42ab2bfa9a25c6c8cddb494e002f26c9546e222b4892f4a16653bf03a2ba0961

Analysis

max time kernel
111s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 3.2MB
Sample260421-rx2fqagt7m
SHA256 42ab2bfa9a25c6c8cddb494e002f26c9546e222b4892f4a16653bf03a2ba0961
MD5 b486b03f39091babfbae04d7ca041ad4
SHA1 4bb005780854d85c0bf616ab1c3cdc23a64d9a02
SHA512 7493981e5736d259f44bb186e4be42ddb8ec5cd8e274a1e16387b25062825d564af74fae0b9c0e8e37d85375e37d41c21feaabe5fd4f43b74d301945db60449c
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrG:Ufv+pV2VG558Og
TLSH
T18EF57D31AEB486F9C97FD570EAA69239E0767C204F70E3CB53582E292E31AD05536713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\dotnet.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5048	2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5048

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.2MB
SHA256 42ab2bfa9a25c6c8cddb494e002f26c9546e222b4892f4a16653bf03a2ba0961
MD5 b486b03f39091babfbae04d7ca041ad4
SHA1 4bb005780854d85c0bf616ab1c3cdc23a64d9a02
SHA512 7493981e5736d259f44bb186e4be42ddb8ec5cd8e274a1e16387b25062825d564af74fae0b9c0e8e37d85375e37d41c21feaabe5fd4f43b74d301945db60449c
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrG:Ufv+pV2VG558Og
TLSH
T18EF57D31AEB486F9C97FD570EAA69239E0767C204F70E3CB53582E292E31AD05536713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe$

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
Size 3.3MB
SHA256 9063338c6363bcf674e89ff8c6b27d18e7ce1c14966739053e7d7a5117077f8a
MD5 2a7142e5680f4bc9f5d44c86400eaf65
SHA1 4cd25ad2ed310493e5e35ec50b32ffc69dd3611b
SHA512 f0d2dbb6d9fe0a50f1b8043ca9a929de0a7ba91d8df9ed060087784a8afa5bb5daf34bb00a460a830bccdf91d3d6c0b1d0bad14129f426c3c742ee17305dabb5
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGFW:Ufv+pV2VG558OgmW
TLSH
T1F3F57D31AEB486F9D97BC574DAA69239E0367C304F70D3CB53582E292E32AD05936713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
Size 3.7MB
SHA256 2356a880a710cba76bfe5feffc0df7a6bd99e7591f153a644ecf4fd1605bba84
MD5 35ab9bef0c4527cdcc2da17ee872a769
SHA1 1d86d6f3faa2e2891f3903f55b617544f4e65bf5
SHA512 88be01827ce34ba29c0224fdd2388bd946b633c6b994983f0323c259c35729d0283f867c472e392d702b559cf67e4b99c88a89903fbdf28965b2abefd676b5f7
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGcT9t2:Ufv+pV2VG558Ogd2
TLSH
T102068D31BAF486F9D57FC570DAA69235E4727C604F70E3CB13982A292E32AD05936713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe$

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$
Size 3.3MB
SHA256 1f1b2bff0e9c8ffd2b05e3f9e6fa3825564ad1787c1d767abf6d9f6b006d782e
MD5 b017009ed0ea7193b93f8cba98a2f170
SHA1 f2c1dc09e773039b55565c763fb2099fc1ea3f2f
SHA512 42e241c12ae2cea4fee9492d5d4fe10cf3cc134be41cf2c69114e911db3280ce11918bb95b431d1c923b8edc622531d54d5cb59dc94c2e59f910e0db9ca616a8
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGXw:Ufv+pV2VG558Ogt
TLSH
T195F57D31AEB486F9D97BC574DAA69639E0367C304F70D3CB13582E292E32AD05936713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.8MB
SHA256 d99517595a850597c727936e4ed6295a8c73894d0ad0509e6bbd7e41768b9c40
MD5 5dead87646c218b43e8257a23e08e5d7
SHA1 5a041ef179eccef33a28d4fa34137a0bd5e78c4d
SHA512 4011ca022b26148969b548372cf22a707b0a572eed4300440aa895ba7e47105ba9936311768ec61a18fc241da9a7d79ab9383642b535b0242e127e213448306b
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGNPji0Aj:Ufv+pV2VG558Ogojo
TLSH
T1A6068D31BAB487B9C47BC474DAE69279E4327C604F70D6CB13996B2D2E32AD04536723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 3.3MB
SHA256 ca9dcc6147ee030d746742a620b4fe5b1ae7f3063a82a8d88bfc381479ac1e28
MD5 bf6fb1bb46b0f43a68d360aa2d58c719
SHA1 a60a5c77cba54b5adbd3dc349c4a1b7fa0d01ee7
SHA512 48cc2073a6fa93d98663c998738bf261e396e77940fa62492d1cf2e2fe473e6ff808eef8b89aa7071ac7aa7e4695224458cd17185ed360eed2c490145d55c52a
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGu:Ufv+pV2VG558Ogn
TLSH
T124F57D31AEB486F9D97FC570EAA69239E0767C204F70E3CB53582E292E31AD05536713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe$

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
Size 3.7MB
SHA256 97b5f1734518a3b5fe15c1bb000ed111689590060694d28be5ebedbe9f41c33d
MD5 7940df772882207191952b7d05c91af9
SHA1 a401f40f01c04ccf2c40aa49525ac517659d6a0e
SHA512 313c6b284ae8e3a223b52caeb5021e1524cb1e907df72381314eff26213026bc702003aeed561827e885cd76f692008090c3af496fea140132d8c05253f16c56
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGxUOlk09:Ufv+pV2VG558Og09
TLSH
T182067D31AEB486F9C57FC574DAA69225E0727C204F70D3CB536C6A2D2E32AD05936B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wordicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe
Size 3.3MB
SHA256 c8ccc521f6c9dec6e7cc86ba513c4ee5752f1310a4469e31fdd56614ae21f6a8
MD5 026081acea4f285b81e619367638cf77
SHA1 9ac5587ce012e0e498b0aae61b1f4669502680d2
SHA512 29896a6ca5f98d43c14bc3f1d1f7077d80fb7f8bf82d2f6249fb41b3a3c3082ed35a2a96ae541c1648ec9c0a3c8bdfdb0f08ec67c942646a46e650e7a325bdfd
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGX:Ufv+pV2VG558Ogy
TLSH
T16CF57D31AEF486B9C97BD570EAA69639E0367C604F70E2CB13583F292E31AD05536713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
Size 3.5MB
SHA256 4cd8839863fd5c708cf805b6c4880d71aa5fe56c8b7b6ddae761d54b33450146
MD5 ee2bb21c8cdc0dcfbc777859376c4f80
SHA1 f13b8174369ef48b7eff01e395e17a1ac04ef0d3
SHA512 dc744c3151720110b97f30c69fb2f5fbbb6a3900c2e58ef88a65e6d3c56028dcb3377da84a92ee85e8724bce9abc5f439610a10a0d16d1323b7d61f1666602ef
SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrG9i2WH3:Ufv+pV2VG558OgwuX
TLSH
T107F58D31BEF486B9C97BC570EAA69239E4367C204F70D2CB53586E2D2E31AD05936713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3644-75-0x0000000000690000-0x0000000000693000-memory.dmp

Download

memory/3644-74-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/3644-9-0x0000000000690000-0x0000000000693000-memory.dmp

Download

memory/5048-72-0x0000000002260000-0x0000000002263000-memory.dmp

Download

memory/5048-73-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5048-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5048-1-0x0000000002260000-0x0000000002263000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads