e0d3a02bed77f0b1ce83ea753ec80a201235e868f27e22e69d6d156b72182e28

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Size 752KB
Sample260809-pm286aad65
SHA256 e0d3a02bed77f0b1ce83ea753ec80a201235e868f27e22e69d6d156b72182e28
MD5 b9d46ead2d4d82a3efb23452956fbca6
SHA1 8e27cb3a23627732de51331fa06846b7d19f3f99
SHA512 51ba699910d926a65500a5b48ed8b9590a5314ca0794e094aa02cbfb9233abdd67b11a4b3ef947083967027a2f12133b9158d81d7b47b33577a8635f25ed7e79
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7sGYCDi50NiQOuysMFZzN/E/msup7sFc:E9ogT89ogTf
TLSH
T117F47C16F75408FDD59BC57489A24546DA35B88F0B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 26 IoCs

resource	yara_rule
behavioral2/files/0x000400000001b86d-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4168-11-0x0000000000110000-0x0000000000126000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001200000001c4f5-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c58a-45.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000800000001b896-128.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000500000001b314-152.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001100000001c588-154.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0003000000019c96-153.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000001c585-151.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000200000001b316-150.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c587-149.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c584-148.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c58c-147.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c586-145.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c589-146.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000100000001bb58-403.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c59d-398.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000200000001bb56-387.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d000000019c61-367.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001bb46-348.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c58d-214.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000001c58b-213.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0003000000019902-1047.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000300000001990c-1154.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0003000000019cab-1951.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001800000001886c-2616.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 7 IoCs

pid	Process
4168	audiodg.exe
5960	shost.exe
1228	audiodg.exe
5256	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
828	audiodg.exe
1084	shost.exe
5340	audiodg.exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\D:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\D:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\S:	shost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	shost.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX93E6.tmp	shost.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	shost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	shost.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCX77BF.tmp	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	shost.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX8849.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	shost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX619F.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\RCX7D70.tmp	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	shost.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX8899.tmp	shost.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	shost.exe
File opened for modification	C:\Program Files\7-Zip\RCX45EB.tmp	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX7154.tmp	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	shost.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4A0F.tmp	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6E69.tmp	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\RCX9D78.tmp	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX516E.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	shost.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9905.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCXB663.tmp	shost.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	shost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender\RCX820B.tmp	shost.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\RCX4C82.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6EF0.tmp	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	shost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4168	4348	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	89
PID 4348 wrote to memory of 5960	4348	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	91
PID 5960 wrote to memory of 1228	5960	shost.exe	92
PID 4348 wrote to memory of 5256	4348	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	95
PID 5256 wrote to memory of 828	5256	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	96
PID 5256 wrote to memory of 1084	5256	2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	97
PID 1084 wrote to memory of 5340	1084	shost.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Users\Admin\Documents\diagnostics\shost.exe
  "C:\Users\Admin\Documents\diagnostics\shost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    PID:1228
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    PID:828
- - C:\Users\Admin\Documents\diagnostics\shost.exe
    "C:\Users\Admin\Documents\diagnostics\shost.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Users\Admin\Documents\diagnostics\audiodg.exe
      "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
      4⤵
      Executes dropped EXE
      PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrServicesUpdater.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
Size 49.7MB
SHA256 be6fab3ba53c2e17b5707100dbc088b0a1a6fc8e4e86c7a0966012ea960a84ee
MD5 7de56c8ffaf67098351fdc47ed920956
SHA1 96d09be6ebebfed1832a96271d6ec68357466f6f
SHA512 333354b0d994d699b12b8f30acf18df41d795e986b360156da5193423ca96a2f4cafc42239668e788860f503a47c0c572b4de8512bb522ce2c8b864eae45ddda
SSDEEP 786432:+C1rq2/r+bqAzMmIn0BuTFE82gC1rq2/r+bqAzMmIn0BuTFE82n:+CRxj+bdzMT0GlCRxj+bdzMT0GA
TLSH
T125B72274861DA679FD3E82F51DCF02A688CA4DF15632F8C5F9925E384E2722037B5B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 428KB
SHA256 c0603b9ec1f0daba488f502bf960ed69670804dde38cb0f21c004d4c20837554
MD5 7803a997af8246c2b62d97f058da3745
SHA1 96bd2b73df77ef3d64dd1e59707429625950cc36
SHA512 07a91b2fade1f04b1e25a27913ca64cbb35ce8f06ec4fd4802c221403cb672656b9d1e3df29602e951ae3c409601fb94356dcefea5b7ebb0c484b288d54b61eb
SSDEEP 6144:uFQw98FQw9/Q81d3f+RysMFZzN/E/msHOtbSiqNsarwMFQw9B:uFfaFfNQOuysMFZzN/E/msup7sJFfX
TLSH
T17C948D13FB914EE2E4A6867008B157AAD676FC245F61D7DB2398421F0E767C08C3972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 924KB
SHA256 cbd70781b6b6eb4b440ae609c3049eb0c3143ebbfdb7997eb556a06896a8ec6c
MD5 43225e5954f6afc695663e613b19f4ba
SHA1 a38d29890ff54c1df39362f82a491fcfa6afc5e2
SHA512 ead3ba4b0047ce797f851f274c574c87fab1912ad8e7bb8855ed80b5ea485faab868978aa6408c1c737f592582f6e5e84416c5cd89f9c4b96fd36fb863ceafc3
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7sMXZNYVLeyUji0h90ZD0wxpGZIVuKrHsz:E9ogT70Le5ji0hmxNrMz
TLSH
T1DA154A16F6644775D073C0B9C5D2968AEE3234861B319ACF0389877D2F27BE58A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.3MB
SHA256 cf28349f4889a6ee6c0120485cc7553b25c13c90713f2f8ae2cfa60f69a27176
MD5 7b791a567ca1a5fd01eb903ace999344
SHA1 1a2a88e0ffacb514b69abd276e1b07eb283397b8
SHA512 d7aafbcfd773857a3f539654aeb166cb54be9493b71291aa603535cd6544c8af687147d01bff5507d53202e13a9922a5a901eed79dbb814067f86ce0e7555fa0
SSDEEP 24576:E9ogTBa7/ezSC6vUyD/aqgrvWx6q8wyux:G0/ezSC6vUzPvMHjyq
TLSH
T15F552A15F6788377D0B3D0B9C5D66A9AFE3234864B3089DB0246836C3E277E58A35739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.0MB
SHA256 fa6e4d42f9bdd95bae1c333fa86c8e168c27c81eaaf3972fdf66903592173c23
MD5 07caa15cbd095f7e56ad819ff83429e3
SHA1 c5b8cdf75dcbf2dbe55a464fabaf55272e97f26a
SHA512 f148d4a91b7804985f664b97ee3e648790febd8f4aa79dbe57a9975e512139198bac559e154cd517a3a7309b5e704c06cd87080d44b3d2e84af6ff7133b6e087
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7soVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0ImP:E9ogTzVbqPb88hv/l+7Y
TLSH
T1E4354B26F6648275D073C0B9C5D2969AEE3234464B31CACF0389876D2F677E5CA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX45EB.tmp

Path C:\Program Files\7-Zip\RCX45EB.tmp
Size 377KB
SHA256 e6ac9e4c3a61f84fab7edc62605d3339e06c1d519b585ff64b8f86db38267e63
MD5 47f0bb9cd9d5e2bf506809736bf367f3
SHA1 07208d0d89079d895288a4b415ba72621835f9fd
SHA512 334457b134b66910b6d382b6529996984962ae4061eadda7d8a345e6ce844f7dad09bcfaf7a021460cdad5a93d5e42d12ee12240eb4d49e299e2419e4222f571
SSDEEP 6144:p+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw:pYCDi50NiQOuysMFZzN/E/msup7s
TLSH
T1F0847C06F75408F9D59BC57489924596DA39BC8F0B72EAEF17C8422A2F237F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 390KB
SHA256 0a536176b0dcc2462cc38d73220b58c4550118786cb4ab98ba955f2460e622f4
MD5 7b7bf5af46dd59f3ce9ace6fc310d1a2
SHA1 995551439131240cdca46e20d23c34479706c090
SHA512 8a8c8ea430ab4b89a2f4fb3174e260dd8fbf716b2d1f9798a64ae50ae04a466237cf1271726556b1ff80647ed26fc8a3cc7ad2918beee0b99ed6adaeab2c2c56
SSDEEP 6144:j+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarwZa7H:jYCDi50NiQOuysMFZzN/E/msup7s2aH
TLSH
T1F2848C06F75408F9E5ABC57489A64646DA35BC8A0B71EEDF07D8422A2F337F08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 657KB
SHA256 b61798618198537b8ce5d043d9f5280aa16310ad43a064da6115500197aaeb36
MD5 48579ad8da592b0cd3b7deb2f92c10b0
SHA1 db623e376be7fdbdc4d79c3ebc9030a11572c9a4
SHA512 44cca2fd51c8afe52cf9eea30f6e1974db408b7794ab1c14ada8a3c47497d7f4ffef704eb88a1a1f5e0f5c209e6f8775c82652315719ee38ed21110820200b26
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7sneBNUbTVO86U+:E9ogTAJIU+
TLSH
T123E47E27FF24ACF5C57B897486928641DB3678650F21E7CFD2A8831E5F236E04E39A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 423KB
SHA256 638a4fa21732b208b86a4e35c18df4cbd0f780b7679242ca923d81dd5168f9fe
MD5 17444267edc6fa87b11e8226a973a33e
SHA1 5275500ec2edd32cfeda9e52b9bc3de8e346f42e
SHA512 7765cb620b73d967c2bbf47475fc589876e9d758c4a9980e2e81c6c9aee60474bc3d7904be637a0ffff063a6fd22ecf2d74a7d8d47091b56352834fd6962a951
SSDEEP 6144:j+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarwKcr0X9:jYCDi50NiQOuysMFZzN/E/msup7sFP
TLSH
T1DA948E06F79408F9D5ABC574C9A245469E39BCCB1B31EADF17C8422A2F237E08E39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.5MB
SHA256 f1dd5ea0cc5355b6f95fc4a4cfbf3666677632de1e1adf97f4a48d47ad88f32c
MD5 e5616e76dee60cd5eb44270a45df87ac
SHA1 d077ab5887fde4bc4c1eea20f645b19dc13471c2
SHA512 cc858dec8702d4ce8389dc669b85d3655e0a097eabb40389d3fabdfb1312f7d16dc91c80d0383d3996e21ccea45841c55fcba079fa972dd96489b353f4a53278
SSDEEP 49152:G7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tr:KQvGAdlCEL8c/bRNw5C6
TLSH
T18B266C65ABF880F5E0A7D178C97A86B2F77678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 734KB
SHA256 4cf1ac6cc52e3699ddf88e1c1311314a0d3c9e1dd255485d5489d5fa8a96833d
MD5 02ed03eba10c9107bac0746e3ea74610
SHA1 79bb524af8625b77bbc446a9d05576539bf23627
SHA512 ad2d90103177b2b6ea5f48da3f9bafa9f05c2f982b679d89cb73e23cfcb1da1a900c295b819c93fb67c6444f3d3e235388762fce517a5b4c509a502f490221f3
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7soAwSfxL/2Dc3jDLLmt0LDQewsAjRs:E9ogTEaewsAja
TLSH
T196F4AE21FB74C479C6BB49B04B628706993D78910F616ACFE3E84A5E1E313E05F39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.8MB
SHA256 13c5bee0eab50d55d35b42f10470c98090d59fe1158fbcd3c869638fb87f359b
MD5 331ed6d3c0c0e4b71d24535f06f3406c
SHA1 ee039a7a10217f5fe0ecd3617f33c417888e423f
SHA512 3fdd2eddd9ef408cf8abb17db016f613fb3368e93fa16dd8c97c851f2f11c45f977813111ee8ec68cfac908bcd66673b6099233ba594a4f7ccde6f0e88723eec
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJH2:GUEtQevvqc2W1cpV2XI322
TLSH
T188474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.5MB
SHA256 f769ac9dae590e06bfa5a2762eb4d3ec724840c1d3548d828e1b57f2c1210e6b
MD5 d5582c3c2477dafdeca4ced2131c6b5a
SHA1 df0f41912431fcbe1b8436385a9d3c550e31162d
SHA512 cc69d2d6491e0bb4f88e47df1ff7f99bb015847dac8e6a0ebb9cd299f9832c36ef5eed67c5c81221f38de028518a3eb27dbe50ad3edd235dca1c0224c8fe97f8
SSDEEP 24576:E9ogTECbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344P:G4CbRquA/m2yL5zbfFiV+XenmE3/z4
TLSH
T12FC55D19B7A881E4D1F6C77886A2C647F37178154B31ABEF4255461E2E33BE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 472KB
SHA256 cd0279b7c476494e8c98fcef83d0859ff5a75a66ee82d853de24104a416e8bda
MD5 5819b1f7149d50011290fb674204ca09
SHA1 3e3f1f94d8ffe5ec8f5de799eb92baf3cd58b6c7
SHA512 3dff5f5e9482b371119d2b695c28c9d6f9a6b0dd5952e550a6abfa70a37f25c55cdd9e4c61e8ce662f7a21243f865e8cb220f920bc7cdce87d03699a4310ad26
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7s2rZ1Iym:E9ogTPZuX
TLSH
T15FA49D06F79414F9D5A7C178C9A24646DB36789B1B32EBDF0798422A1F33BE04E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.4MB
SHA256 f9e8d9169ccf64c866b369bb56862a619700335216cd24e2111af5b20d82fd44
MD5 696fd535c5cbc32af08e175edde91da7
SHA1 2c7b0aba5dd8705a031fc402e34d3700ac64a8b0
SHA512 ee0cbafcf8c490723dfa8401cfba7dd387b0852ddea7866dccfd09207af09a6b3916a95d4b3a77aafc034b3473932c0c58bf8d685356bf07d741eda9688a4482
SSDEEP 49152:Gmj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd23v:GQRQyi36YOcP+Lvw2gAf+PN3Y
TLSH
T1F9666B13F3A501E8E05ED974CF3956229B357C4A8BB092EF259436E11E72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.1MB
SHA256 1f43bdb6b4b1224ed881d9f5ef7c59c9d272a002609d356c147b72f78b3af874
MD5 92c1752a9cb2d2b4309df67a13a2328b
SHA1 5e5e81da0958ff0ffb5e2fdaac41a2a5856ab339
SHA512 b09c38abc663ff5c8cfc925d422a7a47f00cecc591ed7952ca5247eb8afefb53366b1ee4221e98e6b55aabc1cd28a9cc6aab22ecb6f1f1fc9e8ef22dc1c7e3fc
SSDEEP 24576:/gT8wvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:Y+68Qg55nhoeWu7PNU3/Q
TLSH
T16CA52833B2F200A9C04DD1769F56872196E27C758FE1E7DB8145730A1FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.3MB
SHA256 fdb7492d2d20c13edf5e878cf1170576aff17912a576569894489803719453cf
MD5 73b1467e490fe959ee7c8307f9b98fca
SHA1 41b1c354afd688cb9ce3e7276fa7b5da05f439bb
SHA512 e6f279b0dda53c285f61f041ed151123914edc8a4cad4d9b127e1e801bc352a7485078e98be50b9ae8ec2ab70ce8e190901a638ea4a92f39adc71dd49d40a6b8
SSDEEP 49152:G71hpsNoJpF1A6GU44CwH7R4xXNoJpF1A6GU44CwH7R4xu:KmifP5RiifP5R7
TLSH
T145F58D13F29800E8D06ED1788B569622EA72BC460B35B6DF0A9077961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.2MB
SHA256 f183c096f5b9c39620722bb844095d43bfb3c9b586bb4249c4a54e8e0c66f472
MD5 ee189a78a591d554e1f43adda17e75c9
SHA1 c12d665cb189574ffee7bad1e030884f971a2092
SHA512 45151b2663e7cdf4034881c679f87ad0661dd57394ab12bf7fce234a9a4f1413458a13f85c2787e75ff6cc3c993817bf29b47dfa99a0df17b212da76e6b70480
SSDEEP 24576:E9ogTG4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6bR04FxGgVG2Onks6xt4bSMHnqO:G+SuZQIY0Be2K8RVtOnks6NMHqO
TLSH
T1D9B58D03F2E900E8E0BED67487665626EA72BC464B34A6DF068072591E77FE05F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.4MB
SHA256 2f7913c6e3e1a58cad09f19ae1c78e920afebb366551b18d4bc2f2acbfb16b59
MD5 04e29ce73d5893b07ea9c957273a5834
SHA1 d5ee94f76985f57ad124a8137bbfc69ebacfd251
SHA512 b6c711f0a674c1127df2367e2a8244dfaf98ff8bb143e89337b96107fabfe731f6cedbc175ee9e447a9c448b4b09e9f05cb6508710a1ae696f0122e7ed5f6e4c
SSDEEP 49152:G7yLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AD:Tm7vj1BDlZS
TLSH
T141F59D13F2D940E9D05AC07887569232EA72BC494B31A6DF0690BB562F77FE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.8MB
SHA256 87fd36be2a997125baa34b5a47132401de6202798f5ae70d49d5681fd16e687f
MD5 7bded55f94ba642c1656b1bed495c755
SHA1 8591c20813f3a5a97509b9dfbd89fba8c5d007dc
SHA512 2d2ec33bcfad0c780e2978cd996d6bde9f7ac1bf8301ee08acf9e7a0e36aaddb9ca923852b74f2a966efd07c228ff686df234fc32ba44eaca0b8c0ebe43119e9
SSDEEP 24576:E9ogTghiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QLG:GchtSn8EApI0fig1giDn0AP5wC
TLSH
T117958C13F29900E8D06AC178C7568632EA72BC560B35AAEF0A90B7561F77BE05F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 13KB
SHA256 66c960967c83a502ea383fe6327e39008b3c0e6879a93b11ccac189c6e334dac
MD5 fc89ba4b8c42473ef544b11b9eb3dad1
SHA1 eabf3c66575e42c911db0c51ad63064981dfb757
SHA512 eee46884dd2cd7cd5123ebb5f36ef76253927a38435d386b281eea63d476a3fb9cdd47251dd2c99aaa302b749962e03f706db6dd5a95a42d15e6e0eaad7c4140
SSDEEP 192:A0N3GqMzZe/14FJ7ZNaBDbK1FS5tf+i1ef:DtdGI14EKF5i1ef
TLSH
T19F523A06EEA209E7F31542B0C5A61289C8BD7E1BFB92839F776C41043F617503516AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 37KB
SHA256 655a8cf4116532d90f0f2f3a485c200574c2a432f99c54ea54044c12b0730706
MD5 140a13c90e80fbbff24958495ee46604
SHA1 1b178dc0b364442651eb67723fa61903f7940db8
SHA512 dc6410d34d26ebdc2af10c67c31838298963fbe184a242303d56340e7b5e1f2dd0aaa6b3009e5132cf16df7acf468f1ce02aa5b7f316402b1dfd1f844f4bd0e9
SSDEEP 768:c3VV/3wFZafp3VV/3wFZafsYiMPxWEk07:YVGafZVGafs7MPxR7
TLSH
T156036C06DDB608A6F2054670E4EA038ADDB97947BB9282DF776C81142F517803B6A7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 37KB
SHA256 4c81b751b252d34156e0862052fc8c3f101998ca85e0f8604d6bab904ef33d03
MD5 905cab03f9728462310fb780be616762
SHA1 fdf39c61a4e7257abbfe688613ef9b797b7d32e2
SHA512 24fe69257774ca62a7c8dd8eb0f5657b96f446f33592bce3f9f4d335dd917f249eb9d3966bcf6368d55e6bd2fcbbd8ea5a5fe263079479ec0163f7e9b93a0d86
SSDEEP 768:ZHVV/3ZFfIfRHVV/3ZFfIflYi69PxWECd:5VBIfxVBIfl7+Pxs
TLSH
T1E9037C07DDA608A6F60546B0E4E6138ADDB97A47BBC282DF336C81142F51780776A7FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 37KB
SHA256 454aaef17d019ed918c9cf07b6e8083dea11ae130e4698a868e65633d277f5eb
MD5 fe1b97a711b1cf8ecea16382c23a7ff7
SHA1 af1f389449730c67a717f0cd0815e7d07021d606
SHA512 6a2a0663d4e15eec78fc8625b624cd02a99775bd164790eb69c0ecad7bc899911265462af4649d5090f4ef2f5081f65a671384f3142de0f14db554864697cbaf
SSDEEP 768:PHVV/3JZFaUf5HVV/3JZFaUfbYiphPxWEHR:vVqUfZVqUfb7XPxj
TLSH
T1B9037D02DDB608A6F6054670E4E6078AEDB97A47BBC182DF736D81141F517C03BAA6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
Size 421KB
SHA256 6c10268d8440d48b39ec1bd3e3c1c4e6ed2a6a93f97ce90497bd6cc3ceff48ab
MD5 fb940216ffce1bd85b5948f24671f07f
SHA1 487824e18ef4572a4f8d426a0cf441e5c64fdc9f
SHA512 43916579955f25cb23b234f75a5135921e0aa9bbfd01b776fe03dd19385caca278ae94c8cdea764aa86bf185f0951ebac8f0f1c0b5d65541a84918671d202478
