8526b098238389f08d9
MD5 44ec31bdab2e51b96281fc601cbd9e8f
SHA1 73552e106f7d13025047cb21be6e0597d7e574ea
SHA512 52f5bdffdff822d231716d8be9cef6adddbbba6dbf88445ae0df959375d0d5f47a608665d454b988741a5e06333638297f006d4098fdacfa64da8eb682d8e60d
SSDEEP 12288:vXnlZCWxcH0eR3umwPyeLGYsaVyz6xo2HxzHH3mnmCt/8ClgmLoI+ncoNKGPpTV:vXnmWxY3svVK6m2FHH8mCJT7LqncjGR5
TLSH
T128F4333C76D93BE57298007CB382983892710E86AC3E7731BFA6697C24577A741F8067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushUnprotect.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\PushUnprotect.rtf
Size 708KB
SHA256 0b92ac85f6b83b42b1d588b4e394f5bf3fff29f01f05132c75751a48a774dc7d
MD5 958424ab3a06e91f3472ba43a8ceb4ec
SHA1 ca9bef865b7e61c8392370124d1af7d20a7e385f
SHA512 96e5fb9871b8229c86cb2481e65ed6479d91ccddfc4f4cfde63aa48b0c48aa84225b2506fece94f67c709c661c65e55bbc43758793ad1ef45225e474268b6b46
SSDEEP 12288:zmXKzsuWlsv8zr6sD9UUdnJul1xVQQtstY7HadiA2UPeUyN7yq5V0u3sFXf9:zmXaGV3hZnxQtsSQJ2KeUk15VNsFX1
TLSH
T160F423B8F0C1166422E6FA1B07E757CB8CD41BEA1E69DD4C27B384D1C6187F27A0B598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoDebug.docx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\RedoDebug.docx
Size 553KB
SHA256 1994bbd1904c66c4a246589523735c46451b2ce11488b0ab55824df6e8e42b40
MD5 fc874da2a13277a0e10b62362e45a73d
SHA1 686ca2e73a47ffc0c073ac20839b718e5bba3813
SHA512 1518dc167e3a79f44fd5934af25babd20987d4e608e82979b4ac0fda47494109088d133cf846e4549e5f180d5d363909e4f3f2e44e6cc81615bd016b45cfa472
SSDEEP 12288:RIOCVnlWRwuqno5q3u2nn0QmJ5/xhaPEAF7CeKA3E4CiHmj4Gd:RIO2IRgV0Qc5JhkLlKx4C8m9d
TLSH
T1C2C423B4D4B4536E0DB2CCFCA0D48013F4535F6EE7226BBEEB25D665C683A4215AC60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoGroup.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\RedoGroup.txt
Size 927KB
SHA256 33f6e8efb2b897eddfcf0953571918ab0135eff9c68c382fdcd907b7f24138dc
MD5 09d68e1900b795265892a246e2f7ca6d
SHA1 d282538444ef61bcb35aae41447589eb9c9e89af
SHA512 cdb86c5f3b70553127acfd3b0b567e71dce55530e651dbc2c13390c730f347a1ad5eb43b92618507a2ee4190959b1eed88923afc7162c41c2b9215ca98567be9
SSDEEP 12288:TQvMY6vqYSrJK3ymoOdgwhGHr6A5kc/Kle/FTkHxDdc+uePT1aocMDzNRrMfUkiO:T2JPLfw4+Uoe5kfOqaocMDzNRrMfUHQ
TLSH
T152153316026E69428BC73D26FA0CAC3DE07E6A3E79B591D146512B789712DF6D3E00FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterPop.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\RegisterPop.rtf
Size 1.4MB
SHA256 bdf5fd11998c66a89a5ee3c0c71c57ef88cac507d04a32cc0fbb5b5b639768b2
MD5 c13309a4c5aa9a1c60adce76c1e48923
SHA1 9158d216a65e1e0cdae008c20373a5b9cdae13e6
SHA512 fec7f207420539ed161101fc80c3544d0769538a7cdeb326c7f278dcd53c3f7bfc7c9339e02690cfd06a9d1f2738c25696d4b918b1f855bc482a5fa4ecce4f63
SSDEEP 24576:UenT60lvuF8ZY/qSrZkMA0WHXZFSyXky3a+EWAwI5C9M297H9Wp7mtmtU:UenTTGeZYyi+0eXOgvadWd2Tgz9nmtU
TLSH
T1A065338503192D8CD5F2A319BD83C38AFF224EEFB931851517B119B9B0FA2920E7DD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetImport.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\ResetImport.xlsx
Size 14KB
SHA256 476cd8292127e8f3892ee94a6383a9790c60ff4f6faa2f2fb53441980fc61b61
MD5 ad2cb06e8fc5f750783aacfd06a3b34e
SHA1 d7b2ae0b47b4beca26a357f7d5a98e8bd8e8b291
SHA512 2ea85daa4a3ecfd10b77f67420340d4d047b17d1a5e85642b39d220eb85398a7450ade80c4be1ce8528d94f943b931ebe2c845338e6274119a00ee7faa41893d
SSDEEP 384:wc35f32nCUlM9z6pCW2IjX0q2Ixb3GvmaozG:wg+CxWpUItGvmfzG
TLSH
T16F52BF21D26D547DC17ADABE867E04CAB018A1C189496A847861F2ED30E83EF13AF1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeConnect.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\ResumeConnect.rtf
Size 420KB
SHA256 ebbb8a3a939383cd6aa2da961380787f6d08f859cf023579190613de6d3b5a22
MD5 aabb6093ebac0b02b97bdaa5cf87a2f7
SHA1 690eec2e329b2e9a7533b51d9ebc3512a441bde6
SHA512 e271a7d8fde3f2033f83febb6144edd8337192ee89b18e500555af4941f6181c5b8c504c94586c4a0572c030ed9bde5703050219eb3dcc12fe1d44fd154dc038
SSDEEP 12288:D4meEtB2Jvnkg5iHOhsdKD4pJTZDJeNnzskMfI:D4jDRkgcOhsde4XTZD8ng3w
TLSH
T16C9423D02686DAA160C03A29258A830FEBB746E9D4D816F0CFF41776D16ED4E12F3F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchSwitch.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\SearchSwitch.rtf
Size 930KB
SHA256 aef3846abd356ec4bc9c984f4cf8f480aa4ea96cc0ee68f6b14c86b82984df6f
MD5 286784ddce0644b05619a35b0f2b6f30
SHA1 c0afec4ccb1df9590bac5063059439b45d7e447c
SHA512 95333b88e2c97ec55eec620d796b19e806449490fa110b815730c887e64447af8400fc34c12244578b3ccb04f2079fd89be6d30b34447d22be4651a19d6c528e
SSDEEP 12288:GGaO7OL707qEH6iMUOWIv8hlyJE4yKhTOszBxYzfZ6Kjvksu1Ivdm2Z4QZUGzoTi:GG1sQjkb8hSEdsrscKA12d1UqXh/
TLSH
T17215233764E57B0AB4D38B135C0C8BCA7A88B6574D1B7BC2534DF168CA84C9F6AD9207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetOpen.docx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\SetOpen.docx
Size 19KB
SHA256 de5c168de92ea1234f35c90488df7f3b8e814f4cf01f9b096a198ae291090842
MD5 09c217b86e711217a5ee5975dbafa015
SHA1 adda18382c945a6512cdaacedec82be5b3e7f987
SHA512 8654195ea0362ce6cf511f54e18291b3d2198fb77319d33d2fbbffc0840e356d7d8b2d6b36b77412d961fcad8a5909b823bdc440485475bc4b687c81b3b25c16
SSDEEP 384:amr2O1dFcts5uVzzx38bGRxmAN3wHUJedNxt/ZtNNBbMIFH378dXt7:zr7bctsKzxhLAHu6xllNBYIt37+Z
TLSH
T14992CF78EA060630F7A30A7CE12663F5820ED4053923D5572189BBCF657B6EE475358E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitHide.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\SubmitHide.txt
Size 531KB
SHA256 15ce20f3c0a0c2430c9229d23238e60e30d4a77dac825786f49a64dec23eb561
MD5 bf725afc9333d111ad4fa0dc9ca89ac7
SHA1 44edaa490aff31ee29c05226a58d0db778e8a1e7
SHA512 f7bf6adc427fcef969ee30724f8b5d77a8b7ed5ed6af3f6b0aaef83a26811cc5fd0a868f9ad3a19537a5d3fbb4894665c09ffa5ae38d39b187ad66b935dcfd72
SSDEEP 12288:CL3PYwKVgdNcDlLbDBzlL2CQbl4NpUYkF33GeKmHwqZEXnO:C0w7NcDlLBzlwuIF337++
TLSH
T16BC423387AA5614D36E09F5C636C02E467A06EF71A865B445C33C9FAC0B4897F92F31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoHide.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\UndoHide.xlsx
Size 13KB
SHA256 0f2fe3f89138d42f330424c801236728e0ecc74fa30e490cd267955f61261a61
MD5 4e040b7a968f42555af469abe8640ec4
SHA1 49dca7ddee935673c27399f64b4f8f6a33003601
SHA512 e604bb58aa5acbf0062d760cd6cdc7a4db941bd6f9ed06c021b3cb8cceba45f1381bf512c968033d59ca52d256d1941e6b0957ddb93176f0aeabc88f40e736e7
SSDEEP 384:wc3QaB83zEMGF3xgUlM9z6pGCuIgvycSJyZaclw+aoY:wMKxWpGeyyizfY
TLSH
T1A6528D15C0708128D386447DC21AA4F8BE8EA2C0969770C9786DF65B5342A7753BE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterMeasure.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Common Files\Documents\UnregisterMeasure.xlsx
Size 12KB
SHA256 eeb37ded98053c610631c168e08098b391d5bd84e368c700ad616d88ea4a2329
MD5 10908d723f14bab640c993dc6617ec1e
SHA1 81b1902911505c423cd18ce4a5ce922fe33f835f
SHA512 dd64b34cd47db510d9fdbcaacc66f51b666e1c7674274b5478fa60d03ba402fea5dbbd20ec97a493e060b180beb5de5ae6b8b276966d939d1562a1256e6fa463
SSDEEP 384:wc3NTFRk32PmC8ilhsUlM9z6pVkKu3YbRzQ0qhoRaoV:wERxPmC8ilhsxWpeJ3YbRzQ0xfV
TLSH
T108528D399265C908C37A583CA28F08E6715E508996C6F583A8E4F98B525B1D613BF2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

email_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Credentials\email_clients.txt
Size 205B
SHA256 9e267af1140f2b357318c39442ad60d97261256315adfc3e483623c0aff475e1
MD5 7ce373bad92738accf755849c7139c63
SHA1 3e927eb6044bafecaa92d5574260221865b636c2
SHA512 6b8a78528d00c9df7828bb4fde4878d1302bc76a52c0f371d189cac3773d062769fca26d3bf7a1756e0059f79fe25abac1c32863e5fe82e68ede225353c0df4e
TLSH
T188D01285072E90338830FDD03A20C5E83F96440635C71AC30089EF0C811B1A21BED8DF
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Directories\Desktop.txt
Size 1KB
SHA256 7c75ce3e22f0dd00120cccf9735797c588a50d38c5e3faba1434f1fe001a071e
MD5 aa33e5e72ecc1bba890d4770349e0745
SHA1 902a520ac4b388bd806b9dbb9186b5732de037c1
SHA512 af7c7f769c3c321681314d7185faffcc46bcc632315f415f169c38bce7b9aa05d1bce715263d9af288c6b16197bb4a12933df44ff07e957987aa60155dac46e1
TLSH
T13C11E2DE6630DB268961D7EE4B50F84706CC49DF6E95F6A63BCEECE5520AB1A8050403
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Directories\Documents.txt
Size 1KB
SHA256 76e359f92b11e6c0aabadb0687ca739845adf647a54a30cc1058bded93a8319a
MD5 d174b3f8d44a06972f39c2f28bce834f
SHA1 c385b16db31ccffa374919a8f02ec4f492b031ad
SHA512 2782c0647d2cc8b7d7f5b6d48e81058ca56909562786f0a1986d52065865441d0a0d5adc719c3477222769b19952825ff96e3aeebedc98995612922fecd6908f
TLSH
T1C721CD8916BCEF6F5D83DF640721B95322D91CCEADA4E29B37CEED811A89620C060807
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Directories\Downloads.txt
Size 1KB
SHA256 911754c66128dbe07e91862aafafecff5a75a4b0431135110d343ce23f2319f7
MD5 74c65cbeab1839392241d8f3e29afa0e
SHA1 f61c0cf5ba8ee98c5896f11077d1e78a55242a97
SHA512 8e7127239eb7cfac17e612c6e89d49f8c8f82a4f61bcf75b03e69fb5a05e830d7c7d45dae105b6f20f38906286ad9aea932505181efe088ce4b002430ac0046c
TLSH
T1C311F0CA7A74CE1F1A60999413A0364705CE09C99E56F69537CEEEA1A502F1F0050C07
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Directories\Music.txt
Size 741B
SHA256 3c2b1f1099b385af5af2652f3e0c63c2a56ed3a2c6822d4b12ad873876c8fef5
MD5 0311bf1822f614dd9b985c1d7ad260b9
SHA1 2ec3e440f0d6eed0ce1dc22aa45ae2c0b4ea1fa6
SHA512 a4475dcb1c48f1888ce122a516449160397c243202c6eccf72c986f1cad7049748b3a3205b2f69a8123154cf48bbd29174000cca85f2a40bfc6cf05512e0a724
TLSH
T1230144830024CF4766723B5567F0B06301CC0CC68DA8D0BD769DDEB23416F1C04A4D71
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Directories\Pictures.txt
Size 619B
SHA256 543efeddc3fb2c3ba943464e545abdba258b41f28d4671ad47cc43c6e1edf6b4
MD5 3ffe44762a8ee41a07cd0a3d58ed843a
SHA1 dd5a1789f97f49e73c973ee1b09f0d783085dc4a
SHA512 c26177990173aaf55d474e39e4fca03722c3148726ca7044419c80d1565b3bc509f90bc49252b79770c4aa903117b2df80a82b96102b6198d04403f28f1e396e
TLSH
T179F078D8366EED1255032EF54F25B0CB83C41EEBDC62EA3E32CF4C921A0050494E6C80
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\Bookmarks\items.txt
Size 467B
SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
MD5 98dea30b7155d5ace37749f44523438c
SHA1 6f9e7de66f62d2792eefcc130d844199d1dad0f1
SHA512 8d105b4804e6aadb379961a181effc9c6592f182ba34de63fde293d88d2591215d0b9634dfd483a63af381f989188214f91ce583e9903634fa21f343d64de519
TLSH
T156F0A763E5F1C5AD0F508928F5143109168B670CCBD9517EE046383269B63D810EC3CC
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\Email\items.txt
Size 239B
SHA256 bb8cf0d716eaaf9717ec16630223f5543f5c566a71bbd0dd5f4085bc276fc6b2
MD5 7088c75afb24d2e40631b0d177fc0262
SHA1 47bda02a895130cee3eea41608d050db6cff8e6b
SHA512 16a0efe75e111923316b3002ab3d87345ff6a424527bdedf3474157c04506104cbf2f7911d7dab2daa6d433b2852b2b27f0551952e5c674c9559605ce89fbf18
TLSH
T16ED0C702D96DD1734570BC592E50C6E03B6F081E744755F740E7E74865371EA46EC1AE
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\Environment\items.txt
Size 655B
SHA256 f6b48b844ab6739a4367a4d17504db884d4bb13dcdb985f804ea7637deef8667
MD5 51cdae60b2fee8f843b91994585afb79
SHA1 71632bc2221349633ec6377315110c90ad35e12e
SHA512 d3a9175b16440915e6bcdd5dc4c813ce1d783ef396a14618a1b2be8fbbd1174f77063d4012ec3887b174f8bad69a7aa61a590a53965613e92a4565275c2fa1b1
TLSH
T17CF06D2AECE0F1AA44F0D23D1D8351088979281CE948373BE2B2661F3E3403C92C9689
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\Fingerprint\items.txt
Size 429B
SHA256 ecab874449e3ba764001bd30f8d7d98576232473e6a41c3ceadaab3351dd425a
MD5 b5ac500ee74902a196b0776199a434ee
SHA1 d9b023cb5fb91df3caf8647c223203d1d4faad78
SHA512 9f9f8fb315a5afd4fb72cf04bd3293a5b53706fc404e143ba350a229ba3bbb2fc84c908cc77e48f0253a98bc33c062b5906a98770d5c7cbb5f7cc51221e2ede6
TLSH
T153E09232EAD8C4AE5DA0943D1E115960077A351FD4A4437AD0E7A47A7E3225C87EC70B
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\Processes\items.txt
Size 6KB
SHA256 13abf098ae4e959950d2016a72b540700c0e8162ccd9e3ece3dba00016242a29
MD5 fb193d891c8601b7fac3a612d7eb5dfd
SHA1 c27d26c672e7420540a22c8e11b1a7df13f80bd7
SHA512 2fbeeef682b050f1881ea4522ecd26eb12b0e0f9a9f40a72b943ea5f62bd06dbea549ea908a21ab5b2e0631ad06bc792e40a13e103bea0cb51df799992e5cb33
SSDEEP 192:Vq54axkqQhbpT522n2a5AV0V82xn75g0tGRLJLRqiqLV15DnBqybP0wp6nH2D0CU:Vq54axkqQhbpT522n2a5AV0V82xn75gV
TLSH
T1C4D1BD21E9EDC09F157481B71AB1404316EF2D1DC009C5F9BEAAD8797E3424FD2EAE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\ProductKey\items.txt
Size 199B
SHA256 4fb0cbd0cd0c131dd44d364602a44887750ef4114cc86acaa651fbccb2a395ce
MD5 1fbe64e7dcc2e5c7f2986fdcb063353c
