Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/10/2026, 16:04

General

  • Target
    2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant.exe
  • Size 522KB
  • Sample261022-th96esssbx
  • SHA256 c6f71819b2678d27fef75c76738d78b8a3fa2d2086d11be36e621297f8f53e85
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • xworm

Version
  • XWorm V5.6

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/Fxzr3jeT

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

  • Detect Xworm Payload 4 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 4 IoCs
  • Executes a file named after a Windows system binary 1 TTPs 2 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

  • Executes dropped EXE 4 IoCs
  • Modifies system executable filetype association 2 TTPs 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Users\Admin\Documents\diagnostics\audiodg.exe
      "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
      2⤵
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      PID:3844
    • C:\Users\Admin\Documents\diagnostics\shost.exe
      "C:\Users\Admin\Documents\diagnostics\shost.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Users\Admin\Documents\diagnostics\audiodg.exe
        "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
        3⤵
        • Executes a file named after a Windows system binary
        • Executes dropped EXE
        PID:4168
    • C:\Users\Admin\AppData\Local\Temp\2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant..exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant..exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        RCX7D6A.tmp

        • Path C:\Program Files\7-Zip\RCX7D6A.tmp
        • Size 377KB
        • SHA256 13fb7253971ddbbe073834204ce95dbab2cd298fed2feaa728ae8148aa49e4f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant..exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant..exe
        • Size 147KB
        • SHA256 52591bdbfbb9ce52c494248dc11d17e9725278b8bc12416fadfa33f900ec9766
        • MD5 SHA1 SHA512 SSDEEP TLSH

        004906383465.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\004906383465.exe
        • Size 24.8MB
        • SHA256 bef43ac043bbb89896d9d23661697500d9b0f6e3cb3d7a0800f71201c6f052e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        005047283671.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\005047283671.exe
        • Size 69KB
        • SHA256 42cf12cce4c991c6c2c93147fee7d3193341c03b2a65938f521acc7000c4a6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        014487755795.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\014487755795.exe
        • Size 216KB
        • SHA256 30e2d946d30d0a88de97301661b47e1ba797d7787cf054231fb35144bef4339b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        014620823015.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\014620823015.exe
        • Size 506KB
        • SHA256 02ea7b9948dfc54980fd86dc40b38575c1f401a5a466e5f9fbf9ded33eb1f6a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        016368064759.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\016368064759.exe
        • Size 1.7MB
        • SHA256 b7e8f2e0dd4800b01a3f9b2113c47b12e1881a7ac6515261aac2c07f18872a09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        020915730596.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\020915730596.exe
        • Size 455KB
        • SHA256 eff813326d19ea2c2b196e97ebb9bbf60fb2d519283ac78bc87e73baac4e067b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        051153582903.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\051153582903.exe
        • Size 21KB
        • SHA256 ed7e9e46dc90dc6fdf6f6e67bab6176950666daaf8d33fde85df875cf856cff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        062149087126.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\062149087126.exe
        • Size 115KB
        • SHA256 d6bee4ec31c9562c7268d80daee70d69c8af7202927cdbd9778235d86d0cf507
        • MD5 SHA1 SHA512 SSDEEP TLSH

        073500030892..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\073500030892..exe
        • Size 9.9MB
        • SHA256 2892c988e54ab035646f9538f7493b0ddfe4541c358de28fb4a02fc32d8bdce0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        078663151067.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\078663151067.exe
        • Size 5.1MB
        • SHA256 3aa70e2ec135057aacc522bc484a4c557446225938944c57a2cb63c5cda02fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        083105151997.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\083105151997.exe
        • Size 102KB
        • SHA256 a63c8683270acad919d41a7452bfd1313daa2398e693346533f8ee83329390c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        083105151997.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\083105151997.ico
        • Size 1KB
        • SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
        • MD5 SHA1 SHA512 TLSH

        084195842997.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\084195842997.exe
        • Size 102KB
        • SHA256 8a392cd49f0047c8110a4f54f6a74b0a771033406fefa3a9e7838dacbd48373a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        084383304720.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\084383304720.exe
        • Size 493KB
        • SHA256 cc57d54c0d17f5e786a75bc28ce2133499672fe378b6f62c8117f2f0c191e932
        • MD5 SHA1 SHA512 SSDEEP TLSH

        097819932618.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\097819932618.exe
        • Size 18KB
        • SHA256 78ffcd4c0c0c00f7fa563a27e77c39b099e4724f114e67cb7c218a77d343c838
        • MD5 SHA1 SHA512 SSDEEP TLSH

        113361563230.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\113361563230.exe
        • Size 15.5MB
        • SHA256 aa84a576dacbf5cbe8199ca015e303d047f95e207d3629f2e5bd21bb44ed4e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        154909464505.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\154909464505.exe
        • Size 467KB
        • SHA256 dcf51cb36c3952eb5baf217e404e6c972ee1ef4109ebbcc88855860a366edc0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        162814744520.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\162814744520.exe
        • Size 504KB
        • SHA256 2682086ace1970d5573f971669591b731f87d749406927bd7a7a4b58c3c662e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        162814744520.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\162814744520.ico
        • Size 1KB
        • SHA256 a742238dacdff4363a430dacedb364ff073cd4c1f1799badcc88f3b681d565ca
        • MD5 SHA1 SHA512 TLSH

        175482023703.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\175482023703.exe
        • Size 219KB
        • SHA256 3099b6cf67191b1a7e4d8463576fe85835e8df2296dba3470b0cd42babd336c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        175482023703.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\175482023703.ico
        • Size 1KB
        • SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
        • MD5 SHA1 SHA512 TLSH

        186984626381.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\186984626381.exe
        • Size 70KB
        • SHA256 25dfbb22c23a16d75ef7f0468ee4441fb215dad2458da28dad62efa14464f336
        • MD5 SHA1 SHA512 SSDEEP TLSH

        210313743966.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\210313743966.exe
        • Size 1.4MB
        • SHA256 7e3d36adf02a7691cb2854f3a01396bb08f3530d78f1bf96be02e5538d2d3aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        210560794573.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\210560794573.exe
        • Size 3.2MB
        • SHA256 6086a36c945afbdcfc913d74445d59ab548d49e3d0345ce64146155927f03399
        • MD5 SHA1 SHA512 SSDEEP TLSH

        234292519569.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\234292519569.exe
        • Size 19KB
        • SHA256 a96e4c8eb7f8ffbc47118d816bb54c4d729194ce26fd2b0ad6d487ac3ee013cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        252084540513.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\252084540513.exe
        • Size 95KB
        • SHA256 b722655b93bcb804802f6a20d17492f9c0f08b197b09e8cd57cf3b087ca5a347
        • MD5 SHA1 SHA512 SSDEEP TLSH

        259882751041.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\259882751041.exe
        • Size 6.1MB
        • SHA256 ca434df4bbfcadf6a6610a6bbea4eb435adb91751670f63c0a6bc3207e4a89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        259882751041.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\259882751041.ico
        • Size 1KB
        • SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
        • MD5 SHA1 SHA512 TLSH

        281400502770.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\281400502770.exe
        • Size 18KB
        • SHA256 a86b068ed800e85ede4db53f278ed4672e741ad3444dc6de0beaf3a7f0a4363f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        293122180336.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\293122180336.exe
        • Size 570KB
        • SHA256 0647ef7cd5ad437c4c397846d38e6d938d3453fff53e3d370f84aabd3798e69e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        302053919883.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\302053919883.exe
        • Size 19KB
        • SHA256 fec9b389da89c183f8f1c5b96ae874e89d5284276f2cae0f1465a34d69c993fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        312297928476..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\312297928476..exe
        • Size 2.4MB
        • SHA256 de9903082cdf397fc2f6cb24ba226a61b4cc2e402d1ffa99c37f8871be53d1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        314964261759.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\314964261759.exe
        • Size 100KB
        • SHA256 24500799b471e62b4debee45176d7664c424bbeddf620a8fd950dcd2ce94c70f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        317784721541.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\317784721541.exe
        • Size 5.7MB
        • SHA256 072e3df4e4625971a43bd6cb49933895dd2f57e03e7b1d0087ed0e09c35920bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        317784721541.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\317784721541.ico
        • Size 1KB
        • SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
        • MD5 SHA1 SHA512 TLSH

        325751561347.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\325751561347.exe
        • Size 3.2MB
        • SHA256 d7ae0734839956e8797fc1f0c79db614a663728d29439966d1c1df0645f3339f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        330637015874.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\330637015874.exe
        • Size 285KB
        • SHA256 af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        349400134547..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\349400134547..exe
        • Size 268KB
        • SHA256 a7f1ec482233f03892d238d24504f2950d583cf580c39acb9bdcbe928066cef1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        355784205319.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\355784205319.exe
        • Size 21KB
        • SHA256 6da131827b1e8bd452db68cd67ce58717b3ba5d753fb4963de8afbea6c78d402
        • MD5 SHA1 SHA512 SSDEEP TLSH

        384662653620.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\384662653620.exe
        • Size 285KB
        • SHA256 a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        385505399196.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\385505399196.exe
        • Size 14KB
        • SHA256 81e8479d55c70138118738fe3dbae6be35091e787917d4e468e4c1e58f17a9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        394459396946.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\394459396946.exe
        • Size 22KB
        • SHA256 3cd8e15329096dacc75d8d535bb96b8cd2079a70ba37668e04c96980d366f08b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        414151276310.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\414151276310.exe
        • Size 65KB
        • SHA256 d4bede88fe092e6df954ec32a6e88215c36cfadaf0957dd789e6ba4700ad91c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        416106932099.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\416106932099.exe
        • Size 100KB
        • SHA256 dfafeef721064c822faa278595e54b422df3cb14d3724db3cc984220bec052bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        437339929323.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\437339929323.exe
        • Size 18KB
        • SHA256 7f58837afa5961ac854ee151a061875e56e0c265642d45c7807a4f1043c52412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        438338605134.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\438338605134.exe
        • Size 89KB
        • SHA256 a76d230e57f7c5c40af3d527954e3155869d1a4dd628b6c0d6192c6c6ef109e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        440504235955.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\440504235955.ico
        • Size 1KB
        • SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
        • MD5 SHA1 SHA512 TLSH

        448358545669.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\448358545669.exe
        • Size 193KB
        • SHA256 e4e43dce95e60fbc403d965b08f12b604bb05ab5e0d255f6af9504572fe8ea9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        451316084584..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\451316084584..exe
        • Size 2.9MB
        • SHA256 44a6d65442c80b5db26742ff1f2a2a2363177f232917b714947b5cc520a4b5a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        456453013042.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\456453013042.exe
        • Size 163KB
        • SHA256 6cee4877b6663fc93e94ecc0489834379d2fae6c363eb36035d863733ab7c304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        462945869904.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\462945869904.exe
        • Size 20KB
        • SHA256 ee8684af76ee99da5fb6841ff0c089cd91817feee2f4d2563fc5885058ef0fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        467230374812..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\467230374812..exe
        • Size 574KB
        • SHA256 a4f22b40651e87830c2ac8f40b9c84d94bda6fe3a54641625b600c3ce2d7d8be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        478782065666.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\478782065666.exe
        • Size 2.7MB
        • SHA256 09f10e7344ca61b53a080e4d54c7cb6ecd4e3308254b350906437e29e7a7d9b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        478782065666.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\478782065666.ico
        • Size 1KB
        • SHA256 6b5eed60ed17d1d732b2ffad4cbbc21d85b95fd353df56c61d92700df594cab9
        • MD5 SHA1 SHA512 TLSH

        481636520264.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\481636520264.exe
        • Size 376KB
        • SHA256 5cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        486485769728.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\486485769728.exe
        • Size 330KB
        • SHA256 7c84c55ea7df524e972bef93cddf8b8f62c23790fd8b2d3e239455635fa65948
        • MD5 SHA1 SHA512 SSDEEP TLSH

        486485769728.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\486485769728.ico
        • Size 1KB
        • SHA256 1c413336445e2b6d1de737844f2a298eb8eed23eb6a0671cefeb15caeb8eaef9
        • MD5 SHA1 SHA512 TLSH

        497254360789.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\497254360789.exe
        • Size 707KB
        • SHA256 ea29d04c6fe7de564913d3bab4fc7df9f94b243a031aaa52b1853a6f119ee8c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        500065005508.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\500065005508.exe
        • Size 3.9MB
        • SHA256 1b05566a7bdc324f034dfa319a0049fed63ec0937616f89c965c5639ab352dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        507063129888.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\507063129888.exe
        • Size 22.1MB
        • SHA256 841ff119560cef9848232a6fff585e860a777852a96ee97a55b8b0a9a27683d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        529247380752.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\529247380752.ico
        • Size 1KB
        • SHA256 0eecaeef9593a8bdab3aaaf9fdcf9cd4d312fb5c2015b1e12533dbfdfc9e2e58
        • MD5 SHA1 SHA512 TLSH

        545029899185.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\545029899185.exe
        • Size 427KB
        • SHA256 043ce8d288fbdb1fe2a7ecc96f6e1cec5411ec7147e8fd7e23905d29833ea08e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        563000273043.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\563000273043.exe
        • Size 167KB
        • SHA256 c3252a14845280b1a938b4def08f04690ea36e4454d0bebeecc4e31a9c30d742
        • MD5 SHA1 SHA512 SSDEEP TLSH

        583199564585.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\583199564585.exe
        • Size 18KB
        • SHA256 5013e3bdc7ad39fb52659e336b2266e93da7719c949d8e24079131bae948e643
        • MD5 SHA1 SHA512 SSDEEP TLSH

        590340086064.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\590340086064.exe
        • Size 1.8MB
        • SHA256 e7291f05871f498f0beea6100c9b696c9bd0bb9bf49f1c988347ba209b1454d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        592396165223.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\592396165223.exe
        • Size 933KB
        • SHA256 d261b853b0367d5c724319aa4d7008851f48d3e110823e0b650b07d981ca9c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        598708705951.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\598708705951.exe
        • Size 4.0MB
        • SHA256 71adf9af8a362da5135a61f126dcfb39a7e494b6624ede893bea74bd591a836f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        606699227079.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\606699227079.ico
        • Size 1KB
        • SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
        • MD5 SHA1 SHA512 TLSH

        608767008263.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\608767008263.exe
        • Size 15KB
        • SHA256 651569295c9b090dc4a1ccb706027e09bfa6fbe01041c9c0a3a08499b9420bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        617007989788.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\617007989788.exe
        • Size 236KB
        • SHA256 0950328c7234c6c929ea5c159c3b1105a6e6e2bd14d1159a263197557d17a693
        • MD5 SHA1 SHA512 SSDEEP TLSH

        619851613395.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\619851613395.exe
        • Size 236KB
        • SHA256 cd507dd55edeeebc474dc43a101a600e226a5ff22cbc200fc2e26ee3408c0691
        • MD5 SHA1 SHA512 SSDEEP TLSH

        630310809742.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\630310809742.exe
        • Size 1.5MB
        • SHA256 0d8d9bcacb1983f88e196be8cf07e4af367814609b37ac72da63b625218d4af8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        637476001961.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\637476001961.exe
        • Size 93KB
        • SHA256 3b08281fa642225f812960aa29a2a3d9a7b0156e454a8efc1fa9b6f6cd7dd46e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        637476001961.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\637476001961.ico
        • Size 1KB
        • SHA256 9a6584c0e0a8cf98d3d7bd968a9ae54141256e454f1d7dabbc1e59b02be3f016
        • MD5 SHA1 SHA512 TLSH

        647866953548.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\647866953548.exe
        • Size 2.9MB
        • SHA256 09d9023bb6c8e9e48bbdb236b3c15fc535c0ebd5915d1490ec6d987da75688b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        652849361421.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\652849361421.exe
        • Size 814KB
        • SHA256 219280ffebd3d771102fc3a7f26529e5e9161366e3a5de2f8943d81dda7756bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        654691613773.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\654691613773.exe
        • Size 18KB
        • SHA256 6868894ab04d08956388a94a81016f03d5b7a7b1646c8a6235057a7e1e45de32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        657232579817.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\657232579817.exe
        • Size 272KB
        • SHA256 4bd1dcf4ca2347b5181957297a22926bbe64fc2eee3dec93bca6f0c654167b5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        660008906362.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\660008906362.exe
        • Size 94KB
        • SHA256 26d296fd5bf53ffa46db8347368056452d8f9d41e5b2ca8e8681e44f4c75da3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        675614871917.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\675614871917.ico
        • Size 1KB
        • SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
        • MD5 SHA1 SHA512 TLSH

        686194076427.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\686194076427.exe
        • Size 6.6MB
        • SHA256 4889fcd637e58f179e89bbb4ab8e0a4e6325de18f9c89eb79225e1a1516635fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        690689589418.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\690689589418.exe
        • Size 64KB
        • SHA256 b165040eb5857ac06f6f058ed316f41a8cae13bc3f24b14a1f1865a391a9b00e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        690689589418.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\690689589418.ico
        • Size 1KB
        • SHA256 18749bf7cbeaf430807c30dca88b7b7514a65e8c5170f1bcabb548f375e493fe
        • MD5 SHA1 SHA512 TLSH

        704696964480.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\704696964480.exe
        • Size 280KB
        • SHA256 53163c3bbe39681265efddf352cb2f58cccc19c758a228de0c4c6e929c8d1925
        • MD5 SHA1 SHA512 SSDEEP TLSH

        705719233526.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\705719233526.exe
        • Size 7KB
        • SHA256 5b86f9c50ea65d80beb33ba795d990cae58d4c0feb9a731ba27793516c441d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        712959181679.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\712959181679.exe
        • Size 53KB
        • SHA256 edc454bca93a7d41d193a59953bde82766fc6874345a71bea2a8c52e71d06e29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        713378148012.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\713378148012.exe
        • Size 465KB
        • SHA256 1a12fb7e54396631be8f84ba5f4f3c9713025918c6d5c3a3cac58b65803e5f46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        716385527489.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\716385527489.exe
        • Size 22KB
        • SHA256 04f53af53edb01f9bcb4a1491893eb7c847c6cebd050a6cbb93405d0a7ba4311
        • MD5 SHA1 SHA512 SSDEEP TLSH

        723589173200.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\723589173200.exe
        • Size 15KB
        • SHA256 f5f56d65542ff0e0902a98f4d78dae553e39ed3606b61641382051118f3729c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        725402667398.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\725402667398.exe
        • Size 18KB
        • SHA256 ca834c1c18acfd75db55c4b58dd19c0fde85166c66fb397dd5e1d7e67cf9dd15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        725976307686.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\725976307686.exe
        • Size 178KB
        • SHA256 076ea6f96aea911a0175be091d4028f71bc4570d4aac20e2681c35ce992a66d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        735061112042.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\735061112042.exe
        • Size 104KB
        • SHA256 d9f02e9e6d60961122ebca70f9d06f972fd7e32c829245fd66f6733fa5988937
        • MD5 SHA1 SHA512 SSDEEP TLSH

        753392675887.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\753392675887.exe
        • Size 10.6MB
        • SHA256 1dc68c7eb3fc39e118521c7425c47da841283a076cc422a480bf9ef637c43000
        • MD5 SHA1 SHA512 SSDEEP TLSH

        761489890152.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\761489890152.exe
        • Size 203KB
        • SHA256 7a4e21491f698ef68c54fef62bbb895d2f5ebbf005be0b6ec21311fa731bea19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        768328085227.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\768328085227.exe
        • Size 3.7MB
        • SHA256 e142291bc8e720c15e440e0033ee7ae2cea0ce78a3c52f81a07fcf8f6ff61c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        780908984157.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\780908984157.exe
        • Size 44KB
        • SHA256 d8820e333be39b27712c42766d1f141cb45ffbe183c43286e55ecc1b9a82fa4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        788437353128.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\788437353128.exe
        • Size 305KB
        • SHA256 5d4a9bfd25fee53124b07f753ca30469cbadf2061f035ce33f8c5768dbb6e646
        • MD5 SHA1 SHA512 SSDEEP TLSH

        793782473275.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\793782473275.exe
        • Size 45KB
        • SHA256 8b6be6f016b6378d89d9bf1a9337f699f89829d154ae13e2c1c94ac0e00b7b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        795381317638.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\795381317638.exe
        • Size 3.9MB
        • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
        • MD5 SHA1 SHA512 SSDEEP TLSH

        803269536432.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\803269536432.exe
        • Size 84KB
        • SHA256 0263d4511b01c6d55f7adeb41848dd70559e447969b3eb1769b4f20cc819418b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        806387038020.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\806387038020.exe
        • Size 201KB
        • SHA256 f4ce25c64da2142b2cb7d9c5b0f1540d1718e4a5cef38683634e7ba2636d7d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        809418896630.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\809418896630.exe
        • Size 18KB
        • SHA256 a7fae5817e67fd50f16953b3958aea786649fc83a640d07e1513e1dcebf15bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        810511969506.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\810511969506.exe
        • Size 16KB
        • SHA256 b759ec15357e33045570f3bcffded55ee0dba7fadd08df5af98423bb2f321c22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        812901884818.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\812901884818.exe
        • Size 550KB
        • SHA256 2fbeabe6f604c1d2cc95650f7134ebd6df4aaee02808cdcc28302767a349e1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        814646301227.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\814646301227.exe
        • Size 17KB
        • SHA256 8c86e85e5c911dc993a716e56aa2633f97861d2e893ba879b740570fdac2efc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        815664345122.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\815664345122.exe
        • Size 374KB
        • SHA256 add4d8bbc19ee38b5bb9390b03d7588042946e91b94ff98a6e6a1b9f7cb0d436
        • MD5 SHA1 SHA512 SSDEEP TLSH

        819264700262..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\819264700262..exe
        • Size 109KB
        • SHA256 108818ed973cfd2d73c374f6cb461639f39caf52bc28f8b7ceb7eab13d5d7b37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        834500357175.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\834500357175.exe
        • Size 503KB
        • SHA256 c6aa1294f6a5aa52dc8ca2800065f22f7a0a8b5c1f5ec3e1761145d2e12024be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        837173367530.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\837173367530.ico
        • Size 1KB
        • SHA256 5d0ddd51604345a2d39f5008290607d8af6bfd8d17c1f4eb914b8cc0d2953da4
        • MD5 SHA1 SHA512 TLSH

        848496625700.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\848496625700.exe
        • Size 404KB
        • SHA256 1e33218dc30b429abbbf0e02ed5cb3c68deeccf55a01ee6022124596ed03030f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        872545819448.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\872545819448.ico
        • Size 1KB
        • SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
        • MD5 SHA1 SHA512 TLSH

        875899094351.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\875899094351.exe
        • Size 1.4MB
        • SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        877301228932.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\877301228932.exe
        • Size 243KB
        • SHA256 cc658447fa0fff883d4f829ffa8e183b8c8765575bd2489565d79fc6111ca1be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        882675448177.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\882675448177.exe
        • Size 13KB
        • SHA256 d2a73923a4276758114fd0f4247b9b0eb0543fa0f0d4f872ad2eb926d735fb1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        884883286374.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\884883286374.exe
        • Size 4.1MB
        • SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        890346639894.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\890346639894.ico
        • Size 1KB
        • SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
        • MD5 SHA1 SHA512 TLSH

        894249061433.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\894249061433.exe
        • Size 26.6MB
        • SHA256 17a5f35c30b9d1dbb651686407dbf7d1bdcc685426581af6796b364550e7fe70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        894249061433.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\894249061433.ico
        • Size 1KB
        • SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
        • MD5 SHA1 SHA512 TLSH

        899395894798.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\899395894798.ico
        • Size 1KB
        • SHA256 c87216c7ca4c6510e0957de46c989ec10827b6b03b4bd518cf81c7ea2a140b8b
        • MD5 SHA1 SHA512 TLSH

        916975963380.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\916975963380.exe
        • Size 236KB
        • SHA256 4f768edb8c11520ca5672dff310d321d1bcbe7156efcff3f97c91ac99be68ba0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        919027170820.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\919027170820.exe
        • Size 822KB
        • SHA256 9c530f1306aa1312fda938169e208a033341bc49ff956695c7616ad6c5d4bc94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        966626393298.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\966626393298.exe
        • Size 1.9MB
        • SHA256 df15b40803bb6a58067fead883642d5170318d6142e8ef45c5eb9aba71287449
        • MD5 SHA1 SHA512 SSDEEP TLSH

        975163472657.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\975163472657.exe
        • Size 721KB
        • SHA256 2c0decb7df8df6ff79ff9de4febae78b4d40a68a2f96d6beae5a9c911d56a65e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        976019856181.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\976019856181.exe
        • Size 68KB
        • SHA256 5ad4fa74e71fb4ce0a885b1efb912a00c2ce3c7b4ad251ae67e6c3a8676ede02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        986905696609.exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\986905696609.exe
        • Size 469KB
        • SHA256 a71004c20abc2216d52137a41b72703841da8bab3a97a60eedf77a37e951609f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        989232442296..exe

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\989232442296..exe
        • Size 3.3MB
        • SHA256 be28b354497c31f2813a97217a3d61e075b03439d4d055c2ce904913de7080be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        989641460682.ico

        • Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\989641460682.ico
        • Size 1KB
        • SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
        • MD5 SHA1 SHA512 TLSH

        audiodg.exe

        • Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
        • Size 62KB
        • SHA256 7e5a39a84a4e6fa368650cd74a600d37064344fde4d32d8ed52937f84b58d49e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        shost.exe

        • Path C:\Users\Admin\Documents\diagnostics\shost.exe
        • Size 375KB
        • SHA256 23f1e27eb240919a6cb47bd977bd9ab6b436f842957516b891201b7c3b94aa39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logs.txt

        • Path C:\Users\Admin\Documents\logs.txt
        • Size 4KB
        • SHA256 28a3b4e4c694ab6cd539a2b8124663d1124612c1b92632bf63d78913828205cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3844-20-0x0000000000600000-0x0000000000616000-memory.dmp