19f7c1976a466f709a0c30a573637856e4106011f41eb527f9529358f16628ea

Analysis

max time kernel
108s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 1.3MB
Sample260808-b1ehcsfm91
SHA256 19f7c1976a466f709a0c30a573637856e4106011f41eb527f9529358f16628ea
MD5 31c1c5917e3054951e29deae14f47c1b
SHA1 228981a0df85e6c593e841d5cf595a4debb2d081
SHA512 c6cbb15821e754f90c12f2f46cd2a88f159ae2d34091fcfc6484ab53a0bc6615ad6228b7a83190340698be7c3c54ccc6621b6a26c2bbba0f3c9057b1bc360278
SSDEEP 24576:A3mnXoZjzyaT4aewsAjRFYTqMi8CtBd2QHCHmTBW5M:A3kMPljeqJtb2I
TLSH
T1DD556C22F6748275D077C4B5C6E29B56FA3138414B308ACB9389D76D2F237D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c533-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4248-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5964-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001998e-549.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019caa-1271.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c533-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001998e-549.dat	aspack_v212_v242
behavioral2/files/0x0003000000019caa-1271.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5964	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4248	2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
5964	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_31c1c5917e3054951e29deae14f47c1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4248

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.3MB
SHA256 19f7c1976a466f709a0c30a573637856e4106011f41eb527f9529358f16628ea
MD5 31c1c5917e3054951e29deae14f47c1b
SHA1 228981a0df85e6c593e841d5cf595a4debb2d081
SHA512 c6cbb15821e754f90c12f2f46cd2a88f159ae2d34091fcfc6484ab53a0bc6615ad6228b7a83190340698be7c3c54ccc6621b6a26c2bbba0f3c9057b1bc360278
SSDEEP 24576:A3mnXoZjzyaT4aewsAjRFYTqMi8CtBd2QHCHmTBW5M:A3kMPljeqJtb2I
TLSH
T1DD556C22F6748275D077C4B5C6E29B56FA3138414B308ACB9389D76D2F237D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.9MB
SHA256 290e23b833fa63fcd9c1260703c3b6389f169ce6d3da3bae126405d67863c85a
MD5 363aa1b4f83f26f391fc4df69e215cca
SHA1 e286e3a2a23bdc2413187d9c87cf0e1397460061
SHA512 a96307eb870a40f2bef2793f0f77de9789211bc2ac0001fcb252c793793968b4e8d9e8bb02f93726708c0f2e6187ff5df99c27376aa403bf1baf7b526a53ba15
SSDEEP 24576:A3mnXoZjzyaT4aewsAjRFYTqMi8CtBd2QHCHmTBW5MP0Le5ji0hmxNrM:A3kMPljeqJtb2IRPji0Aj
TLSH
T1FD955B26F6748375D077C0B9C5E2A75AEA3134424B308ACB5389D76C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$
Size 1.4MB
SHA256 b73bf25e0111afc590c6a63f2e65a23d26dc0055fbea374f9b7910d02b6cb0c2
MD5 c5c263713558e672ccd89fba359ff40b
SHA1 37580b122c8f7f3e1e5c2dec3000c40c53981e44
SHA512 59f86ba23e92e63c3f7640915355c10dbea74129c4e3fd92ae8cb398616274a39213ba3f5bd5a439c00e896bf46eb6aaf58258e7228dfd4f0cb8c3f82638711a
SSDEEP 24576:A3mnXoZjzyaT4aewsAjRFYTqMi8CtBd2QHCHmTBW5M6a:A3kMPljeqJtb2Ib
TLSH
T1E5657C22F6748275D077C4B5C6E29B56FA3138414B308ACB9389D76D2F237D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 1.4MB
SHA256 749b451ebd777a75b5fb49c455bee97bbf777aaf0c0ea6d29366088488ea3655
MD5 1ca9774ac1c3eeb78a85f1cac69436aa
SHA1 e743dd160d64771d70a290f0e19eaeefae38066a
SHA512 8316effe978e9869260e5cdcac83b239c2a47f446dff96c561db31741705e459e12d0d4dc1dba8e3a636da5ccb32457003634b8db8066435b7df08c09320201a
SSDEEP 24576:A3mnXoZjzyaT4aewsAjRFYTqMi8CtBd2QHCHmTBW5MLF:A3kMPljeqJtb2IT
TLSH
T108656C22F6B48271D077C475CAD29B56FA353C810B308ADB5398B76D2E337D19A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4248-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4248-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5964-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads