Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 09:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe
- Size 2.0MB
- Sample260810-lpdrsseq3x
- SHA256 b4108c149a408079d5afa5e883add6c3f253a755dd179888062702fb4e41eade
- MD5 bbcdb7a25c6b55886c094cc8bab5cc85
- SHA1 f1d1eadc64b57abe9358ca9f9f5eb52be0455f78
- SHA512 3edea067a0149d796a6043cede83302e395705b4ff308e5826c8e19f274bc3e6190106527793e4619a82bb9c4aa3bb8ba25fb3e648495f80b55db70f8add2632
- SSDEEP 24576:E9ogTqRHcCdOYtaZR9/uwZM49HkA8N/JYiToIlO70oD:GWR84taZfRZM4dRw/tTMV
- TLSH T138A58C07F65544E9C05AC178CB46C632EA71BC8A4B35A9EF13906B163E76BE01F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 4 IoCs
resource yara_rule behavioral1/files/0x00070000000243ed-2.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x00070000000243f0-12.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/3056-13-0x0000000000090000-0x00000000000A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x00070000000243f8-57.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Executes dropped EXE 4 IoCs
pid Process 3056 audiodg.exe 3224 shost.exe 4752 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe 4592 audiodg.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: shost.exe File opened (read-only) \??\J: shost.exe File opened (read-only) \??\K: shost.exe File opened (read-only) \??\M: shost.exe File opened (read-only) \??\R: shost.exe File opened (read-only) \??\E: shost.exe File opened (read-only) \??\N: shost.exe File opened (read-only) \??\O: shost.exe File opened (read-only) \??\T: shost.exe File opened (read-only) \??\L: shost.exe File opened (read-only) \??\Q: shost.exe File opened (read-only) \??\S: shost.exe File opened (read-only) \??\V: shost.exe File opened (read-only) \??\W: shost.exe File opened (read-only) \??\X: shost.exe File opened (read-only) \??\Z: shost.exe File opened (read-only) \??\G: shost.exe File opened (read-only) \??\H: shost.exe File opened (read-only) \??\I: shost.exe File opened (read-only) \??\P: shost.exe File opened (read-only) \??\U: shost.exe File opened (read-only) \??\Y: shost.exe File opened (read-only) \??\A: shost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe shost.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX24D1.tmp shost.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe shost.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe shost.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe shost.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe shost.exe File created C:\Program Files\CopyConvertFrom.exe shost.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX4B1E.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX21DB.tmp shost.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe shost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX41F6.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX19CD.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX1B43.tmp shost.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe shost.exe File created C:\Program Files\Internet Explorer\ExtExport.exe shost.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX2631.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX26B1.tmp shost.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX289D.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX11FD.tmp shost.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX286D.tmp shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe shost.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe shost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\RCXAF8.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX5443.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX476C.tmp shost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe shost.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX1A50.tmp shost.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe shost.exe File created C:\Program Files\Windows Media Player\wmpshare.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe shost.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX154C.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX2463.tmp shost.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX5422.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe shost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\RCXBF7.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe shost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4368 wrote to memory of 3056 4368 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe 86 PID 4368 wrote to memory of 3224 4368 2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe 87 PID 3224 wrote to memory of 4592 3224 shost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
PID:3056
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
PID:4592
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe"2⤵
- Executes dropped EXE
PID:4752
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zG.exe
- Size 377KB
- SHA256 e6ac9e4c3a61f84fab7edc62605d3339e06c1d519b585ff64b8f86db38267e63
- MD5 47f0bb9cd9d5e2bf506809736bf367f3
- SHA1 07208d0d89079d895288a4b415ba72621835f9fd
- SHA512 334457b134b66910b6d382b6529996984962ae4061eadda7d8a345e6ce844f7dad09bcfaf7a021460cdad5a93d5e42d12ee12240eb4d49e299e2419e4222f571
- SSDEEP 6144:p+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw:pYCDi50NiQOuysMFZzN/E/msup7s
- TLSH T1F0847C06F75408F9D59BC57489924596DA39BC8F0B72EAEF17C8422A2F237F08E39750
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcdb7a25c6b55886c094cc8bab5cc85_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm..exe
- Size 1.6MB
- SHA256 592f3f1fb6ee234d82e031c097101c94628767cdbb80a6579fe4d3fb5b1204c5
- MD5 fd73f9aacf36138310d6de07d5775425
- SHA1 20410adb97361b73277bc3c1c9e57906570ef784
- SHA512 943314ff927caf9aa063a6784dda151852d1e8527baffd6345495a5ad41050b2d05874aa1caa22b94553968a2284b145c4fec16e1d85c2147c0e356a4c3b8e9e
- SSDEEP 24576:MRHcCdOYtaZR9/uwZM49HkA8N/JYiToIlO70oD:MR84taZfRZM4dRw/tTMV
- TLSH T1C9856C07F26940E9C05AC178C746D632EA71BC894B65A9EF23907B163E76BD01F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\028441497323.ico
- Size 1KB
- SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
- MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
- SHA1 13470460552d9f4c465130d654b2095316b22854
- SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
- TLSH T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\032586866140.ico
- Size 1KB
- SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
- MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
- SHA1 0a18f23ef372593dee476bb852745b2490bc8421
- SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
- TLSH T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\076544272547.ico
- Size 1KB
- SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
- MD5 6ed58acd10d2c394c7638d5e4d4e4d04
- SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
- SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
- TLSH T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\076973982313..exe
- Size 268KB
- SHA256 a7f1ec482233f03892d238d24504f2950d583cf580c39acb9bdcbe928066cef1
- MD5 6feb00c9a2c3ff66230658b3012bab6a
- SHA1 01503f44c6ae7866dea94b04f08aaae77e3b459d
- SHA512 e039817de40a4530ff6e91aa8ce32ad4df1db24005c50bcdcd6fc35d7bf253130ed9342061a9e24815173ff5f637a7d0e65c32a6af02d992be47335a37fb99bc
- SSDEEP 6144:m/h/WmnJztI9KFpp8uyO+376c+Rg0pYbM0+IZHkO:m/h/WmJhI9Gpx+7lZ
- TLSH T1D04407A93BA88CE1D903917948A1D3B4F373B4524F21A74F6DA1C33F5F771A0AC19A25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\161012308392.ico
- Size 1KB
- SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
- MD5 3d272e20bb157f11d4ae75abc33aef1a
- SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
- SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
- TLSH T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\229987193487.ico
- Size 1KB
- SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
- MD5 aea8653be6803940e5f5017482ed8f31
- SHA1 83d770a087be76863aca353d9e394c29b126874a
- SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
- TLSH T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\300990798278.ico
- Size 1KB
- SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
- MD5 d91c5d1ab9c7e29648ace11bcb875f98
- SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
- SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
- TLSH T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\309422038496..exe
- Size 574KB
- SHA256 a4f22b40651e87830c2ac8f40b9c84d94bda6fe3a54641625b600c3ce2d7d8be
- MD5 7ee79b4d6cdd2e42a3d6fd2393f5031a
- SHA1 2e506b59e6ddb94ef9277631f9ab5b9adebd0bd7
- SHA512 a29a56643845ef43a8fe9fdaa0137b03be4f0c25998155b261423a3df1d5e8719a1e87f36be12245c1f1fa48479a7bf77c19c7f6fa6980c1b06e5663135d35d8
- SSDEEP 6144:Khny2oKzHNR+VKkt4id77JRBlh2zpu00e+1+e6dM+MTYnSYXMBb3YvKnpJIggewk:KRy2NzHmVraixzzAXtWASz3Y4HIbk
- TLSH T14EC4E65BEAB952E0C4FAD0748162A677FCB1B4898C319B039691D75F1F37B60AD2E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\363850158790..exe
- Size 2.4MB
- SHA256 de9903082cdf397fc2f6cb24ba226a61b4cc2e402d1ffa99c37f8871be53d1ef
- MD5 6f8eac2c377c8f16d91cb5ac8b8dbf5f
- SHA1 def53a43d9549f086ca9aa1bd6bc5bd9ecd48f81
- SHA512 28902d6dce20820a4cfea49e15dda559d4949b0f181db51bb089219ca7c22e0f5427186bd08c0d331c595c0282969630832df0e3b85d1cf315230288ce6a7c0b
- SSDEEP 24576:eNPyI2m8hBvM70K4W6pjyqn6Ma7rKpOcvPuGtmRM:0ydk7axpn6MJpOcvPuGtmR
- TLSH T181B56F56B758E496C8194678CDA7C7FCA771BC51EE2187037A90FB5F3E332A0AE18250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\573209476625.ico
- Size 1KB
- SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
- MD5 bdc7cdea596ddc3d6542f6eae40a3509
- SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
- SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
- TLSH T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\602235593244..exe
- Size 9.9MB
- SHA256 2892c988e54ab035646f9538f7493b0ddfe4541c358de28fb4a02fc32d8bdce0
- MD5 9e6de6715b85ad6920e1bef5a93b67ac
- SHA1 455b86f5977e5079568e1593ec057fd68c99e261
- SHA512 dc2fb39fdf5728169020a7aafbc32506e4ed53925e66c92d1017488531fef989e03db489f84fe4c6b9ebdeb6279b6c4a838b470b4b8a473b59ed3cc071a6b85a
- SSDEEP 49152:S9dka/cOOInuHWhH+9JYAwotWSgUZyHAB09ZPV2am7gNXTjyURvsS/MaNXgDOJQP:ChgWJvs2j5KqxSVCXcTsDYcvPuGtmR
- TLSH T169A649953B68C4D2D41285BA8CA6CBF9F271BC625E3023076992F71F2F370A19D2D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\612234607197.ico
- Size 1KB
- SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
- MD5 cb4265d1bed8a3606c50c3ace6452c94
- SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
- SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
- TLSH T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\642705761067..exe
- Size 109KB
- SHA256 108818ed973cfd2d73c374f6cb461639f39caf52bc28f8b7ceb7eab13d5d7b37
- MD5 edb5a5207a5eab205b99326572036d5b
- SHA1 ed941af1124f394b9384aa128da8f4674e6091d3
- SHA512 34a0c9c06d555c3579c175c7c0e2b47f1cc87d65a0127a641d4e058879fab949e874b7b054f21332de0f3386ff00483838bf221cbcbfde380b8eb465105e075d
- SSDEEP 3072:fxGqf2A2GlXUeHV62KbXPhSegdOKsbSR:fQqf2A/lXT62KbXpedsbS
- TLSH T13EB3285ABB6580F5D153A13CC4A6A2B5F3B6F8425C72574F5752C30F0F3B2A05E2AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\700670125134.exe
- Size 4.1MB
- SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
- MD5 2864c8b005a6414e2fa9b06c1e089dcc
- SHA1 3041fbd63ae570b537c38a315050c06aa566362f
- SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
- TLSH T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\713243289424.ico
- Size 1KB
- SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
- MD5 1af3523517c4a23a831af16191e71ba5
- SHA1 34674885738a8717def95b016697802778f0d520
- SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
- TLSH T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\851055152825.ico
- Size 1KB
- SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
- MD5 81e2b09e1f33b8c702aed3d14d341a13
- SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
- SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
- TLSH T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\875196578647..exe
- Size 3.3MB
- SHA256 be28b354497c31f2813a97217a3d61e075b03439d4d055c2ce904913de7080be
- MD5 56ac82018a550cf0c525f0c7891806f1
- SHA1 05e032e47e17dfb5dc51e275a16815985160c801
- SHA512 d93e0b15dd35743556a6f87567e883201cc5cfa066c809794df10e06988f31a068c34e4b15e6bebb2c0e3ae55541a6c516014783ed53f1153a51383399277483
- SSDEEP 49152:fd/c4qw9yAGTUsYUYhzlArlb3pvmk2rP3H8z066/OOe3nXZ4pQizEeZ6wdAyGJw:V/MJI0b3pvmk2rP3HtQAESMC
- TLSH T17CF53956FAB9C1E0C9BAD038C466A6B3F9B1B9869C3063135256D71F1F33A61ED2D310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\917560264955.ico
- Size 1KB
- SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
- MD5 4a3be9e27a938152348d20edbc4c08ee
- SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
- SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
- TLSH T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
- Size 62KB
- SHA256 b5265ebf73fedc1d0333fd4f72c7021eef1cd8b948b4e41969cdb2a3ef6bd35d
- MD5 83e0bdc6f86ef6d0c1d991f2b737ed19
- SHA1 52677f99fc860a5b9f2b29f3e536ff2ba168101f
- SHA512 4c298729be4e77edd165a5c52be40f022763a479777be1ae55809c8158649f3159c6369649e5407140b7dc9b111b8cc67c611fdedb0990b2d9f1c083068b6f11
- SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpbExJO1EA+Bdd:QE/msHasdDOFHbAMbExJO1Ebdd
- TLSH T1E6536C18BBE60125E5BF6FB158F53266DB39F6635903D62F28C602871A23E85CD006FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\shost.exe
- Size 375KB
- SHA256 31b75d348274e4cfd2793c52d52945e40b2b5ee6d7a6965553fadcf062865f39
- MD5 7999a5c7bbf9726315fa342210961d6f
- SHA1 be1d548469faba16985bc6e5fabbe06bd56701e5
- SHA512 af6e1a29a6451ff754f6d94a576fbdc2f835e63a39f26a5b3b65f94497c8ee5b17ab701d2e3ce2356e66ff3ff1318519b70a896b1b7f1773701e28d27695e16c
- SSDEEP 6144:j+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw:jYCDi50NiQOuysMFZzN/E/msup7s
- TLSH T127847C16F75408FDD59BC57489924546DA35BC8E0B72EAEF17C8422A2F237F08E39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\logs.txt
- Size 4KB
- SHA256 527c9953894805ec2866d2500f0e7a9e91704a54b2c842c8e7629370c6586928
- MD5 4b9c77b557d41dce181f389c0a0c8756
- SHA1 a0abac09891d2a9edad5c0c413a3a968bd0167ce
- SHA512 2157be83f0d67faa6fa557cab1a4bd82905c9709d41310f72df5274f422b30ea45987abdbc868b41be0e76e054f7b176c5403fa52d6a239d00674f93cbdf141b
- SSDEEP 96:2mW5WFWrWdWAW2W3FW3oeT8pi3Z8ZpRUF1VPmPr0ofwGbv:28wb3
- TLSH T19E91B9B1ED55C1C5732331802B113901365E9C896B4D80EAE7CC978BE8CEBD99B5BAF1
- MD5 SHA1 SHA512 SSDEEP TLSH