f8908a3cfd86402ff3768f76c7af8b68357d532ae1e3d66d8b4214dc6f258bc8

Analysis

max time kernel
112s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 2.2MB
Sample260802-g3y8faec56
SHA256 f8908a3cfd86402ff3768f76c7af8b68357d532ae1e3d66d8b4214dc6f258bc8
MD5 221cf688717b43ff50d5d2a38aee43b2
SHA1 909cbdc8c81ab9a4330b643e0fa8122c832bbf53
SHA512 8d922174923a8977b1b2fb8b2081ea4fc5a01501cffb61869df888374afe5824908b193bc686e321c17a5a7f1f10b1565690f3490911b68107824fd2fbed12d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2RNxCD5TvinrmfaewsAj5D5Tvinrmrj:A3k03kHRJU56rfljR56rQpYq
TLSH
T155B53812E6644BA5D02F8174C7928656FA333C414FA087CB53D4EE3D3F326D19ABA663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 6 IoCs

resource	yara_rule
behavioral2/memory/1932-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c599-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1932-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2816-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001ae2d-1515.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c599-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001ae2d-1515.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2816	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
2816	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_221cf688717b43ff50d5d2a38aee43b2_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1932

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.2MB
SHA256 f8908a3cfd86402ff3768f76c7af8b68357d532ae1e3d66d8b4214dc6f258bc8
MD5 221cf688717b43ff50d5d2a38aee43b2
SHA1 909cbdc8c81ab9a4330b643e0fa8122c832bbf53
SHA512 8d922174923a8977b1b2fb8b2081ea4fc5a01501cffb61869df888374afe5824908b193bc686e321c17a5a7f1f10b1565690f3490911b68107824fd2fbed12d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2RNxCD5TvinrmfaewsAj5D5Tvinrmrj:A3k03kHRJU56rfljR56rQpYq
TLSH
T155B53812E6644BA5D02F8174C7928656FA333C414FA087CB53D4EE3D3F326D19ABA663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe
Size 2.5MB
SHA256 066560f5453d17b385298e284ba427121315ba56c06f517caac1c41c580aab9a
MD5 586af012ea2ac9663758c41a05b7e375
SHA1 14150f914f15883af52ddf15d02c96256a027eec
SHA512 3fa3ef36cd4474b9288794cd7d02eb59096337b32fd9d63c9fa00e165a876159f7681ef6c4355ab8dbd30635f80aaffae12420b2277b823b4e881d25d5abadb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2RNxCD5TvinrmfaewsAj5D5TvinrmrR:A3k03kHRJU56rfljR56rQpYqsT1Llje
TLSH
T126C53812E6644AA5D06F8174CB928656FA733C414FA087CB13D4EE3D3F326D09AB9763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.8MB
SHA256 fe5dd7b04c608a452d4b2a222ab35e8d7cc1ef68710226b6703ac5e7db08bdd5
MD5 b0d93dea8007dec1291a9a6c97276a69
SHA1 d484f20698b03e251528b146ca497aa790584369
SHA512 2ce04efbd60abc8716b82617a98b9e3304e2360a4a97016838066c31c2c06af3c6ad74ae0cf6f9876506b7c846db2c1a8380cb052ef1a6fa6a4973a6e8d380ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2RNxCD5TvinrmfaewsAj5D5Tvinrmrz:A3k03kHRJU56rfljR56rQpYqjPji0Aj
TLSH
T1F8D53816E6648B65D06F8074C792965AFA333C414FA087CB53D4EE3C3F226D19A7A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1932-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2816-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads