Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 03:38
Behavioral task
behavioral1
Sample
x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe
- Size 417KB
- Sample260417-d7fecaev3r
- SHA256 7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a
- MD5 5eac01559e88e060f14840c5a66b19b3
- SHA1 77a72836ed7e33540ff070cc8a84bcc4ada26489
- SHA512 05e4fbe113529b16fda48b22d4de7b63ec0581baaf499480df3c1559a1e0ef95f2ba596941232b658e618a529d499f1a5a69c45f42caf30268c73dfac1971723
- SSDEEP 6144:j+GYnA0zeWsDi5rJziQ8kV3f+nysMFZzN/E/msHOtbUriDNearwQwKbgZC:jYyDi5rNiQ7gysMFZzN/E/msu+GAsXF
- TLSH T194949D06F75408FDE5ABC57489924656DA39BC8A0B72EADF17C8432A1F337E08E39750
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 4 IoCs
resource yara_rule behavioral2/files/0x002d00000002b44d-3.dat family_xworm behavioral2/files/0x001900000002b551-10.dat family_xworm behavioral2/memory/1192-21-0x00000000000B0000-0x00000000000C6000-memory.dmp family_xworm behavioral2/files/0x001c00000002b553-72.dat family_xworm - Executes dropped EXE 4 IoCs
pid Process 4280 audiodg.exe 5008 shost.exe 4980 x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a..exe 1192 audiodg.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: shost.exe File opened (read-only) \??\J: shost.exe File opened (read-only) \??\N: shost.exe File opened (read-only) \??\U: shost.exe File opened (read-only) \??\Z: shost.exe File opened (read-only) \??\A: shost.exe File opened (read-only) \??\L: shost.exe File opened (read-only) \??\P: shost.exe File opened (read-only) \??\V: shost.exe File opened (read-only) \??\W: shost.exe File opened (read-only) \??\Q: shost.exe File opened (read-only) \??\B: shost.exe File opened (read-only) \??\H: shost.exe File opened (read-only) \??\K: shost.exe File opened (read-only) \??\M: shost.exe File opened (read-only) \??\O: shost.exe File opened (read-only) \??\R: shost.exe File opened (read-only) \??\S: shost.exe File opened (read-only) \??\G: shost.exe File opened (read-only) \??\I: shost.exe File opened (read-only) \??\T: shost.exe File opened (read-only) \??\X: shost.exe File opened (read-only) \??\Y: shost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe shost.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe shost.exe File created C:\Program Files\Internet Explorer\ExtExport.exe shost.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe shost.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe shost.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4685.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe shost.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe shost.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5338.tmp shost.exe File created C:\Program Files\7-Zip\7zFM.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe shost.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe shost.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe shost.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe shost.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe shost.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX66A6.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCX66E7.tmp shost.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe shost.exe File created C:\Program Files\Windows Media Player\setup_wm.exe shost.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe shost.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe shost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4665.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX514E.tmp shost.exe File created C:\Program Files\Windows Mail\wabmig.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX4B42.tmp shost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe shost.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX6FBA.tmp shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe shost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX41C0.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe shost.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe shost.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX630A.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe shost.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe shost.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe shost.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4848.tmp shost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2792 wrote to memory of 4280 2792 x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe 80 PID 2792 wrote to memory of 5008 2792 x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe 81 PID 2792 wrote to memory of 4980 2792 x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe 82 PID 5008 wrote to memory of 1192 5008 shost.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe"C:\Users\Admin\AppData\Local\Temp\x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
