Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 12:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
- Size 384KB
- Sample260815-phackswbrc
- SHA256 624e56aa79043cfe3e6fbddb05164eb613b570f2068ae14cbf644e181b3e826e
- MD5 74cff92db39317c1a87c83c2117a456e
- SHA1 5ffb6697f7f792bddd5868a026db041703724da0
- SHA512 2d00bf710b8e96c5f0d2335c34fe2108dcff79abc23140cf3917c6fb9f089bebd236492635534f1edf7695013ee6a68b7170cb4ea0d07c104635cded421e6595
- SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarwfQ:jYCDi50NiQDuysMFZzN/E/msup7sIQ
- TLSH T12F848C16FB5408FDD5ABC57489924546DA35BC8E0B71EAEF17C8422A2F23BF08E39750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 4 IoCs
resource yara_rule behavioral1/files/0x000700000002465c-3.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x000700000002465e-12.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/3564-18-0x00000000001F0000-0x0000000000206000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x0004000000022b40-69.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Executes dropped EXE 3 IoCs
pid Process 3564 audiodg.exe 2060 shost.exe 4508 audiodg.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: shost.exe File opened (read-only) \??\T: shost.exe File opened (read-only) \??\V: shost.exe File opened (read-only) \??\X: shost.exe File opened (read-only) \??\Y: shost.exe File opened (read-only) \??\A: shost.exe File opened (read-only) \??\B: shost.exe File opened (read-only) \??\E: shost.exe File opened (read-only) \??\H: shost.exe File opened (read-only) \??\R: shost.exe File opened (read-only) \??\G: shost.exe File opened (read-only) \??\L: shost.exe File opened (read-only) \??\M: shost.exe File opened (read-only) \??\O: shost.exe File opened (read-only) \??\W: shost.exe File opened (read-only) \??\Z: shost.exe File opened (read-only) \??\J: shost.exe File opened (read-only) \??\N: shost.exe File opened (read-only) \??\Q: shost.exe File opened (read-only) \??\U: shost.exe File opened (read-only) \??\I: shost.exe File opened (read-only) \??\K: shost.exe File opened (read-only) \??\P: shost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX97D8.tmp shost.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX8CF4.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\RCX70CA.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX755B.tmp shost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5BA0.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe shost.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6376.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX6CE3.tmp shost.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6AEB.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6613.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX9512.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX9616.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXA312.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX769A.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX782C.tmp shost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\RCX5EB0.tmp shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe shost.exe File opened for modification C:\Program Files (x86)\Internet Explorer\RCX917D.tmp shost.exe File opened for modification C:\Program Files\Internet Explorer\RCX63F6.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX75FA.tmp shost.exe File opened for modification C:\Program Files\SwitchStart.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6714.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX8C40.tmp shost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCXA3C3.tmp shost.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe shost.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX66D3.tmp shost.exe File opened for modification C:\Program Files (x86)\Windows Media Player\RCXA426.tmp shost.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6764.tmp shost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe shost.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXA2D2.tmp shost.exe File opened for modification C:\Program Files (x86)\Windows Media Player\RCXA437.tmp shost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe shost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX6BCF.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX91AE.tmp shost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3416 wrote to memory of 3564 3416 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe 86 PID 3416 wrote to memory of 2060 3416 2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe 87 PID 2060 wrote to memory of 4508 2060 shost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_74cff92db39317c1a87c83c2117a456e_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
PID:3564
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
PID:4508
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\RCX5A43.tmp
- Size 377KB
- SHA256 b1da7d95f7f1c8d2281f783ffd841242625f4aa7a66ead2b2520233fa4b8cf00
- MD5 d3afc34062f2fb3a54a224d696bc6c26
- SHA1 47715c2203625eb2e296d846bb797ba3e81ea479
- SHA512 6df54b6c15f305bf3d72341c5cd887a0f26a0f51ac11dd47452071d51eb17db850c37995e201a027832d96f0958e1b74ffd51422786b3700b4e4dd74a2611274
- SSDEEP 6144:p+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarw:pYCDi50NiQDuysMFZzN/E/msup7s
- TLSH T182848C06F75408F9D49BC57489964556DA39BC8F0B72EAEF17C8422A2F337E08E39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\101683838837..exe
- Size 109KB
- SHA256 108818ed973cfd2d73c374f6cb461639f39caf52bc28f8b7ceb7eab13d5d7b37
- MD5 edb5a5207a5eab205b99326572036d5b
- SHA1 ed941af1124f394b9384aa128da8f4674e6091d3
- SHA512 34a0c9c06d555c3579c175c7c0e2b47f1cc87d65a0127a641d4e058879fab949e874b7b054f21332de0f3386ff00483838bf221cbcbfde380b8eb465105e075d
- SSDEEP 3072:fxGqf2A2GlXUeHV62KbXPhSegdOKsbSR:fQqf2A/lXT62KbXpedsbS
- TLSH T13EB3285ABB6580F5D153A13CC4A6A2B5F3B6F8425C72574F5752C30F0F3B2A05E2AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\131918610365.ico
- Size 1KB
- SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
- MD5 1af3523517c4a23a831af16191e71ba5
- SHA1 34674885738a8717def95b016697802778f0d520
- SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
- TLSH T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\155626073795.ico
- Size 1KB
- SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
- MD5 6ed58acd10d2c394c7638d5e4d4e4d04
- SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
- SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
- TLSH T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\189740064750.exe
- Size 4.1MB
- SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
- MD5 2864c8b005a6414e2fa9b06c1e089dcc
- SHA1 3041fbd63ae570b537c38a315050c06aa566362f
- SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
- TLSH T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\260379749460.ico
- Size 1KB
- SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
- MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
- SHA1 0a18f23ef372593dee476bb852745b2490bc8421
- SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
- TLSH T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\290699897010.ico
- Size 1KB
- SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
- MD5 aea8653be6803940e5f5017482ed8f31
- SHA1 83d770a087be76863aca353d9e394c29b126874a
- SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
- TLSH T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\300220700492..exe
- Size 268KB
- SHA256 a7f1ec482233f03892d238d24504f2950d583cf580c39acb9bdcbe928066cef1
- MD5 6feb00c9a2c3ff66230658b3012bab6a
- SHA1 01503f44c6ae7866dea94b04f08aaae77e3b459d
- SHA512 e039817de40a4530ff6e91aa8ce32ad4df1db24005c50bcdcd6fc35d7bf253130ed9342061a9e24815173ff5f637a7d0e65c32a6af02d992be47335a37fb99bc
- SSDEEP 6144:m/h/WmnJztI9KFpp8uyO+376c+Rg0pYbM0+IZHkO:m/h/WmJhI9Gpx+7lZ
- TLSH T1D04407A93BA88CE1D903917948A1D3B4F373B4524F21A74F6DA1C33F5F771A0AC19A25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\407898606344.ico
- Size 1KB
- SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
- MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
- SHA1 13470460552d9f4c465130d654b2095316b22854
- SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
- TLSH T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\419087454601..exe
- Size 9.9MB
- SHA256 2892c988e54ab035646f9538f7493b0ddfe4541c358de28fb4a02fc32d8bdce0
- MD5 9e6de6715b85ad6920e1bef5a93b67ac
- SHA1 455b86f5977e5079568e1593ec057fd68c99e261
- SHA512 dc2fb39fdf5728169020a7aafbc32506e4ed53925e66c92d1017488531fef989e03db489f84fe4c6b9ebdeb6279b6c4a838b470b4b8a473b59ed3cc071a6b85a
- SSDEEP 49152:S9dka/cOOInuHWhH+9JYAwotWSgUZyHAB09ZPV2am7gNXTjyURvsS/MaNXgDOJQP:ChgWJvs2j5KqxSVCXcTsDYcvPuGtmR
- TLSH T169A649953B68C4D2D41285BA8CA6CBF9F271BC625E3023076992F71F2F370A19D2D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\563852604383..exe
- Size 574KB
- SHA256 a4f22b40651e87830c2ac8f40b9c84d94bda6fe3a54641625b600c3ce2d7d8be
- MD5 7ee79b4d6cdd2e42a3d6fd2393f5031a
- SHA1 2e506b59e6ddb94ef9277631f9ab5b9adebd0bd7
- SHA512 a29a56643845ef43a8fe9fdaa0137b03be4f0c25998155b261423a3df1d5e8719a1e87f36be12245c1f1fa48479a7bf77c19c7f6fa6980c1b06e5663135d35d8
- SSDEEP 6144:Khny2oKzHNR+VKkt4id77JRBlh2zpu00e+1+e6dM+MTYnSYXMBb3YvKnpJIggewk:KRy2NzHmVraixzzAXtWASz3Y4HIbk
- TLSH T14EC4E65BEAB952E0C4FAD0748162A677FCB1B4898C319B039691D75F1F37B60AD2E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\594639721252.ico
- Size 1KB
- SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
- MD5 81e2b09e1f33b8c702aed3d14d341a13
- SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
- SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
- TLSH T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\625695618224.ico
- Size 1KB
- SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
- MD5 3d272e20bb157f11d4ae75abc33aef1a
- SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
- SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
- TLSH T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\707636422280.ico
- Size 1KB
- SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
- MD5 cb4265d1bed8a3606c50c3ace6452c94
- SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
- SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
- TLSH T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\732020547260.ico
- Size 1KB
- SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
- MD5 4a3be9e27a938152348d20edbc4c08ee
- SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
- SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
- TLSH T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\759989253712.ico
- Size 1KB
- SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
- MD5 bdc7cdea596ddc3d6542f6eae40a3509
- SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
- SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
- TLSH T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\775359562772.ico
- Size 1KB
- SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
- MD5 d91c5d1ab9c7e29648ace11bcb875f98
- SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
- SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
- TLSH T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\808538318708..exe
- Size 2.4MB
- SHA256 de9903082cdf397fc2f6cb24ba226a61b4cc2e402d1ffa99c37f8871be53d1ef
- MD5 6f8eac2c377c8f16d91cb5ac8b8dbf5f
- SHA1 def53a43d9549f086ca9aa1bd6bc5bd9ecd48f81
- SHA512 28902d6dce20820a4cfea49e15dda559d4949b0f181db51bb089219ca7c22e0f5427186bd08c0d331c595c0282969630832df0e3b85d1cf315230288ce6a7c0b
- SSDEEP 24576:eNPyI2m8hBvM70K4W6pjyqn6Ma7rKpOcvPuGtmRM:0ydk7axpn6MJpOcvPuGtmR
- TLSH T181B56F56B758E496C8194678CDA7C7FCA771BC51EE2187037A90FB5F3E332A0AE18250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\868989832796..exe
- Size 3.3MB
- SHA256 be28b354497c31f2813a97217a3d61e075b03439d4d055c2ce904913de7080be
- MD5 56ac82018a550cf0c525f0c7891806f1
- SHA1 05e032e47e17dfb5dc51e275a16815985160c801
- SHA512 d93e0b15dd35743556a6f87567e883201cc5cfa066c809794df10e06988f31a068c34e4b15e6bebb2c0e3ae55541a6c516014783ed53f1153a51383399277483
- SSDEEP 49152:fd/c4qw9yAGTUsYUYhzlArlb3pvmk2rP3H8z066/OOe3nXZ4pQizEeZ6wdAyGJw:V/MJI0b3pvmk2rP3HtQAESMC
- TLSH T17CF53956FAB9C1E0C9BAD038C466A6B3F9B1B9869C3063135256D71F1F33A61ED2D310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
- Size 62KB
- SHA256 b5265ebf73fedc1d0333fd4f72c7021eef1cd8b948b4e41969cdb2a3ef6bd35d
- MD5 83e0bdc6f86ef6d0c1d991f2b737ed19
- SHA1 52677f99fc860a5b9f2b29f3e536ff2ba168101f
- SHA512 4c298729be4e77edd165a5c52be40f022763a479777be1ae55809c8158649f3159c6369649e5407140b7dc9b111b8cc67c611fdedb0990b2d9f1c083068b6f11
- SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpbExJO1EA+Bdd:QE/msHasdDOFHbAMbExJO1Ebdd
- TLSH T1E6536C18BBE60125E5BF6FB158F53266DB39F6635903D62F28C602871A23E85CD006FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\shost.exe
- Size 375KB
- SHA256 24a216490911265845433c41ccbeb223355b16f48901c382030f0ebaa78084e3
- MD5 58885b313185d39c8e90092f22192b87
- SHA1 d02effcc9ed906e16a651ad9c446c3f655052e85
- SHA512 7bd8bb41fd6b30667dc0ddc14f051bded5e5dcff794a5a3a2645d6afd26452c12e5253719b9532bd28edd242f9486642b27d44d1a59c4943bcf29ce5e3c728af
- SSDEEP 6144:j+GYnA0zeW8Di50JziQ8kd3f+RysMFZzN/E/msHOtbSiqNsarw:jYCDi50NiQDuysMFZzN/E/msup7s
- TLSH T1A5847C16F75408FDD59BC57489A24546DA35BC8E0B72EAEF17C8422A2F237F08E39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\logs.txt
- Size 4KB
- SHA256 7333e0c489a9e7fc683a60d707fdfd25e97a79183055cbc3027fd77c01463e19
- MD5 a6cfd7b0bd65c1ec6574c066272f77e2
- SHA1 8aafd283e5bc2db5c2fb1e7fd5ead7f2975dbc97
- SHA512 1eb9541ee338dba507e3be7fabed1610b1a2f8dfd2f28836a0cd41bd1a10a82c73c7f152cab43412b8e1f3f6153277e3b56b2975f49967acaa46db0526d959cb
- SSDEEP 96:2mW5WFWrWdWAW2W3FW3oeT8pi3Z8ZpRU8VPmPr0ofwGbZ:2Lwbx
- TLSH T1BC91B9B1ED55C1C5732331802B113901365E9C896B4D80EAE7CC978BE8CEBD99B5BAF1
- MD5 SHA1 SHA512 SSDEEP TLSH