Analysis
- max time kernel
103s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 00:13
Behavioral task
behavioral1
Sample
2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 975KB
- Sample260815-ajabmscg65
- SHA256 06cdb96ac943ebd240e59e86719171716e80128f395b42568043bf4ca426c247
- MD5 240329f036423188b9b3b9c30224c5a8
- SHA1 4f26f343fc5ef7c90da9e40751d7b642ef37da61
- SHA512 8c53c1df77c32aeddd72fe4dd69eb8c2ad837b447495d9cb0bbd22e7c15c97f0b3430e4354a8f210b018c852bd85b4a948f3d6eff6776b71ee50a72570c163d0
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRa:A3kMzlj
- TLSH T19B25B023EBB090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1048-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1048-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4108-82-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-304.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001babd-302.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000019b45-757.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cca-1279.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e3-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-304.dat aspack_v212_v242 behavioral2/files/0x000400000001babd-302.dat aspack_v212_v242 behavioral2/files/0x000e000000019b45-757.dat aspack_v212_v242 behavioral2/files/0x0003000000019cca-1279.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4108 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1048 2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4108 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_240329f036423188b9b3b9c30224c5a8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1048
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 975KB
- SHA256 06cdb96ac943ebd240e59e86719171716e80128f395b42568043bf4ca426c247
- MD5 240329f036423188b9b3b9c30224c5a8
- SHA1 4f26f343fc5ef7c90da9e40751d7b642ef37da61
- SHA512 8c53c1df77c32aeddd72fe4dd69eb8c2ad837b447495d9cb0bbd22e7c15c97f0b3430e4354a8f210b018c852bd85b4a948f3d6eff6776b71ee50a72570c163d0
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRa:A3kMzlj
- TLSH T19B25B023EBB090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 aaa6171c2be0e8fc6959d2316323d3f10d91d8d4ad521a20e23fb9a62285ff68
- MD5 34fcb1e8c5263be6edce8bb3e48ffc09
- SHA1 21ad3fd101e168ad2bfd4638e45f59db5add4054
- SHA512 0dea1a7875d7926e8a5e9595a6c9a362190f0414aadf11f33bdbb61285483e0710e48577bf23fdb00eb9990360af9d2639e60d67bb0d1ca78835cff64adbbfe9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRaP0Le5ji0hmxNrM:A3kMzljXPji0Aj
- TLSH T1E6758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 999KB
- SHA256 5937707ec81141aaa8734180fa1507185777b2c041ef0cabb7e1ccc4f2c2107b
- MD5 5a3c61b4ecbfe14e35f15fe9b7fab5b4
- SHA1 ef66fe140099eb635b074ec6d21b3e93183e64a8
- SHA512 03069921a30857c152ebac6a47ff145b18b0992d05ceaced63c02239e691f09c9c7d72037270d453d69e0d36a39815ecbfba4e310893db556872678a67e5832d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRaQw:A3kMzljX
- TLSH T1CE25B023EBB090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe$
- Size 999KB
- SHA256 e1c3aade2595550d3a91e3dfeda642b547822c3e63e1653aaa8616b93891cd3b
- MD5 822ce614d2b0334e2e3673f8461ede3e
- SHA1 c957ea2ee9be406ba49dcf9a7c4a4ba30698ef05
- SHA512 49d0649a15db9cc42427e344e1b069df56a8429ae39feccd9137b7059a043b38dfe2a160a820ecbe612b539ace7b63f7155eb61a546817cf0e28a740b6a9e343
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRavC:A3kMzljC
- TLSH T18025B023EBB090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.0MB
- SHA256 01936cc7548f3f5184a65fca84a4436ca2b88a6ce46302d3ff519e3e46519748
- MD5 eb0462081c504f437e506ee64a8d37f1
- SHA1 b3b69c0718c54b1efd24830a0ba681f0964fc8f2
- SHA512 4fd7e73e85f03f1bc4a9430d24838d9fa4a20779d3d8f0d4dd3b36b9c28993cd4239fa12f8bba5300c3e9c53b1f31e535a1fad8c3df4320d5ae57c555473bafa
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRaLF:A3kMzljJ
- TLSH T13B35B013EBF090B1D76B05309E658712E638BD610B505ADFA368BB691F313C07B3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 1.4MB
- SHA256 8aecb32c4841528dff7f5ece8abad83e81f952aa47b4273fb46605b3798b4c16
- MD5 f6b87fa0bb3a4f1c23ac9a4170d15d44
- SHA1 ba27ae7648d88513f2c23de62dfa8c5664b1e5ce
- SHA512 2582de1ab9321a937e5f59c0537980c863a3c896287be6f7d3aa1bf61f09b6c418abf3b244841e5b50213f1ff9b5dc852315eba2b077cd4885dea584ecb58167
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiWaewsAj/iTbRanUOlZ7q/c9:A3kMzlj/UOlk09
- TLSH T1AA659E22EB7494F1C27B49745AA68702E6757C110B609BCBE368D2691F337D06F3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH