712369a8fbe4553d420b61a013ba34b274307aa31e56a85a9abd5b6c6fe818c0

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 596KB
Sample261024-d6l6haeb73
SHA256 712369a8fbe4553d420b61a013ba34b274307aa31e56a85a9abd5b6c6fe818c0
MD5 98f0c824c3bc46924f3e1961405ddc59
SHA1 6e08a1313a138fd98b8a00e83b070911375487de
SHA512 55571425be78431f497bd4d0a820535b5e7e5f7ab8c21c33ccac7b4cbe80f7a6b295c53ee27215982482332b9998a5bfb48a2ffc0b642f83d761bd892309a093
SSDEEP 12288:4kVyYiAwSfxL/2Dc3jDLLmt0LDQewsAjRE:5kAaewsAju
TLSH
T1C0D48C31FE74E036C6BB0DB21B26C716183D7A604F611AC3E3E89E9D59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
832	svghost.exe

Loads dropped DLL 34 IoCs

pid	Process
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe
832	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
File created	C:\Windows\svghost.exe	2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svghost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svghost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 832	4200	2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_98f0c824c3bc46924f3e1961405ddc59_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\svghost.exe
  C:\Windows\svghost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 786KB
SHA256 6340b6375c0dcb059d57777fa77b91c801f476eddeb4d3e969cfd815b4b4440a
MD5 2c755fe2fc4b6622256da0837b6e5c5f
SHA1 8f5e18a5c4f4778631e517513b5b0f1eb1d53dc3
SHA512 7f4de3504f520a869ccb6deb36326b51de6ed717bb92bc3bb0f45ee2e1eecc5c12efb355699706c7648545e0ac397a884bf039051053dd4481d1f611dec77124
SSDEEP 12288:wkVyYmXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:hk30Le5ji0hmxNrM
TLSH
T179051A16F6748335D073C0B9C5D2A69EE97130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 786KB
SHA256 53f684dcb7c026d73f356f6e60bcd78ebdb6b2972b51c66e70908e211f89fb5d
MD5 c9875d2260c39d39d3f227f4e4b29eb7
SHA1 7687557c9d4334a4a00b92d598011496c5858aa1
SHA512 c5f633aad8ff00d2048a213ff7b2fb9d7d6120ee298276c87d9032ae5cf2e106d02e4e2faa2e22735ca817a0f7800e1bf43b05360eb7f98da026c994413b607d
SSDEEP 12288:4kVyYmXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:5k30Le5ji0hmxNrM
TLSH
T188051A16F6748335D073C0B9C5D2A69EE97230865B308ACB4286D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.2MB
SHA256 21019f95392aac8c4930ca23595362d1b6fb0e617539382c259f3ca79ad561f4
MD5 523df0d457f3a237ea99a6cb0ef2e169
SHA1 4379a34f7a83cbc30b3540131e800ced1237132c
SHA512 0e4eeb26e2eb8a64f447bd5588f9127a8ff9fcfb1314c188057e36867674f205ffc700810bc3a04284e89dc4a07df70770d578088ab0417a143e1202eb905627
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWx6q8wyI6q8wyu:W/ezSC6vUzPvMHjyIHjy
TLSH
T1A445B515F578C722D0B3D0BAC5E36AD9FE7230464B3089CB024AE66C3D277E68636725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.2MB
SHA256 6e02ba3b2cf5c274536c56611b222bab814b8bc701947942b6606f9679f31f9b
MD5 e95c5a0fb78167a3385eb57191b78215
SHA1 376322581054c2b40c49b0e8c1a090d6b3989978
SHA512 a876dea8b22a1628ba93eadf55c3128ee2f309d7f45258f53a6090fadda49957248686de177fd5b7adef4fad104c5d9a8280e7ea0d183ad10316a5b9ac3f72e5
SSDEEP 12288:4kVyYJ8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:5k1a7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T11545F915F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 929KB
SHA256 df330f77f3c9ad89a217b97fa2b8343100ae001f1c61a33376ef7b549a56fa74
MD5 ec37fdce494603ad0b369f78712d127e
SHA1 704a0a248e1a196b00718ff7f3478e4aab176155
SHA512 728d3a56b3f819791c7eef35d5b2f5406b9dc8a9a585d17df4c654d1e82373a0678cb84f0dc926cb68216b9a12a1d92b6b779eb2e0037502182e8cef1756762c
SSDEEP 12288:9VJjBq33vckVyYKVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:9VbqPdknVbqPb88hv/l+7
TLSH
T1B3154C66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2F677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 929KB
SHA256 bdc765513412906a39595ff214b586d9c3b026c0dffe56b3271c3b98aa3ac3e1
MD5 fed77fc19d0916e6aa942bf554b8f739
SHA1 bdd25e86746d30b70a0bb12dfbc93b94d6065b87
SHA512 a21f0ca58754c8f87c0486dc38ddb6a9f99bdbe229005efaac2df7dc30ab098d91c231de0e5304f4ede79789bd9ea93c04088af94378a23a10d0f42402fcbfa1
SSDEEP 12288:4kVyYKVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:5knVbqPb88hv/l+7
TLSH
T192153B66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14KB
SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
MD5 5dfdda860ba69df0ae0ab193cf22a4ad
SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
TLSH
T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 519KB
SHA256 ea992e96258a07acc726ef0ec04de239b41a6569a7b5714b7695202725e40a77
MD5 5cc70b5582bcbb3e69a60c54e88d8cdb
SHA1 554a81c5139104bcf8d5b0dd6c7f48baa417fa87
SHA512 9caa2911d2f986a69eb6f00fb1b7e36c3d94b1b7fde76786f7aac7cb334637664c28da12a1b968d794f914362c6a3dd422e8303cbe746595008ebe0597e2c285
SSDEEP 6144:4knVuOGK9fCOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:4kVyYFeBNUbTVO86Uq
TLSH
T1D1B43A3BEE28FCD2C27A8DB857918640D77278704F61A3CBD165830E9E236E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 519KB
SHA256 0316495bda257080f34bff219d8d7f7a12f7b15bc3ad4a91f35aa6d04f91a6c2
MD5 7eab2e62312c559335d112de55086842
SHA1 8dccf69cb354f701d0fc2b91c0d3df37b80a7cd3
SHA512 6511d5dd7bf6ad883ab47288cfde1a8e3af69e78054fe45b18a895ac5b774af825cbaef8d124c5bfc0fce8a6df0b4dcf4c06da165110ad744235c136cd4016fd
SSDEEP 6144:zOyknVuOGK9fCOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:jkVyYFeBNUbTVO86Uq
TLSH
T1F0B44C3BAE38ACD2C27A89B85B91C600E77278714F61A7CBD175C30E9F239E15D79811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 47KB
SHA256 6598ca3e59435f37ed0394e8bc1f2555b19acb60df87a3f7109a318186f0452d
MD5 7cd19ecb92ca273bfe0fbc6981f074b4
SHA1 1673458eeecdf3b4c69ba0f9b22050709d76b19f
SHA512 5eafa9a701f586822e4e0a572c67d328383547b58c0d51de2a1578660f557adfc485ffa0f02a07899be261b023a979bafe510f6d6d0615db311adfc12fe44d1f
SSDEEP 768:xrv0+Wh0VwUbH+48TLMM0l7h4TA5zt70oOLvEbFX2:xrecnr8fMMq2TozxOL8bg
TLSH
T14D233A41A7AC8217F9BB1F70B5F0C5121E7DEBC63C31C65E188AB49A2D637C08A1172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 a876ab716d5529552855ff2d05bdfc58f29d88de7069e6424b80bfe728279bd5
MD5 1ead893645d72a9fff6a9f934a5b5a10
SHA1 2616835e5848685c05928e982cab4252000d965b
SHA512 08e92708f044b344363122e1874a9fbdb519793ff01e50ac460b4205916e0624a3f17e772c5698e875d13b07abfd99cdccaa545982f146d9c64d313bb5b43ed4
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euN1ov3/euNw5TScWwJb9DN5A:ZQvGAdlCEL8j/bRNw5CO
TLSH
T16F265C656BF880F5E0ABE174897AC972F77678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 d30f2b6e6c7ebf93d3f693940f8347ea5015fc1a9c7bf2c34edd5e524348ef20
MD5 672031bf99a3780329eff4eef85c9b31
SHA1 1db6d35cdd2066a59433b79c833f1fe3ed7e503c
SHA512 9f2145deebe5d8f12aa6c87d91d3dab13d35e48eade6e9260815bd9c303bc505367d290cc35ab6bbfc7abf8e8c196f9c6472bff65a05b756193e6ffb3c9ff411
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3cov3/euNw5TScWwJb9DN5J8NRB:ZQvGAdlCEL8k/bRNw5CO
TLSH
T1F8265C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 597KB
SHA256 a59fa7b22a24290bbbf499a11b84786a174bea3f2713b6d5623b9a789bd6f8ba
MD5 92448c2718fc85510514dad45cc8bf51
SHA1 ef44f98ae670017140fc9a2d3fc59f216540dcd9
SHA512 b616d424c1a78cd3a1874887d62a7b1799580ae989f2262f6e92c99f213c59854ef762b6cb510e1efff2e678a17d2ba5d04650fb87f3698b2e6e7946f650362e
SSDEEP 12288:tAwSfxLdkVyYGAwSfxL/2Dc3jDLLmt0LDQewsAjRE:eAksaewsAju
TLSH
T18BD48C31FB74D436D67B0DB21B3ACB1B143CAA504B6529C3E3E89D9E19702D22736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.7MB
SHA256 8a4e975e788e545cd13d04923de133e996ccb88cb66f7c4b9587f65c7e84421b
MD5 bd92435fd42d782de6ac1a1f5bac246f
SHA1 17947a7615a340815002edaf6b42e4d1a214c60d
SHA512 ecad053c388c7a85da830069e58ea2dedd091967a7d2bf30500894a0b2ab0b893ccf00c1ec1ff552dcb4a9e9e2640f8f044944fcfe81736f56649b306acf0a22
SSDEEP 98304:vVJ3MHEJqyQdetVbvC+2gslOxWixBDJ2sJTv6wsztRC1:XsEtQeTbvf2zlO12sJTv6Ja1
TLSH
T147477B966BB802F6D57BE478C6568173FFF138050638A66B46E6CB172F375305A2E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.7MB
SHA256 8152d76c18abd215ed805058e3f2b545c2fed2897a5b05b19fe880bc99ac3bf6
MD5 dd7a35aa851bb0b235b3fdfc68395270
SHA1 3eeedd8bb68706a6d121a6525934356934bcabd7
SHA512 88f04e18232f4f73f445d46953f535b471c28b66fd84eb62ae8d4cbded783be1b7bfdaf9163ddb2026cba1793db4182833fed6355524d935627efaa05d56ab7e
SSDEEP 98304:vVIVJ3MXEJqyQdetVbvC+2gslOxWixBDJ2sJTv6wsztRC1J:OUEtQeTbvf2zlO12sJTv6Ja1J
TLSH
T1874738D5D6A403F3D76AD478C57681B3EAB07C0E0736967A42BEF65B2F33620256D220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.4MB
SHA256 58561ccec899b6ec53cdb084f3b9501be46ec1105b8770934d239ba09aabc5f3
MD5 87f37055bbd5fa812b245979acb21d4a
SHA1 e83a2aba9394a2f26faa3a899a1573abd41c3b06
SHA512 2a50b6d956f41a3fe763541390e0ec10d9973c9a8ecd6254fd902700941ae83c66ab5b8ee00c23635096cf889030d2c9eb5fb7101d4390fa02b5b2466087b5f9
SSDEEP 24576:5kwCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:KwCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T138B55C0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.4MB
SHA256 9a56f0febe4e7f5d6f892d45d1c29be9d4ee4f1058227f66572d89d21ca7298c
MD5 d8a03ad686ea1a46ea81addcc47a5212
SHA1 2d1acf7f862ced7023051d0f9a656daeddedfa56
SHA512 3ea0c4f972af32e14493e1d1cde738546837240e61900b03bcd782a14faefae71c73a914e3041e79fe6060414e605ca2ef1a6247f6e8d9ce8c24ea4d790ba0da
SSDEEP 24576:hkwCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:SwCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T1F7B55C0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 817KB
SHA256 1f336b09f4bd9ce36b6cfb6b5dbb91637235ab92ad568d4daa8bdbca9408f5d3
MD5 5afb850a8df546714dec75cce0f946cd
SHA1 d5b58db06d7f4923d0290a96657ee91d4fcdee70
SHA512 4e3ced6e05859620a77c6f82169e36849fed98d146a15ca9a708c18765cf94fc4590ecf71df87e2b85bf45885f4f56d005b528f3f91ae23c300c206aff739543
SSDEEP 12288:4kVyYqAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:5kDAhGLAIFoiwtA5l7S53f
TLSH
T1CA052981EBF955D4F5B3AA7899B68571EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 495KB
SHA256 f57956d1128bd5728141c484201fdf775e9ff3c9d1588794e8452ca9c9c0af6c
MD5 4ffc391344cf739b8252619c1738a85e
SHA1 848a279ec2a34dd321ba6be4771bb36a9733cfa6
SHA512 7923238256b20e8679dbec0d5b1347078696f9f59106092b0b076166c7858d9cedd67da171383d52fb06bd4b7300a4aff5069c7e655d1cad3a483a7463e8e5f5
SSDEEP 6144:4knVuOGK9famw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:4kVyYSmw5HEjsChNVBFgl0WDm+Cp
TLSH
T173B49D4677A41CF9E96791388697C536F7B2BC022A25D71F07A0C65B1F33361BE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 334KB
SHA256 68144a57b4e6f9f95b26cc5febab9cee8a15d9db121020779053c783fa1198e7
MD5 ac1774bda109cdebeca11c2ded23b890
SHA1 c6b719d4c674b9d959e8d2ce2e3164fed7501ff3
SHA512 1e3acc2ce50383a3083982b45f848cd82eed21cbb9a17dd1f3ff52363df3cd8d00180fb2fce43f9e044edd661bfe8f6344435f9a9597051547c693079c0e133c
SSDEEP 6144:557L2DTH0Z1Ie8YDSknVuOGK9fk57L2DTH0Z1Ie8YDfvat:5rZ1I1kVyYMrZ1IyS
TLSH
T1C774AE9923E420F9E2A3913CD9E65646E7727C53273583CF026052AA1F73BD26D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 334KB
SHA256 ade51cf9e291a51aad531640add679d7237f7d3301b36edbdccaabcdae06edfc
MD5 1ba28c90582d66f36f85330e117f5a24
SHA1 eab3b3311fc3ad1b8cf540c28cab7d794148c906
SHA512 235955d46e6b4d29792c3e413cb89d4551114375e23944750f5b6e03eca4abf9afcfb8c758edb23ea4107189bfd4f3b52018b5c4e7a2f49cb76141c5c929737e
SSDEEP 3072:fCiyiukvvVHC6++uq3eqW14k/EyK9f1Pkv57OsX2T3TH0XzZP1Pwe8UXDCsCy17S:4knVuOGK9fk57L2DTH0Z1Ie8YDfvat
TLSH
T16E74BF4A27E430F9E1A38238D9E54A46D7727C636B3543CF066062AA1F73BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 381KB
SHA256 17e774ca544abcc090998129f3cc3cc36287383c8d40207bb820f6af57e4b511
MD5 52da181e3e03f47da6af939dfedd0023
SHA1 1d24b3f53a5f031bc1c741b3c8c075498fbca90b
SHA512 6df5a449ff528874885f3fd2d5354f0aa8c7403a2416cc051691ec098ed03d3d588cb8034d5d21049208518bbbe4ffd0a465291446530b15746568b7899f8baf
SSDEEP 3072:fCiyiukvvVHC6++uq3eqW14k/EyK9f1FvJ9psmeIBcV8pQFq4XKF3QP6:4knVuOGK9fb3psmeI+sQFqT3Qi
TLSH
T187846A0AD29402E8C06EA135C7568A41B3373C6697E1D3CB57D0F53E1F76690AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 293KB
SHA256 22391ed18d979d313f44a61af8a4e95941ee55f0739552c21765b3170183bbdc
MD5 e7acd8762da4cea4bc77a402452a6162
SHA1 d0a0ab18b160d1cad6749eba992fa8ce3a260cdd
SHA512 7ffc2593398f1d181c03e562e0522ed45753f82fda7c8140b86c8fc33899854e618437318964ec1d90c7a85f96b80bac735f5d007ef4a2fc36a555009566c7dd
SSDEEP 3072:fCiyiukvvVHC6++uq3eqW14k/EyK9f154WJgkt:4knVuOGK9fvJJ
TLSH
T17C54D00A6BB510D6E4278170C5921B56F93DBE53671092CF4FE8B21A1F733C4AE39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 301KB
SHA256 1bc62cd67478b5a86ff52d58f7e31f8a92825ea9b005aec67c7ec6768d64bdd1
MD5 81cb9c93d38690d999c416c966728418
SHA1 bde617d1c22008c9b2f67bb30ead48a8259711c0
SHA512 25f3e12be402d61c7b33bf5d7dc437bd39c091749f89425df5904cbda4ef3ba83f95985a6da117c9d2167db6eb6247d8500f5d269269a4676289215aa9d39694
SSDEEP 3072:fCiyiukvvVHC6++uq3eqW14k/EyK9f1rkIvQnkraVTxoQG:4knVuOGK9fRk3nkraVT8
TLSH
T19364E14517E200E9E12B8274D1A35A46F479FD124BA0A6EF4FE4B21A1F73BC0DE39742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 297KB
SHA256 ef71c088e7c4078777a77b9aaf971e9960854acd0edb47db5d32e777beaf44b6
MD5 969ba46382b226b238f99b05ae84246d
SHA1 3f9a5b50ea61b4e04db70903a91c53e94c4f5ca1
SHA512 ed8c365d20152d6d2086fd2f6e4288cc3d531bba914f4e898d9ce0cd97e2bfac01048e306527ac5345a78604e9f6c3c7d4980dc81506c52be12fc343dcc8d37c
SSDEEP 3072:fCiyiukvvVHC6++uq3eqW14k/EyK9f1Bpw5Z/KtbmmD22RQXSfj:4knVuOGK9frpw5ySuJQX0
TLSH
T12254E18527E200DDE02741B4C2A71A47E979BD525BA0E2DF4BE4B10D1F737D1AE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

andji

Path C:\Users\Admin\AppData\Local\Temp\andji
Size 4KB
SHA256 12974a2f4099c7f1bc3de5e21d66702bcfe65087a52d50a79808762a5c224007
MD5 da6a16aa00b293576147de4af60339a5
SHA1 079c279b68fd00e3f885d405f9dec88c43d22b84
SHA512 9e22db6d05708fedfd538e516acc935d5cc4c7ca986381c415c91b2401ffd15192d48027c9331c2409eca945c0feee8ee2c24e2fb9d391c1092103b76a20de52
SSDEEP 12:G/HH0Hk0Hk0EHE0EHE0EEH0E300EUX0U3k0knk003k0En0En030303HHHJt:GI
TLSH
T1629102417300D05CC1440730CC02C2FA01497C11CD74110334C13F0F39321840835640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mlewh

Path C:\Users\Admin\AppData\Local\Temp\mlewh
Size 238KB
SHA256 b7099c1551be5f845147ef04df81992989d2e14e9d1d865bb34c6d6bf500571b
MD5 5b9913f222410cc23f8c3d6c58441bd4
SHA1 72cdec03567d8ddb0939e399d28bc46a67c6ad1b
SHA512 1e45bce55d80a717e3ad29cdedb656e03afb016e39977d7148840df40c9da7e6f79f4199880efc59c216ca2eac3ccf26e37122f51271a147fb7a2931de3a83c6
SSDEEP 1536:oA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAy:TCiyiukvvVHC6++uq3eqW14k/EyK9fJY
TLSH
T1B534F25A5F523509E472C131B35E1BE9413D0EA2EF7DA31ACEC1705E1FB52256921B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owjot

Path C:\Users\Admin\AppData\Local\Temp\owjot
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjwej

Path C:\Users\Admin\AppData\Local\Temp\qjwej
Size 239KB
SHA256 665216895f5ab7feaacda7d0d9f179edeb180f87d2569c382b7ca96ea0eccd57
MD5 df9923f23fff23115e5ee5d0da75b4d6
SHA1 ec9f7540546514905b03a352e028e0a53bf4366f
SHA512 6ffd913f2e3a2670b6f1eff35bfb93dd80d173a3f23195cba0ca69c0ced8ea450eb4f41df343889b44beb3ba164bf81b4e8112f5cb062f0381e2f13cb95996c8
SSDEEP 1536:ZSA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9Ii:/CiyiukvvVHC6++uq3eqW14k/EyK9fpV
TLSH
T16134015B2F923509E472D131B35E1BB9513D1EA2EF7DA31ECAC0304E1FB66246920B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssliu

Path C:\Users\Admin\AppData\Local\Temp\ssliu
Size 4KB
SHA256 a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c
MD5 3ea9bcbc01e1a652de5a6fc291a66d1a
SHA1 aee490d53ee201879dff37503a0796c77642a792
SHA512 7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501
SSDEEP 48:r2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:r6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T12291553EA718B8B0F94E6DB1236FC064501E7504141BCDA6B1A9FCB07F92CEA40147CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 237KB
SHA256 3b092f9bebf8051385293a22b93a3b2b8df86b27a727ce7b60789cf35a1740b1
MD5 ea2e70eecb36f8768852ab3559365113
SHA1 2c6a2efe4a7bba1984fb75248dd41e6bd1702f5a
SHA512 6807d8039b01af85b79a9d7abdffd97bf2ba40627a68dd5bb43eb4d5755aec6a13839f044b64d38754c8cdff3b68a7d653192e38ff332aff0efbea07323a0521
SSDEEP 1536:UA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:fCiyiukvvVHC6++uq3eqW14k/EyK9f1I
TLSH
T17E34F15B5F423409E572D031B35E1BE9412D0EA2EF7DA319CEC1705E1FB62296921B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/832-36-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/832-37-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4200-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4200-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/4200-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4200-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads