b6825a5df0b37d8c235252820ca1887bf84199172a99972e46005a0db8e697da

Analysis

max time kernel
121s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 3.2MB
Sample260419-shlmdsax71
SHA256 b6825a5df0b37d8c235252820ca1887bf84199172a99972e46005a0db8e697da
MD5 a589c225e7cefb27b1d550b88aa531b2
SHA1 91270d7cdb6785285ab2eba4dc3ab7baf5b63f4e
SHA512 e461cc23895349d0c887bed6cd709034fe16d290395d0c8a766e0ef2957b3bf7d843763565078fae861604f055be11feeb2cd1b2d274f1c1e8995c11c615a3d6
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556rX:82fP5GAAaukfxlM+M6RkMkIM7drX
TLSH
T16BF58D11B7A9C5B5D0BB41704A76C726A637BD110F208BCB6394BE6E2E327C16D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/2436-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000002a769-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000002a1c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00090000000272ed-143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000028e79-1229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2436-1353-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1156-1355-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000027aba-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e000000027a5a-1468.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000025e0a-2042.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1156	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2436	2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
1156	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_a589c225e7cefb27b1d550b88aa531b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2436

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.2MB
SHA256 b6825a5df0b37d8c235252820ca1887bf84199172a99972e46005a0db8e697da
MD5 a589c225e7cefb27b1d550b88aa531b2
SHA1 91270d7cdb6785285ab2eba4dc3ab7baf5b63f4e
SHA512 e461cc23895349d0c887bed6cd709034fe16d290395d0c8a766e0ef2957b3bf7d843763565078fae861604f055be11feeb2cd1b2d274f1c1e8995c11c615a3d6
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556rX:82fP5GAAaukfxlM+M6RkMkIM7drX
TLSH
T16BF58D11B7A9C5B5D0BB41704A76C726A637BD110F208BCB6394BE6E2E327C16D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
Size 3.9MB
SHA256 ebc98895b84b67e2f3bf8039197a9ecdc2c2d2cb45342732bd4fab8671bc1493
MD5 9952f843a49cc55bb75adbedff338d91
SHA1 9863c75850b6f6ba70555da37b1a83275e64e974
SHA512 58dc150ed07b6503df6e892517e99c35d448589504ef02e29a6e843719a120b7051ae06c608075b473a3d3b93d7751f75f45805ab3b6784bfb67231be956ea81
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556r6Vk0QX:82fP5GAAaukfxlM+M6RkMkIM7dr3Haib
TLSH
T14D169E11B7E886B5D0BF427486668616E632BC110F348BCF5294BA5E2F337D15E3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe$

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
Size 3.3MB
SHA256 63cfbaee9232c27204eb590337a8470becbf04049ae4bac6267a8afc49f84178
MD5 e3365fa38e40ea876281770c7f4a9c9c
SHA1 6b67baeca1ee67b0cba56a9b7c69aa4238856194
SHA512 b5fe5d29fe7cc47c934d0faa7a321a521a9212b3a32cbc7e074c8ab2669816dc31f627254c23815ca7defaa7fe25797469f7a637a411ed474255fa456e7a9177
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556rDW:82fP5GAAaukfxlM+M6RkMkIM7drDW
TLSH
T13FF59D11B7A9C5B5D0BB41704A768726A637BD110F208BCF6394BE6E2E327C15D36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.7MB
SHA256 705fd462df819f609b94ac211de30b51fb1aea168064689383f0116bd3169f61
MD5 aec304077a282b0e99ee493cd0ace7f2
SHA1 0ee6ec998276288b3632a694b5393f1a3c9bca97
SHA512 2c56bbcbf541e829d64b23bd9d89cef2f48b315e849f88ceb361b4b4d55a9043e5a69cec8dd20899bea9b3e684fb54ad3645d5002083b35bd1ad8a3f827c7f05
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556rTPji0a:82fP5GAAaukfxlM+M6RkMkIM7drLjo
TLSH
T150068C11F7A8C675D0BB817589A28766EA327D110F308BCB5394BB6D2E337C19936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
Size 3.3MB
SHA256 2c88dd70512caca3108f78c9561e54031e43e3eacf0ddd0ddd9c21d61326b0c7
MD5 79ee687aaabef2c789d6a18a20255917
SHA1 37c9de71d8424dbc1de95af914bd3027dc3e76cf
SHA512 65e65b607492e790b0b6f191e6810a7a37534c0e58d0fa0e426a99be041b02b222d5424608623d111baaff25f2ef484fc2a1f122139f71d4fd9020eb98c94f23
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556rU:82fP5GAAaukfxlM+M6RkMkIM7drU
TLSH
T154F56B11F7A485B5D0AF01708B668626B637BD110FA08BCB52D4FA7E2F327C159B6723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
Size 3.3MB
SHA256 f4291407813ff3691f92a745aa2360ca97ff50a0ea95b18fe7faffbd87b52a45
MD5 9c0494058cdd6e8c8c3b68ee966c6f59
SHA1 fccc8e1b2d0938aaef856f137a5afb1d25de146f
SHA512 d89c3f6661b25f6dd02d57d0231fd999d13a42c195f86504d32857d7dcae116851041f03c24ec5c69e03c1a44026144d613902c9f100a0ec0cc6ac0c3f41fb6a
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556r9:82fP5GAAaukfxlM+M6RkMkIM7dr9
TLSH
T16DF58C11B7A9C5B5D4BB017089768726A637BD110F208BCB6394BF6E2E327C16D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
Size 3.4MB
SHA256 60262b2625c402151156aa3424ef2f62fc84c67d76b2003289dd4e56f0c35625
MD5 ac39461efa514c01ea578348a2ec3a45
SHA1 429ac22f5113b3f98de0a6a412ff4c3cb8ddb7c7
SHA512 7d36c4e6352633daf6d63a8863ea2faa50b735cb971c2a8e0882bb2a191b7e2b9a6fc24a7ff9d0e905833cb50199a8bd6588532f37cb4839f5f4a48e8bd43fbb
SSDEEP 49152:BW0Re2fP5GAFya0MUkfZqhaK6zbfqdleljS0g7mM+M6RkMkIM7I067556rPi2WH3:82fP5GAAaukfxlM+M6RkMkIM7drPuX
TLSH
T13FF58D11B7A9C5B6D0BB01714A76C726A637BD110F208BCB6394BE6E2E327C15D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-1355-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1156-70-0x0000000000920000-0x0000000000BAB000-memory.dmp

Download

memory/1156-2174-0x0000000000920000-0x0000000000BAB000-memory.dmp

Download

memory/2436-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2436-1353-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2436-69-0x0000000000960000-0x0000000000BEB000-memory.dmp

Download

memory/2436-2167-0x0000000000960000-0x0000000000BEB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads