fe9d7a9c5b3d91ea97898c47c508e512e2df6b1b9bf3a9224ee7f1bed2f841e1

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Size 2.9MB
Sample260712-rwf4dsbx2l
SHA256 fe9d7a9c5b3d91ea97898c47c508e512e2df6b1b9bf3a9224ee7f1bed2f841e1
MD5 059b51d7d5d740271f1d8d6695959a90
SHA1 db4bb2be3338a5a4baf7fb009b52348442201b0b
SHA512 761744d9c9f03f81bdfd4b0a578ae9e4880048a1dd9b8a25d02d741a8756b05a67a9858aaa57d36e1dc0b35914c942b08af0d7f17ed17db4b4587b2487b6bd99
SSDEEP 49152:NJHtbIwL5D4Jc+b01tnAyB63TANQnME+6Te8wTv:JkPbiHd6Z0
TLSH
T1E5E54B07F3F941ECF0AAE2B8D63256229E72BC578B30A9DF135452151E71AE05F38762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 29 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f3-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c5f5-11.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2020-14-0x00000000002A0000-0x00000000002B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c5f9-45.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c5f4-77.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001b2c2-139.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c601-138.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000001c5fd-137.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001200000001c5f7-136.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c602-135.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c600-134.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c5ff-133.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c5fe-132.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c5fb-131.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e000000019c81-234.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c606-286.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c608-327.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000800000001ae3a-383.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c60f-393.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c615-474.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001ba8d-382.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001ba8e-381.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00030000000198eb-909.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001300000001c5f1-231.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c604-230.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000500000001b2e5-158.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001a9fd-1974.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00040000000066b6-3331.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000200000001b673-3414.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 9 IoCs

pid	Process
2020	audiodg.exe
4352	shost.exe
4000	audiodg.exe
4728	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
5912	audiodg.exe
4188	shost.exe
3780	audiodg.exe
3564	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe
3252	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\D:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\D:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\U:	shost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3897.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCX4B1E.tmp	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXF778.tmp	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\RCX28D0.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXFE74.tmp	shost.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	shost.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	shost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	shost.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	shost.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	shost.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	shost.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\RCXF035.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX2A9.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX671.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	shost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	shost.exe
File created	C:\Program Files\Windows Defender\MpCmdRun.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX2F19.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCX1E04.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	shost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2020	1228	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe	87
PID 1228 wrote to memory of 4352	1228	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe	88
PID 4352 wrote to memory of 4000	4352	shost.exe	90
PID 1228 wrote to memory of 4728	1228	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe	91
PID 4728 wrote to memory of 5912	4728	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe	94
PID 4728 wrote to memory of 4188	4728	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe	95
PID 4188 wrote to memory of 3780	4188	shost.exe	96
PID 4728 wrote to memory of 3564	4728	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe	101
PID 3564 wrote to memory of 3252	3564	2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Users\Admin\Documents\diagnostics\shost.exe
  "C:\Users\Admin\Documents\diagnostics\shost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    PID:4000
- C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    PID:5912
- - C:\Users\Admin\Documents\diagnostics\shost.exe
    "C:\Users\Admin\Documents\diagnostics\shost.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Users\Admin\Documents\diagnostics\audiodg.exe
      "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
      4⤵
      Executes dropped EXE
      PID:3780
- - C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ff758e9a6a0,0x7ff758e9a6b0,0x7ff758e9a6c0
      4⤵
      Executes dropped EXE
      PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 18.7MB
SHA256 3c80b7bc7e1f491d18a30cfd5375a8e8eda52e67260ea04b317da3bcd5a2e58e
MD5 b11af15963f87e6bc64af58d907dc30c
SHA1 ce72de382a37f0aaeabedb8df48cbea10a92e3ee
SHA512 ed225d18553bfc54ee604a0c23c6f48ae56fc2dec3cc81c79116d75d31db1d0564dee09035b76262994e8439d2dc2f8bd2805143188e4f896f66628ce1139731
SSDEEP 196608:4+hpFzXnfWexuhwPcPXnfW/JLGMcblLheT0:4+1DfWesPXfW/VdX0
TLSH
T1A317AE1DBBE21036CD732176AB4FA104E738D0076215C7977ADC87981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 175KB
SHA256 bc2c48053f07aaa9256861abe4ef2d9b6bd792c7547b9c8dc18627ce0ac67b6f
MD5 df30d27b8efec5c2dff72f158fa71fe6
SHA1 b61ba101f6a89f308e41f338e3255d9298b7e1a7
SHA512 e210453da7a9514813d4e18b8b6b373c6afd959747e37d051e5dd5df03dfb7ab19f9410c2736e663b23bac6e52ba2ce4f583cd8b14442b33493cd5e13260f26a
SSDEEP 3072:miselSsONt3F7oQGO7M1bmq9YnyoRmLotiselSsONt3F7oQGO7M1bmq9YnyoRmLd:mvldRgL0vldRgLd
TLSH
T1AE043913BBE1C872D7A202305E75B7A796AFF5718E74CB277B88070F5DB05824D08A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.1MB
SHA256 3991243618ed4c48f96076ba8c54dfc1242495aba27833ad958463ceb89a9668
MD5 ebaa9d83a5f20e07841e3f6a72f454d5
SHA1 78bf97223305ef56cbe34b95fd47610e708ed456
SHA512 7a2c61f8e85ff2453957d8c6c4477ed805b1414d50df2b9034b28a6de87c7d84465fbdff11bb6b376e982c9c3150c487143a8d4b8e2894da3e362a105608a64e
SSDEEP 12288:A3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1An16iU2NI+:CSgouvz0ZRHkFfenxyQZXS7gZn1o2NI
TLSH
T1E245E50267F94129F1F37B71EEB993645A77BCA1AE39C50E5280025E0DB4A90DE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 422KB
SHA256 4573ad304f15e14447bbccff525f5c0edbbe09e43322dbabb9b20b58a59e9714
MD5 4bf4466e9f5e34918a1b5e904ef1337e
SHA1 1a4fb579fcc530ad64e953cd1c7e86b9cf839c1f
SHA512 672cad2d5eabd901000b5bf96e0dce313548a5adbb07652c2cb6745d0b30ab1d82e3d293361915c78984e0e59601ac8796c36fc2469fdd0dc7ef50f95d1cb8b7
SSDEEP 6144:yBjZPaS4VF4T52ikHohhoA9BjZPaS4VF4T52ikHohhoAlc:4jM35i6owijM35i6owsc
TLSH
T1AF94F86925FC10F2D576D1B48BD08A43E271F87263208EFB4391435A5E23A916DBBF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3B20.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCX3B20.tmp
Size 376KB
SHA256 afd85f115d33badd6b89eee9124d706f41ec32f23348edd851ff1fe936859d0e
MD5 994c83d1e154c947fe0a59bce80646de
SHA1 580fff9cb1a9f057acd733db971d5bd503cb2348
SHA512 255b699f45a2d60ccb53be2a35404f37191960d566fd8c95c0c94ed99e0b92a3aa31bac0ae5d83d6248d868d7c23b94e2675f2a3c72f03f4e6dfca972c5c3ad7
SSDEEP 6144:N+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarw:dYCDi50NiQDuysMFZzN/E/msup7s
TLSH
T151848C06F75408F9D59BC57489924546DA39BC8F1B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe
Size 516KB
SHA256 9e9ce585856fcbce5d392e642483f2d19c373b65ea57c002c796d94dea00efbb
MD5 fdb713972f15ce54400b4315171286e4
SHA1 966fba938f7faa1a1f7e6eb9a6245851e9960d50
SHA512 14b39f3a50780a4b79857923bbf6cd9aa507d8746f5c9dcf2439ef6711a95f41ee8a134b8fb78b800b0368032fad8608d15e688f1e8ea872fa0746967e7ffcf9
SSDEEP 12288:fcMkV5EalRv4mWL5UMeYS+xNQcMkV5EalRv4mWL5UMeYPh+75:kMGN/v4mWLqYSsNtMGN/v4mWLqYPhO5
TLSH
T11EB4382138F84433D4B6D1788BE4DA22A578F87256118DFB53914B4E1E32AD2A177F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 474KB
SHA256 46ff1118b3dc10434c4a6d7f14294a7246f724022fc11991028749c884a6a5d3
MD5 ec4d94a2f76164d532b25d1b749f7f60
SHA1 fcba350e4bdf3abe77744a0f23860c4f82339352
SHA512 08467ddd97167fd41c80482cc8bf95b235e277e13ea522093578c38aa02edf36a5a65f0e5e91489be03b00ea0c15843e627c42b8e44764988ecb4dbd18282159
SSDEEP 12288:fbrNPzB+N+brNPzB+NNFZzN/E/msup7smbrNPzB+N8:fbBPzBA+bBPzBABTBbBPzBA8
TLSH
T1AFA45B13F6D188E1E5B60D3148B09A615E3BBC660B50DEAB32C8566E0F327D1CE35F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe
Size 2.3MB
SHA256 b3d60d1e4b0d8ca53c208ae79b9b85b008dcdc1157ce0ae5ee28f688b9dc874d
MD5 2d12ae6877eaa3360ead8757b1bdcdd5
SHA1 491419d8962e587e37cbf94a703821cbd3e2db69
SHA512 ac42bd08bae0d5bb2bc3422d56dee082ad791d257f7152cbc7457060d29a8910903ba414531eb1763c7a0227d85448195ac67c6dd7839a7953d5db45a28729c4
SSDEEP 49152:mTUDi7PhOtdx4yYmOZsrzNTUDi7PhOtdx4yYmOZsrzw:mTNstdx42TNstdx4j
TLSH
T115B58D07B6E941E8D06EC1B48B464172E972BC560F34A6DF0690B3592E77EE42F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 14.1MB
SHA256 5628fb46e1f65e8055b9d5e3f1ef86c4a3ba668e3a8734e09157389faa64b2f0
MD5 e5e5d0cbdee1784e5336c5505f0f8b74
SHA1 e09e93a90e28d21af16e51df35f3c99e21fe699d
SHA512 ea3f5536132cb805a87f60b078f2fde394a155d793e099e47d1a6401f0d5f6a3a7edbb640fc4f7bcdbdccd4fb44dfeef5ff3a92799ba9367287d7456f41415c0
SSDEEP 196608:yCZetaEMGIG5xVqzRdDLCZetaEMGIG5xVqzRdDD:yC6aETxqddDLC6aETxqddDD
TLSH
T1C0E66C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 7.8MB
SHA256 19ae1ddaa67dfad341677b44e96e2a4794b0aa2eaf298bcd61ea132aab956fed
MD5 5118cbff583ef4b292540fb7aab39712
SHA1 de3427bdb229d381b7ae7422fea65b2b34a4d678
SHA512 a1bdf4ac475502ef720e714dc7205cd4f4089fb8ecdfb2a2314b4442d29c6c145632621cc12444a7a24fef58f6a0bc756edf731753737b530d6e017458be8de6
SSDEEP 49152:VudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpePX6YRJMudQuVyBvNT:XijnUdYd+ROxUijnUdYd+RaAX
TLSH
T1E7864903B29940D8D059C074CE5A9232EB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 544KB
SHA256 19637b0537ff0d9b79de4cef926cecccc6fd3d42f22cf10199b854c6524b000a
MD5 22f433055ab8189fb8cd7d447d18db16
SHA1 883e3fc1abc77dd9112ba44be7a8e478b98d5e93
SHA512 d9b84fcfb1c49877e19e3001c1cd4462194fea34ab61809f04dc5bd66baaacf814e77cfec08623838191f04ff2abfadc699765e279c3d8f1c6de6a65319ca91a
SSDEEP 12288:b1XLsswWkxy2lRq2czAG1XLsswWkxy2lRq2czAe:hXYfDtczAkXYfDtczAe
TLSH
T13DC48E28B7E408F9ED67827CCCA28512EA73785547A0E7DB03E489651F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 924KB
SHA256 c87d30cce6a025767135e091e038028a4c153e1ae199d1c83deef2116bb979f1
MD5 e5e89d9d81e2d1dfe0cf30eb70b94769
SHA1 d5b7a159cc1c164ea7cee95075245e75ffb31aed
SHA512 ad129e8ca6f10e96275eb923e3bd3729e0b02709f32e4d9938da8133f38854bb913290b9791e79434a1b313cb96d21e306406dc78a4a571429f185ac7a8257c3
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7sMXZNYVLeyUji0h90ZD0wxpGZIVuKrHsz:E93gT70Le5ji0hmxNrMz
TLSH
T17F154A16F6644775D073C0B9C5D2968AEE3234861B319ACF0389C76D2F27BE58A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.3MB
SHA256 2671a1adfb85d788152856e2db75f68cbc1a915e34038799ee580d2ad4d87f24
MD5 45b6279f0727f713e9063916451b1c30
SHA1 d043cf1a6598958caa25fbf859ed5cbbf45331fb
SHA512 0aa87f93560db8c9803cb46c7dea8156f2e5d5c1cee6abd7dbcec97322604c2da1c20472b16c164b15722cc417f1f65f680967b7d7b76fa92a021fde07c1518c
SSDEEP 24576:E93gTBa7/ezSC6vUyD/aqgrvWx6q8wyux:N0/ezSC6vUzPvMHjyq
TLSH
T125552A15F6788377D0B3D0B9C5D66A9AFE3234864B3089DB0246836C3E277E58A35739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.0MB
SHA256 0bcecd23d96daf7f5e98efa6c9b0d8b9980be0a6e7e4b5e0a05a8fcdc728c5dd
MD5 694b03da05cc8cb8253f4ddb7679ed08
SHA1 41553c16de2ed395cc5472b99887e9d575fd7317
SHA512 ec3dae792968a6b8d8c45e3eb2fb74b031a648876d6c1c0e1deec870efe49f2ee4f5100c43ffc18be9ea3704ead8021880bf23abe5141e5724025b3fab4b5068
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7soVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0ImP:E93gTzVbqPb88hv/l+7Y
TLSH
T14E354B26F6648275D073C0B9C5D2969AEE3234464B31CACF0389876D2F677E5CA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE8B2.tmp

