Overview

overview

10

Static

static

10

2026-08-09...rm.exe

windows10-2004-x64

10

2026-08-09...rm.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 12:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
  • Size 752KB
  • Sample260809-pv2mla1vgt
  • SHA256 0e434fd4f0deb6402ba052f8d80f48e8669a6e84bf6461c44b957d79bea697d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormpersistenceratspywarestealertrojan

Malware Config

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 32 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 34 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 12 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\Documents\diagnostics\audiodg.exe
      "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
      2⤵
      • Executes dropped EXE
      PID:3328
    • C:\Users\Admin\Documents\diagnostics\shost.exe
      "C:\Users\Admin\Documents\diagnostics\shost.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5968
      • C:\Users\Admin\Documents\diagnostics\audiodg.exe
        "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
        3⤵
        • Executes dropped EXE
        PID:5476
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5488
      • C:\Users\Admin\Documents\diagnostics\audiodg.exe
        "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
        3⤵
        • Executes dropped EXE
        PID:1280
      • C:\Users\Admin\Documents\diagnostics\shost.exe
        "C:\Users\Admin\Documents\diagnostics\shost.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Users\Admin\Documents\diagnostics\audiodg.exe
          "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
          4⤵
          • Executes dropped EXE
          PID:5640

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 924KB
        • SHA256 ffc72bb1e9202976cde3a4da052ec0f0a3ce73f2dd722b229a303fbde86fd4c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.3MB
        • SHA256 bc4aebd465efb2951081aeed269ca718d0f14fa9d4f53812ff4d6c6fb5100e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.0MB
        • SHA256 34ca345c5fbb23a91c98cc1fd2f667d450048b0a277d94a8b3b23e71b3e17a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX7576.tmp
        • Path C:\Program Files\7-Zip\RCX7576.tmp
        • Size 377KB
        • SHA256 80c9f0f720a09c4622f9f336be2d85bb34f6cc8f48f4d61f7a89019aa6bce8f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 390KB
        • SHA256 016fa688eb956fa1b5af320b2b57ef2d6de6af41624a7b6a4885c3cf6e4c5ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 657KB
        • SHA256 858d3b636752cf0c27771bc7774250fa79a2f6a1bf2ae6478b486193302b3fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 423KB
        • SHA256 c3cde6ac64a2e363d25baf65b1a6d4d0782a2c7e880cecf6352d7308b5f738aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 4.5MB
        • SHA256 48c57ae321ab8c75c4aeb2d37f36b2548aacf11fb95d5298b68f34e9e6701dd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 734KB
        • SHA256 531745076d56191304a0f12f324b3293f4c4785b8fbc2faf29e6638f0399f3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 23.8MB
        • SHA256 91f189786ec34e15a226025cbd8351bd6e67ca453fd8a2c9711acfd484bfa325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 2.5MB
        • SHA256 c450d3c742cb3574eaa3d74fe7b4a607ceefbd5a3856afda7b796642ef8fce2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 472KB
        • SHA256 ad0bf59db57d4622b82f526523339c9f714ba1e747442f59833fc30034efbd0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.4MB
        • SHA256 5db587cb305e770220039c9c44f5cff98eb9e872fff5b716cd9acb15f51e609d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.1MB
        • SHA256 664178a19900a3a4b47c7ba242ac322ddb770d55aea3f47b0c42483481a488d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 6.9MB
        • SHA256 234ff61c7407c6bfad932da4d5a07a3ac978c8eb5aad2790e22bbb84fda25b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 f0759c59fa535ad3b4bfeb9e368ad5630e45da22db2c13bc0d1ef3f01d23d1ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.0MB
        • SHA256 93f9317fa9acd2b403d1dcd26ab9ccc00c45d780b08842716465c69f7ba56be0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.2MB
        • SHA256 da7ed40ca413ad0caadfebb549ebe022a6f64c590852d1626ddf901306be38d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.4MB
        • SHA256 2bc8c07ba818a64e75f49c7a6431fb818c19e9fa38a2d3c1d88c265615fe7cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 1.8MB
        • SHA256 7eb10547d240c666c8697fe9ca92ffd8ba88168ceba9742f40ee5cf8e93d6010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 399KB
        • SHA256 4f91b31b76e51c9cffcb267af07e2684fb49680b3e73e013ea971d24a2138af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 399KB
        • SHA256 77ca995b1a42b5821d48b27788951f1f0499c2599b707f6e07b430ee763a0687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 399KB
        • SHA256 5520515745ef8228c65c66c611bc2c419f7b7ee6d8bee2e4ab7ea8e6946e14da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 419KB
        • SHA256 63291ac648784a0c0ad4d597722f9961884741a1d5c3e2801814216575c125fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 399KB
        • SHA256 d80a909c9f5fcd7833b1c271dcf4d4302680b71162c3adad27a0abb28bddfa10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 399KB
        • SHA256 169be75733f586b618632f416f8c0dda5ebd9120e45b85643b2e3a92aedeb941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 200B
        • SHA256 37b452ed84f4777ebb5a6130a6dd6e791729d1b5d5071244ee0dfa40493c408e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 37KB
        • SHA256 4c81b751b252d34156e0862052fc8c3f101998ca85e0f8604d6bab904ef33d03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 751KB
        • SHA256 c4cd233324e0b78f293760075c673db048ff88d5f5561574c6809a4538f0d552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 103KB
        • SHA256 439d23b45c2ad554157914df366a65a952f7f8c4fc765b938fae21c37049fbf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 660KB
        • SHA256 06eeac6dac5bcc3a149c3bd1a4f9a63c03f556d2aca8efb3cd7c551ddf291fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 287KB
        • SHA256 023868dda30767cbfe01a8e2c088f16e17388993159e3317453eb6c2bf86b11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 37KB
        • SHA256 08c0df68b694641a35055dac25ea853fb59f2166264a55f17dad9f89cb10a8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX8FE0.tmp
        • Path C:\Program Files\Java\jre-1.8\bin\RCX8FE0.tmp
        • Size 13KB
        • SHA256 8c35f069a4b6ecd3a2bce500c0ee15bc330cc2ddbae72c712e9936e90c9e8cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 37KB
        • SHA256 73820be29e141f5cbd2a3b27d2a83b18d74b212e4520d80743b5f51502f1ac20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 88KB
        • SHA256 b8f423aed617fa1b102e31a4ef6552f517129407db4e6839bdd7942c4e932e27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OLicenseHeartbeat.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
        • Size 3.9MB
        • SHA256 8c4af1ba75e06a44472cc92024560396b0862007a668400b1b20c06f9e932384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 519KB
        • SHA256 03b334ff6443d9c5febd0e539c2c123e640c1050bffa6463fdb7f93e90a1d50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 432KB
        • SHA256 f1b63770e45a3a1532cc0d7f7650141e8f4313723aa2adbdf32258e5a683b517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 440KB
        • SHA256 eed96c259f3174322f2db2b06395a477ea09844d00d62b6daebbbd93e949e5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 436KB
        • SHA256 8be3bd586f7494b7108c19c40aaa78018b042f8f363e763e1d34f9519529cc85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_25e0f3cccf321e1d9dd9529c4c310dfb_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
        • Size 377KB
        • SHA256 67a4bc4c574569f303cfcb258eaa706baf9ef3fb062e882e5e2c95368c3840f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        199752604875.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\199752604875.ico
        • Size 1KB
        • SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        356937133600.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\356937133600.ico
        • Size 1KB
        • SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        399183350170.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\399183350170.ico
        • Size 1KB
        • SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        428289090644.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\428289090644.ico
        • Size 1KB
        • SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        507122344983.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\507122344983.ico
        • Size 1KB
        • SHA256 99143e3c977916ae0bffcd76fb770cce778f63459bf49ab42b639bb4da8555c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        518658565983.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\518658565983.ico
        • Size 1KB
        • SHA256 9a6584c0e0a8cf98d3d7bd968a9ae54141256e454f1d7dabbc1e59b02be3f016
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        524667285403.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\524667285403.ico
        • Size 1KB
        • SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        579760819583.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\579760819583.ico
        • Size 62B
        • SHA256 2ab662eae228f6451f07fbb7b8e91711caa3309540bd7eb4d9cf2dc6904ba08d
        • MD5 SHA1 SHA512
        Submit Download

        579775615636.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\579775615636.ico
        • Size 1KB
        • SHA256 18749bf7cbeaf430807c30dca88b7b7514a65e8c5170f1bcabb548f375e493fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        586422472492.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\586422472492.ico
        • Size 1KB
        • SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        587865800858.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\587865800858.ico
        • Size 1KB
        • SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        634161580561.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\634161580561.ico
        • Size 1KB
        • SHA256 a742238dacdff4363a430dacedb364ff073cd4c1f1799badcc88f3b681d565ca
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        663854131483.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\663854131483.ico
        • Size 1KB
        • SHA256 b15cc5b7b654156b96c718da8c6a5402aa2d7afab332ec98038ce8a6b6efd052
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        700165456429.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\700165456429.ico
        • Size 62B
        • SHA256 f0cabbb3b1c107a8c455b233d6f6f9e2597ed2b35f52d438152314eb2c9f85db
        • MD5 SHA1 SHA512
        Submit Download

        724966127018.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\724966127018.ico
        • Size 1KB
        • SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        766211381891.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\766211381891.ico
        • Size 1KB
        • SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        905211267498.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\905211267498.ico
        • Size 1KB
        • SHA256 1c413336445e2b6d1de737844f2a298eb8eed23eb6a0671cefeb15caeb8eaef9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        927990589533.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\927990589533.ico
        • Size 1KB
        • SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        942136744068.ico
        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\942136744068.ico
        • Size 1KB
        • SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        audiodg.exe
        • Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
        • Size 62KB
        • SHA256 4fb072cd5e2bc7a1e8ffe3f12ee9a77b48bbf747e188ef21bd4b512342fe7611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shost.exe
        • Path C:\Users\Admin\Documents\diagnostics\shost.exe
        • Size 375KB
        • SHA256 9031ae233cfacf96d44dcf1c9a49efa2d15bf90a19b91b84647bc9543f175a13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 1KB
        • SHA256 96ef08ae1ff7aa19df4cb44f05671f33166f019038427d4adfc65e910c3a0ca4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 1KB
        • SHA256 a1446de079a1785777cb5e2a2791b6176447bd5784e4a1d57dfcc45dbc56f666
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 3KB
        • SHA256 7f5978460bc89f7cf45be2a608637ef0af0b310f97789e657935a42c7ef83e7a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 3KB
        • SHA256 fd43d4444196fb3e47047b1b637068d74941b207f66540f0910cded1cbdc3cfa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 3KB
        • SHA256 951fe4eb55cc3ac6adf10c58d509ea0bb3eb244e95ece59c458189a355f074db
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 3KB
        • SHA256 147c3896a0ed37f86b8c1cca5fc29963cb4cbc9ac75edf5a8acda24912c33467
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 4KB
        • SHA256 356324acc733bd88dfe2fe58cb7626e5b73b419877f2f4760093faceaf4cc79e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 5KB
        • SHA256 7a4a9ee3c9cfd805ed68d2cc56d3913314cf919c3395370def8daaa8f1b119e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 4KB
        • SHA256 10b38bea18b844783605dc67ccf77c63bf804e9f7244f3aee0b06f57ab2f93fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Documents\logs.txt
        • Size 6KB
        • SHA256 803e8f241be349d6c80331cbf89c777ce41764a57ead67bb719d8818a3f05ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3328-898-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
        Download

        memory/3328-13-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
        Download

        memory/3328-12-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
        Download

        memory/3328-11-0x0000000000BE0000-0x0000000000BF6000-memory.dmp
        Download

        memory/3328-10-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp
        Download

        memory/5476-869-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
        Download

        memory/5476-130-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
        Download