Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 23:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe
- Size 26.5MB
- Sample260801-3raxcsae87
- SHA256 bf522fc868a7e0e5aa0cc8b7a18874b6cfd82a63cffdaf595ff7170fe1237ca4
- MD5 ceb4e9caea073fe38307d79d7c7a66cb
- SHA1 45f759ff0fea54799eec0d4874acd669bbead08d
- SHA512 dbbdeec3472f15d774fa291d5f782e31ff45cab793fa47865db369f3c314116a10243e361bbd9871df1b3832b4362e99befe7ecf2e75abb0fa1e61cb17940ee8
- SSDEEP 786432:kymbqVpNazr8TyE2UVjpG7pH7IDQkfOm6c:fQ6712Wwpf7c
- TLSH T19E573324FB25A8B1D5A34230496A82F6D93D39041B61E9DF27E00B3F4F352E55E36BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 4 IoCs
resource yara_rule behavioral1/files/0x0007000000024576-3.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2608-5-0x0000000000100000-0x0000000000116000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x000700000002457f-12.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x0008000000024582-56.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Executes dropped EXE 3 IoCs
pid Process 2608 audiodg.exe 556 shost.exe 460 audiodg.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: shost.exe File opened (read-only) \??\X: shost.exe File opened (read-only) \??\Z: shost.exe File opened (read-only) \??\A: shost.exe File opened (read-only) \??\B: shost.exe File opened (read-only) \??\P: shost.exe File opened (read-only) \??\W: shost.exe File opened (read-only) \??\E: shost.exe File opened (read-only) \??\G: shost.exe File opened (read-only) \??\U: shost.exe File opened (read-only) \??\Y: shost.exe File opened (read-only) \??\H: shost.exe File opened (read-only) \??\I: shost.exe File opened (read-only) \??\J: shost.exe File opened (read-only) \??\L: shost.exe File opened (read-only) \??\M: shost.exe File opened (read-only) \??\O: shost.exe File opened (read-only) \??\R: shost.exe File opened (read-only) \??\S: shost.exe File opened (read-only) \??\K: shost.exe File opened (read-only) \??\N: shost.exe File opened (read-only) \??\Q: shost.exe File opened (read-only) \??\T: shost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX8D9E.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX9120.tmp shost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe shost.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe shost.exe File opened for modification C:\Program Files\7-Zip\RCX8400.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXB023.tmp shost.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe shost.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe shost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCX9711.tmp shost.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX94F0.tmp shost.exe File opened for modification C:\Program Files\Windows Mail\RCX9F8B.tmp shost.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe shost.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX933D.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe shost.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\RCXB2B3.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB6D7.tmp shost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX92B9.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX930B.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXC446.tmp shost.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe shost.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\RCXB8CC.tmp shost.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe shost.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe shost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCXC4F7.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX8E30.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe shost.exe File opened for modification C:\Program Files\7-Zip\RCX8430.tmp shost.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe shost.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX9C5E.tmp shost.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\RCX9634.tmp shost.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe shost.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe shost.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe shost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4432 wrote to memory of 2608 4432 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe 85 PID 4432 wrote to memory of 556 4432 2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe 89 PID 556 wrote to memory of 460 556 shost.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_ceb4e9caea073fe38307d79d7c7a66cb_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
PID:460
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zG.exe
- Size 377KB
- SHA256 7b141a7e61a3a9d847a327a1df2feb78d97b3f1e58803919ca0fc50cbe81ffd3
- MD5 e3c34eec9f0eaf68c1fabb88b9b5fde4
- SHA1 554ccc4f428264df050b3817eaa31e227dcdbca4
- SHA512 2003fdafffab0e7539f3f5289d3f89f3ccbefec4ef72df2dcad25c8696d9f7222b5da978938db392a9756b0abfe41fda77bf12e7e3e4d51f80fcc021616d7d92
- SSDEEP 6144:p+GYnA0zeWsDi5eJziQ8kV3f+RysMFZzN/z/msHOtb6ih8sXrw:pYyDi5eNiQ7uysMFZzN/z/msuF37
- TLSH T1AE847C16F79408FDD4A7C574C99245869A397C8E1B72EADF17C8422A2F237F08E39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\016899988576.ico
- Size 1KB
- SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
- MD5 d91c5d1ab9c7e29648ace11bcb875f98
- SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
- SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
- TLSH T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\021459686359..exe
- Size 268KB
- SHA256 a7f1ec482233f03892d238d24504f2950d583cf580c39acb9bdcbe928066cef1
- MD5 6feb00c9a2c3ff66230658b3012bab6a
- SHA1 01503f44c6ae7866dea94b04f08aaae77e3b459d
- SHA512 e039817de40a4530ff6e91aa8ce32ad4df1db24005c50bcdcd6fc35d7bf253130ed9342061a9e24815173ff5f637a7d0e65c32a6af02d992be47335a37fb99bc
- SSDEEP 6144:m/h/WmnJztI9KFpp8uyO+376c+Rg0pYbM0+IZHkO:m/h/WmJhI9Gpx+7lZ
- TLSH T1D04407A93BA88CE1D903917948A1D3B4F373B4524F21A74F6DA1C33F5F771A0AC19A25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\024274269511..exe
- Size 574KB
- SHA256 a4f22b40651e87830c2ac8f40b9c84d94bda6fe3a54641625b600c3ce2d7d8be
- MD5 7ee79b4d6cdd2e42a3d6fd2393f5031a
- SHA1 2e506b59e6ddb94ef9277631f9ab5b9adebd0bd7
- SHA512 a29a56643845ef43a8fe9fdaa0137b03be4f0c25998155b261423a3df1d5e8719a1e87f36be12245c1f1fa48479a7bf77c19c7f6fa6980c1b06e5663135d35d8
- SSDEEP 6144:Khny2oKzHNR+VKkt4id77JRBlh2zpu00e+1+e6dM+MTYnSYXMBb3YvKnpJIggewk:KRy2NzHmVraixzzAXtWASz3Y4HIbk
- TLSH T14EC4E65BEAB952E0C4FAD0748162A677FCB1B4898C319B039691D75F1F37B60AD2E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\033419076964.ico
- Size 1KB
- SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
- MD5 1af3523517c4a23a831af16191e71ba5
- SHA1 34674885738a8717def95b016697802778f0d520
- SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
- TLSH T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\263836638939.ico
- Size 1KB
- SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
- MD5 6ed58acd10d2c394c7638d5e4d4e4d04
- SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
- SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
- TLSH T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\343568857084.ico
- Size 1KB
- SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
- MD5 bdc7cdea596ddc3d6542f6eae40a3509
- SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
- SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
- TLSH T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\393509220217..exe
- Size 3.3MB
- SHA256 be28b354497c31f2813a97217a3d61e075b03439d4d055c2ce904913de7080be
- MD5 56ac82018a550cf0c525f0c7891806f1
- SHA1 05e032e47e17dfb5dc51e275a16815985160c801
- SHA512 d93e0b15dd35743556a6f87567e883201cc5cfa066c809794df10e06988f31a068c34e4b15e6bebb2c0e3ae55541a6c516014783ed53f1153a51383399277483
- SSDEEP 49152:fd/c4qw9yAGTUsYUYhzlArlb3pvmk2rP3H8z066/OOe3nXZ4pQizEeZ6wdAyGJw:V/MJI0b3pvmk2rP3HtQAESMC
- TLSH T17CF53956FAB9C1E0C9BAD038C466A6B3F9B1B9869C3063135256D71F1F33A61ED2D310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\492340827002.ico
- Size 1KB
- SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
- MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
- SHA1 0a18f23ef372593dee476bb852745b2490bc8421
- SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
- TLSH T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\511472217373..exe
- Size 2.4MB
- SHA256 de9903082cdf397fc2f6cb24ba226a61b4cc2e402d1ffa99c37f8871be53d1ef
- MD5 6f8eac2c377c8f16d91cb5ac8b8dbf5f
- SHA1 def53a43d9549f086ca9aa1bd6bc5bd9ecd48f81
- SHA512 28902d6dce20820a4cfea49e15dda559d4949b0f181db51bb089219ca7c22e0f5427186bd08c0d331c595c0282969630832df0e3b85d1cf315230288ce6a7c0b
- SSDEEP 24576:eNPyI2m8hBvM70K4W6pjyqn6Ma7rKpOcvPuGtmRM:0ydk7axpn6MJpOcvPuGtmR
- TLSH T181B56F56B758E496C8194678CDA7C7FCA771BC51EE2187037A90FB5F3E332A0AE18250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\520353411344.exe
- Size 4.1MB
- SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
- MD5 2864c8b005a6414e2fa9b06c1e089dcc
- SHA1 3041fbd63ae570b537c38a315050c06aa566362f
- SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
- TLSH T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\521161629781.ico
- Size 1KB
- SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
- MD5 4a3be9e27a938152348d20edbc4c08ee
- SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
- SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
- TLSH T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\570632777826.ico
- Size 1KB
- SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
- MD5 aea8653be6803940e5f5017482ed8f31
- SHA1 83d770a087be76863aca353d9e394c29b126874a
- SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
- TLSH T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\600990720692.ico
- Size 1KB
- SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
- MD5 cb4265d1bed8a3606c50c3ace6452c94
- SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
- SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
- TLSH T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\611102926926..exe
- Size 109KB
- SHA256 108818ed973cfd2d73c374f6cb461639f39caf52bc28f8b7ceb7eab13d5d7b37
- MD5 edb5a5207a5eab205b99326572036d5b
- SHA1 ed941af1124f394b9384aa128da8f4674e6091d3
- SHA512 34a0c9c06d555c3579c175c7c0e2b47f1cc87d65a0127a641d4e058879fab949e874b7b054f21332de0f3386ff00483838bf221cbcbfde380b8eb465105e075d
- SSDEEP 3072:fxGqf2A2GlXUeHV62KbXPhSegdOKsbSR:fQqf2A/lXT62KbXpedsbS
- TLSH T13EB3285ABB6580F5D153A13CC4A6A2B5F3B6F8425C72574F5752C30F0F3B2A05E2AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\668382167283..exe
- Size 9.9MB
- SHA256 2892c988e54ab035646f9538f7493b0ddfe4541c358de28fb4a02fc32d8bdce0
- MD5 9e6de6715b85ad6920e1bef5a93b67ac
- SHA1 455b86f5977e5079568e1593ec057fd68c99e261
- SHA512 dc2fb39fdf5728169020a7aafbc32506e4ed53925e66c92d1017488531fef989e03db489f84fe4c6b9ebdeb6279b6c4a838b470b4b8a473b59ed3cc071a6b85a
- SSDEEP 49152:S9dka/cOOInuHWhH+9JYAwotWSgUZyHAB09ZPV2am7gNXTjyURvsS/MaNXgDOJQP:ChgWJvs2j5KqxSVCXcTsDYcvPuGtmR
- TLSH T169A649953B68C4D2D41285BA8CA6CBF9F271BC625E3023076992F71F2F370A19D2D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\685283927101.ico
- Size 1KB
- SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
- MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
- SHA1 13470460552d9f4c465130d654b2095316b22854
- SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
- TLSH T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\760937655746.ico
- Size 1KB
- SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
- MD5 81e2b09e1f33b8c702aed3d14d341a13
- SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
- SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
- TLSH T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\820468980388.ico
- Size 1KB
- SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
- MD5 3d272e20bb157f11d4ae75abc33aef1a
- SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
- SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
- TLSH T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
- Size 62KB
- SHA256 191105e595983493dae047841a21444507cc93459c0f9a7bf76155d78a260f71
- MD5 bdf5a6c11c895cd516bfbb4fb51fb6c0
- SHA1 1419e283abd9fbf0b171d2172340fea0ca97c03d
- SHA512 7c6520817770b804785c1079e7cb2dcb1e2d40cce0149b652d2d11095c03ff344a0e488351b3900a225567e7684eebfcaa9dca897e6270060d4179d6c215b54b
- SSDEEP 1536:QiA/msOFA3asSkD6nFHbAkExJO1EA+Bdd:Qz/msHasdDOFHbAkExJO1Ebdd
- TLSH T177535C18BBE54129F4BFAF7158F53262EB3DF6736903866F248902871A22985CD406FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\shost.exe
- Size 375KB
- SHA256 125d6e5d891290b7b7167f469fcf909692abf622f5a635979fcf6a8f1f44f11d
- MD5 6babe2684d6ae34dd9abd67ebcf1bd84
- SHA1 381e6af4c918c2339a861e53c8ec24a3006068d8
- SHA512 47947613ebdaecb897b8f100643767c5ab4c90691e98a32a93d2e25021f6530c6baa9fe5564761a15e212983a2e39d92aca5732ba5287bdf0bfca73f95c80baa
- SSDEEP 6144:j+GYnA0zeWsDi5eJziQ8kV3f+RysMFZzN/z/msHOtb6ih8sXrw:jYyDi5eNiQ7uysMFZzN/z/msuF37
- TLSH T138848C16F79408FDD4A7C57489A24546DA397C8E1B72EADF17C8422A2F237F08E39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\logs.txt
- Size 4KB
- SHA256 7333e0c489a9e7fc683a60d707fdfd25e97a79183055cbc3027fd77c01463e19
- MD5 a6cfd7b0bd65c1ec6574c066272f77e2
- SHA1 8aafd283e5bc2db5c2fb1e7fd5ead7f2975dbc97
- SHA512 1eb9541ee338dba507e3be7fabed1610b1a2f8dfd2f28836a0cd41bd1a10a82c73c7f152cab43412b8e1f3f6153277e3b56b2975f49967acaa46db0526d959cb
- SSDEEP 96:2mW5WFWrWdWAW2W3FW3oeT8pi3Z8ZpRU8VPmPr0ofwGbZ:2Lwbx
- TLSH T1BC91B9B1ED55C1C5732331802B113901365E9C896B4D80EAE7CC978BE8CEBD99B5BAF1
- MD5 SHA1 SHA512 SSDEEP TLSH