Path C:\Program Files\7-Zip\RCXE8B2.tmp
Size 377KB
SHA256 a821fad8294fa2493acdaf2434779c0c83d9c1cad48c1a115ae0c2b0bb2b2262
MD5 fb5b1e818d194d383e5998c09888db54
SHA1 6bc668c3e852254689438df1fe4934977bcdffb2
SHA512 c6bd2c356ddbf97d95224a467ca10c75f8d6ce7640da02c1e880e6fd92f272996e9dd62bc5e744c67018c4958738a3655aa34b2acd003422e2922c8a97a5347d
SSDEEP 6144:p+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarw:pYCDi50NiQDuysMFZzN/E/msup7s
TLSH
T1A4847C06F75408F9D59BC57489924546DA39BC8F0B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 390KB
SHA256 8e24c21ba4ae2350bad7698fae7a675dea5e1dc6cddfe0e0f931595639731852
MD5 f4481ae6ff432857de33669a7f67660c
SHA1 dd0be65853215145f68feaa3915ec0f5f609652c
SHA512 3f4dc5ecd727d36290fa6b3a852dbcaace5a93d763379bd66c2875caf937caca6b6bcb45985709ccace5c191709850ddb940c135b4558a4cbfdc7f8fe26b182a
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarwZa7H:jYCDi50NiQDuysMFZzN/E/msup7s2aH
TLSH
T1A1848C06F75408F9E5ABC57489A64646DA35BC8A0B71EEDF07D8422A2F337F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 657KB
SHA256 8f17376eaaf5fa7c8b7d14e68855eac1916ad2060763b00c5983c44f43653cf8
MD5 2bddb37a5a57efdccda9e0e5bc7bb508
SHA1 814edf7db8475242a37f4493c7cb0af9d5044dbd
SHA512 5a883dcc352a34b190d9b1b9f00fe9c4ce88383bca989875d6c9a5ed323508d202c791309962efaf808adb94cdb492a56ec3b7fe09a4c365c44bedceeecf3a79
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7sneBNUbTVO86U+:E93gTAJIU+
TLSH
T1A7E47E27FF24ACF5C57B897886928641DB3678650F21E7CFD2A4831E5F236E04E39A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 423KB
SHA256 93d1cf233914cfafc16714cf2205c3257c4941b03c209a1c2c4b0a454831b40b
MD5 d41e83b41cf2705b0abc34bdd913d9dc
SHA1 438801bea1916b0c6b28ae04563ec83d796bcd28
SHA512 2685ae9da01847a79dcae60ba90cb81464dc07f50ca3685fa73822c4cd44aa2f082e271439fe84db96e929e8657fe1d38bb6bb26aef66011d2e701df90e5f2ab
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarwKcr0X9:jYCDi50NiQDuysMFZzN/E/msup7sFP
TLSH
T12E948E06F79408F9D5ABC574C9A245469E39BCCB1B31EADF17C8422A2F237E08E39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.5MB
SHA256 7b830961d37fbe288b0cb9b09ec84bbd18b0dbf68c5f58a99f47d9c990bf185a
MD5 f6f4393540bdf95f2a0654b5faa83728
SHA1 e11e41d993db1462784b330c8e3ff2703c5e8f5e
SHA512 e1cc1365fb9747ce64aa3076bde78f99bb90fc637904156e37e9eddbd724b4def3fc998597742e4dcc87eea64ab1bce37600e9cbfc651a7e77e94a5278364ff5
SSDEEP 49152:N7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tr:pQvGAdlCEL8c/bRNw5C6
TLSH
T177266C65ABF880F5E0A7D178C97A86B2F77678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 734KB
SHA256 24a8a80ec9517f717179ad923587e572d40e60dc6d378d599341d32c2fa0987e
MD5 86761f5caa30fa01c86fdee79cc48f38
SHA1 e1c66ffd7df881576101dd0deffe820a0c313256
SHA512 50bb0c485f96c27294bacf129cd1d97c700a082b7c1ff6078b7196043ee2abddacbc465745c2fbb7a6815e57abe9c6b0444f4a773d6016162cb2070c8cbf130d
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7soAwSfxL/2Dc3jDLLmt0LDQewsAjRs:E93gTEaewsAja
TLSH
T1C3F4AE21FB74C479C6BB49B04B628706993D78910F616ACFE3E84A5E1E313E05F39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.8MB
SHA256 74944314f4090f6eb44b051d698ce3e7b550ae250d7d34e262ec867fb5988179
MD5 48ee8ccd0658b43d2fa4ad3ac673dd69
SHA1 5a0f8e678947a09cf17cd373c84e560d326000e3
SHA512 3569c9f4418dc1dbfda07f5ce039d878b57e36b72c2a9b33e5e438922dbba570e167aa6dc2ff2fcb6deae9f0a580c546284549d7399ca4606d99b7c27fc4d159
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJH2:HUEtQevvqc2W1cpV2XI322
TLSH
T18D474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.5MB
SHA256 0efa1f17871af4ce5796c5629c0cde0f3d6674c5d80a8840d2a02b506bc246a1
MD5 bbea106852dea6d46f7440face8db2a3
SHA1 cb3172726cb8a64bb32e8564b3e82d4e6a058ba6
SHA512 95cda0b1e883cec9be8d92ec4ac910f4daef7b453fde4c99a24ea732811bbb4e870d8c582283a21bba125ebcc4f801bab506b9085e0ace27e0031eea561b3a28
SSDEEP 24576:E93gTECbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344P:N4CbRquA/m2yL5zbfFiV+XenmE3/z4
TLSH
T187C55D19B7A881E4D1F6C77886A2C647F37178154B31ABEF4255461E2E33BE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 472KB
SHA256 24adce18a6ebb002cd28f7cbb6bada828b067ceb96495ad3f679f364aa0a6ed3
MD5 0cd24c8456ffa17a8bf5631c00442fc6
SHA1 46518aa7724f98b55337684ee0ca6e8f6a261991
SHA512 761f8637bacba8ea4ff38488e5bbd6246d265cec7fbc79369ad98e3d094ea58b8e9e17478aee9dcc3254e5e79a95d6cb29fd98d27ac086fbc65f06c859ee7361
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7s2rZ1Iym:E93gTPZuX
TLSH
T1ACA49D06F79414F9D5A7C178C9A24646DB35789B1B32EBDF0798422A2F33BE04E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.4MB
SHA256 1e2e08bbc673636adaac6b81e0bc69a0a0939691f6768ebc83b7184edb344920
MD5 927a927d3d56416288b24fb14e158799
SHA1 c372b9c5e679e5f1a51953ceff912899ff844c6f
SHA512 56d0e08d9db94802f0388bdc283b2a75e113617e09bd65ad055234c85e74142e5ea95101076e9c7f7d82f3166fed864e78731686f08924d4b6206753e36abe84
SSDEEP 49152:Nmj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd23v:DQRQyi36YOcP+Lvw2gAf+PN3Y
TLSH
T1DD666B13F3A501E8E05ED974CF3956229B357C4A8BB092EF259436E11E72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.1MB
SHA256 498e396d733c631dce881d71805b77db8712b198f91c61029450c1733052a077
MD5 10af67d1d8499db08980fa849c647cc6
SHA1 241226a8b82827145edf514329b8dc35428d6fa9
SHA512 eba459d6508d4ced9ce78706d02b2e33e0a2f1ad97c3d99d0976dad8ff6d6a38fda1527df158b18caf4b737f0a6bb3404e3c1108e56ddefe48ff31ffdf83e8ad
SSDEEP 24576:E93gT8wvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL0V:N+68Qg55nhoeWu7PNU3/w
TLSH
T1CCA53933B2F200A9C44ED1769F46472196E17C768FE0E7DB824573161FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 6.9MB
SHA256 ceee5e7abd2562477b7fca3bc67d136340c10ef726e59414f53490568a23c927
MD5 7938a2a45b5b21a92f29b5a747ebdc5f
SHA1 ef3d38892ea9a179e48ee2b6b00c7a2fb7d6d785
SHA512 2469c5f2d3ff195865c6caeef2ec04cc4b6d669299b421009b0b91db2d08388f092602da46101d949e785531e9d1ae704dfecd9eec91e810ea4547aa6cc61bf6
SSDEEP 98304:Vy5112gYy5azzVvf69nLKnhZiy5112gYy5azzVvf69nLKnhZO:4LIHuWhFLIHuWh8
TLSH
T197765A13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.0MB
SHA256 0215601c035217e446a71a81b5869305ca5b0133c98712adaea83a7f24fdea09
MD5 290b73e110fc12f5d0ec4873ab4c6de5
SHA1 f94fb08d2914fcb472b44048af74885e71b6b8e9
SHA512 2654ae2212123d3d64f4acaeb8d18b184542f42ca52adcff0dac20c9b4404b342dc0cc31dd95f107cf997bc5497cfad1e89e40af4fe3e961e6e0a434897ed345
SSDEEP 24576:E93gTthv8E1hps0+ogd2z615uCMVF1Agz6hUQ1zNOgLLwH7ReaQXx3q:N71hpsNoJpF1A6GU44CwH7R4xa
TLSH
T1BDA58D13F29900E8D06EC17887569622EA72BC4A0B31B6DF0A94B7961F77BE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.2MB
SHA256 f0a0150cf3dc2f19c005b5fd37fbc1746d9708e2c32105fe18bf981156f88415
MD5 79a92aefca7f14a252de019414b1188a
SHA1 44425fb70c812d55804f959eaf969de50f2e7468
SHA512 feb8add8ff4f0abaf65dec17de789b39b6dfd136c81651b8b514194fee8302efca47af2378ce24e35d9aa7fde4c20b4b9a5abf99b3a56e780f08f2f74840d22b
SSDEEP 24576:E93gTG4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6bR04FxGgVG2Onks6xt4bSMHnqO:N+SuZQIY0Be2K8RVtOnks6NMHqO
TLSH
T177B58D03F2E900E8E0BED67487665626EA72BC464B34A6DF068072591E77FE05F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.4MB
SHA256 39446279834b2f9739a14e320537f3e42a28352414856f5809763c038ad58636
MD5 b27450f896d21ab24d3734c336622c03
SHA1 3a5a4d29646aa416f773cdb9578cf1bc4c7ab220
SHA512 04cd9be1eb9c290092dea07f947ec59025ab801c449472befef8d5e14f265cadd9c78c9ac262e2a1404e1081578fe3ce28280e18e143258903ce740227fb640b
SSDEEP 49152:N7yLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AD:Em7vj1BDlZS
TLSH
T1C1F59D13F2D940E9D05AC07887569232EA72BC494B31A6DF0690BB562F77FE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 751KB
SHA256 834700ca55121ff240642115d74ec097338a621106c7f00d8089831b5286eb9f
MD5 e0d13234e8a62ced55caa5831c2aab9f
SHA1 ffa21b882c4a7108f9fd180a504637eafc909595
SHA512 b1c38b102e1850f1c55767e93da456a80877f01bb6199b76ba99358c305358a1e1f2668f1a9354c0965c21501667e1a10686d4c8515e7b6375c6c386d2f5afab
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7s0YCDi50NiQDuysMFZzN/E/msup7sU:E93gTi93gT1
TLSH
T17BF47C16F75408FDD59BC57489924646DA35BC8E0B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 399KB
SHA256 c53faf60310bddd043de304040ba80248d889b3c9a0b27ea7c3d540b8c61fc26
MD5 2b0db6dc96dfbae5e8c32045272dce36
SHA1 d4c2184aa4670dfbe0078b653846f29aeb96d00a
SHA512 ef5f9e9d9a283b67315d6c1b86bb2012c7045fb74beae6b63202a67e968baada6e369624af7236851a5b6f0770a79b347c36b46f30637b655a69433baa130cb5
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarwvev:jYCDi50NiQDuysMFZzN/E/msup7sJv
TLSH
T183948C06F79408FDD59BC57489A24646DA39BC8F0B72EADF17C8422A2F237E04E39754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 37KB
SHA256 ea52a66e85c79d8b487ce7ffce719abb2c6de37ca43ed1c7a52eff5092ad45e5
MD5 5131fbe783fe08a8a7d08e6fcdd14545
SHA1 4fb5846acc755ddd877d8e802cafefa38363845b
SHA512 4bc394650a6a14e5c737c3283791483b1d20902718cb1ef2c91ecce2fc93a7ef6056b876e4869d94b9b79cdd93fd263a78a1b5020ec318e5d23828c52fec6ec8
SSDEEP 768:/3Vl/3/F9MfA3Vl/3/F9MfezYijPxWEvZWF:PV1MfEV1MfU7jPxTWF
TLSH
T152037D06DDB508A7F6064670E8E6028AD9797E57BBC283DF332C81142F617813B696FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 399KB
SHA256 19457fc3291961408f7cca69a6b7b37fc79e09610d09fc47cfeb87f5c4318c44
MD5 a1cfaebceb5853def28c8e0d665b033a
SHA1 f58ff529486ab8b5bc1887a640712ad6fbcb4036
SHA512 26fada9573b5cd556b2c629c628b5c4b389cc84bf04914d39bb24569f52e4b3535b6c5caec9edf49e0f1d62b21a86f69ffc63b85f4dae966867b3376268488c3
SSDEEP 6144:QApAS0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarwuAu:NyQDi50NiQDuysMFZzN/E/msup7s8u
TLSH
T15E949E15FBA408F9E49B867488A24646DA36BC8B1F61D7DF23DC421A1F337D08E39764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 840KB
SHA256 5acc8734e0d0d7414f3b2cee891dcbec4d548e226e91b9b44d823fad6968082f
MD5 8d061886902f46df19f51ea22f5f933a
SHA1 ad6a0480ef3a3b953ffa949d033c59d09ad2229a
SHA512 9608c72dc25a3eb1573d935b4f4970c4f49bc907530f99e5f7301a38052bcc70eb27970e0202db415274c91498b2a23a13891a28853e47791e486b3839895e22
SSDEEP 12288:4/E/msup7s0YCDi50NiQDuysMFZzN/E/msupfbbdIvI:Qi93gTFJ
TLSH
T16E058E51F7D408E8E4B78A7489B646519E3A7C9E1B32DA9F22CC521A1F337D08E34F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 8.2MB
SHA256 be91e5c3e066fb2ff9b65eeefdb54ffc4a006a3ccff8c48defd9de6520631884
MD5 531bb90cb6f90958d476aa6143dfa433
SHA1 acca94e1884927a199761aaa918ed359beb41f8f
SHA512 714862fc92e3ff1baa9b86c8bc5173ae1c239487ae5ced547c1ba5ed02c2935be82ccaf09f438b06df128c7176f0c570865ea5d56d51a19fbd67d1c290344a76
SSDEEP 98304:LQvGAdlCEL8c/bRNw5CaQvGAdlCEL8c/bRNw5CO:EvyEYc/b3w87vyEYc/b3w8O
TLSH
T183865B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate32.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
Size 359KB
SHA256 6f2bf0a1658e95f1fe807395aa9fe46d7db805b063221331a7b5e3a28f1813af
MD5 6307d4ed228227924bf4d8738c79f33a
SHA1 6d5406ad7d3c0f1d66e086aea2b0d4d5ebafb6de
SHA512 89f913c63ff6397ff3233eccfd659b137d4bff3153d8aaee413551349a3d8fc4282fb5284235e9e5f867f4bbaba5137e5aec0a035e94f1c51a8b141cd7fd736d
SSDEEP 6144:v80N2vAE+Bmmt0fSoD7KG4iGJw80N2vAE+Bmmt0fSoD7KG4iGmN:v80N2YSmt0LDH4I80N2YSmt0LDH40
TLSH
T188741A76EDBAE537D3BF0DB42FF0D7544829A9214B8221D3E2B8879E0550AE11372D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 200B
SHA256 37b452ed84f4777ebb5a6130a6dd6e791729d1b5d5071244ee0dfa40493c408e
MD5 b04071df851d97459160ae607e6d1934
SHA1 19eeac9fafbf7d6817e9a7ffbcea128d9a63ec86
SHA512 2348c2fdbc9d27b33e25d851ce2149da618ca3a54c55c3a7f7e95d051315ab7c8db39570bbd678c1b39d6bdf3f9a136b4d9710737e87805b6b47455bc9f15ff1
TLSH
T17BD0A91A9A115101BAA80185944AABB6EA5AA08BA7AFA44A4A5D002813F2BA60032604
MD5 SHA1 SHA512 TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 12.5MB
SHA256 d68fd62b167095dd2593f42ebacc1c0475f7b6fb5ccbe488ed07dd1dbc5bb58d
MD5 7ebabb2b646ac75b2dbd6bf3c5596df5
SHA1 8b8db7cec5f4d75468edd460774a21b189f496f1
SHA512 43d00ce86f69fcc7e16b4e15a11dd366a0882f88684d51201fdcc6b87c2f496bb10722e3737490881aca9822cc36faf202db26af1b30d9100659a7f0a6b9d3dc
SSDEEP 98304:QcHK9eW+Lj9ECNzvzHjVcHK9eW+Lj9ECNzvzHjR:nq9ehEC5HGq9ehEC5HV
TLSH
T1ACD65A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
Size 375KB
SHA256 5b841904773d032a39256e2ff933b325d66c2441b76297f335a0df52ddbf56f4
MD5 8d33aec13eb979a475421522ce7148c6
SHA1 e71182ad292a119adfc5ad70e47371c71eed9e3d
SHA512 9a5c69f3707ecfe663a2df46c93b2173e4755f4b68bcf8549a35a74b6e65e3616d4883cd9735f15b1a2873414861fd7e98f3a00f41e602b8c1a7be8927c662b5
SSDEEP 6144:UT4DtEtUjD5hLT4DtOUjD5FGv9oU5DOY7y4j9KJtbSiqNsarwR:UT3tUjD5hLTDUjD5F69oU5DO69KJp7sU
TLSH
T1B6846D01FBA08DD6E4B34A305C7697665F36BC6A5FA1DB0B3388720D9D72380DD25B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 899KB
SHA256 5b8128005018765083ab25fd3881837ba883e57f6181a2759ac0537600cad391
MD5 e26239b6b0ffb5d9418e63422ddd33e5
SHA1 a582e043b2dc40248b9f4354c4e3c124d1f5f5d5
SHA512 dbeb5b81b623a9001947544b61f14707124cf2375afcb6ca99102bd690d5fce2869cfbc18f5646963dcefdffdf49ad30c2a5a9082ada98e70a4e099583fe67fc
SSDEEP 12288:6pecLWREJYqOzwb7AcE2ZeGKSpdGy+JcpecLWREJYqOzwb7AcE2ZeGKSOJAdGyr:gecLWREJYQB3R+JmecLWREJYQBGJ+Rr
TLSH
T129158E29F3900DF8F82BA274C9A28511E673FC554760A6EB23A4D6253F332D45A3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 519KB
SHA256 76d46340ff6393006e13744c96f4c2f31d752bfec723e850093fa318b4e15527
MD5 516c25c33258bc61d02d15576c7b2dbd
SHA1 469fecc3cd5e9bac6cb7316ab48df954ec04db6a
SHA512 eff22e97bfd85e49f53b7fe1a758b6dd0591b656b4495880bfde0ff20027b77014c1b46e6d5cd4a169d61bbbd4be8718f771b76cef2ba5f21c878f5afd33b94e
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msup7syXsf3n:E93gTw3
TLSH
T15AB43806E75404E8D4AE8174CB924646BA377C9A47E1AADF17C4E23E1F326E04EF9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 432KB
SHA256 545b668baf2e00594f4992c5b19432a1196924fd655d6b626f0c83cccef32e0f
MD5 89f7feac536673941b2b82042835fd31
SHA1 a46c19327eec65d3b377c054b7dab502534b28f1
SHA512 882899e7567d45bd9fea29f44cb80450cacc0cc0d6a29d31ffac63fea2cd228fb04a1d2f5ce9c52af6692cf1ac06d6b46ff31d37789a17d2eb66d7d53793458c
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarweJB:jYCDi50NiQDuysMFZzN/E/msup7s5f
TLSH
T181948D06F79408FDD59BC174C9924646EE35B88B1B71EADF17D8422A2F237E08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm...exe
Size 2.2MB
SHA256 5c82727dde6bf0144ecd3afd5f48e46aa798eb906acdb0d8dfb71331616aa24b
MD5 79610edaf46844a956991532a0f27b88
SHA1 9bf58d3d4e8abff0c1c3617414df2d1fe14908a2
SHA512 2818b46a3f86cc7ecc46dee6a06e937219be4229b8270c4fe0d3674f023426234a8783b3414f7c2e0e0f8701d2ad907bc81efde2234f498d3a2b7f8429cbdbae
SSDEEP 49152:UtbIwL5D4Jc+b01tnAyB63TANQnME+6Te8wTv:GkPbiHd6Z0
TLSH
T15BB53A07B3F941ACF0AAE2B8D73156329EB2BC53CB34A5DF125416151E71AE05B38B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_059b51d7d5d740271f1d8d6695959a90_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
Size 2.6MB
SHA256 d3b9df94224af7f31798039e718a04ce530e57b7cff4b5fb4936392d869fa934
MD5 42421eac150afd74eb1f7305301f218b
SHA1 f66fffdd162667168368c4a1fb4b8aa3fd6c894a
SHA512 845e389026a8f68258de41ebbbc84cd48f92673de1803454a54b5ca226eb3c1f5876279ffdb093bf3c01cfcce175f366a269e311e44d1bf3c81c11359341a9c5
SSDEEP 49152:DHtbIwL5D4Jc+b01tnAyB63TANQnME+6Te8wTv:5kPbiHd6Z0
TLSH
T102C54A07F3F941ECF0AAE2B8D73156229EB2BC568B30A9DF135416151E71AE05F38762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

