Analysis
- max time kernel
113s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 12:13
Behavioral task
behavioral1
Sample
2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
- Size 1.7MB
- Sample260629-pd6j8aex2m
- SHA256 4b1f6abfeca9149108ef2d39dddb94ca27ecf1be489f615f526b7580ab97d914
- MD5 cd772d5863d122ea5bcd944be6592d6d
- SHA1 71b63c05a191848a2bc8aab4c193adc64354c9af
- SHA512 75a570af3645d9fbcdabbe6d5f542898c6c3ae16556270e088c2d7b1d8b7e9720839c55d5107258f4598b8eb22918fe5b72228700e69eaea662bcebef2bf06f5
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyE:9MVs356rW4pYqqpYq
- TLSH T165852915F6A48B71D077C079C9D2A69AEA333C810F308BDB1385BB683E376D59935722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3984-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024478-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3916-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3984-70-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3916-71-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001700000002266f-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202d7-1526.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244a5-1701.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071d-1974.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001c00000001b35e-2070.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024478-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x001700000002266f-1378.dat aspack_v212_v242 behavioral1/files/0x00150000000202d7-1526.dat aspack_v212_v242 behavioral1/files/0x00070000000244a5-1701.dat aspack_v212_v242 behavioral1/files/0x000400000000071d-1974.dat aspack_v212_v242 behavioral1/files/0x001c00000001b35e-2070.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3916 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3984 2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe 3916 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_cd772d5863d122ea5bcd944be6592d6d_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3984
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3916
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 4b1f6abfeca9149108ef2d39dddb94ca27ecf1be489f615f526b7580ab97d914
- MD5 cd772d5863d122ea5bcd944be6592d6d
- SHA1 71b63c05a191848a2bc8aab4c193adc64354c9af
- SHA512 75a570af3645d9fbcdabbe6d5f542898c6c3ae16556270e088c2d7b1d8b7e9720839c55d5107258f4598b8eb22918fe5b72228700e69eaea662bcebef2bf06f5
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyE:9MVs356rW4pYqqpYq
- TLSH T165852915F6A48B71D077C079C9D2A69AEA333C810F308BDB1385BB683E376D59935722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- Size 1.9MB
- SHA256 3784931088f9d43bf3a4830525e5558e3f565c64352a777e4d4f2c5492b2faf3
- MD5 9068b0d50becf9f7d2b9af6c3d189d99
- SHA1 af225a2839254659ac420ef34371425d12e24646
- SHA512 9415d7d7102d9cba7527576fce5bd11f9769a2bf9b5b25f09560413dc8be83aff7492d461b8fa2286246763ce7070e244d403152be66c4a3d384a74aa8cc6323
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyE/WnvQBDVDfTe:9MVs356rW4pYqqpYq+KDVjy
- TLSH T11C954B15F6A48B71D077C079C9D2A69AEA333C814F308BDB1385BB683E376D19935722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.1MB
- SHA256 6fa80383ae540128f98dc2eeba5b2361c450f8ac398598aa032aae686f5b60a5
- MD5 050d002d62f7ba72262f31017da15832
- SHA1 e7689645a25e5d2734ea951556828fcc8af079a7
- SHA512 554a3bf62a382a26c07c4a1c90eeb3a6ab635b424cd998ba452ab8ff92e7f9b07ecb20404b04a229a36105901f08d9354f1f6c2a4c5b7f6ab6b3562c3b8edbfd
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyEX3Td9CHKy7GZO:9MVs356rW4pYqqpYqHTd9CHKyao
- TLSH T103A53911F6A48B75E077C179C9929656EA333C850F308BCF1385BB693E336D19939B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
- Size 1.8MB
- SHA256 071021d679fcf99e02d1004cc0f3164b6df20a307f927ac44af49b19d077c3a8
- MD5 edbaadddf9d8fe50204f44242a3b62e4
- SHA1 9b2d4b4e268dfaf257b43deb79b5209c6510885a
- SHA512 90804f9d80ad0407926c0c626ec5d944e8c062174add0cc0db0efa1ace58d3abdcd8d406f1c7c2efba126f174b9999dbcdc0a69308f981b351285f5569467842
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyEeGen:9MVs356rW4pYqqpYqZI
- TLSH T1C8853A15F6A48B71D077C079C9D2A69AEA333C410F308BDB1385BB683E376D59939722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 aa2d8a4e616bff33de6ed95532c609336abfce30148eaa419d4e61c103b46c6a
- MD5 1e0529ee0f871b11b439fb9f553a77c0
- SHA1 6f804331130db9a781b318f8febe544d8e432774
- SHA512 05a94e18d29b4c8bd5180de12ca1f8cdbc1ec1d7a72d114eb0baf2de77d23994fdca2fcb8526a92480368c392a6cd5a1088c123361a201869d69cefc1f295d9f
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyED0Le5ji0hmxNrM:9MVs356rW4pYqqpYqjPji0Aj
- TLSH T1E2B51A15F6648B71D077C079C9D2A69AEA323C414F308BCB1285BB783E376D69936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.1MB
- SHA256 d989b0b22f4f8f4337b68b7fb6cb116a45de56adcc6fcb553926e7a93d187214
- MD5 d2a0e00cbc77756151879d0756cf726e
- SHA1 0147a2aff604a1c880f5b04999cc449273c77036
- SHA512 9699c771635579cfa996baed11de634949decc43635cc26a810ed16f170aec7ad0ae88fef051513c24d6e378989a54841593ef52ad7790106e6f8a7416a165af
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyEu3npi63iC:9MVs356rW4pYqqpYqOXpiMh
- TLSH T1E9A52811F6A48A71E0B78175C9A29696EA337C914F308BCF1385BB6C2E326D1D935733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.9MB
- SHA256 8fd48739b0c9c16f479d02b6f78883d407aa7b24269dd6d3ffd6794872027f01
- MD5 9873e2e8d34a1d3048aa1d2974cf8cd0
- SHA1 253cc0890e60d80c78ec3710cc23526de3a9c28e
- SHA512 88126da3f49ceecb18948c7573d6ecd7e574600c35870084eb775daeacbf378c3b003f4df5c71800a1a049055374c33ea6d84c4bc162678b18b10211fd00892e
- SSDEEP 24576:EjQMFHDUT22CGD5Tvinrmu2i5jcAkSYqyE05jcAkSYqyEfV+PAk2hMH3:9MVs356rW4pYqqpYq/i2WH3
- TLSH T155953A21F6A48B71D0778075C9D2A6AAEA323C414F3087DB1385BB6D3E376E19935723
- MD5 SHA1 SHA512 SSDEEP TLSH