SHA1 6eb07be5c98191f4b03c4f76f74708be7285bdf8
SHA512 54c2be2da4440e796d646d51ed85a32843cd984b1586785327ca871cecd4392e5d0392fc5c7c2413dd93dd2e0c542bd415dd4d5bbfd35ba878bf7506a218be1a
TLSH
T1F8D012A1CCB9C52585B4446364AB1781251F34BFD0895975A4D2A155BD70A0F4395258
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\Other\Software\items.txt
Size 2KB
SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
MD5 28bd85dc25bc0c55db6291d1db885a12
SHA1 0b019bf7c9e28d7be0687733395b2fbae6111517
SHA512 d7a38124242a0f1c39c434c6c1e936ae2c09436a398e5aa733d904849382e393a0c14880e790effc1e286a284c6d4a38dc670087d120a6487f6b80734f74f03c
TLSH
T1DE51061EDBE4C0BE5F20AA939E321C30225E259FF6508A36C1EB152A6E332DD45EC755
MD5 SHA1 SHA512 TLSH

Submit Download

Antivirus.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\System\Antivirus.txt
Size 31B
SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
MD5 e2da04c91dc82476ba3aebdaa6f40eb6
SHA1 abcd50cd2dbabf56fb88210f5083ce94d5bb34f0
SHA512 735c51ad836d453deea37e2e5f44d05006bdfb433149495e503161131ec32bb01389405bb65a3207b45799e27b694708031b98a5f675346d8cbb1ab2188607d6
MD5 SHA1 SHA512

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\System\MAC Addresses.txt
Size 34B
SHA256 5b59d7a3c50c0689496dee17e4e00fbc139cc3ace30ad2633fc057e1672e86e5
MD5 88daafba1fe79e35b04c0e226ee288f6
SHA1 1baa273383e6cf8509b6b71bf5e27bb8bf1b62ac
SHA512 5d88d647228726ede25e7192a8a082ca5121fec43b61d469133f9a064335b372d7ce5dad99f033e4a94c073fde3e3f9eead63acdb80b638baeb27c4ba32e3fe4
MD5 SHA1 SHA512

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\System\System Info.txt
Size 679B
SHA256 0333c8392b60fcb3c8b286eea10e1cf628fe0ab7a38969140cfa37f20fb309b8
MD5 665b259bfca20d821ea5034953dc738d
SHA1 c23053987e0917dd0d62b627d1938b1bf660980c
SHA512 74cd81c2e167441be6d9f81387aac3c224ed957221825d45fd40b8a4733c42fc54895f5f58c6a4cd5bd022edca499ad93886cac67c9cb3b16e8865346d2319c5
TLSH
T17401C0E0625C0002C7AB23F51317575731F56AC7359BA86D62DE81CD2ED72C5D749141
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\System\Task List.txt
Size 2KB
SHA256 7cc9f79155f82e8ed332efaf1fc5187e4da78c3ac94f769544dcccfbec0dc15f
MD5 c9f9a733f7c1ca42b02fe14a8f266d96
SHA1 2d2ad1e5c707f2e9d1aab62faff10b37a537adee
SHA512 210d85676793474a82baab5393614306ffd3a848e26cfe2acd39459b164bc8d28b821591c832371aadf5847f223d58904a023e849d41e4cfc09490c1c76cd39f
TLSH
T1EA41CA0BC4AFE6CDD6D511EF3E21128E1BAB090C018F9DD9726205EC29B5C1DCA4BB1D
MD5 SHA1 SHA512 TLSH

Submit Download

results.json

Path C:\Users\Admin\AppData\Local\Temp\vg__1fv7ul2\organized\results.json
Size 36KB
SHA256 6375be02b956263ab24757a1d32ea28dcf488b2c8c82782b2f987a2718dbed02
MD5 f32eeb881315f2fd46a26a073d7cc6de
SHA1 3712c640e562a2344e3db7fe91c13e46582f352e
SHA512 688dc0d0e0bb510bcd7b7d31b5075413ae4c8c0ae7a65ad04ae98c9c23952a4935acc4e295724bf9bf21d6d46bc7e5d4506759f128f60192b8179daad4219d63
SSDEEP 384:FnvSypa8czaTLoCb2DnzW/am4YQbCaDmmCEz3DL7Zv3+MsOvcA+WB6OXqAoRHsLf:dayfKGXt8J
TLSH
T1EEF2143ED5B84CE3088DA4A11577064372A0454B8E697EA87B4CC9CCAFCCD1F65BB69C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download