PID:4280
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
PID:1192
-
-
-
C:\Users\Admin\AppData\Local\Temp\x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a..exe"C:\Users\Admin\AppData\Local\Temp\x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a..exe"2⤵
- Executes dropped EXE
PID:4980
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\RCX4082.tmp
- Size 377KB
- SHA256 7d57b902eb148fd14dd1ce0a532487a0f6de5f4b7bc18cc8aa3447a1921bbc36
- MD5 8a9da2b37c219f4248d6e56a7161fb18
- SHA1 b7afb38c431fee9fe9acd49afc776aa6f827d492
- SHA512 00c22429d14afc750a7a8fbbfefbfb2323cfb1b746757ce80f983b2f8994e7a901be93c573797f662a15c92eb69493de39d04bcd4af8660dfbfba68ce0623dbd
- SSDEEP 6144:p+GYnA0zeWsDi5rJziQ8kV3f+nysMFZzN/E/msHOtbUriDNearw:pYyDi5rNiQ7gysMFZzN/E/msu+GAs
- TLSH T10E847C06F75408FDD49BC57489964656DA39BC8B0B72EADF17C8422A2F337E08E39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\036477727110.ico
- Size 1KB
- SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
- MD5 aea8653be6803940e5f5017482ed8f31
- SHA1 83d770a087be76863aca353d9e394c29b126874a
- SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
- TLSH T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\155416650520.ico
- Size 1KB
- SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
- MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
- SHA1 13470460552d9f4c465130d654b2095316b22854
- SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
- TLSH T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\201337217714.ico
- Size 1KB
- SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
- MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
- SHA1 0a18f23ef372593dee476bb852745b2490bc8421
- SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
- TLSH T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\363007249215.ico
- Size 1KB
- SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
- MD5 3d272e20bb157f11d4ae75abc33aef1a
- SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
- SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
- TLSH T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\524109302063..exe
- Size 1.4MB
- SHA256 e6adb24c63c2622f76ed91b2def9498074716f5e154dd483b3469848e38174af
- MD5 23ab9226d797b4f36e4d23852031fb6a
- SHA1 53462550fc7b14c940dbe39e45fd4a801803edb0
- SHA512 f432ab01886095849214a9426483bb3a90ae699fb36464342ff7818d8a7a52da1513f03c666e187ee69542f3f5268c711650d0b5a1a70f93c30e38e68f3d7bfc
- SSDEEP 6144:m1c3qnqrG33v9cmhCPf2GtmuH8StGxp+:lDrG33VcmhCPf2GtmuH8StGxp+
- TLSH T14265EC66B704E48AC8580A34CD97C7FC2B617C21EE6186477BD0BB9F3EB2361AD14794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\545729944369.ico
- Size 1KB
- SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
- MD5 bdc7cdea596ddc3d6542f6eae40a3509
- SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
- SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
- TLSH T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\556217475342.ico
- Size 1KB
- SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
- MD5 1af3523517c4a23a831af16191e71ba5
- SHA1 34674885738a8717def95b016697802778f0d520
- SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
- TLSH T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\602498106772.ico
- Size 1KB
- SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
- MD5 81e2b09e1f33b8c702aed3d14d341a13
- SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
- SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
- TLSH T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\611731541989.ico
- Size 1KB
- SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
- MD5 cb4265d1bed8a3606c50c3ace6452c94
- SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
- SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
- TLSH T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\679494001783.ico
- Size 1KB
- SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
- MD5 d91c5d1ab9c7e29648ace11bcb875f98
- SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
- SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
- TLSH T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\742637910485.exe
- Size 4.1MB
- SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
- MD5 2864c8b005a6414e2fa9b06c1e089dcc
- SHA1 3041fbd63ae570b537c38a315050c06aa566362f
- SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
- TLSH T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\845713177697..exe
- Size 1.4MB
- SHA256 1724f2173c7307bea75bb4621bf7f52b673393f8bd2b77ee8308d3061eabe271
- MD5 edd8997073672cbe84ed33207f3b07e3
- SHA1 cfd0126c4559b82a9619bce805e1e5da83f30df7
- SHA512 5e1e28aaf0b7f6c5e6b17ef00899679b24924b506fc4c0e48c4f859c94a2c3ff09604138b462e59f20bac682f5dda93692bf129461f7d0a602232c6eaa92318e
- SSDEEP 3072:BmfQDc7gJ/VhG33v11h0FQcBJiAiCHuxSJZ2J16BmQ6fuH8StGxpBMue6Y1:PDTJdhG33v9cmhCPf2GtmuH8StGxp+
- TLSH T15465EC66B704E48AC8580A34CD97C7FC2B617C21EE6186477BD0BB9F3EB2361AD14794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\874383650581..exe
- Size 263KB
- SHA256 66bf24b6a4a645bb814a8d44de5cb98ff544aa24c8acc843d21337260f6f5d43
- MD5 6ace5d3b039dd33892d0de2b54e302a9
- SHA1 967e80b08d8721721cf8a96af2ae1e7c1baf295a
- SHA512 28822e918054e1d17bb15d074a64785623693467bd8a679cde00b37ba9d48380457675f2f69ce04c8ca965cb4f1a9c62a3c7a718321366877ce0755404f7236a
- SSDEEP 6144:GnhqDA3+sx2sehbsayOTwHibOUEbL9qO:GnUA3N27bsayOwic/w
- TLSH T11644F66A3BA48CE2D513913A88A1C7B4F372F5924F60974F5DA1C33F1F771A0AC19A61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\921651436075.ico
- Size 1KB
- SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
- MD5 4a3be9e27a938152348d20edbc4c08ee
- SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
- SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
- TLSH T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\950566351183.ico
- Size 1KB
- SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
- MD5 6ed58acd10d2c394c7638d5e4d4e4d04
- SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
- SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
- TLSH T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\987392601326..exe
- Size 107KB
- SHA256 16f7ddaa4944632505f557d45ade328911169a7af17599a71ffe7edfa5eb5f51
- MD5 1bd0d798a5a7f7e975d9ee59572a4012
- SHA1 1c7c813b048b1ebfaff1b0a8d07e161dafac3964
- SHA512 3cb55ab081c43319cc02a9244ddc45a950792c843a71b6d5374a9d46b1a16b07d0805bad955872af54ce77dc7ba047b0357722a123abcde23afab4884bba0986
- SSDEEP 1536:PJIdb9rVs5AbrCo8tenUpIdB0VeF7h/c5pF05PnObFcuF:PJIdb9RsSH5UpIdB0VeVhkjK5vObF5F
- TLSH T1BCB33B9E776580F5D152E13C94E6A6B6F3B2F8421D72470FA651C30E1F372A0AE2E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\x7822a10ef4b9b6b6a1bb263c910121bfca764aa2da818088dfc386740780341a..exe
- Size 41KB
- SHA256 ca70db00555683fdc153d38bbce1dc1cc9d7b50f20588e6ca9055a552393268d
- MD5 64d4406545406e6f97d44ee7ac913cbd
- SHA1 d8e4d1f4b453abc9d8c300e12fb6f4b9d9e8f2c9
- SHA512 012ae08ac023510811155c964765536aa2b8c2d1de837a2dc288e67ab20603d7b57e7932d47658977d77191c0e6533115fe455c4a64d2775965f246e7f6550d6
- SSDEEP 768:w3V/q1Boa9cUlxLcbdVOm4KbwFIKZi1dstYiI09/yOPxWETQN:SEToa9D4ZQKbgZi1dst7x9Pxw
- TLSH T1A0138E16676808D5E13BD238A4E34922FA35B9641BA1D7CF1352432A0F367C1FE7639B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
- Size 62KB
- SHA256 7e5a39a84a4e6fa368650cd74a600d37064344fde4d32d8ed52937f84b58d49e
- MD5 4ffb27ae71766bd752c5a6bd2826b7d4
- SHA1 5ff0b94140d4b61a7a53c29a48b271c70cd8b6d1
- SHA512 9f00074b48be7b01c0b2053b4d70cca86cf88b618014b5316b50e799416f8c722682474dc5643eabdd352b602afec1cd8ad2faed6af7af6ad613450d479a70b5
- SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAwcYp5waExJO1EA+Bdd:QE/msHasdDOFHbAUuaExJO1Ebdd
- TLSH T1B7537C18BBE54129E5BF6FB158F13276DB39F7635903862F28C5028B1A23E85CD006F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\shost.exe
- Size 375KB
- SHA256 c15129e905ac92e0a1b5437d6864d406e8a422ea3f1b011e68477b03db710c6d
- MD5 1276620e113cceeec35fc0efa5eb003e
- SHA1 9d5b194563374d95936b19b18e685dcd232d2ab5
- SHA512 31ede56a6cdb888ec472180618185a8a87b64e8a9f20f380830a71af834b2755eb67d9fe2fadb25d11c451944aac231e66e820c02f3d3937d60f490a2b69c744
- SSDEEP 6144:j+GYnA0zeWsDi5rJziQ8kV3f+nysMFZzN/E/msHOtbUriDNearw:jYyDi5rNiQ7gysMFZzN/E/msu+GAs
- TLSH T141848C16F75408FDD59BC57489924646DA39BC8F0B72EADF17C8422A2F23BE08E39750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\logs.txt
- Size 4KB
- SHA256 2a01d8e8e9e7688baae182d41336e8dc6229551a7c10305cade0b0b6eaa2d54d
- MD5 ddc10ee2555c6ce23c261511afc33a90
- SHA1 415e1758eb75c31eb5ab47e995a6dc8a003884ce
- SHA512 657549cda2abb919c45c1a0a9c854d154d6a50394b31fd09ad4d777bf9f0d977dde50a5044f2ced25f257d14ef8c3dbd5a98417c9ab283e6de46c77c79e27db0
- SSDEEP 96:2mW5WFWrWdWAW2W3FW3oeTi3Z8ZpRU8VPmPr0ofwGbO:20wb2
- TLSH T1339195B1ED45C285732331802B113901275E9C896B4D80AAE3CC978BE8CDAD99F5BEF1
- MD5 SHA1 SHA512 SSDEEP TLSH