SSDEEP 6144:H+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw2uSiox6J7:HYCDi50NiQOuysMFZzN/E/msup7stVm
TLSH
T1B4949E16F75408F9D4ABC574C9A24546DA35BC8F1B72EADF1788422A1F337E08E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 376KB
SHA256 f21cf1257e8d2791fed46b6a6e6857fe52e7d8f3db1af8a8e8ffe6055a3e70ac
MD5 9aa65bdd66635ed0c0644fbbb8983dd2
SHA1 646e66f7df1608afe5a5a279c59dc578255c3777
SHA512 c011fa895f7c8a6bd1e6af05b693f39a4a895a365cf476b9365eca9c63bc57490cea953ba5ccee8f80037a1740f31f507918583c2ef8086d102615822f413e72
SSDEEP 6144:N+GpikDi50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarwA:dIkDi50NiQOuysMFZzN/E/msup7sd
TLSH
T17F849D05FB9408F9D49B8574C8A60646DA397C9B1B72EEDF17DC422A1F237E08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 37KB
SHA256 f6fdc158f90e8fbceb0014a78f210e474513839b562ed140fb67bb051d8fbb96
MD5 bbc7f5d40a76bc34dabde7a62b0db3ad
SHA1 2e73e6c5b969c8feb29d8bf2d5d8b8f3a56e82a7
SHA512 6afd26644f672e9ffbd33495ed1437055d987993eea29acc37adadcd15401119de917362422488d3e424d886a3c7eb81923d96e63bd0157a8076a1dfdda72215
SSDEEP 768:MHVV/3cFcUfUHVV/3cFcUfBYixPxWE4/y:4VLUfgVLUfB7xPx7
TLSH
T1CF037C06DDA60896F2054670E4E6038BDDB97A57BBD2C2DF736C81042F517813BAA6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 37KB
SHA256 2f85a8fca057b4a789c2dfbd7d41e8258b61bc60810dc58e315bb860f59f081b
MD5 a5c8e7d0ba865c6d1c92234962c15378
SHA1 8af3285340b88cf993077f6f5b0de845fdc4e060
SHA512 65bb4c97759568a142c95779417dd340342c22fdcdef3f3a3476edd0d60690ed35fba371b2f7f13730b2073d33c9b23b9adcbff8acbb657b9e309cb5c2b45452
SSDEEP 384:0/X5FVV/3gqKF5y/PefuIYi1o8Pxh8E9VF0Ny5QF5Qm:8HVV/3gFwGfjYiFPxWEHkb
TLSH
T154036D17CDA50C82FA064970B4D9069AD9B57A97ABC1C2CB732DC1141F817C17BEA2FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.5MB
SHA256 1491a7cde73a91f5484166520d05a7f070b0afc70fd78e0294ce52419844b584
MD5 10c42226429d69769cbc74e2c34da214
SHA1 5aaff14799a4f7313c5eb31269998b248b343751
SHA512 e1ffb11077de5499c5b83fe806809bb0eb29f37238e8130b592eb992ae0bc232c6377c7e6578eda7122a0dd98a5a68e37124cbe034fd3fb5ca850f9ea25343a5
SSDEEP 49152:spQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tr:qQvGAdlCEL8c/bRNw5C6
TLSH
T10E266C65ABF880F5E0A7D178C97A86B2F77678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate32.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
Size 176KB
SHA256 df6ce033dfbc710f47fba9e471f2950138b845bf2a6b55dbe1d1f90eabd088d5
MD5 152c05d9f5779aec7c496cf3905009c6
SHA1 860030a9a579886223a219c0813d700fe7485813
SHA512 7eded0580ab0f7a13a2af57edef22985270175fe18e4363728c61cca8d11e4a5dbc3120eea2a8f1490464897234e3e47ada0c5b4caa142fb884a124b7b85c555
SSDEEP 3072:v8oXN2vAEhk3ujDfkmmt0fSoD7EXG8ZiGF7xFAv:v80N2vAE+Bmmt0fSoD7KG4iGJc
TLSH
T127041976EDB6E537D3BF0DB82FF0D7544429A9214B8221D3E2B8879E0950AE11372D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
Size 12KB
SHA256 bcceab8f0a1cc305762d22b6a7864de1392e4f5a1419603b96d238473074ea65
MD5 5f0528d7a7f90b5e56fcb07e11bfccda
SHA1 400ae9c2db097b8e9e50bcb298fa3cdd34994f8f
SHA512 b130378608e14f50ff0e9b11ade7fdb5b11ca71cecbaf82fd2b8cacf04a2970eb57127acc0ed1a59abf08ebb70b6c201add814bdb88b44c3e1e2130940a63030
SSDEEP 192:q+K2ba5rz427hIdkz0MM2Y1b2GB+PNNRURW2r0D1W61l:oecU27hIaz0MxY1b2G8NDURW2rw1WY
TLSH
T1BB42C61CA7E84333E4BB977588F305836636BE436521DE2E18C5534E5C63B899A9233F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.ShowHelp.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
Size 38KB
SHA256 d6c7a2e0bb2727df69daf0816318d4b4b0fce852ae1633a9d24873912f6b72be
MD5 768f742409e0360dce50ab6521b709f6
SHA1 7542a9b0255c9d31b98205485f05e375c61f5d57
SHA512 c40c57fbd563555f61ef1f68d84863d1d1755e6c20abec77b29ef35cf937f3e402e614e2d9e56c6e4452a65149ba22282086c790f2e0e1b0f6fbceea1c78d104
SSDEEP 384:z70wgiZW/ePgCLcH2PaDWQVlnluONrPWWhj4Wo1wOpt95DKlx6UkEKGHbHRN77K7:zGiBNLcW+ZVllBPtG1f5DzEKGHb8
TLSH
T12B036DA58B7844C2E952A970C370FD23FC38B7972695A22F4766E5640E537C0BF24B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 519KB
SHA256 7c4a0d685c1da4a7d63740bf243fa6abf4c61d0fc028a52ad246d6ee15816f4d
MD5 3e75807403dff94917661fd9ce0e6277
SHA1 d495ee12db7d203914449aea58324a771ffd5d8b
SHA512 eea3565cfbdfc3dc9fda3c517766bcd2180c5fe0a7ac912efa2d2b199345fcd5a3a367de28be40c6fedb81083712af38114bfc4fafa7fd4b5392924de57bc747
SSDEEP 12288:jYCDi50NiQOuysMFZzN/E/msup7syXsf3n:E9ogTw3
TLSH
T17BB43806E75404E8D4AE8174CB924646BA377C9A47E1AADF17C4E23E1F326E04EF9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9d46ead2d4d82a3efb23452956fbca6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Size 377KB
SHA256 24592688d9966ae7bbcf1962cd5f445e10777ac95158d826ee738c7ad49c9065
MD5 2571947055a873b09da9f432823fea87
SHA1 3d1a09a7ee659bbe4eb70f78a1f0c6e1419a875e
SHA512 6b9f3d65f906540ee184d71722b4bc60e57e3a7ae8d7064aab534cfb5f6454baf655772f77ffcedc3c8e950eef6dc42f0485945bbaff2a9e3ac2328773fa1c38
SSDEEP 6144:p+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw0c:pYCDi50NiQOuysMFZzN/E/msup7sFc
TLSH
T19E848C16F75408F9D59BC57489A24546DA35BC8F0B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

137823671590.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\137823671590.ico
Size 1KB
SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
MD5 aea8653be6803940e5f5017482ed8f31
SHA1 83d770a087be76863aca353d9e394c29b126874a
SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
TLSH
T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
MD5 SHA1 SHA512 TLSH

Submit Download

174257549643.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\174257549643.ico
Size 1KB
SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
MD5 bdc7cdea596ddc3d6542f6eae40a3509
SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
TLSH
T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
MD5 SHA1 SHA512 TLSH

Submit Download

225690407193.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\225690407193.ico
Size 1KB
SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
MD5 3d272e20bb157f11d4ae75abc33aef1a
SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
TLSH
T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
MD5 SHA1 SHA512 TLSH

Submit Download

238305445254.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\238305445254.ico
Size 62B
SHA256 f0cabbb3b1c107a8c455b233d6f6f9e2597ed2b35f52d438152314eb2c9f85db
MD5 6f73694b41567963c8e86b9de78778a2
SHA1 8effabe5dc88ebdf672765a42d7e269836db7ab7
SHA512 81e155b322af7b91e7bf45d1b1f792615c87d5a7e4b80a0729a94e95abfe77f882349fbcaf0c7cc6c49ae8a3d1a2785f391b823fb22b3a36e6b12a80e6efcd44
MD5 SHA1 SHA512

Submit Download

271948306198.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\271948306198.ico
Size 62B
SHA256 2ab662eae228f6451f07fbb7b8e91711caa3309540bd7eb4d9cf2dc6904ba08d
MD5 d78899ea3032dc5fcbb8d97c915537a4
SHA1 8bb1ba75d291cae9704a2b6ea67fad30476ee73e
SHA512 96a7d7354910fc1df6ddc04e7ff79af177df397b6fbc2fa52348ea3d0eaed5a3fca9458563321046b0f101a42573bd57f42fa09ecb36c021f5766779b8e85825
MD5 SHA1 SHA512

Submit Download

376280935117.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\376280935117.ico
Size 1KB
SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
MD5 cb4265d1bed8a3606c50c3ace6452c94
SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
TLSH
T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
MD5 SHA1 SHA512 TLSH

Submit Download

444689487122.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\444689487122.ico
Size 1KB
SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
MD5 6ed58acd10d2c394c7638d5e4d4e4d04
SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
TLSH
T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
MD5 SHA1 SHA512 TLSH

Submit Download

473304754014.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\473304754014.ico
Size 1KB
SHA256 18749bf7cbeaf430807c30dca88b7b7514a65e8c5170f1bcabb548f375e493fe
MD5 fab1ec8207037349470a004224fff883
SHA1 ce82654b651ddbeca904c5fd4128c2d229bd34e7
SHA512 1987032071bc2afd3802a59559b52a3a39ea12a729b1f8d97cf2893504242159a66da80e20f0ccf9176f337d890322f6ebec1c6212ce2058778721c9a3144491
TLSH
T1D8216BC0659093DBDC239A7610D4C5520A7DAFF645BD2AD0B8877B3AEDFD2282621097
MD5 SHA1 SHA512 TLSH

Submit Download

570758604096.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\570758604096.ico
Size 1KB
SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
MD5 4a3be9e27a938152348d20edbc4c08ee
SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
TLSH
T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
MD5 SHA1 SHA512 TLSH

Submit Download

572790983719.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\572790983719.ico
Size 1KB
SHA256 99143e3c977916ae0bffcd76fb770cce778f63459bf49ab42b639bb4da8555c6
MD5 1242320e51856e417a3b897993ed3862
SHA1 1a8e37c65a34144d55e135dbe5c80f1d3cb54995
SHA512 7e362214be096890c16bb2d19ad6119d8e441b25995221a02e10a9a7bb62b83f10f3df8b5e20444ee2c068fca8153097f12d098f15f71ca550121a6642e5f425
TLSH
T14D2112C4FF993060D8D9F735F395AA0A5766F2C298A40684105DFC69BCB84247847E39
MD5 SHA1 SHA512 TLSH

Submit Download

607607913840.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\607607913840.ico
Size 1KB
SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
SHA1 0a18f23ef372593dee476bb852745b2490bc8421
SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
TLSH
T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
MD5 SHA1 SHA512 TLSH

Submit Download

676385138467.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\676385138467.ico
Size 1KB
SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
MD5 81e2b09e1f33b8c702aed3d14d341a13
SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
TLSH
T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
MD5 SHA1 SHA512 TLSH

Submit Download

715697174570.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\715697174570.ico
Size 1KB
SHA256 b15cc5b7b654156b96c718da8c6a5402aa2d7afab332ec98038ce8a6b6efd052
MD5 eacc2d68b6aac8c25d01a76fd292ebf8
SHA1 90bae45731dd564088bf7fce380e39266bea02b4
SHA512 ad8760c2c91c46238f9b80f85074ae3574bfe7bdb0d2b9ac85e94349e82d5d70f2adc6762beb07d0747794a571febd96bf5e08ea9b3bc44bcd789e0d0043c3a2
TLSH
T18B21A459BA5CD77BC0653330D5170BF529709D01D86D472FB7053E8AF8B4A0409D9994
MD5 SHA1 SHA512 TLSH

Submit Download

716444366922.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\716444366922.ico
Size 1KB
SHA256 1c413336445e2b6d1de737844f2a298eb8eed23eb6a0671cefeb15caeb8eaef9
MD5 b6045946e2c0f888d84de0df859c0c16
SHA1 cadc6a9281b18084c29ab4ef552ac382fe3c5ddd
SHA512 9ca39d615c37a455fb43c0d6aa9210c10b341bcd685bc053965022cc4cf9de0f03737d0f9d0c894ea526f3537b87769e59245fc259f976473c029fe49fbfc8ab
TLSH
T13021898DFC4945CBFC9207B0B87E2C9655749C029F6C982A01A178878C30215C362E4F
MD5 SHA1 SHA512 TLSH

Submit Download

748876900161.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\748876900161.ico
Size 1KB
SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
SHA1 13470460552d9f4c465130d654b2095316b22854
SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
TLSH
T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
MD5 SHA1 SHA512 TLSH

Submit Download

779304776193.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\779304776193.ico
Size 1KB
SHA256 9a6584c0e0a8cf98d3d7bd968a9ae54141256e454f1d7dabbc1e59b02be3f016
MD5 88c3118c4f877d50855cd23644fef184
SHA1 4a05378db5fc432be7587da1e25e8f7e73e548ee
SHA512 71a681b3a2db9a80059ecb41be03fdab98e1a831ca920cd9a5e05f1aaf6fab709dbcb70ac2c0f1e7705f72bae5d43acf0d7013a6de5ad3bc7c47498e90b0ff2d
TLSH
T1CC21CE07D5D408A0E663F93A2489E4E747346DADACB21B6636DD2017267C93FCA035E8
MD5 SHA1 SHA512 TLSH

