Analysis
- max time kernel
98s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 16:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe
- Size 3.5MB
- Sample260423-tklkvaat2s
- SHA256 5b23f3fad2b87ef13358d083e395589815ff06ce5b1d9c60d9fae63c5b247df7
- MD5 337d83c7e87a37fcc6bbedc500231d0b
- SHA1 7bf36609be7c7c1e58fe13f35794c3b940dbb4f0
- SHA512 01be878a7a6ac6cbae1536645609d73874b49a73c95c2db838a28075a4572507894f76938c6c4b4be1308158d27480e57828d4d5b2bf419d21298cf020f227d1
- SSDEEP 24576:BCbvtJ1WAXIR8RrxzfadB3Iotwe6BavWrB1xetOsQuEZIG6+/GNsElnJnC15jcAf:BCL3IR8DydB3Io3W1PszNsQEpYq
- TLSH T18EF5071DEEEA8E12CC7124708F3D979C45203EA01BA1C59B6694752DEA33F89643F727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b3dd-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a19d-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e24-1228.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2980-1347-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2328-1349-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ab3-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001a5fe-1507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000025ad0-2070.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2328 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2980 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe 2328 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2980
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.5MB
- SHA256 5b23f3fad2b87ef13358d083e395589815ff06ce5b1d9c60d9fae63c5b247df7
- MD5 337d83c7e87a37fcc6bbedc500231d0b
- SHA1 7bf36609be7c7c1e58fe13f35794c3b940dbb4f0
- SHA512 01be878a7a6ac6cbae1536645609d73874b49a73c95c2db838a28075a4572507894f76938c6c4b4be1308158d27480e57828d4d5b2bf419d21298cf020f227d1
- SSDEEP 24576:BCbvtJ1WAXIR8RrxzfadB3Iotwe6BavWrB1xetOsQuEZIG6+/GNsElnJnC15jcAf:BCL3IR8DydB3Io3W1PszNsQEpYq
- TLSH T18EF5071DEEEA8E12CC7124708F3D979C45203EA01BA1C59B6694752DEA33F89643F727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 4.2MB
- SHA256 a20cab9bc4da3edb1baf3701af9eb887c08a1e0468f4b6e5ee85fc5b77d37c6a
- MD5 2d62817e43f78f89356cfdfbb4447c87
- SHA1 0ccde47f07c69c5f5114c8ba55feee298f08699c
- SHA512 4ad993a3822d622bc8afa7099d26ac7ef7fca8eca3aa881993fe40ae174e580d4d83ef70fa61d6b2d25bc4577f3929748c028a9d3ac898014e2a8cb110790d73
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYqKVk0QGTvntQb:YjIiDWCo3W1Pszo6EHaib
- TLSH T13916181DEEEA4E52C87050308F3A979C95303D601BB1D69B2694B529EE33F89593F723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.9MB
- SHA256 e5f51b9ce8d6c2200d4f1e6fde2d39b7f048e7d2af1671433ba566129c80db12
- MD5 ba21c692d8fb7f2385a9f9286ba8fabf
- SHA1 60ab9f7d6464ff62e683e2677d121789b8d3e519
- SHA512 5b396747aaad461d2719e3f214672d0afe19f22dc3ac00682b78fc542236f3eecad857d2dd8e23ab0cd4aa7b8c06cfacf03b2cf8305eae75e502f99ca1f00fc7
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYqHTd9CHKyao:YjIiDWCo3W1Pszo6YCqo
- TLSH T13A16171DEEEA8E62CC7114308F3D979C45203EA01BA1C69B6694752DEA33F89543F727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.0MB
- SHA256 36f6de9947c6804ae9df2824111bdb10fd0bcc71bb05a89dc2f0a56284ea64c5
- MD5 42e429174dfdc639ebd8e06eb9d7e0ba
- SHA1 d85d35c761374c1d9a94f453ee4d62e6c3268de4
- SHA512 9a9937243c3351487109da1a38bcba2cae2108e407e9f1f85c022f59958856a6a2b6c30018ca8a47cdc987627010d3ea050b915647abdd0c3f4d838083cc07dc
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYqjPji0Aj:YjIiDWCo3W1Pszo6Gjo
- TLSH T1A616071DEEAA8E22C8715070CF79979C45303EA01BB1C5976694B62DEA33F89543F723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.5MB
- SHA256 941d3003d2c9ba7953663b60e29c440dd914cfef6623cef35bb979d16eeff657
- MD5 b5d3bad5e5b592baa3db3a1e03b7b79b
- SHA1 94996bf2ae45a49fb3c22c952da8c3dbd0b1ce63
- SHA512 e2a43049dd96ea593a467959e9c76a8cb15b1b35b26b0e756016124eb01966ff955f801570129cf96ae86c95c4ed335a6c640df1e786f153b6a8eccc2e79b300
- SSDEEP 24576:BCbvtJ1WAXIR8RrxzfadB3Iotwe6BavWrB1xetOsQuEZIG6+/GNsElnJnC15jcAl:BCL3IR8DydB3Io3W1PszNsQEpYqt
- TLSH T16C06F81DEEEA8E12CC7124708F3D979C45203EA01BA1C5AB6654762DE933F89643F727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.9MB
- SHA256 284dc4e44ba4ba983f67632085b373473774972309101f30f56c78a971eb9651
- MD5 ad96a33ee0ca005edecbeeec4bb44771
- SHA1 2c41585b7ebe373e90d65f8e324b5e70cf98d8b4
- SHA512 e49b6b927931e57736661c5bca98f394aa1c4b9b2f19294a54e9e750b2f300945261189345e20037c311cc428e054ebf688ebb80981ce27dde89722ee6d9e731
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYqOXpiMh:YjIiDWCo3W1Pszo6Dpig
- TLSH T1B616061DEEEA8E22DC7125308F3D979C45203EA01AB1C65B6694752DE933F89643F723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.7MB
- SHA256 1231447659047eeaf074fe0ccd3e7f521be5af90e2c97abb5f257af7d216b131
- MD5 3819aadf13358859fcfca0d8212f6215
- SHA1 30346abcceafeacc14d9d4d6b9549e518ca754de
- SHA512 e3ad5b60fac08c714f813f1b83b0fc41c9d71dd6d9a11075f37faa7f992da3fb270a65006872c161b6c5c4a8a25207fa38ce1b505ad91961a24ed9730b0fcfac
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYq/i2WH3:YjIiDWCo3W1Pszo6CuX
- TLSH T10706F61DEEEA8E22CC7124308F7D979C45203EA01BA1C59B6694752EE933F89543F727
- MD5 SHA1 SHA512 SSDEEP TLSH