Analysis
- max time kernel
114s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 3.2MB
- Sample260421-rx2fqagt7m
- SHA256 42ab2bfa9a25c6c8cddb494e002f26c9546e222b4892f4a16653bf03a2ba0961
- MD5 b486b03f39091babfbae04d7ca041ad4
- SHA1 4bb005780854d85c0bf616ab1c3cdc23a64d9a02
- SHA512 7493981e5736d259f44bb186e4be42ddb8ec5cd8e274a1e16387b25062825d564af74fae0b9c0e8e37d85375e37d41c21feaabe5fd4f43b74d301945db60449c
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrG:Ufv+pV2VG558Og
- TLSH T18EF57D31AEB486F9C97FD570EAA69239E0767C204F70E3CB53582E292E31AD05536713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 824 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79593\javaws.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2300 2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 824 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_b486b03f39091babfbae04d7ca041ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2300
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 42ab2bfa9a25c6c8cddb494e002f26c9546e222b4892f4a16653bf03a2ba0961
- MD5 b486b03f39091babfbae04d7ca041ad4
- SHA1 4bb005780854d85c0bf616ab1c3cdc23a64d9a02
- SHA512 7493981e5736d259f44bb186e4be42ddb8ec5cd8e274a1e16387b25062825d564af74fae0b9c0e8e37d85375e37d41c21feaabe5fd4f43b74d301945db60449c
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrG:Ufv+pV2VG558Og
- TLSH T18EF57D31AEB486F9C97FD570EAA69239E0767C204F70E3CB53582E292E31AD05536713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.5MB
- SHA256 f5c134c9007a9b49f40c63b8baa6afa1946556757f36548ffcc228115bb6b496
- MD5 e4229c14ee356634531726d688c0b0d4
- SHA1 b424aa0e229c940d514e78fb08d42e75ed9e7af0
- SHA512 61de7d803f19350dff7907c4ab231f4308935094d2364fa6c9846a36c345a13a3e79e41c32ba68f0c33f5a3bb278951c51b0c454fb24425a58ddeceabc2719e1
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGPUN+Eir:Ufv+pV2VG558OgOE
- TLSH T1FC067D316EB486F9D97BD574DAA69239E0727C204F70D3CB13582B2E2E32AD05936713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.7MB
- SHA256 8e1f9ed07b2b18c4aca1744c09b681a36cc682756282514e485941ab9cb512a5
- MD5 d6f60833367f5e477882c4367661aa08
- SHA1 02b12cc764026890e37580883d47930ac1a7b797
- SHA512 3ab25a08f8f6eab95caedaea32a803b33d9508d3a0cd30b554aa54576869e93e979d9278201054cd30b9caceb5888638a63e33cc4d3d043a17aed9afdb8c4b59
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGBTd9CHKyao:Ufv+pV2VG558Og2Cqo
- TLSH T13A068C31BAF486F9D97BC570DAB69235E4727C204F70D7CB13982A292E32AD05936713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 d99517595a850597c727936e4ed6295a8c73894d0ad0509e6bbd7e41768b9c40
- MD5 5dead87646c218b43e8257a23e08e5d7
- SHA1 5a041ef179eccef33a28d4fa34137a0bd5e78c4d
- SHA512 4011ca022b26148969b548372cf22a707b0a572eed4300440aa895ba7e47105ba9936311768ec61a18fc241da9a7d79ab9383642b535b0242e127e213448306b
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGNPji0Aj:Ufv+pV2VG558Ogojo
- TLSH T1A6068D31BAB487B9C47BC474DAE69279E4327C604F70D6CB13996B2D2E32AD04536723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe$
- Size 3.4MB
- SHA256 b47893619f016c6d97fa09401c224e2bd7814e911557ad7c20a3a38b1192fca5
- MD5 e045eb0f66f85c82a1cc1ea545a6cd18
- SHA1 d64b798f7e1c3b23f8305dbf4d896f92ff3a2741
- SHA512 9d34e1a943c4d4d8bfa7a2444436eca6b0877ccbef6168d5e0f18302c92864fbf8a8505fe339414618f5e7bc214743c317099a6ec4ca9f2bbaef347645e0298e
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGO:Ufv+pV2VG558Ogf
- TLSH T101F55B31EAB486B9C97F9570DBA69225F0377C204FB092CB5398AA3D2F31AD05536713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.8MB
- SHA256 e420cdf345ba84916c0756bd0f2fb55766a513332d8ff4527e4656cc90452864
- MD5 6e53ebe0f1479bbe7dd70f19181c9dc0
- SHA1 2632e669fc64076583742bde1c333f2e883f584e
- SHA512 0226abfa14555e4efb7fb0c8b0289b0e03aadd90f82c99857a745d9878978f22e610ae5f187bbcdf99148a1b04fef36e4e549903640b6ba5296f161b736f10ce
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGX8tDZqrKV:Ufv+pV2VG558Og+m
- TLSH T1B0068D31AFB486F9C57BC574DAA69135E0727C204F70A3CB5358AA2E2F32AD05936713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.3MB
- SHA256 c8ccc521f6c9dec6e7cc86ba513c4ee5752f1310a4469e31fdd56614ae21f6a8
- MD5 026081acea4f285b81e619367638cf77
- SHA1 9ac5587ce012e0e498b0aae61b1f4669502680d2
- SHA512 29896a6ca5f98d43c14bc3f1d1f7077d80fb7f8bf82d2f6249fb41b3a3c3082ed35a2a96ae541c1648ec9c0a3c8bdfdb0f08ec67c942646a46e650e7a325bdfd
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGX:Ufv+pV2VG558Ogy
- TLSH T16CF57D31AEF486B9C97BD570EAA69639E0367C604F70E2CB13583F292E31AD05536713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.7MB
- SHA256 3faaeae707c70559375dfc7f7e97ce4cdcb1e7a88d3f32a16ce3756617ebe01a
- MD5 9e4aed1b73eeaa37d4d547b07bdb5342
- SHA1 f9224b040a4c084a7eaa6a56955d08cadc1fe9d0
- SHA512 de8b8da80ad2aa2443e7f9f258d7911eb59a5e58c483d7d7c11c02f1aee667e0ca5ba56c4467bc3f12b58351010ff14c86f76282953055247ad6cd0747330220
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrG8XpiMh:Ufv+pV2VG558OgBpig
- TLSH T1B6068D31BBF486B9D97B9570EAB69235E4367C204F70D2CF13982A2D2E31AD09536713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.7MB
- SHA256 a44c8732178070b374f90fb5dbb1d82cd4777ae8dfdf0b5753998a4051cfbdb5
- MD5 ba3ed4ffb97e4637da49b71ab35d66ce
- SHA1 f37ffcb6e5222e4e5bf2b6e90aa438c87f28ae43
- SHA512 8a87cbcb6e80007e374d74bdd1f947c1fbe9366a7b87f35d7c2ff2d06ea216d2a1f092449fce86c6d19a38dbe39098688c019b7e59d7a2456b5f265e7a7ead87
- SSDEEP 49152:3/oIiIZM84pv+X8xzSbtL2tLb35DMnCIjtAy7BMO+YrovpU/9wrGMpbSDMh:Ufv+pV2VG558Ogl4Dg
- TLSH T137068D31BBF486B9D97B9570EAB69235E4367C204F70D2CF13582A2D2E31AD09936713
- MD5 SHA1 SHA512 SSDEEP TLSH