Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 08:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe
- Size 519KB
- Sample260827-jw4wfseq41
- SHA256 f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e
- MD5 8c6d12211200e44f50fe3e19c9aaae65
- SHA1 4e5d695647111a19b9fe8aab581efd74c66f0c42
- SHA512 0e01228e36cbaa44f31b99c2f8130638136786f3d0bc8bad3bcf4f0c4498b69724e5ee0569a4af10e235232aa9ca192ebeff142821b5cde4be4ae63957f7e925
- SSDEEP 12288:jYkDi5eiQ7uysMFZzN/0JK2z4G1SYkDi5eiQF:EvvgW94evw
- TLSH T160B46A16F74818FCD997C1B8C6874556DA2978CE0B71BEEF078886262F62BF05E39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4756 audiodg.exe 4124 shost.exe 2556 audiodg.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: shost.exe File opened (read-only) \??\G: shost.exe File opened (read-only) \??\H: shost.exe File opened (read-only) \??\I: shost.exe File opened (read-only) \??\J: shost.exe File opened (read-only) \??\K: shost.exe File opened (read-only) \??\N: shost.exe File opened (read-only) \??\R: shost.exe File opened (read-only) \??\B: shost.exe File opened (read-only) \??\M: shost.exe File opened (read-only) \??\P: shost.exe File opened (read-only) \??\S: shost.exe File opened (read-only) \??\W: shost.exe File opened (read-only) \??\Y: shost.exe File opened (read-only) \??\O: shost.exe File opened (read-only) \??\L: shost.exe File opened (read-only) \??\T: shost.exe File opened (read-only) \??\X: shost.exe File opened (read-only) \??\Z: shost.exe File opened (read-only) \??\E: shost.exe File opened (read-only) \??\Q: shost.exe File opened (read-only) \??\U: shost.exe File opened (read-only) \??\V: shost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe shost.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXAA0.tmp shost.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX30F6.tmp shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXD0F.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\RCX144A.tmp shost.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\RCX3D51.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe shost.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe shost.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe shost.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe shost.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX31C9.tmp shost.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe shost.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\RCX2C4C.tmp shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXDE6.tmp shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe shost.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe shost.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe shost.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe shost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX29D2.tmp shost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX2F73.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA1C.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXBD8.tmp shost.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe shost.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe shost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXAD1.tmp shost.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX162C.tmp shost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe shost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe shost.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCX103E.tmp shost.exe File opened for modification C:\Program Files\Windows Photo Viewer\RCX190F.tmp shost.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe shost.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe shost.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe shost.exe File created C:\Program Files\Internet Explorer\ExtExport.exe shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX513.tmp shost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX544.tmp shost.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe shost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXDC4.tmp shost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe shost.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe shost.exe File opened for modification C:\Program Files\Windows Media Player\RCX188C.tmp shost.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe shost.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe shost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCX3076.tmp shost.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe shost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4756 3608 f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe 84 PID 3608 wrote to memory of 4124 3608 f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe 85 PID 4124 wrote to memory of 2556 4124 shost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe"C:\Users\Admin\AppData\Local\Temp\f4dd395ce19ff4343295efe6c575acc3547d7f83d5ec45cf314c88154f20f82e.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
PID:4756
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
PID:2556
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\RCXFC35.tmp
- Size 377KB
- SHA256 f8b83f1628fea2433cd7598dbf36635c36795929277f373073841c1b131c0748
- MD5 2823916285d7aaa6bc495ffe6ecc2d26
- SHA1 4526664d7950876d081440daeb90e8bc7a4fd008
- SHA512 adf4dca8fc05c6fd69329a8f49fa2f6994308a68b79dbfccd25898f06f8e3e0800f254d07f43227e7823202f11b155eb533a19002ae53094a0473e73a84577d1
- SSDEEP 6144:p+GYnA0zeWiDi5eJwQ8kV3f+RysMFZzN/0JK2P71ctk8sNrw:pYkDi5eiQ7uysMFZzN/0JK2z4G1
- TLSH T15C848D16F74408F9D893C2B4C9964596DA39BC9E0B71AEDF17C8472A2F227F04E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\064962538090.ico
- Size 1KB
- SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
- MD5 cb4265d1bed8a3606c50c3ace6452c94
- SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
- SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
- TLSH T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\179088876183..exe
- Size 268KB
- SHA256 a7f1ec482233f03892d238d24504f2950d583cf580c39acb9bdcbe928066cef1
- MD5 6feb00c9a2c3ff66230658b3012bab6a
- SHA1 01503f44c6ae7866dea94b04f08aaae77e3b459d
- SHA512 e039817de40a4530ff6e91aa8ce32ad4df1db24005c50bcdcd6fc35d7bf253130ed9342061a9e24815173ff5f637a7d0e65c32a6af02d992be47335a37fb99bc
- SSDEEP 6144:m/h/WmnJztI9KFpp8uyO+376c+Rg0pYbM0+IZHkO:m/h/WmJhI9Gpx+7lZ
- TLSH T1D04407A93BA88CE1D903917948A1D3B4F373B4524F21A74F6DA1C33F5F771A0AC19A25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\210824230331.exe
- Size 4.1MB
- SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
- MD5 2864c8b005a6414e2fa9b06c1e089dcc
- SHA1 3041fbd63ae570b537c38a315050c06aa566362f
- SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
- TLSH T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\263327849101.ico
- Size 1KB
- SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
- MD5 1af3523517c4a23a831af16191e71ba5
- SHA1 34674885738a8717def95b016697802778f0d520
- SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
- TLSH T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\272257938951..exe
- Size 9.9MB
- SHA256 2892c988e54ab035646f9538f7493b0ddfe4541c358de28fb4a02fc32d8bdce0
- MD5 9e6de6715b85ad6920e1bef5a93b67ac
- SHA1 455b86f5977e5079568e1593ec057fd68c99e261
- SHA512 dc2fb39fdf5728169020a7aafbc32506e4ed53925e66c92d1017488531fef989e03db489f84fe4c6b9ebdeb6279b6c4a838b470b4b8a473b59ed3cc071a6b85a
- SSDEEP 49152:S9dka/cOOInuHWhH+9JYAwotWSgUZyHAB09ZPV2am7gNXTjyURvsS/MaNXgDOJQP:ChgWJvs2j5KqxSVCXcTsDYcvPuGtmR
- TLSH T169A649953B68C4D2D41285BA8CA6CBF9F271BC625E3023076992F71F2F370A19D2D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\374913174743.ico
- Size 1KB
- SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
- MD5 81e2b09e1f33b8c702aed3d14d341a13
- SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
- SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
- TLSH T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\376432695189.ico
- Size 1KB
- SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
- MD5 d91c5d1ab9c7e29648ace11bcb875f98
- SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
- SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
- TLSH T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\382856008549..exe
- Size 574KB
- SHA256 a4f22b40651e87830c2ac8f40b9c84d94bda6fe3a54641625b600c3ce2d7d8be
- MD5 7ee79b4d6cdd2e42a3d6fd2393f5031a
- SHA1 2e506b59e6ddb94ef9277631f9ab5b9adebd0bd7
- SHA512 a29a56643845ef43a8fe9fdaa0137b03be4f0c25998155b261423a3df1d5e8719a1e87f36be12245c1f1fa48479a7bf77c19c7f6fa6980c1b06e5663135d35d8
- SSDEEP 6144:Khny2oKzHNR+VKkt4id77JRBlh2zpu00e+1+e6dM+MTYnSYXMBb3YvKnpJIggewk:KRy2NzHmVraixzzAXtWASz3Y4HIbk
- TLSH T14EC4E65BEAB952E0C4FAD0748162A677FCB1B4898C319B039691D75F1F37B60AD2E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\535041425087.ico
- Size 1KB
- SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
- MD5 aea8653be6803940e5f5017482ed8f31
- SHA1 83d770a087be76863aca353d9e394c29b126874a
- SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
- TLSH T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\551114128833.ico
- Size 1KB
- SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
- MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
- SHA1 0a18f23ef372593dee476bb852745b2490bc8421
- SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
- TLSH T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\606803559968.ico
- Size 1KB
- SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
- MD5 bdc7cdea596ddc3d6542f6eae40a3509
- SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
- SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
- TLSH T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\650636686205..exe
- Size 3.3MB
- SHA256 be28b354497c31f2813a97217a3d61e075b03439d4d055c2ce904913de7080be
- MD5 56ac82018a550cf0c525f0c7891806f1
- SHA1 05e032e47e17dfb5dc51e275a16815985160c801
- SHA512 d93e0b15dd35743556a6f87567e883201cc5cfa066c809794df10e06988f31a068c34e4b15e6bebb2c0e3ae55541a6c516014783ed53f1153a51383399277483
- SSDEEP 49152:fd/c4qw9yAGTUsYUYhzlArlb3pvmk2rP3H8z066/OOe3nXZ4pQizEeZ6wdAyGJw:V/MJI0b3pvmk2rP3HtQAESMC
- TLSH T17CF53956FAB9C1E0C9BAD038C466A6B3F9B1B9869C3063135256D71F1F33A61ED2D310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\678882643053.ico
- Size 1KB
- SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
- MD5 6ed58acd10d2c394c7638d5e4d4e4d04
- SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
- SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
- TLSH T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\723834315965..exe
- Size 109KB
- SHA256 108818ed973cfd2d73c374f6cb461639f39caf52bc28f8b7ceb7eab13d5d7b37
- MD5 edb5a5207a5eab205b99326572036d5b
- SHA1 ed941af1124f394b9384aa128da8f4674e6091d3
- SHA512 34a0c9c06d555c3579c175c7c0e2b47f1cc87d65a0127a641d4e058879fab949e874b7b054f21332de0f3386ff00483838bf221cbcbfde380b8eb465105e075d
- SSDEEP 3072:fxGqf2A2GlXUeHV62KbXPhSegdOKsbSR:fQqf2A/lXT62KbXpedsbS
- TLSH T13EB3285ABB6580F5D153A13CC4A6A2B5F3B6F8425C72574F5752C30F0F3B2A05E2AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\806157586385..exe
- Size 2.4MB
- SHA256 de9903082cdf397fc2f6cb24ba226a61b4cc2e402d1ffa99c37f8871be53d1ef
- MD5 6f8eac2c377c8f16d91cb5ac8b8dbf5f
- SHA1 def53a43d9549f086ca9aa1bd6bc5bd9ecd48f81
- SHA512 28902d6dce20820a4cfea49e15dda559d4949b0f181db51bb089219ca7c22e0f5427186bd08c0d331c595c0282969630832df0e3b85d1cf315230288ce6a7c0b
- SSDEEP 24576:eNPyI2m8hBvM70K4W6pjyqn6Ma7rKpOcvPuGtmRM:0ydk7axpn6MJpOcvPuGtmR
- TLSH T181B56F56B758E496C8194678CDA7C7FCA771BC51EE2187037A90FB5F3E332A0AE18250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\903232716321.ico
- Size 1KB
- SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
- MD5 3d272e20bb157f11d4ae75abc33aef1a
- SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
- SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
- TLSH T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\914245755429.ico
- Size 1KB
- SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
- MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
- SHA1 13470460552d9f4c465130d654b2095316b22854
- SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
- TLSH T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\922399633275.ico
- Size 1KB
- SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
- MD5 4a3be9e27a938152348d20edbc4c08ee
- SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
- SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
- TLSH T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
- Size 62KB
- SHA256 b152811df5aac79a3cfdf5ea04e3d66705cd70852e80a335a40f9ba1d2bcb6ef
- MD5 ed6b646ec23f1b0fe149ac2cd1ed344f
- SHA1 4329d9d423a773024e8aad0cfaff092316482a70
- SHA512 347d136199c672aec23f7b3af97d6e54055333575437c9ef83233b7dcfa9d60e998d0d7343f294d1e66136d40512df6e0085e6653416c2f6c43ff2c760e7971b
- SSDEEP 1536:QjpzqnSA3aGK2u0YENUG1LbD1ClnCmc7/iRH0EA+Bdd:QNzqnZaGK2u0YENU8LH1ClnCmo/iRH0Q
- TLSH T194536C20F7498261D49083F065B95ABBD43EF67807650BDBB1C81FB32450EDA7A3AE53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\diagnostics\shost.exe
- Size 375KB
- SHA256 69aeb0e5216b392d7c8571eee6b031a0ce975314987aada114255d2258816a75
- MD5 bf5175b1b0c2db49bbf09efa7496bc8f
- SHA1 b781b5d3cf530efab9d171818207395bf5bae680
- SHA512 4b0b10e4085bca72e2a2f602fd055a411d33ce61b97ccbe7d99dead5ef4e09e88b70f1d0361282609797d9b6aecdf1b8c34f374b48343e3a414d3a93eff45601
- SSDEEP 6144:j+GYnA0zeWiDi5eJwQ8kV3f+RysMFZzN/0JK2P71ctk8sNrw:jYkDi5eiQ7uysMFZzN/0JK2z4G1
- TLSH T140848C16F74408F9D893C2B4CA964556DA39BC9E0B71AEDF17C8472A2F227F04E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\logs.txt
- Size 4KB
- SHA256 7333e0c489a9e7fc683a60d707fdfd25e97a79183055cbc3027fd77c01463e19
- MD5 a6cfd7b0bd65c1ec6574c066272f77e2
- SHA1 8aafd283e5bc2db5c2fb1e7fd5ead7f2975dbc97
- SHA512 1eb9541ee338dba507e3be7fabed1610b1a2f8dfd2f28836a0cd41bd1a10a82c73c7f152cab43412b8e1f3f6153277e3b56b2975f49967acaa46db0526d959cb
- SSDEEP 96:2mW5WFWrWdWAW2W3FW3oeT8pi3Z8ZpRU8VPmPr0ofwGbZ:2Lwbx
- TLSH T1BC91B9B1ED55C1C5732331802B113901365E9C896B4D80EAE7CC978BE8CEBD99B5BAF1
- MD5 SHA1 SHA512 SSDEEP TLSH