024404898967.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\024404898967.ico
Size 1KB
SHA256 b15cc5b7b654156b96c718da8c6a5402aa2d7afab332ec98038ce8a6b6efd052
MD5 eacc2d68b6aac8c25d01a76fd292ebf8
SHA1 90bae45731dd564088bf7fce380e39266bea02b4
SHA512 ad8760c2c91c46238f9b80f85074ae3574bfe7bdb0d2b9ac85e94349e82d5d70f2adc6762beb07d0747794a571febd96bf5e08ea9b3bc44bcd789e0d0043c3a2
TLSH
T18B21A459BA5CD77BC0653330D5170BF529709D01D86D472FB7053E8AF8B4A0409D9994
MD5 SHA1 SHA512 TLSH

Submit Download

031161894990.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\031161894990.ico
Size 1KB
SHA256 18749bf7cbeaf430807c30dca88b7b7514a65e8c5170f1bcabb548f375e493fe
MD5 fab1ec8207037349470a004224fff883
SHA1 ce82654b651ddbeca904c5fd4128c2d229bd34e7
SHA512 1987032071bc2afd3802a59559b52a3a39ea12a729b1f8d97cf2893504242159a66da80e20f0ccf9176f337d890322f6ebec1c6212ce2058778721c9a3144491
TLSH
T1D8216BC0659093DBDC239A7610D4C5520A7DAFF645BD2AD0B8877B3AEDFD2282621097
MD5 SHA1 SHA512 TLSH

Submit Download

079854262021.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\079854262021.ico
Size 1KB
SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
MD5 81e2b09e1f33b8c702aed3d14d341a13
SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
TLSH
T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
MD5 SHA1 SHA512 TLSH

Submit Download

097416955883.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\097416955883.ico
Size 1KB
SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
MD5 1af3523517c4a23a831af16191e71ba5
SHA1 34674885738a8717def95b016697802778f0d520
SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
TLSH
T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
MD5 SHA1 SHA512 TLSH

Submit Download

246617840262.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\246617840262.ico
Size 1KB
SHA256 5d0ddd51604345a2d39f5008290607d8af6bfd8d17c1f4eb914b8cc0d2953da4
MD5 bf77863d8fa394812b0d6b5a0c3afc27
SHA1 40d18e72feec018cc90cc5cf9238314449cdb966
SHA512 6b70306850d6d591c12bd20e62e0e90a9dd33e61a4e33fbc249fd3b197f1147132c3fe03a67100cb8e325392afea8d99a41651d3a97cc89f580b1c1257de5ed3
TLSH
T14321CE46B21267A6FC10AE7345E67F29204E76467890411EE90F15365E287F85AF6306
MD5 SHA1 SHA512 TLSH

Submit Download

289954718112.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\289954718112.ico
Size 1KB
SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
MD5 cb4265d1bed8a3606c50c3ace6452c94
SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
TLSH
T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
MD5 SHA1 SHA512 TLSH

Submit Download

306857439611.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\306857439611.ico
Size 1KB
SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
MD5 bdc7cdea596ddc3d6542f6eae40a3509
SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
TLSH
T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
MD5 SHA1 SHA512 TLSH

Submit Download

323040586423.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\323040586423.ico
Size 1KB
SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
MD5 6ed58acd10d2c394c7638d5e4d4e4d04
SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
TLSH
T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
MD5 SHA1 SHA512 TLSH

Submit Download

356939551434.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\356939551434.ico
Size 1KB
SHA256 99143e3c977916ae0bffcd76fb770cce778f63459bf49ab42b639bb4da8555c6
MD5 1242320e51856e417a3b897993ed3862
SHA1 1a8e37c65a34144d55e135dbe5c80f1d3cb54995
SHA512 7e362214be096890c16bb2d19ad6119d8e441b25995221a02e10a9a7bb62b83f10f3df8b5e20444ee2c068fca8153097f12d098f15f71ca550121a6642e5f425
TLSH
T14D2112C4FF993060D8D9F735F395AA0A5766F2C298A40684105DFC69BCB84247847E39
MD5 SHA1 SHA512 TLSH

Submit Download

368467225951.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\368467225951.ico
Size 1KB
SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
MD5 4a3be9e27a938152348d20edbc4c08ee
SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
TLSH
T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
MD5 SHA1 SHA512 TLSH

Submit Download

389111310058.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\389111310058.ico
Size 1KB
SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
MD5 d91c5d1ab9c7e29648ace11bcb875f98
SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
TLSH
T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
MD5 SHA1 SHA512 TLSH

Submit Download

428250955756.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\428250955756.ico
Size 1KB
SHA256 9a6584c0e0a8cf98d3d7bd968a9ae54141256e454f1d7dabbc1e59b02be3f016
MD5 88c3118c4f877d50855cd23644fef184
SHA1 4a05378db5fc432be7587da1e25e8f7e73e548ee
SHA512 71a681b3a2db9a80059ecb41be03fdab98e1a831ca920cd9a5e05f1aaf6fab709dbcb70ac2c0f1e7705f72bae5d43acf0d7013a6de5ad3bc7c47498e90b0ff2d
TLSH
T1CC21CE07D5D408A0E663F93A2489E4E747346DADACB21B6636DD2017267C93FCA035E8
MD5 SHA1 SHA512 TLSH

Submit Download

453370064693.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\453370064693.ico
Size 62B
SHA256 f0cabbb3b1c107a8c455b233d6f6f9e2597ed2b35f52d438152314eb2c9f85db
MD5 6f73694b41567963c8e86b9de78778a2
SHA1 8effabe5dc88ebdf672765a42d7e269836db7ab7
SHA512 81e155b322af7b91e7bf45d1b1f792615c87d5a7e4b80a0729a94e95abfe77f882349fbcaf0c7cc6c49ae8a3d1a2785f391b823fb22b3a36e6b12a80e6efcd44
MD5 SHA1 SHA512

Submit Download

506418460174.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\506418460174.ico
Size 1KB
SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
MD5 3d272e20bb157f11d4ae75abc33aef1a
SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
TLSH
T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
MD5 SHA1 SHA512 TLSH

Submit Download

557008727394.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\557008727394.ico
Size 62B
SHA256 2ab662eae228f6451f07fbb7b8e91711caa3309540bd7eb4d9cf2dc6904ba08d
MD5 d78899ea3032dc5fcbb8d97c915537a4
SHA1 8bb1ba75d291cae9704a2b6ea67fad30476ee73e
SHA512 96a7d7354910fc1df6ddc04e7ff79af177df397b6fbc2fa52348ea3d0eaed5a3fca9458563321046b0f101a42573bd57f42fa09ecb36c021f5766779b8e85825
MD5 SHA1 SHA512

Submit Download

580000735328.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\580000735328.ico
Size 1KB
SHA256 1c413336445e2b6d1de737844f2a298eb8eed23eb6a0671cefeb15caeb8eaef9
MD5 b6045946e2c0f888d84de0df859c0c16
SHA1 cadc6a9281b18084c29ab4ef552ac382fe3c5ddd
SHA512 9ca39d615c37a455fb43c0d6aa9210c10b341bcd685bc053965022cc4cf9de0f03737d0f9d0c894ea526f3537b87769e59245fc259f976473c029fe49fbfc8ab
TLSH
T13021898DFC4945CBFC9207B0B87E2C9655749C029F6C982A01A178878C30215C362E4F
MD5 SHA1 SHA512 TLSH

Submit Download

681407631339.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\681407631339.ico
Size 1KB
SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
SHA1 13470460552d9f4c465130d654b2095316b22854
SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
TLSH
T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
MD5 SHA1 SHA512 TLSH

Submit Download

686140881745.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\686140881745.ico
Size 1KB
SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
MD5 aea8653be6803940e5f5017482ed8f31
SHA1 83d770a087be76863aca353d9e394c29b126874a
SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
TLSH
T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
MD5 SHA1 SHA512 TLSH

Submit Download

716767928467.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\716767928467.ico
Size 1KB
SHA256 a742238dacdff4363a430dacedb364ff073cd4c1f1799badcc88f3b681d565ca
MD5 5ffda0c41775e66798bfda13857ae248
SHA1 bb3cdc63843e60b3684185fbdb9db5d7bdba2665
SHA512 5818090b0188ce2f6b8f07598112eb838f5f320bbe364ebaecdbb208354c68c30b2a9bcfd32611b137b162d1c3af19f71977c2564ef91d7816533b3aa04f535e
TLSH
T12721F583B780C9C8D510C7774356D86D4A17F4E59056124B28D678235FCB269302A6AF
MD5 SHA1 SHA512 TLSH

Submit Download

876063100703.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\876063100703.ico
Size 1KB
SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
SHA1 0a18f23ef372593dee476bb852745b2490bc8421
SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
TLSH
T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
MD5 SHA1 SHA512 TLSH

Submit Download

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 b5265ebf73fedc1d0333fd4f72c7021eef1cd8b948b4e41969cdb2a3ef6bd35d
MD5 83e0bdc6f86ef6d0c1d991f2b737ed19
SHA1 52677f99fc860a5b9f2b29f3e536ff2ba168101f
SHA512 4c298729be4e77edd165a5c52be40f022763a479777be1ae55809c8158649f3159c6369649e5407140b7dc9b111b8cc67c611fdedb0990b2d9f1c083068b6f11
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpbExJO1EA+Bdd:QE/msHasdDOFHbAMbExJO1Ebdd
TLSH
T1E6536C18BBE60125E5BF6FB158F53266DB39F6635903D62F28C602871A23E85CD006FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shost.exe

Path C:\Users\Admin\Documents\diagnostics\shost.exe
Size 375KB
SHA256 24a216490911265845433c41ccbeb223355b16f48901c382030f0ebaa78084e3
MD5 58885b313185d39c8e90092f22192b87
SHA1 d02effcc9ed906e16a651ad9c446c3f655052e85
SHA512 7bd8bb41fd6b30667dc0ddc14f051bded5e5dcff794a5a3a2645d6afd26452c12e5253719b9532bd28edd242f9486642b27d44d1a59c4943bcf29ce5e3c728af
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarw:jYCDi50NiQDuysMFZzN/E/msup7s
TLSH
T1A5847C16F75408FDD59BC57489A24546DA35BC8E0B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 939B
SHA256 0ee7a002848154914d85086a16461edaf01dbcf1e44afea512af3d81981f5b44
MD5 9d24a36d64574a7b3842bf57a47a5750
SHA1 b639479141123775dc18f069e358075eccf7a85c
SHA512 3f6d82a5f990fb36eda39b5523e1bd2f470608e8a57996007826399a39d6b7e7dfea2fb2b640fceb2a46de03dc78929d56a30c9178e620204f6ef2601049c440
TLSH
T16311E620F550D0447127305027207D023699DD9AAB4D65B9978CB39EE84EECE8BDF8F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 1KB
SHA256 c1f8ccb84f83c1cd0a0d177daf5f423a649c4b04eaf9f58779574c3a7192be08
MD5 f1246027c3a8d6fb0906ed7ce63b06bf
SHA1 e93e2953da4302d67b26a1d56d5ba34d1e6ec5c5
SHA512 41ff5aff7c22f874a13dcb518c7c8b5431121b1c85b2b71ad36f26441622872ffe94fd4fd01a4d7be7ab6d7933974dd713ee556e7893ba29b267b5a7729014cc
TLSH
T10821F520F560D0447127305027607D02329DDD9AAB4A95BD938DB39EE44EECE8BCF9F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 2KB
SHA256 c0b7dee3b2fa3f84e027ae4b83d5970b1d60b22667fbf0ebf2d36ba2e26b570c
MD5 5497cd62e4db5ac503b82309beb323c4
SHA1 56978a85c302333b520e88c7fbc96a03c309ae41
SHA512 6bdf6fe19d7b65cc82923ed516bdc2c031a1cbf0f1292864906a1ce1d300a5825b86ea3e6b4507a9a460fa839b3505a61fc46ef0a59e8b35518747761852ecbe
TLSH
T1CD51D221FA50C18A7233315427217A02319DCD9B6B05D0A897CDB78EE449EDEDB8A5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 846626ba17a5254cf6fc97096aace28928d5f9abd167a5dffcde9a6cec7f5677
MD5 a23001d9860497ec426e879e57c60259
SHA1 40669e52e7cdcd84ccbe9e29a8fff68be758c0a3
SHA512 e10f353bcc0ee897f6668b0bca816e9b143ef5a7fc0f7850c654f0ed1e1f624d04e01e1497b2273cdb25e1f7e74467829d4c13d811f445105fd867bccbc1d296
TLSH
T152611761FA94C1897233315427227A01359ECD8E6F49C0A957CDB78EA08DEDD8F8E5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 fe6c9faf780a08b20a35dd4b8e63855afb14ba5bac9e2fe288e656d18f19598f
MD5 7dd717de974fef72edff38eca18bd612
SHA1 377392e88db18ca710de7e9bd684c5101fff5608
SHA512 0362b5f6410b5269949e1da412a3ae377d0b9e5de4efaba1826a114b59496bb449554bfce287d32dbdcc463ecbb3643f4fdb2cbddec23b15d5b9fabc38fd2642
TLSH
T17F712861FA94C0C97233315427227A01359ECD8E6F49C0A957CDA78EA08DEDD8F8E5F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 a673abe98ceaa93833653e6fda373dd1bbeb9f0019eef4fc80522667faa7874f
MD5 67bda77b17d72444e3b23f7ddea9cb54
SHA1 15102b5a2130accaf51a7f8472ef5690cd646d2f
SHA512 ddc2284d8e21e453182be20394e2fd8e85da3ed2d5671814896d60d88428aa3713a070bccf8c7eceff09a05ab7e1f9abbf9fe4d059cde06bbd5b63873a34ff18
TLSH
T197713A61FA94C0C97233715427227A01359ECD8E6F49C0A957CDA78EA08DEDD8F8E5F1
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 104f9985e076da6027e46810a04e2313a3876ae89df0e5a84bcb3f6499e5a80f
MD5 efbf8f98393226fbf8697426f79f9a5e
SHA1 61f408c73ebd1af1a9f5a4cd753ba3b592086fdc
SHA512 4fd515561c874c31496d0becc034cd79285a84bc078fec4060d0ac579067894ff3674a110a1886f60c96b9f6091d3fed285b85d5ce83fe40e183475e31283a67
TLSH
T1B1814962FA91C0C97233715527227A01355ECD8EAF49C0A957CDA78AA0CCEDD8B8A5F1
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 10KB
SHA256 d1b75931ae3a76af1751675f1fddd1c79852d23a1e5c127664b38c1cd93c89b3
MD5 96fb1be7605a35a7ec167e1ae86970aa
SHA1 b4bf6460caaafc2db493916722e8cd9bcde8ceab
SHA512 0a18cbfa9ab7eadeb398f300813b5a46b576f90777e774805c0a95e4839a07c0493d5d1b40575ed429df1a759e83f2ce73618d2e449a058f50d44c575ed63754
SSDEEP 96:2mW5WFWrWdWAWPprW2W3FW3oW3FW3oZ8ZpRU8oZ8ZpRxPmPdYGYm5MPm4vYTSrOs:2t+Gdna59OLP6I4/kMo3nK
TLSH
T13C22C8B1DC45C695721232942F11390113AF8C897B4D80AEE38C87CBECD9A959F5BEF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 9KB
SHA256 393ef821db9f686caadbe3f1fd40be1d1b488f4e9c23a001044e1ffb36c94096
MD5 e74ef3ba1760ee186c2eda9791a89bab
SHA1 18c396560d373c5830dff867d58c22ef33750a2a
SHA512 2dcfdfde9f25efe604bec1ca8f6aa355c17953032455bc81ba1945aecab6c6adceb83380c757ecd1e49886d475e45ebae246472d287d98b3c4b99b4368fd9998
SSDEEP 96:2mW5WFWrWdWAWPprW2W3FW3oW3FW3oZ8ZpRU8oZ8ZpRxPmPdYGYm5MPm4vYTSrO3:2t+Gdna59OLP6I4/kMo3nx
TLSH
T10412ECB1DC45C699721231442F113901276F8C897B4D80AEF38C87CBE8D9A999F5AEF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 7KB
SHA256 a4580ac8afefc9b5249927646e62b19fd021d092a8b108948a8714cc25b57a80
MD5 43e5143646494806db9202431148ede9
SHA1 c5cf2df9419098ca38d54d813d94b8e61e970b63
SHA512 289301095b6da45a8f31981b92db213c1f60204ef1ad52503d8506b3c4be877a13bc9e6f27cd530575a931eb1ab8ce4b6b6ca4e9f4cc9d737c9d50f5a5e68b0a
SSDEEP 96:2mW5WFWrWdWAWPprW2W3FW3oW3FW3oZ8ZpRU8oZ8ZpRxPmPdYGYm5MPm4vYTSrO0:2t+Gdna59OLP6I4/kw
TLSH
T189F1FBB1DC45C299721331842B113901276E8C897B4D80AEF3CC878BE8DDA999F5AEF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2020-18-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/2020-13-0x00007FFA712EF000-0x00007FFA712F0000-memory.dmp

Download

memory/2020-14-0x00000000002A0000-0x00000000002B6000-memory.dmp

Download

memory/2020-1183-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4000-297-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4000-1067-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads