a5498026efc604daf3a7a08f52421f18bf79c828a1834ec6137f235fd910a40b

Analysis

max time kernel
81s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 2.8MB
Sample260506-msa1rabv2k
SHA256 a5498026efc604daf3a7a08f52421f18bf79c828a1834ec6137f235fd910a40b
MD5 258af04135af169171d47cb1a8ccd923
SHA1 adb5643789a2bfe333384297f81047c133eece3d
SHA512 14719360903ff52655e65f3df754da36d5a63ff6c50c8f3c86d9ef8a5235fb770018703c3b12d735ec73a5aba641b7d0a6148db8b2fe6e779b6450729dc0104d
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rX:HK5N55sgjOk9WOY6C8GrX
TLSH
T131D56B12F6648BF9D8674075CAA69375A6363C210F20E7CB6248EA1D6E33BC19D37713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 12 IoCs

resource	yara_rule
behavioral1/memory/4316-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00070000000243a2-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4972-7-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000800000001e121-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000023498-165.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000221a0-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000300000002182e-1196.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021788-1255.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4316-1406-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4972-1473-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000227bf-1739.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000b000000016916-1915.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4972	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4316	2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4972	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_258af04135af169171d47cb1a8ccd923_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4316

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.8MB
SHA256 a5498026efc604daf3a7a08f52421f18bf79c828a1834ec6137f235fd910a40b
MD5 258af04135af169171d47cb1a8ccd923
SHA1 adb5643789a2bfe333384297f81047c133eece3d
SHA512 14719360903ff52655e65f3df754da36d5a63ff6c50c8f3c86d9ef8a5235fb770018703c3b12d735ec73a5aba641b7d0a6148db8b2fe6e779b6450729dc0104d
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rX:HK5N55sgjOk9WOY6C8GrX
TLSH
T131D56B12F6648BF9D8674075CAA69375A6363C210F20E7CB6248EA1D6E33BC19D37713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.9MB
SHA256 5bf85df2b27e594ff05e2cf6bfe7364f74c749df98f7931b88e0f0fb7e8dd3d0
MD5 f38d32a8ddb43fb32ee04c245026c14e
SHA1 8da6e53e64c58d9c2f1ad37ac76618b43591e3f6
SHA512 8fc9fdcb73cb32ae377baf96b803e1e134db49d970847d57bab0aee6e3da957c8531b603b5e000cffb3b4867561e0535204343b5b55f736cc7cbff96c6274bd1
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rNw:HK5N55sgjOk9WOY6C8Gr2
TLSH
T19CE56C12F6648BF9D8674175CAA29375E6367C210F20E7CB6248EA1D2E33BC19D37712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
Size 3.3MB
SHA256 b95d74c8ddcda56947a606780491d88b0aa56d07ca02538448a9a40cddd4cb7a
MD5 7a6e947a57d52c00223ec69a63552a1f
SHA1 31340cae11fb6309b3ae80b90626b595a44fe72f
SHA512 480b855b6cd4dd1da92c2a12a0be72c164517efd9daaf27e6e173e7183c2e189f65f6a15dfbfdea83ad76b8c661232463fe8932d33cd9143a7deb1ef9d33fa76
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rvUidGl:HK5N55sgjOk9WOY6C8GrvdGl
TLSH
T121F57C12F7548BF9D8678075CA929365E6367C210F20E7CB1298EA2D2E33BD15E37712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.4MB
SHA256 b5f49de1b86ad4b2ca70060dfb59ac6df164498a6fb0e9501ebc3cf6075dee4e
MD5 c14421a4fda15b58fe57d94b642dec9f
SHA1 cf33c19c45d9f0876ac14a42a1614ec0ff6f91f7
SHA512 1f9973c83da465d61c2f90b4370154e83137543e10bc752b14fd4e207a5b5291f6a430e37a8c98b3250911481d043776f8687cbdaa1d6f83a984b0045f00124b
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rTPji0Aj:HK5N55sgjOk9WOY6C8GrLjo
TLSH
T13AF56C12F6648BF5D8778075C9A29765EA323C510F20D7CB5288EB2C6E33BD19937722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.0MB
SHA256 64be1b4cfe6960ef468b3917ce7d94875c55aa09ddff8e14950e496d458ce28b
MD5 e573dcc9cc796c3185304878f16a077f
SHA1 03d5b4bdc4fb1843a8f753cdb03c1888a8d88013
SHA512 68508256479a5d88b58647edbd6eb681681e786e132f79eb3561ea4c4993446167310ce140deffa555a95cdf5d06126c8689aa0316ec1257ba6a097d7888ec79
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rU:HK5N55sgjOk9WOY6C8GrU
TLSH
T169E54A12F6548BE9C86B4075CBA59265B6373C210F60E7CB62C8EA2D2F32BC15D76713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe$

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
Size 2.9MB
SHA256 d8bfec654c727d5b198cff28ceed91976fdd537f0e13b8bb108a182f29ff0099
MD5 a50a05c0c4a605525c4c7fef56b507b5
SHA1 78d5444c2982009dff253f169bb0f70421605401
SHA512 1ea9c5cce76564b2d739b12cc405c8368439caeed5e7a22e85dc0ea2f3d331755960d2bb27825f02b671e5b74825cbfc4265f20c4fcf69afc266874e935e665a
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56r9:HK5N55sgjOk9WOY6C8Gr9
TLSH
T1A1E56B12F6648BF9C8674075CAA69375A6367C210F20E7CB6248BB1D6E33BC19D37712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe$

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
Size 3.3MB
SHA256 6ad51b520c8b839da0e7f2738e523b6597e924a63d47a6de5ab5944a28265039
MD5 2fbfbfcc5e8ab9840b45a433ef045462
SHA1 dbb6c27813e60c228732dbac469ea103adc35660
SHA512 74b8e5be346797111f1fe706f73ae3bd1891939f5252a79cf5dae20ab3b671fdf32493ec1d31510c745bca3833c658db87a55827bd9c50fa92a7ffe147230347
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rjUOlk09:HK5N55sgjOk9WOY6C8GrF9
TLSH
T162F56C12F6648BF5C8774175CAA29365E6363C210F20E7CB6258EA1D2E33BD15E37B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubs.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe
Size 3.3MB
SHA256 7e44225b06892f5123f053f96233819708b949312e2edf19fb3105986ae4b059
MD5 e9c77e5057b718aa01b46940e2b515e9
SHA1 fd0443bc60c0d2866acf930f9e6e5e6c629bbf70
SHA512 e6a19e968dc5037bca6c212dfc7dd987b50598000b24f43989b7c91e225e3a48b71626842d5214c0576a929a2e3880eaa0406f97a7a2fa28863121ecee58f8a0
SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqJ85H56rZi6:HK5N55sgjOk9WOY6C8GrZi6
TLSH
T1FEF54942BB108EF9F86A8074C991923996377C240FE2D7C7624DBE1D6E32BC559F6312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4316-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4316-1406-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4316-22-0x0000000000A70000-0x0000000000A95000-memory.dmp

Download

memory/4972-59-0x0000000000520000-0x0000000000545000-memory.dmp

Download

memory/4972-1473-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4972-7-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads