Analysis
- max time kernel
111s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 11:32
Behavioral task
behavioral1
Sample
2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.7MB
- Sample260604-nnc5zset4q
- SHA256 996295b25e7d5d1458eb7308d1644058f5de0bc41a05db7668eac20201993633
- MD5 3334ece27c32a3c1cceda600abe62320
- SHA1 319d1d17db9f539926295395180d5d6fe2444c6d
- SHA512 b35ad42b84f2c1de233fd0cd17997b3b43be50322b3190ac7ed81bcdd667131f4f7ab9f04f484a84b93f77294437c771ec2abea343ae2c4ddbeeb5c675395e0e
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXo:A3kMFljd3kMFljY
- TLSH T11785B023FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3200-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4cf-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4344-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a34c-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3200-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4344-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028deb-1270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ac5-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001a621-1533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a000000000478-1970.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4cf-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a34c-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028deb-1270.dat aspack_v212_v242 behavioral2/files/0x0008000000027ac5-1373.dat aspack_v212_v242 behavioral2/files/0x002000000001a621-1533.dat aspack_v212_v242 behavioral2/files/0x001a000000000478-1970.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4344 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3200 2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 4344 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_3334ece27c32a3c1cceda600abe62320_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3200
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4344
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 996295b25e7d5d1458eb7308d1644058f5de0bc41a05db7668eac20201993633
- MD5 3334ece27c32a3c1cceda600abe62320
- SHA1 319d1d17db9f539926295395180d5d6fe2444c6d
- SHA512 b35ad42b84f2c1de233fd0cd17997b3b43be50322b3190ac7ed81bcdd667131f4f7ab9f04f484a84b93f77294437c771ec2abea343ae2c4ddbeeb5c675395e0e
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXo:A3kMFljd3kMFljY
- TLSH T11785B023FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.4MB
- SHA256 8d6295bd87939ddf3f8d9897b3594042fe541049b5f36fe5c0b0b6fd23359f10
- MD5 8756c9097171dbb5ce696f3b393e184d
- SHA1 5cd5cac67e9fb50349bf9c3b6e54a3d3156feb3f
- SHA512 d92b0d03aaee1122232a62d0db3e32194311225f8535a53bcdbff5d831d042e2d437f54f9e57d400c4a09078ff8197949891cb9eeaab16488ae854b6abb9d503
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXxVkGDvQGs94iGWWs:A3kMFljd3kMFljhVk0QGTvntQb
- TLSH T1DFC5AD23E6B851F5D17B86788A668603FA347C1107319ACB93B8C65A1F637E06F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 2.2MB
- SHA256 ea2282cf1c35cba1009875a34abcb6a12accf928b8b29c4d9bf66b5e049b0e2b
- MD5 335713a3166468d895351da1149a33fe
- SHA1 f674826ffc9b0453d5efacc62707fd2eae4af98f
- SHA512 74b5ea88bebe389ae81e60d1f7d0934a7b6789c863843b62acd2c9b2931cef070edfe79307b1ea5dc20ec163fda1ad1f6ef0b2b0609ba82dd25f9618a7d8b7b0
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXE3Td9CHKy7GZO:A3kMFljd3kMFljeTd9CHKyao
- TLSH T157A5B022F7F050B5D17B49705A758712EB797C210B209ACFA3A886591F327D06F3AF26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 35657c6557de202f608b1411cc5f1168d00ce1e1e26dc70a9e323dd96f72bc3b
- MD5 4e6cb1c3efd663b6e74897f458f9c784
- SHA1 a56e551d0bb54c3cdb27a1b1c6c7cca78281c2ad
- SHA512 544bec4add299ef8620e9436a357a0ada72806280dc6f58d963240b1922e27f67154df73c15a4e0c049dae44897044aac37b5fbd9972adf7d3b77f2986983877
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXw0Le5ji0hmxNrM:A3kMFljd3kMFljgPji0Aj
- TLSH T1CDB5AE23FB748175D13784758AE29716EA3578510B308ACB93A8C76D2F237D19B3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.8MB
- SHA256 b96f31fd58143c46033b342137ed01c1d9895383b23ee27c90f9b2de327ea9ef
- MD5 a868ee602e40593b4149bb0cdb0dbf2c
- SHA1 3c3235a5647810b920a3e69f1deaff4d5e85e0d6
- SHA512 5c3ee8f462a759e0960f60abae5a7cb4899534439cbdd2e9097a40d0d0f39d75c96d3759f531b7078feaf53df83790f913e4aedda3cabf79341a631bd6e5bf9b
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXiF:A3kMFljd3kMFljQ
- TLSH T1E185AF23EBB090B5C27B45705E65C712E6387D610B205ADBE3A8BB591F313C07B3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.1MB
- SHA256 5bedc7d917f389cad917330257ba5d33463b4ff44bb18d8e875cb72ec2584c39
- MD5 47d9b5baad2933bb8b53e2ce2951c5ce
- SHA1 4c5339983b7db892ec61b069f71b2b517e068fac
- SHA512 e53e41b0eb8438e5a4830e42a90dc79847c265a35520e421128c5b1dd882c1db061d0c2e652439f5c9d2b24e6a7224805e3229f7d90948d8772bcecb88ac9d98
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjXt3mnXoZjzyaEFoeo+aewsAjXD3npi63iC:A3kMFljd3kMFljTXpiMh
- TLSH T1FCA59E13FBF49075E2770A705B758712AA79BC214F3096CFA3984A1D1E717C0AB39B62
- MD5 SHA1 SHA512 SSDEEP TLSH