Submit Download

823995291514.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\823995291514.ico
Size 1KB
SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
MD5 d91c5d1ab9c7e29648ace11bcb875f98
SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
TLSH
T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
MD5 SHA1 SHA512 TLSH

Submit Download

839347205737.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\839347205737.ico
Size 1KB
SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
MD5 1af3523517c4a23a831af16191e71ba5
SHA1 34674885738a8717def95b016697802778f0d520
SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
TLSH
T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
MD5 SHA1 SHA512 TLSH

Submit Download

895240739441.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\895240739441.ico
Size 1KB
SHA256 a742238dacdff4363a430dacedb364ff073cd4c1f1799badcc88f3b681d565ca
MD5 5ffda0c41775e66798bfda13857ae248
SHA1 bb3cdc63843e60b3684185fbdb9db5d7bdba2665
SHA512 5818090b0188ce2f6b8f07598112eb838f5f320bbe364ebaecdbb208354c68c30b2a9bcfd32611b137b162d1c3af19f71977c2564ef91d7816533b3aa04f535e
TLSH
T12721F583B780C9C8D510C7774356D86D4A17F4E59056124B28D678235FCB269302A6AF
MD5 SHA1 SHA512 TLSH

Submit Download

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 b5265ebf73fedc1d0333fd4f72c7021eef1cd8b948b4e41969cdb2a3ef6bd35d
MD5 83e0bdc6f86ef6d0c1d991f2b737ed19
SHA1 52677f99fc860a5b9f2b29f3e536ff2ba168101f
SHA512 4c298729be4e77edd165a5c52be40f022763a479777be1ae55809c8158649f3159c6369649e5407140b7dc9b111b8cc67c611fdedb0990b2d9f1c083068b6f11
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpbExJO1EA+Bdd:QE/msHasdDOFHbAMbExJO1Ebdd
TLSH
T1E6536C18BBE60125E5BF6FB158F53266DB39F6635903D62F28C602871A23E85CD006FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shost.exe

Path C:\Users\Admin\Documents\diagnostics\shost.exe
Size 375KB
SHA256 31b75d348274e4cfd2793c52d52945e40b2b5ee6d7a6965553fadcf062865f39
MD5 7999a5c7bbf9726315fa342210961d6f
SHA1 be1d548469faba16985bc6e5fabbe06bd56701e5
SHA512 af6e1a29a6451ff754f6d94a576fbdc2f835e63a39f26a5b3b65f94497c8ee5b17ab701d2e3ce2356e66ff3ff1318519b70a896b1b7f1773701e28d27695e16c
SSDEEP 6144:j+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw:jYCDi50NiQOuysMFZzN/E/msup7s
TLSH
T127847C16F75408FDD59BC57489924546DA35BC8E0B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 1KB
SHA256 96ef08ae1ff7aa19df4cb44f05671f33166f019038427d4adfc65e910c3a0ca4
MD5 3fc652b1fae8e455917c28243a54ab9e
SHA1 5807f95c4fb68da01959d6e03915cefc8cda56af
SHA512 021d70cc34292adc93033d69aed02f02dc4c0f6fe15069515886fd00ebce1057403b92e50f97489dc25e4df08e5ae68eba176de1a0fdc22bb8c44f8be0206b63
TLSH
T100110810F460D0447127305027207D023699DD9BAB4A95BD938DB39EE44EECE8BCF9F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 1KB
SHA256 2209fdc2055d4637fe1ed832378fd848e98555423f531f3ebde419b029f35493
MD5 9443793ce9ff8e4a9303a1af491f40fd
SHA1 56d7bbd84e701e248c870046978cb96c3de457a4
SHA512 94a8bfe2cce6de0578f7fc2fa8cbcfc5f0b6f31546c6162a9f1ad20f8f5eb389967d9758dafcc2ecbd2168a9849041c66008fca7a898fdd829df3287e39a9e71
TLSH
T1DA21D320F5A0C0457127305027213E02329DDD9B6B1994BD978DB39EE44EECECB9B9F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 2KB
SHA256 7acd1c90c131e7a81d45bab17be3986c93afae37ba47840711925068806bfc25
MD5 5a8868a6dad7f2115ab83992e3f5eade
SHA1 c9b45b5542bcf80c73e51ea8894eef2dc7544a8d
SHA512 8e98675ddac437dbd9bc8decb55d0caf4416275d216de54e7f74115bf7c633246647e1d18e3eb5ba34b76ebbda4466453a1a333f459569197f64bced4d30ad5d
TLSH
T10151F361FA90C18A7233315427217A02319DCD8B6F09D0A957CDB78EE08DEDDDF8A5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 2KB
SHA256 afb284ce7fd713bbcf860e3ea6bccf7d5cae08c05fa0c506d9ee4f7eb9e39635
MD5 6590056c7fda84f9a5bf64b224a40a43
SHA1 4cb6015971d14009623561a1d04367efc07f5d38
SHA512 9ae15f88126b5fe22c52e2143c26506e7e819707dd33e5ae122d1053f520ea2d4239abae3fc8665dd3e118e6c68f974b982a3991f85250fb7efbc6314cb178e2
TLSH
T11751E561FA90C18A7233315427217A01319DCD8B6F49D0A957CDB78EA089EDDCF9A5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 2KB
SHA256 0b57eadb857c8830beef0ec241f0c835c095a6a2fd72f61c46bfbb353c5b291f
MD5 29f3208de415689da057a3a21b0c9060
SHA1 457bbc29e688644579a6c914c01cb063f3260ae4
SHA512 86f8e6ee8fef15150745b326d2970aba85c93dd32d099c229c99496f0675d67c87bf08de633942c74986a294883bd1292455d80b7af23291e8d72f84d6062976
TLSH
T1B241C461FA90C1857237305427213A02319DDDDB2B09D0A9578DB78EA44EEDECB9B9F2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 3KB
SHA256 e7371487111da4ceb954f5d4c8ecd284c9a93b9d269bbce3e6ceaa071266c822
MD5 cdfbd8a0080055490a881256fa0fedb7
SHA1 72ab0f60c13262712bd186c5db92ce6b848b92c2
SHA512 31f54842c8c1e542b559b9cff007ff6c331e849702908945a0a1a71076809c3afe88fff75d49f96b853ad3e3960c331e49cf6939c35e0fb745a852f7b006204e
TLSH
T1B3716E61FA94C0C97233315427227A01355ECD8E6F49C0A957CDA78EA08DEDD8F8E5E2
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 4KB
SHA256 445dbc154d5e22a7dec12ff1447add40983060ca6608102e4746b450fe0ac440
MD5 ccb9935cea6b3526c7338040d0b89983
SHA1 209d53267179bb65236d5161dcc250ee0622c330
SHA512 6ab458ae5581092809aee8fdd0a0058f17feec81493d9f60d7f58bb0ddfe6fe2c62b13aa90d2b1eb47455f0cb2544d00a78d220833079f6a358f376837bb6671
SSDEEP 96:2mW5WFWrWdWAW2W3FW3NprW3FW3oZ8ZpRU3Z8Z6oRxVPmPdY1FYSPm4FY1XYnSrO:2CPGdKHPEX9O9
TLSH
T1B0A19FA2E945C0CD7323715513123A01365BCC8EAF48C0E9A7CD978FA0CDEDC8B9A6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 4KB
SHA256 70c0ee0b5d677e7bda0ca1e482e2497cb6fbfbd09c766af9f12b86b49fc40960
MD5 d7f50b42bbe70ec22527a02c9f157c0c
SHA1 c4f722ac6dcb66d3417d7883d63d1d411a970e0a
SHA512 a06015d8a571c2fdfce5697cb35313e50b1ee871347f9410c0d4778b4e4e4374ee1142d8ead073e5aca5a48a42fb4acefe66f48feb58784906f4d42f5ba2c4e5
SSDEEP 96:2mW5WFWrWdWAW2W3FW3NprW3FW3oZ8ZpRU3Z8Z6oRxVPmPdY1FYSPm4FY1XYnSrb:2CPGdKHPEX9Ow
TLSH
T146916DA2FA95C0CD7233715527127901355F8C8EAF49C0A657CDA38BA0CCEDD8F9A5E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 4KB
SHA256 d651b7f44a7e2dbf3f108ee9829e4a8051181e51a02e41d7375f41c5ccc0d548
MD5 adbd3c06b37273cdf696ccf1b2e27d29
SHA1 ea4b750837f51f2938d607249d5d9973976013d7
SHA512 f411580e066c96033fad25b09940a4bbc3bc0cf5329ec42229095a71413cca026c3eb2c1e1f1d125617109918f1ac4279ded5d6f100dcf18e42ad1388b63d912
SSDEEP 96:2mW5WFWrWdWAW2W3FW3NprW3FW3oZ8ZpRU3Z8Z6oRxVPmPdY1FYSPm4FY1XYnSri:2CPGdKHPEX9Ov
TLSH
T1BAA18FA2E955C1CD7333715513123A01365BCC8EAF48C0E9A7CD978BA0CDEDC8B9A6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 5KB
SHA256 a15fb86557751f1de734a65c09f256685994f8ff14fe2bd9253fbca40e3b2e79
MD5 43a41fbe7efecb079c71fb60db7cbd40
SHA1 d1caf6f9abd5a3f7bf3ceb78f111fbc1dd6819a4
SHA512 01a1a69f194a3833b4e80923dcddd64e712362200873bd75fe919b8495b3ede4335589a40cdffae4a86f1048748f81cd8f15714512e177c6fe0dd96b2d4c5ac0
SSDEEP 96:2mW5WFWrWdWAW2W3FW3NprW3FW3oZ8ZpRU3Z8Z6oRxVPmPdY1FYSPm4FY1XYnSrw:2CPGdKHPEX9Or
TLSH
T1D9B19FA2E945C1CD7323715513123A01365BCC8EAF48C0E9A7CD978FA0CDEDC8B9A6E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 5KB
SHA256 8f5b057ac8cb2cf791a7a256e30d2a258cf9fe60f799ade8bb88d153f8a4d873
MD5 fa582158d3e1f865253cd5a22b2baec2
SHA1 8b9ebbad5d7b5c0e7a16849ccb254dc5a1e1de90
SHA512 69439c67bfce17cd50fe82a9e5d6178bf9ed85aacb0e3293e194809bf238eaee9a9f8281bfc9237f5bba8d913aea78e442421a23b9d46ad59bb03edf8bcc0a5f
SSDEEP 96:2mW5WFWrWdWAW2W3FW3NprW3FW3oZ8ZpRU3Z8Z6oRxVPmPdY1FYSPm4FY1XYnSrx:2CPGdKHPEX9Om
TLSH
T143B17B92E945C1CD7323755413123A013A5A8C8EEF48C0E9B7CD978BB0CDE9C8B5A6E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 5KB
SHA256 a51c3ee557b136d0bd25427feb37a131e8dd6a110e9f3c04333ab0d5a52066eb
MD5 e7acfae67dd2d785eb9e2c104a081617
SHA1 7613b7d466765b69a1642b3d7dd3d27d5f8a5712
SHA512 35917b9c8dce465ac526d86ef003cb1117139f424afd0ae19eb9cd3a0c95f6c0dce03badcaae84147b543e75ffca9561f9199dfe71376fd350679be1a77a3705
SSDEEP 96:2mW5WFWrWdWAW2W3FW3NprW3FW3oZ8ZpRU3Z8Z6oRxVPmPdY1FYSPm4FY1XYnSro:2CPGdKHPEX9OXB
TLSH
T1D4C17BA2E945C1DD7323755413123A013A5A8C8EEF48C0F9B7CD978BB0CDE9C8B5A6E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-260-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1228-692-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/4168-703-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/4168-13-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/4168-11-0x0000000000110000-0x0000000000126000-memory.dmp

Download

memory/4168-10-0x00007FFC9299F000-0x00007FFC929A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads