d163c1d0ecc165baf3deca6b7628c354dc69c38b43703328426d272c4b5f4d4e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Size 751KB
Sample260807-a7r7csvbnd
SHA256 d163c1d0ecc165baf3deca6b7628c354dc69c38b43703328426d272c4b5f4d4e
MD5 45d00ae7be589d0465f6dedf268fc825
SHA1 b0afc939cd6ebe9fd7a286ae4520df3f6fa5bbf1
SHA512 65867fe5151122543bd1b3d5ea5ff5dd93cc2296bdc79f090c25b76a01f66b447d810458badf5c8f563e0a956ee72a1e549582dfb8ba7a95293a033cc3b9eaed
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msuY+s0YCDi50NiQDuysMFZzN/E/msuY7sU:E93gen93ge1
TLSH
T136F47C16F75408FDD59BC57489A24646DA35BC8E0B72EAEF17C8422A2F237F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 24 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c544-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1984-10-0x0000000000040000-0x0000000000056000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c546-9.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001b308-57.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c545-127.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000001c54f-150.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c555-318.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c557-290.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001900000001c528-231.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c56a-649.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000a00000001b305-149.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c551-148.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000200000001b30a-147.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000500000001b309-146.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c550-145.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000001c54b-144.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000001c54c-143.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c54e-142.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c54d-141.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00030000000198f0-901.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000800000001887f-2593.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000600000001b6e6-3572.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00130000000173e4-3914.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001bef7-3952.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 7 IoCs

pid	Process
1984	audiodg.exe
4752	shost.exe
1032	audiodg.exe
968	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
1780	audiodg.exe
2316	shost.exe
3748	audiodg.exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\D:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\D:	shost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXA430.tmp	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCXB941.tmp	shost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	shost.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	shost.exe
File created	C:\Program Files\Windows Defender\MpDlpService.exe	shost.exe
File opened for modification	C:\Program Files\Windows Mail\RCXC0E2.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXA2F3.tmp	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXB7FA.tmp	shost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	shost.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	shost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXA3B1.tmp	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXB7D9.tmp	shost.exe
File created	C:\Program Files\Windows Defender\DlpUserAgent.exe	shost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	shost.exe
File created	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCXAB7B.tmp	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCXB9C2.tmp	shost.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	shost.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	shost.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	shost.exe
File created	C:\Program Files\Windows Defender\mpextms.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCXBAF0.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	shost.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCXBAAF.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX9F04.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCXBA70.tmp	shost.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	shost.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	shost.exe
File created	C:\Program Files (x86)\Windows Mail\wabmig.exe	shost.exe
File created	C:\Program Files (x86)\Windows Mail\wabmig.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXA6FD.tmp	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	shost.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe	shost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 1984	5496	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	88
PID 5496 wrote to memory of 4752	5496	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	91
PID 4752 wrote to memory of 1032	4752	shost.exe	92
PID 5496 wrote to memory of 968	5496	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	95
PID 968 wrote to memory of 1780	968	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	96
PID 968 wrote to memory of 2316	968	2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	98
PID 2316 wrote to memory of 3748	2316	shost.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Users\Admin\Documents\diagnostics\shost.exe
  "C:\Users\Admin\Documents\diagnostics\shost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    PID:1032
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    PID:1780
- - C:\Users\Admin\Documents\diagnostics\shost.exe
    "C:\Users\Admin\Documents\diagnostics\shost.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Users\Admin\Documents\diagnostics\audiodg.exe
      "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
      4⤵
      Executes dropped EXE
      PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 200B
SHA256 37b452ed84f4777ebb5a6130a6dd6e791729d1b5d5071244ee0dfa40493c408e
MD5 b04071df851d97459160ae607e6d1934
SHA1 19eeac9fafbf7d6817e9a7ffbcea128d9a63ec86
SHA512 2348c2fdbc9d27b33e25d851ce2149da618ca3a54c55c3a7f7e95d051315ab7c8db39570bbd678c1b39d6bdf3f9a136b4d9710737e87805b6b47455bc9f15ff1
TLSH
T17BD0A91A9A115101BAA80185944AABB6EA5AA08BA7AFA44A4A5D002813F2BA60032604
MD5 SHA1 SHA512 TLSH

Submit Download

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 18.7MB
SHA256 3c80b7bc7e1f491d18a30cfd5375a8e8eda52e67260ea04b317da3bcd5a2e58e
MD5 b11af15963f87e6bc64af58d907dc30c
SHA1 ce72de382a37f0aaeabedb8df48cbea10a92e3ee
SHA512 ed225d18553bfc54ee604a0c23c6f48ae56fc2dec3cc81c79116d75d31db1d0564dee09035b76262994e8439d2dc2f8bd2805143188e4f896f66628ce1139731
SSDEEP 196608:4+hpFzXnfWexuhwPcPXnfW/JLGMcblLheT0:4+1DfWesPXfW/VdX0
TLSH
T1A317AE1DBBE21036CD732176AB4FA104E738D0076215C7977ADC87981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 375KB
SHA256 b47239cd7d0a528f377a65629107d5613a89856e2ee7fb11cade703ede0e1efa
MD5 83d549358ff95db19aba537a71d5e277
SHA1 f219a9f777beb969832c7b9e68179364eb88e1fc
SHA512 05d2c7aba319697889189f3aa5fa652b5b980fc1df53c3a8eb8a22eb93801cf89b8919dfca49b95857a441b2d9e094b4af0a3a395df7b67b16555cfdf73122f5
SSDEEP 6144:ip3VL4kv6l8aGo7p3VL4kv6l8aGoM/E/msHOtbSH3NsarwR:izQl8Ho7zQl8HoM/E/msuY+sU
TLSH
T162846C16FBA528E9E4B78A3588711645AB32BC791B72CB5F1298025E1F337C08D39F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1020KB
SHA256 f93c75e2b2194d0b12f4ecdee39a5a2d51ea98aaebd5524c2297a3bfa3946023
MD5 bcc99d018a0d4433e45d7d5331bda9df
SHA1 a2764f90045124d5fbb3467341f0a749ff0ef351
SHA512 54c4e5b4ec3c3b69e014c672851356e75904243450458c622eb4f38acd0fedcd106f5f9a6d04ef37800967e45a4b6772065dfe1f5a4183c34f89d2bad39390de
SSDEEP 24576:vJ7RKqjjg/PzNWOyTbJ7RKqjjg/PzNWyri:FPjiPXyThPjiPDri
TLSH
T11025AE2439A0C032D17311314D6AE794A73EF6704E6249E777D4AFBE2F345C1EB24AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe
Size 3.1MB
SHA256 2d079daa0d013741d257143a623b4bdeb0b5e87b50858783ca4f64dbd616ca7b
MD5 b9837c80b1b688d5c66f073cb11a115e
SHA1 114b5999c7f24925b027b216b4728eaa407fb30a
SHA512 bd54f84f9617cc8e52d2c58460b1594e694eb88ccea2cce3092c8e1642868fac7fb203fb328086f8d4b3558c82ee2601fdd999938009c60b386eb2f6f2ead6a2
SSDEEP 49152:5QnQxqz5/Kfi2t0YpRwqQnQxqz5/Kfi2t0YpRHf:5BY/KAswqBY/KAsHf
TLSH
T1DDE58C03F68641E5D05EC2788E764725EA72BC255F30A6DF0290BA252EB7AD01F3DBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 188KB
SHA256 31a1c3bfceb857f4c1bdbee1b06aeaca5bd3081b067410c76f21861084f94b2d
MD5 38a606a8adbc3be84e9ad58beacf796e
SHA1 0148eb17d660cc0d4d4123b35f7e597c890e11de
SHA512 784d23b036ab65320bbeb5e2609b454e13cfb440e6f9fd2546a9e58747711ed4192e4262b5af0484458a2ecb749f725d3f821fbf1a356d332d58c5ca72776029
SSDEEP 3072:EhUBf8Bo/mu+YDfYz8KrRVwWEhPd4r+ZtCFOhUBf8Bo/mu+YDfYz8KrRVwWEhPdn:iG7/fYfLvr+rCFAG7/fYfLvzB+QFyT
TLSH
T17D145B1375D088B1E5B10C3049A0E9B19E7FFD621B509EAB37C416BE0F316D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 889KB
SHA256 c7f020d816ef7a7212a1a35b93b37374de3b0d7bce1af39aab50eb5b6b7835a7
MD5 86fe4666478e02dcc7c6b1f2d0ab0f2a
SHA1 79176861322e3b6981bd9f1c1c8d4ecaaeb572bd
SHA512 74f5a6de399458ff3f7422424baf8726039010e0b19a71ea281280637790acdb10bad2c91969a7499d0ca9786f85d1a1428a5c78b0a695e7b8965d3dfa2a1879
SSDEEP 6144:GHvEm10k9mqI9PZJroJIxXY720DRaOOcno2m9XlqkuMAroJIxXY720DRaOOcno2R:q50k9mnRT0JIxQ4ObTMA0JIxQ4ObTMS
TLSH
T157158D41B7E446E9E06AC5348A478242EA7378960F64E6CF02D4D27D2F376E95F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.0MB
SHA256 6afb251d09cbc3583493c7ab3b9369a00116aca38b610b351c98873d6d9cc1ca
MD5 aa1cbe71b1adfd1dde755f48c1bf3356
SHA1 142bfbf40564285fc49baee2a9d2fa82eb1a6fd9
SHA512 d42483a435e34bba8eb792e515e4c5e04c137816dee979131933c47c650d9dd02f366db95fe02f85f0f27538214d79d3c3b9892bc512d8bc74fa8c3baeebc165
SSDEEP 12288:FS86nHrUA9HVlK8SQBJ9t4f15PfS86nHrUA9HVlK8SQBJ9t4f15r/:o86n9kAJ9tAzK86n9kAJ9tA3/
TLSH
T1D2358E41B3D847E8E07AC534CE428646EAB178960B61F6DF03A0527A2F37AE55F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
Size 3.2MB
SHA256 9dff3272c14343f5725331d849f88f196fdef23a7a065e5edca76fd542261691
MD5 a78f3fa6a2924b0a7f267da949ddced3
SHA1 094fc90e4f00fc06c312565df3a75db36372b657
SHA512 8599a6bec7e841ffcd779096123e8548cdac84ec87171aa790ef95c6bb70b68022a4d7ae246046e07a7095b7d8bf9bcd8b9570ae657f2faecd4258e8e40c25ff
SSDEEP 49152:E4hoNiZVB6PeuT5lxeHX04mfHIu4hoNiZVB6PeuT5lxeHX04mfHI8:xhsi9ubHihsi9ubHH
TLSH
T1BBF56903B2D941E8D06DD2B8C7468132EAA2BC450B34A6DF0791B75A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.8MB
SHA256 c928d52339dd6001f9030b91eb9a5f2f7f205217d8a98d04229dd84a533a76a8
MD5 44499bb840c9153df5e5b7567ce74561
SHA1 61b54aab7e41cc0feb1fd1989157f46af8f781a5
SHA512 42225e51923dd2d790d09515cb867cd8e0a90d576ee89cc8c7a17e9baf43e86359c0dca768190684ea06df15f024754a46aa1974d9b1506550b7c94ac084ef6c
SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27dOY2fF8FhmS86IUJWQn+6h27d6:jbOjjstobOjjst8
TLSH
T1AFD57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 375KB
SHA256 fa37837ccf0c85f30f0f2672c721abff19c8b2095d9678e80fec281da17d838c
MD5 356ee6d22205f8c4949bd5cca25dec67
SHA1 0dabca879b145ee123eaa4defde260bd2591024d
SHA512 f0e493d881ac9a619e4036511c1eacaa4f75ccf585f5cb9058e52bd22a038cae3ee581ae45df6c3ba47290b8a1fb5903430a096218af4092683c4fc0ea05eba3
SSDEEP 6144:YT4DtOUjD5F57y4j9cT4DtOUjD5F57y4j9jzN/E/msHOtbSH3NsarwR:YTDUjD5FX9cTDUjD5FX9jzN/E/msuY+R
TLSH
T1E2846B00FBA08DD6E4B64B305C7657665F36BC6A5F61CB0F2388720E6E72780CD29B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 924KB
SHA256 bdb22816a5e79fc86154bd593c8be800f6eab69efc6d9cb2560b408b13dd1170
MD5 005cb2be477425fe1e2f52ae061d3b23
SHA1 ab19779d2d4fa2d921eaa58fe73895f9aa82448b
SHA512 4578df4ea393e94468243df1845d8e61536f5bec988b4309a9440473650699d5af088b92c223d1d3a109e88b0342cbfc44b01ecd9f4c558322a4116bbdcee766
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msuY+sMXZNYVLeyUji0h90ZD0wxpGZIVuKrHsz:E93geE0Le5ji0hmxNrMz
TLSH
T19F154A16F6644775D073C0B9C5D2968AEE3234861B319ACF0389877C2F67BE58A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.3MB
SHA256 8cb755e8b802f2b564a133f91b0d9319ef02533d0a76745cd4e6763083fb7dff
MD5 fed229de04da34df7b666f55c23c2bb0
SHA1 10942c3c73cc2d1d93abdd67c28bce3c1c784e02
SHA512 9965fa2e1a6abe0555447aa7f7028ad085eca941ee271665b1bc7eb787d5d33303c257bfadf9babf78aac4fc83ff91eb1f51ff7df6f6c09fc634cd93056ddec9
SSDEEP 24576:E93gewa7/ezSC6vUyD/aqgrvWx6q8wyux:NE/ezSC6vUzPvMHjyq
TLSH
T1CE552A15F6788377D0B3D0B9C5D66A9AFE3234864B3089DB0246836C3E277E58A35739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.0MB
SHA256 f8554da9a5a555c29359cdb38f9353848ff5a3d2cb3577ce20c54ddcffb9e355
MD5 8abb2de77f111370664566620860e8e6
SHA1 37baa7f59e1f0d1d9884e97986aca00516b124b7
SHA512 42c419240e0de7133d1bcdaa6ee9dbd4f7fe6f3219f2b9e228d2598e0a935614a9e287adc19d01afea55fc96c0da07804225674b594ee0e3e95b978f7bb48b7b
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msuY+soVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0ImP:E93geQVbqPb88hv/l+7Y
TLSH
T1AF354B26F6648275D073C0B9C5D2969AEE3234464B31CACF0389876D2F677E5CA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX8E10.tmp

Path C:\Program Files\7-Zip\RCX8E10.tmp
Size 377KB
SHA256 06a213a51b8fd5c9d54930b441cadcb5baf929df2572e50958d8603e57f7ea94
MD5 f221aa7605f1744f17d62a13c6dd7b81
SHA1 290e578ef465a2a5547b1b7892e3890a8b6323dc
SHA512 ffe5c7bddb159da2aed5ff128b173a5ce4093679f642026da544ea87fc3dfb09a2a11c62a83899a6d4a0cb514ba14b1787f76b1939b0498a3dda68acf0b90f0b
SSDEEP 6144:p+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3Nsarw:pYCDi50NiQDuysMFZzN/E/msuY+s
TLSH
T14C848C06F75408F9D49BC574C9964596DA39BC8B0B72EAEF17C8422A2F337E04E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 390KB
SHA256 1f8ef2b8fd2c075429e37a177821b32d6ac12cda702701f3b8571c12b8bd898b
MD5 8eaa76102cd76e3e6243e07470887e46
SHA1 b62751cd2f074ff6f600f09b8c9c80b6a63be0df
SHA512 7669127707b499cde1e0d26734426f7f269e2d9bce306350fa07a64948dd8ee96ee10e57824c208d8c60a2750a552fd243247bc178bf7ffaea9baf0210a8cf57
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3NsarwZa7H:jYCDi50NiQDuysMFZzN/E/msuY+s2aH
TLSH
T129848D06F75408F9E5ABC57489A64646DA35BC8A0B71EEDF07D8422A2F337F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 657KB
SHA256 c3dea72a25d95a6838813ffa2e33e0b5188d22f3c38375bbe9b5837b815c5b05
MD5 a82245a997d04b28dab1060aee7a553e
SHA1 8351fed7a2aaf90a40a0f6fa5a14c74753e5c862
SHA512 28250feb2e7cf771d9c036f90743b27ea226083a50ee2705482e2471846e1d4848a30866b4bf49044e980f0e81468ebed59db3c6e9c90cedf38b82936692dbfe
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msuY+sneBNUbTVO86U+:E93gefJIU+
TLSH
T1F1E47E27FF24ACF5C57B897486928641DB3678650F21E7CFD2A8831E5F236E04E39A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 423KB
SHA256 59f654a1f1a430469c811ad92fed9542876f7e44e061ab7151def8613d0543b4
MD5 9ec4b3fa201cd1cb2805244105a71080
SHA1 6a8ef706f290d0e50c2f650fbd4c2ecbe8cd5427
SHA512 1d45d24cc796a6b599b946d297470a6ba732ab4fffd9165c6bf36ed64694e2b918e14a01889477b2b294f6d959bb21776bb12ae9b480ae325a5557baa01d729b
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3NsarwKcr0X9:jYCDi50NiQDuysMFZzN/E/msuY+sFP
TLSH
T138948D06F75408F9E5ABC574C9A245469E39BCCB1B31EADF17C8422A2F237E08E39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.5MB
SHA256 60f87800b0641c9046abdfdcb3a7bc8926f50ef2fc7be63b48e8ec5285484d10
MD5 42cae7ede247d96f4a6fe888bbf07fde
SHA1 9c59e96d2e50402373b00814357b7a41811d3bbe
SHA512 32c301a4692b4bd951e36483457fc4ee0f3540e71beb7a09477a0c27aa846d161539712ec258d2a6a7160d0d62c98e29d911ca41381c44abb0ed6cb6b9feebcc
SSDEEP 49152:NrQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tr:NQvGAdlCEL8c/bRNw5C6
TLSH
T157266C65ABF880F5E0A7D178C97A86B2F77678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 734KB
SHA256 6560b83112dc86a38403a6c174e333880bb513417cc5ce0588f83d7b02902fd9
MD5 5b69910a1375f0e3347d118c170fe2ea
SHA1 20515bf84a278dbd9c103bfb9525836e46e0e9d1
SHA512 afdc94444ca0c8be96de7fee72bda00f0edfba5c379651104ce55c5c3197008b7dcc699c2e7054c893dedbd172693ab01ea2a494f37d2d604f1a1714c0a2c4d4
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msuY+soAwSfxL/2Dc3jDLLmt0LDQewsAjRs:E93ge1aewsAja
TLSH
T124F4AE21FB74C479C6BB49B04B628706993D78910F616ACFE3E84A5E1E313E05F39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.8MB
SHA256 9240f6b5464b2c351e8acbac5c0fd4abd20a1961be0aff3deaa3100f4fd2eabb
MD5 ef551ecb800a3f3f37f1cc884b896621
SHA1 9edb10c8856192225e0bf19d897eb6ca98839ed6
SHA512 dc62fb470d8fbc3a61068aa15c7f8d5188f94a13d0b645fdf0a601047d9d2810e37968baf0428ca4c5dbc4af53fdf507eeb6f2f30d1f6cf3b515746a5c7e4ce5
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJH2:TUEtQevvqc2W1cpV2XI322
TLSH
T16D474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.5MB
SHA256 167b5ceb33ba1a5add049ce36ed3c14c9ed1f3e0d699dbd76874b011092c9083
MD5 f76db6bd2079c1e4e5d20dc95796a157
SHA1 c3d29a1ddb7699f61e17a74501c8b01750b7d012
SHA512 0da23594a653f43a314cf46150fb3ed008fcc3c83762061dc68ca31bc4ce18c6647ddc317e45c3124d7410258fd774af64ccd78af6a4c58bea54b533ae3015fa
SSDEEP 24576:E93gefCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344P:NoCbRquA/m2yL5zbfFiV+XenmE3/z4
TLSH
T14AC56D19B7A881E4D1F6C77886A2C647F37178154B31ABEF4255461E2E33BE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 12.1MB
SHA256 3cdde1b1b52a90b3d0c32008a3175bb841cdd053a919b42eeacaa456088d4a57
MD5 2a3c3b7cddf0b63efe0dbbd919de1eb9
SHA1 efdbcfa8d94c885db7b9f0f2ad048a4461f18440
SHA512 a03a5201e8d5630219834f6027a320aff0d9ba11f59e5ddfffd1ffd448b91a2b6d0a1bc78972870ebbf84cda9182f32b63d500023ae5a7ab91f06bb6c42b1e86
SSDEEP 98304:TQRQyi36YOcP+Lvw2gAf+PN3OQRQyi36YOcP+Lvw2gAf+PN3Y:CQyiKaUX+PNFQyiKaUX+PNI
TLSH
T1DBD65B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.1MB
SHA256 4a2d0a747fb658c31659a7efc22c5c68182a3e534ed84994a6db630fe2641910
MD5 232745b3cb1a9ecfbb6aea447ba9f522
SHA1 ec480b3741d134c04578fe6646f5073bf27c6572
SHA512 0202267bd7dcd7ed4ddd9eb706b59191794e34ac5719aa4e152ba94a743d771359ac872aa0e675c0bf97c1328840f4d8c3a4a77d3bebad6d1ed1f6a575e2355e
SSDEEP 24576:E93gebwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:Nu68Qg55nhoeWu7PNU3/Q
TLSH
T113A53933B2F200A9C44ED1769F46472196E17C768FE0E7DB824573161FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.6MB
SHA256 24178db63a02f6f2362804c4ab9d84d30dcbf1aebbca07177bf551bd4062da58
MD5 efc7d4d02e92d0cc06c5c0f918e8e0cf
SHA1 f1f4f58861b9fb85a68b79de1fd7c9bae7da3f5f
SHA512 cf9fcfc06d5cf6ff761ad763fda7c114532129fb9472806b4517a1c5ab0afd4fa28d74ff2b76bafa887e9063c7b4377c2021a8501e4def8d4df6ba5263222850
SSDEEP 49152:NTB+taZ3usBWOBr4tEGW0bqx0z+n217aau1glj:Pu6Jm0xd2dj
TLSH
T186D57C13F2D901E8D06AD578874A9232EA62BC4A0B35B6DF0B9073562F77EE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.3MB
SHA256 cee92c0d643ff290017758e8092d5529b3acf24a4ece817615d239a2f8043735
MD5 ba65f01c697af54bf7356df314000873
SHA1 f44f429092c2e99e41128c5e95a2e1e096316dcf
SHA512 c2aa6c927dfc843b70e04cb210e91796ace9561af1a7bbaae0928a69a10a7e40defacc1a60ad8fda14f6c792addc618aeda055d4e7f6080e42b66aa26df693f8
SSDEEP 49152:11hpsNoJpF1A6GU44CwH7R4xc1hpsNoJpF1A6GU44CwH7R4xu:1mifP5RBmifP5R7
TLSH
T1F6F58C13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.7MB
SHA256 19bdbd8259655e69808ff21fc99dae37589ed2c0c438cd10ebff85441746e775
MD5 60909be09a8187961a09a33a6ca9276f
SHA1 31664c6177c1f78388668938405f8c8fa98dbfdd
SHA512 404b20fe3b53b254629adbc1203298598b01225ab93f056dce8a0a484d93a5de21731b25c0b3069ce0633549fdf00013b2d4263d8a57cbc83e39c32059167770
SSDEEP 49152:sSuZQIY0Be2K8RVtOnks6NMHq1SuZQIY0Be2K8RVtOnks6NMHqO:O5dKCi61b5dKCi61O
TLSH
T1CA069D03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 6.1MB
SHA256 03c40f2568ad6965b3c18b10d1fe8551f2dfb1267c8faa621e395b4f084c7be7
MD5 8a2d3a908815792fce2cf2a2f248a5a4
SHA1 7522f5e94a904f97036209e27a40608f2406ad77
SHA512 6546359c667c80337551b28c97ff6e727d61b0991995d2fb6d986345415259a11c2489aaa337fb7c8890193500451de1b03d0827d81598c57e2bd9df5d5ae48d
SSDEEP 49152:ByLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcva4JPRsYsY5AcyLSrJhMe+:4m7vj1BDdDmm7vj1BDlZS
TLSH
T13F568C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.8MB
SHA256 0bdf5c5219c00c538217e330e0032b4109c29c5d9f12970ecf9c547e4118a521
MD5 731b385d775e619a25b5d77a0ccd306f
SHA1 917f4da32f8afe14e17d196f067963fd9a331ad4
SHA512 59c112c1d9c8f5e34bb7fa7b410d977e895db8b1652114cb657d3bfd33823fbf5ead5dcb4591becd55d7bbdde7cd025b4bd42e6c7757bac6d980de6050e93db9
SSDEEP 24576:E93geBhiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QLG:NshtSn8EApI0fig1giDn0AP5wC
TLSH
T1BA958C13F29900E8D06AC178C7568632EA72BC560B35AAEF0A90B7561F77BE05F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 375KB
SHA256 a11bf6ed30709afcf4d056bf55c14b03eee0c9b1874fd3731d750fa00b0608a0
MD5 399e77818a2f1a54d0122087364f564c
SHA1 037548e04476953ab25d0b25abeb2327da2e0711
SHA512 a2b6e80fe0024ba097adff930cdae31f7cfc8ca889ef1a3bd68ce6dc073a83793720552aca4694c6ff3043a3dd496102c6762c1d2de6e5b487134c29eba8ef90
SSDEEP 6144:mcNcw0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3NsarwR:vGSDi50NiQDuysMFZzN/E/msuY+sU
TLSH
T177849E15FB9408F9E4AB827488A24646DB36BC9B1B61E7DF13DC421A1F337D08E39764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 561KB
SHA256 3940f0c6ef6adc7df043d38f1707d836d8650d2bdd57a9cc1e286b4dd3e59272
MD5 119ca5906366222c53a4f4c6b9794450
SHA1 a241a1736b94b4b74526a4d37c6d324d8889b658
SHA512 2922dab9dd5d7c0c883dd8826cd611de3907d39b5d56a8f0458c8c41484eb9b60898135b1197f4c4fbbaeac34a403986b247bb14e7e6503df7e065d91d872a41
SSDEEP 12288:TCd9/WYoaLHF3z0z04PVdvdWCd9/WYoaLHF3z0z04PDvhn:eTWaLl3z0zr3TWaLl3z0zDn
TLSH
T19FC48E95B39018F8EC67813ECD658906D6B27C5A0770C65F03A836675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 375KB
SHA256 cdc7ee6b34b39c5e9497f4edf372c8ad6374474fdecb0f83bbe0a3f09fa6822e
MD5 2c6b5ccd788d4e026cf40e709ad01bd8
SHA1 04de44f259707cb87e23337a4a9d713034b889a7
SHA512 c8aefdc11caf839d9640deaa7e761afbf7092662e1d2906a4df1ec812a8e5570a443865eeed4db492212a42ea31eb8da0fa9d5f15675cf4088f42ff07f3c986e
SSDEEP 6144:qyGxe2A/5DEmdggIn1UHyGxe2A/5DEmdggIn1UINsarwR:qnc3/BHdBdHnc3/BHdBdlsU
TLSH
T13D842901F7E508D5E4B3CA3988A04642EB76BD961B61DF9F5394211A0F367E1EE3CE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 661KB
SHA256 e33d450de1ff5194953a34593355faa10d13fddf0690a4d26e4be6d81610847f
MD5 8adcf40b3ae850fa8a9b2fbe89dccf0e
SHA1 69de6ee65d3dff6281f6a9d4bf795cb9d86d0700
SHA512 e7feba567610cff279a86adff7f65d94d47c7c2da056cb1712aa67196a231daf4a16edbbbaeb87aeffacef386a5cf9dee29e11dcacb7e5783cde93d3d139af91
SSDEEP 6144:C3NsarwLWPZw225bN5zFEjGkqkAJHyEzYV/Pvy3:C+suiZwb5zzFEoS2cPvy3
TLSH
T10BE47D55F7900CE9ECA3853988658A46D6B27C990BB0CB1F23AC262E1F773904D3DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 855KB
SHA256 849d232c8fd5258d5f35099eaf265b7b219b9478b99fac72faccf20baaec1dbc
MD5 7307334dfc3303226006cfdb8215e195
SHA1 9daf2dba0a9b2be1a4f1751f81c1ff2d3b4095a2
SHA512 5f9632727e6b7e892623e71ca1a63b676004dde9e24a62b194a4bc155f573f40e24e600178512309327e6ae709939548c186b4f0534d7c6f6d6153f070d8efa1
SSDEEP 24576:aTWaLl3z0zDGTWaLl3z0zDKTWaLl3z0zD3:aT1LljXT1LljjT1LljK
TLSH
T1F0158EA5B3901CF8EC67813EC9558906D6B27C5A0770C65F03A836675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
Size 596KB
SHA256 c6c5af08941bea77a06c0ba194fb1d31a86f50b1e8a02c2fcf27b31ecb016e79
MD5 78827d1ec21adc0812734445191ea579
SHA1 53acbe11e3ca894e95bbf7a37bcb82ed1ada1998
SHA512 a11e100965ec97ffd9bc5d0dd29f32fc7a5f492c25639e2cf30cf416c97cf26fd885564e3e04291572acc57cc50050a1286bf1585e3561e0b694857df092f341
SSDEEP 12288:uQ0dWCXSyCq7IwIQ0dWCXSyCq7IwldWCXSyCq7Iw9:PjCXF7IwxjCXF7IwSCXF7Iw9
TLSH
T101D47CA6276019A2C9F7427DD9C3871FD7B67D25036887CB40C883662B036D42BB97ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 432KB
SHA256 4c717ba7228b86c5ca0b0633b585911e90a5266e20fc5d99c74a859801feed88
MD5 675282e597b47a5eca6d8bd25b3131e5
SHA1 925fda4d7ba758ace1abf9dfa17e03d18ebeb844
SHA512 417a4f7c77110eae03751169cb2abc77018dc0a9a1255b6226ac3bc49ffb9abf17379b28bfd756b049a922f0b2c7ef18573bd94dd535b00ad2b68a1f06741d8f
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3NsarweJB:jYCDi50NiQDuysMFZzN/E/msuY+s5f
TLSH
T161948D06F79408F9D59BC174C9924646EE35B88B1B71EADF07D8422A2F337E08E39754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 376KB
SHA256 7d1bd1e94aee1730ffbe8d5e63053d63d63d498a79bae2e6618d6036963c96b3
MD5 57850f4a35b71d1f072216a5e4bd03bf
SHA1 9d1b58e628b1d5b5252f8f4bb8fb597ba93db490
SHA512 2c9d28008eae4643d168abfb97e887d088ad2244e737b31e465536489d4f207b3628f7b49d92dcb247e19e8e97c8421d5aca96ec12ce276133f7cb1c7911e06c
SSDEEP 6144:N+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3Nsarwg:dYCDi50NiQDuysMFZzN/E/msuY+sd
TLSH
T147848C06F75408F9D59BC57489924646DA39BC8F1B72EAEF17C8422A2F237F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-06_45d00ae7be589d0465f6dedf268fc825_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Size 375KB
SHA256 52b6d27f1d25b2aeaffdab21caa1e5a609fc4e0d85f56a97142af86dfc495f06
MD5 c31aa04aa45add27ee11f36ed07197dc
SHA1 cac2c8ec79deb50667e375a711ddd36c531e761c
SHA512 fac809e39968e7743041a45ad363e17e8547cc3d9fc41f6b5010dcf680633a4cbafaa9c1334677646862e0c0ae2c11337750e71321c452579ec50173f418d70a
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSHqNsarwR:jYCDi50NiQDuysMFZzN/E/msuY7sU
TLSH
T1DD847C16F75408FDD59BC57489A24646DA35BC8E0B72EAEF17C8422A2F237F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

036502521837.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\036502521837.ico
Size 1KB
SHA256 c87216c7ca4c6510e0957de46c989ec10827b6b03b4bd518cf81c7ea2a140b8b
MD5 17ecdd5b8e00a3598edccb98a81e4f8e
SHA1 0b67f50bb70e40b2aa9f2cb23762b7c6c6a5c2a2
SHA512 ff7ab90a506cd66cb4076c1b5a9fefd3cab86b25bdad32ff43d96e3fa105aecb493af201fca1cfc3cf21baa23ea59f84f4577febde4432e1ac7dc5e6de53633c
TLSH
T1292166D1E120C8DBFD19CB3581296A0BAB7A3F16005606092320FD61BB834C9C849AF2
MD5 SHA1 SHA512 TLSH

Submit Download

051050990878.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\051050990878.ico
Size 1KB
SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
MD5 cb4265d1bed8a3606c50c3ace6452c94
SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
TLSH
T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
MD5 SHA1 SHA512 TLSH

Submit Download

096388943311.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\096388943311.ico
Size 1KB
SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
MD5 3d272e20bb157f11d4ae75abc33aef1a
SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
TLSH
T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
MD5 SHA1 SHA512 TLSH

Submit Download

124092144951.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\124092144951.ico
Size 62B
SHA256 f0cabbb3b1c107a8c455b233d6f6f9e2597ed2b35f52d438152314eb2c9f85db
MD5 6f73694b41567963c8e86b9de78778a2
SHA1 8effabe5dc88ebdf672765a42d7e269836db7ab7
SHA512 81e155b322af7b91e7bf45d1b1f792615c87d5a7e4b80a0729a94e95abfe77f882349fbcaf0c7cc6c49ae8a3d1a2785f391b823fb22b3a36e6b12a80e6efcd44
MD5 SHA1 SHA512

Submit Download

296074547687.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\296074547687.ico
Size 1KB
SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
MD5 aea8653be6803940e5f5017482ed8f31
SHA1 83d770a087be76863aca353d9e394c29b126874a
SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
TLSH
T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
MD5 SHA1 SHA512 TLSH

Submit Download

320177658582.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\320177658582.ico
Size 1KB
SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
SHA1 0a18f23ef372593dee476bb852745b2490bc8421
SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
TLSH
T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
MD5 SHA1 SHA512 TLSH

Submit Download

329749578598.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\329749578598.ico
Size 1KB
SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
MD5 6ed58acd10d2c394c7638d5e4d4e4d04
SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
TLSH
T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
MD5 SHA1 SHA512 TLSH

Submit Download

329940247088.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\329940247088.ico
Size 62B
SHA256 2ab662eae228f6451f07fbb7b8e91711caa3309540bd7eb4d9cf2dc6904ba08d
MD5 d78899ea3032dc5fcbb8d97c915537a4
SHA1 8bb1ba75d291cae9704a2b6ea67fad30476ee73e
SHA512 96a7d7354910fc1df6ddc04e7ff79af177df397b6fbc2fa52348ea3d0eaed5a3fca9458563321046b0f101a42573bd57f42fa09ecb36c021f5766779b8e85825
MD5 SHA1 SHA512

Submit Download

377457646768.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\377457646768.ico
Size 1KB
SHA256 99143e3c977916ae0bffcd76fb770cce778f63459bf49ab42b639bb4da8555c6
MD5 1242320e51856e417a3b897993ed3862
SHA1 1a8e37c65a34144d55e135dbe5c80f1d3cb54995
SHA512 7e362214be096890c16bb2d19ad6119d8e441b25995221a02e10a9a7bb62b83f10f3df8b5e20444ee2c068fca8153097f12d098f15f71ca550121a6642e5f425
TLSH
T14D2112C4FF993060D8D9F735F395AA0A5766F2C298A40684105DFC69BCB84247847E39
MD5 SHA1 SHA512 TLSH

Submit Download

409677919841.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\409677919841.ico
Size 1KB
SHA256 b15cc5b7b654156b96c718da8c6a5402aa2d7afab332ec98038ce8a6b6efd052
MD5 eacc2d68b6aac8c25d01a76fd292ebf8
SHA1 90bae45731dd564088bf7fce380e39266bea02b4
SHA512 ad8760c2c91c46238f9b80f85074ae3574bfe7bdb0d2b9ac85e94349e82d5d70f2adc6762beb07d0747794a571febd96bf5e08ea9b3bc44bcd789e0d0043c3a2
TLSH
T18B21A459BA5CD77BC0653330D5170BF529709D01D86D472FB7053E8AF8B4A0409D9994
MD5 SHA1 SHA512 TLSH

Submit Download

434287247405.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\434287247405.ico
Size 1KB
SHA256 1c413336445e2b6d1de737844f2a298eb8eed23eb6a0671cefeb15caeb8eaef9
MD5 b6045946e2c0f888d84de0df859c0c16
SHA1 cadc6a9281b18084c29ab4ef552ac382fe3c5ddd
SHA512 9ca39d615c37a455fb43c0d6aa9210c10b341bcd685bc053965022cc4cf9de0f03737d0f9d0c894ea526f3537b87769e59245fc259f976473c029fe49fbfc8ab
TLSH
T13021898DFC4945CBFC9207B0B87E2C9655749C029F6C982A01A178878C30215C362E4F
MD5 SHA1 SHA512 TLSH

Submit Download

440957831744.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\440957831744.ico
Size 1KB
SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
MD5 d91c5d1ab9c7e29648ace11bcb875f98
SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
TLSH
T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
MD5 SHA1 SHA512 TLSH

Submit Download

547794406264.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\547794406264.ico
Size 1KB
SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
MD5 81e2b09e1f33b8c702aed3d14d341a13
SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
TLSH
T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
MD5 SHA1 SHA512 TLSH

Submit Download

598395022240.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\598395022240.ico
Size 1KB
SHA256 18749bf7cbeaf430807c30dca88b7b7514a65e8c5170f1bcabb548f375e493fe
MD5 fab1ec8207037349470a004224fff883
SHA1 ce82654b651ddbeca904c5fd4128c2d229bd34e7
SHA512 1987032071bc2afd3802a59559b52a3a39ea12a729b1f8d97cf2893504242159a66da80e20f0ccf9176f337d890322f6ebec1c6212ce2058778721c9a3144491
TLSH
T1D8216BC0659093DBDC239A7610D4C5520A7DAFF645BD2AD0B8877B3AEDFD2282621097
MD5 SHA1 SHA512 TLSH

Submit Download

691669104807.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\691669104807.ico
Size 1KB
SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
SHA1 13470460552d9f4c465130d654b2095316b22854
SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
TLSH
T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
MD5 SHA1 SHA512 TLSH

Submit Download

730772410645.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\730772410645.ico
Size 1KB
SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
MD5 bdc7cdea596ddc3d6542f6eae40a3509
SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
TLSH
T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
MD5 SHA1 SHA512 TLSH

Submit Download

783659905183.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\783659905183.ico
Size 1KB
SHA256 9a6584c0e0a8cf98d3d7bd968a9ae54141256e454f1d7dabbc1e59b02be3f016
MD5 88c3118c4f877d50855cd23644fef184
SHA1 4a05378db5fc432be7587da1e25e8f7e73e548ee
SHA512 71a681b3a2db9a80059ecb41be03fdab98e1a831ca920cd9a5e05f1aaf6fab709dbcb70ac2c0f1e7705f72bae5d43acf0d7013a6de5ad3bc7c47498e90b0ff2d
TLSH
T1CC21CE07D5D408A0E663F93A2489E4E747346DADACB21B6636DD2017267C93FCA035E8
MD5 SHA1 SHA512 TLSH

Submit Download

873976742349.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\873976742349.ico
Size 1KB
SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
MD5 4a3be9e27a938152348d20edbc4c08ee
SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
TLSH
T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
MD5 SHA1 SHA512 TLSH

Submit Download

948831276445.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\948831276445.ico
Size 1KB
SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
MD5 1af3523517c4a23a831af16191e71ba5
SHA1 34674885738a8717def95b016697802778f0d520
SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
TLSH
T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
MD5 SHA1 SHA512 TLSH

Submit Download

967189177050.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\967189177050.ico
Size 62B
SHA256 479bdf498d165be846fa58bbb2f99e0cff844ea6517523c332d719a288097cfa
MD5 5a1651c8dc24cd6da8852b64594740cf
SHA1 5c12b214c6f44e899d68e951c1cb21113e5ad0f8
SHA512 3f81bcd1beec81be69ea6ff8bc5474eb13b6c4517aa7a7e28e5acb605bd52c060c7e276633d4e13663859c27bc750c43624a5ade4c225584afc4b0e04edd751d
MD5 SHA1 SHA512

Submit Download

998830739354.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\998830739354.ico
Size 1KB
SHA256 a742238dacdff4363a430dacedb364ff073cd4c1f1799badcc88f3b681d565ca
MD5 5ffda0c41775e66798bfda13857ae248
SHA1 bb3cdc63843e60b3684185fbdb9db5d7bdba2665
SHA512 5818090b0188ce2f6b8f07598112eb838f5f320bbe364ebaecdbb208354c68c30b2a9bcfd32611b137b162d1c3af19f71977c2564ef91d7816533b3aa04f535e
TLSH
T12721F583B780C9C8D510C7774356D86D4A17F4E59056124B28D678235FCB269302A6AF
MD5 SHA1 SHA512 TLSH

Submit Download

PushEnter.exe

Path C:\Users\Admin\AppData\Roaming\RenameMove\PushEnter.exe
Size 816KB
SHA256 6d1321a3e06c98f74c9b0060584a9103814f0db148c5364a279ea0e29de6f86c
MD5 84135c8f05d6a5637cd5c3d1403e0371
SHA1 3836aecb9062b2b9bc7dd5ddd098a1ce96c6c0b8
SHA512 7dbf41dc725de7ff09cc26eb406e539a890c8a30af4b577634056dd0efd3c107a138143f525ee711ff4db1398a0c2772f26380c9a2a7f942551bc314c9b9e0a7
SSDEEP 12288:jYCDi50NiQDuysMFZzN/E/msuY+sjkT8qDXFA6TE7OBqZkfpXd8HQsdo8ywRGDX3:E93ge7qD1IiBZfRlsdTzUUd4+WNd4+W6
TLSH
T11605E005FB9408FDD5AB8274C5924552EA35B88F0B72EAEF17D8426A1F23BF04E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 e59adaa13fdbaa2c529e536fc46c13a7287d6507be398cb36705907513dc6420
MD5 35ff5e0cdcea32dedcdd83b7fc99d780
SHA1 44b0b9ddd417a29ca892db5ed45b0b669531427b
SHA512 2c830b8b6e27c33a4b13c6830834489b13ff5c91291b1bcc7c3028a9cec652de4081928ed334ce672e906b65ff6e4a0c264ed87a5bd42b1826234109a477db19
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpbExJO1EA+BEd:QE/msHasdDOFHbAMbExJO1EbEd
TLSH
T1F6535B18BBE60125E5BF6FB158F53266DB39F6635903D62F28C602871A23E85CD006FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shost.exe

Path C:\Users\Admin\Documents\diagnostics\shost.exe
Size 375KB
SHA256 b90a9cb50acb4cdfce6eb3a2128e3b82e73416c84d4f804f1e04021269cdff90
MD5 25b661fae19165a82f588a4abdc29b10
SHA1 05bcbc34bf4d096f1709087f1aa88d6fd934ac53
SHA512 f4fe91f1f34e3979ef6a0f5ea0b21dbeeeedf67fb0637352cce0dadd0a6fb0115b680e7c3f0143bc09778c5d257df1eda87285a52ce19a4551e128dec670e4e1
SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSH3Nsarw:jYCDi50NiQDuysMFZzN/E/msuY+s
TLSH
T1E4848C16F75408FDD59BC57489A24646DA35BC8E0B72EAEF17C8422A2F237F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 1KB
SHA256 c3339b09708f13f692d7ac294cd26dac0feb651ae41ae13ab0ba05068ec2108e
MD5 dba632d0416978ac933c3a45a3703acb
SHA1 f14e9efd63157dbc9fbe4aaabaebf8eee3581b27
SHA512 435e41a1e6f9031d7f2f8983f1e3b43066f28e96cbabd6ecddaea7504658baa8f7be66330bdd00b1f4c951026310425b696760896fdf303c23b789126cf626fd
TLSH
T11C110810F460D0447127305027207D023699DD9BAB4A95BD938DB39EE44EECE8BCF9F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 1KB
SHA256 b274b35829c2fae1d2daf71aff42d0009ee4d629d00d002cadbf79f327cb49af
MD5 8709969a0c7a29c50fc8ba1cf64555bd
SHA1 92c7204122f4ff8759f31e6e43041f37c07ee9d5
SHA512 7cf7517f2d178f39b057bb78609b9e639c2fbc23bf1a2bb640918f6982aa1fe549c2a09458088340060169e91bb9d8cad6b84338a55d1d6a3e62e7eb1ef2c6eb
TLSH
T1EC210610F460D0447127305027203D02329DDD9BAB4A95BD938DB39EE44EECE8BCB9F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 6ac9f911aa6d08873c32ec81ded0e5b108e74b17dfd9d00f3771a71531563906
MD5 6d1041f8322bd67dc33f4c2a62b4e4e3
SHA1 a96e5446d83d7567899538a4dd617d9075b9d9d3
SHA512 50ab142e2868de637e8cc43e325bc812bcb564fe188af9e307141ece24dac14c863d1e51aeaa713e754db626698ec6ab1537a2fd1b759630e57c85904e501050
TLSH
T195815A62FA95C0C93233715527227A01355ECC8E6F48C0A957CDA78FA08DEDD8F8E5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 2KB
SHA256 b5b07d877419507f6b661c3f198a03dbb3a8b46ef148161af4abd4d01f03e7f1
MD5 6b3e7e19aa539f3c800a9574aa535949
SHA1 c0c0ab3a0722cfbfe3539b48909f347a56f8effb
SHA512 c565b244517352dde78257250fb302e77e77840ac154f2f7fc953b09c3429b8437038d679ce882a319e64aff88e044e75e7346927705674899cea308bd99d048
TLSH
T14551C421FA50C1867233319427217A01319DCDCB6B49D0A957CDB78EE449EDECB9A5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 904dd229a1c3591916710f85806819a82fd9db15a70b0b6b852cc7d216977112
MD5 170951cd18d364748d46a244c8d67bb0
SHA1 eaef1ed82335537784ff0ebeb6b36670ca768c1a
SHA512 1871239d8ed53763094bcacd0457996c4d261423822ee2072e208cc2cfea3cd31a65b7ec9ee29fe481b6d077e5c3bb4822bb00b0d0e1e1ed7a2545133efd151c
TLSH
T120715A62FA94C0C97233315427227A01355ECD8E6F48C0A957CDA78FA08DEDD8F8E5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 4KB
SHA256 afc20ec45b37c52f681d090abb2fd5f82a0087fe012bd8f3fc1d9602fa9266e1
MD5 0a3e0af7162ac8227fe82ac672769dd7
SHA1 96974e25e99ff54ee8931c01af2b308594d727e7
SHA512 1d501d3cfa450660a6949d6e695a204d17f75fc0b077b3891de425a6bd68f9288a942165b2523410293f3ce393050415def56213821d86dca53005dc503a0419
SSDEEP 96:2mW5WFWrWdWAW2W3NprW3FW3FW3oZpZ8Z8ZpURRUOaY++VVPmPm40YeYNrO0:2NNqGCf6O0
TLSH
T167815AA2F995C0C93233715527227901355F8D8EAF49C0AA57CDA38BA0CCEDD8B9A5E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 5KB
SHA256 f95c0998254abf71b5600e4392b405d93f4711405e6c12fbfc25ce8332ae3954
MD5 b16195d9bfa5426bef18c24294279efa
SHA1 5b466f7cc378f8770ca6011fc4290210611f81d8
SHA512 16824791b2e412ed2440ef0565ad17abdaabf891d4ee7d09386ae80f434c9a5fed00151423fae9f285c184df116ae4daf6a034dc8270dfaf420f2cd6a536eae6
SSDEEP 96:2mW5WFWrWdWAW2W3NprW3FW3FW3oZpZ8Z8ZpURRUOaY++VVPmPm40YeYNrOUofw2:2NNqGCf6O7V
TLSH
T13EC1FBB1ED45C1C9732371942B113901265F8C8DAB4D80AAA3CD978BE4CDE9D8F5AAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 6KB
SHA256 a0beac26f7cd97544ca1783ef4cca74479920adb21763246173a23fbc7cc1138
MD5 2f7bd38252170b20148371e4dbca32b9
SHA1 05d462e9b8584552297b77cc00283ec5036e0de9
SHA512 99cef1c69482332b058d5b3fedbd900f8c7f11b32ec0f76e5c1764ccfefb03b85065b1cb0945e59aa3d6f3a7d3fbfa47f886bb68c7ca0adfe0b0e6ebad156270
SSDEEP 96:2mW5WFWrWdWAW2W3NprW3FW3FW3oZpZ8Z8ZpURRUOaY++VVPmPm40YeYNrOUofwY:2NNqGCf6O7n
TLSH
T1ADE1FAB2DD45C5C9732371842B113901275F8C89AB4D80EAF3CC978BE4CDE998B5AAF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-129-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/1032-725-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/1984-12-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/1984-11-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp

Download

memory/1984-10-0x0000000000040000-0x0000000000056000-memory.dmp

Download

memory/1984-788-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads