Analysis
- max time kernel
96s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe
- Size 2.7MB
- Sample260423-rfaxfaev8q
- SHA256 c81182fc5cd1bfbb2a91e6a3fd40daeffe7b7478c927aeb640e1fc4c6535d86c
- MD5 43467af15cbf59a9e80afc90739f2b00
- SHA1 1976754b1f6768dce3fce48d45b0e032c6b30602
- SHA512 0a6b0a820cc9cb771f71a56adf8208ffc2c14aba7f45725b5b0b459d188704f0c37487d4ce11495948546d1a7ee37ba83f7e7b0d4bcb6cfa8adca615923c0318
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xw:B++VBf35DMnCIjtAyd7u
- TLSH T13AD51923A59806DCDD0E2D70C949A630F525BC9F3E0EF55B5D1C7B2A5973EE0382A263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4160 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4292 2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe 4160 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_43467af15cbf59a9e80afc90739f2b00_cobalt-strike_darkgate_elex_hijackloader_rhadamanthys_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4292
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 c81182fc5cd1bfbb2a91e6a3fd40daeffe7b7478c927aeb640e1fc4c6535d86c
- MD5 43467af15cbf59a9e80afc90739f2b00
- SHA1 1976754b1f6768dce3fce48d45b0e032c6b30602
- SHA512 0a6b0a820cc9cb771f71a56adf8208ffc2c14aba7f45725b5b0b459d188704f0c37487d4ce11495948546d1a7ee37ba83f7e7b0d4bcb6cfa8adca615923c0318
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xw:B++VBf35DMnCIjtAyd7u
- TLSH T13AD51923A59806DCDD0E2D70C949A630F525BC9F3E0EF55B5D1C7B2A5973EE0382A263
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.4MB
- SHA256 c4368dc1e8916c629b3ee8128b26d43bda6e915cef1baceb8760936201f78ec9
- MD5 823f59dd537f54ccdae2fb53339c536b
- SHA1 2adcbc7b413707158ca40a4ae4f64ae30591010f
- SHA512 5be30acbc8169e50f6c918d123e2d9b477383613e7746c7005da1dad290f446b92fdad3f2da56b01028d1c36d1aecb89ce549b5af1bc3c2f74b78b56821c903a
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xJVkGDvQGs94iGWWdTxT5f5U:B++VBf35DMnCIjtAyd7rVk0QGTvntQb
- TLSH T1FDF53A23A59802D8DC5E5D30C546A631F631BC5F3E1EF58B1D6CB71A5E73AE0393A222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.2MB
- SHA256 8df410ae70c33bf6051907a55c53f47e939cde353b02b9413abdbf27afb13cea
- MD5 7199a056cb8c2f22a455209718b95fc8
- SHA1 302db90aec634f7f11a9a0ac5341f1cfab93f01a
- SHA512 f3536bdae2e9a6b63867fdb5540ca08382f8e72d57080c917286fa3f155afd7163d75ea8929a54baea3ea0cc54d5b26a929e41b812257354e79934ff180c3abb
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xM3Td9CHKy7GZO:B++VBf35DMnCIjtAyd7sTd9CHKyao
- TLSH T141E54B23A59402D8ED1E1D30C959A630F525BC9F3E1EF98B1E5C771A5973EE0383A623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 0029aeb9d7956ca4a2bbee6a48e15e9d49d61900c1234e1c2b45003b50f27ab2
- MD5 1d35b6bf098980a186583650e2323e60
- SHA1 c65aa2b419c7cd377ee8c117f215f674e1ec72e3
- SHA512 22644934e506dfd5eaa5c91cdbd121189022bce46c580de05a1347ab05117cbb129959d3214191b4665560458d5e543235a1152673ffbd819d0076bedb7738a1
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xI0Le5ji0hmxNrM:B++VBf35DMnCIjtAyd7ePji0Aj
- TLSH T10DF53922B5940298DC1E5D70C985A235F531BC9F3F2DF98B1E5CB7295973AE1383A223
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.3MB
- SHA256 a109a76fae20fc4b1d02e231cfed9d1ecb0f0a6846178cfc85da1e765d9cc973
- MD5 a12be20419e79edf3a57e6ac3b93d417
- SHA1 9077a799a4c82279dc3f2d6c1fe9480fa2494d52
- SHA512 69f21afa44460556ddbb288dc216aa8949756e426531a79265cb69787f847b874b04cbe3d03a3b8da69c5859ae4777c9a3e6d31e74c2edd236a9d4212b1e2e27
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xY3N+tCn50ChWdArKV:B++VBf35DMnCIjtAyd7q8tDZqrKV
- TLSH T1C7F53A53A69402D8DD1E2D30C959A631F631BC5F3E1DB64B5D5CF72E1E73AE0382A222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.8MB
- SHA256 5d5bfc468a8ede0c7ce94a8a716557abc83093a50d9b863205e5dd7f191f57e8
- MD5 c087ebf500a154ca228f4959617e3c24
- SHA1 44e3f5d924c182fa2da39c6051bddbb504697c54
- SHA512 6f9c0a4d43b2d725159dce543edd9247bf84cab6c94ec9e06783ca74a25c0aeaaae6156cd65565963f38cc3b045aa47042a4da2a3f5a68714a5b7fa570ddc2ff
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xqF:B++VBf35DMnCIjtAyd7m
- TLSH T18ED53B23A59406CDDD0E2D30C949A630F525BD9F3E0EF95B5D1C7B2A5973EE0382A263
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.1MB
- SHA256 0036beb004ac16ccae944f1082c677a7bd3cbd85c9fe65c9b6998cbfd692ca6d
- MD5 681a26c2f68130ee5ec5e28492565b27
- SHA1 459ca69a1a986d07a9487be0769bf06eeebd5873
- SHA512 b9cb6dec545e496b3c27c80f55a390d11bd87886b642a0250e2e25f8105fa5751c87a975b5a0dc4dad87a85bf4d66107051b915e58ef2a299b3a52ccdfe344ed
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xb3npi63iC:B++VBf35DMnCIjtAyd71XpiMh
- TLSH T10EE53913B6D80298ED6E1E30C959A230F625BC6F3D2DF54A1E5C771D4873AE0782A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.0MB
- SHA256 9a2d296a206cf173e080705ce22c713b8fa890a8c01babf265dac0abba51b01e
- MD5 d6af25584bb532e312dd494dfd2083aa
- SHA1 e668deb044f7a94bea45640dd67db3c56eac8f8a
- SHA512 2e8d704345782755985b10c0065e8247e2b65cb28d282b371c64f15e9e03ab52f96e5e97cdbd5ea7e4382f8e72c894e51c2c2098b0e41c277dcb0d56e0fc786c
- SSDEEP 24576:lXt1sXt1sXt1g6B/H35DMw2n/qIjtAT3GjDNzPP/xSV+PAk2hMH3:B++VBf35DMnCIjtAyd78i2WH3
- TLSH T1E2E53A23A5980699DD1E1D30C949A234F624BC5F3E1EF58B5E1C7B1E5973EE0383A263
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 3.2MB
- SHA256 e5c0f69af03b8013fe0603727d2fd5e34fbf1ef32919d4f315c3fdb5289a1ed6
- MD5 254b6cff043aed4b04f63353537cc886
- SHA1 b50ed2c1bf7ae7f1d969c2b8f7399019a09fbe14
- SHA512 943c36b00b0947d7cff90106322318a11e0aed0425d8998bef77974aa49902905b737acb91ced86f6289823c1bb7e886f4b78341486622f1a5efb83c1ab9cdf7
- SSDEEP 49152:B++VBf35DMnCIjtAyd7FKrNnlIG2n0/9EVuuM:Fs55wx2G2nE9EVu3
- TLSH T1F5F56C23A58806CDDD0E2D70C949B630F525BC9F3E0EF55A5D1C7B2A5973EE1382A263
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 5.7MB
- SHA256 4c0a62518e17667570d652f0c41243d0b066a7018dcf0ef1afaeb2b9287039cf
- MD5 eeafcd7f3454b338f13baec73b3db8e9
- SHA1 b49b3408fed9be783346306e52c360e5ad6d417c
- SHA512 456eda199bac022a50277913e9cf9cfa51909256b983b327f51a5cf2f9330a6f8478f0304c97e9d908300a216ce5c2490d85d95abf8d86608f1f713a1125c108
- SSDEEP 49152:B++VBf35DMnCIjtAyd7W++VBf35DMnCIjtAyd78i2WH3:Fs55Ws55IuX
- TLSH T1E5562A23A598069DDD0E1D30C949A630F625BC9F3E0EF59B5D1C7B1A5973EE0383A263
- MD5 SHA1 SHA512 SSDEEP TLSH