Analysis
- max time kernel
90s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/07/2026, 18:13
Behavioral task
behavioral1
Sample
2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
- Size 1.8MB
- Sample260715-wt4twset4t
- SHA256 82bbc4d8821b5d77f5901042e8e2b3ffe1a8544863f395ecde82849062e69ff7
- MD5 cd11adfcd453cffffd69fabb5e074989
- SHA1 f5d9c6e57c793fcdbc3c688675600db9efdbd330
- SHA512 a2ecce19c1e8eea323045b3b08b9449aef2498e09556822df57ad59b3cdd4530f814119ba1837773865eea04e6188634827b84d679dc87d6e72417f38a25a211
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmPu:TagnTkLfUTpnqJtb2Ij56r1
- TLSH T16F854A26E6688BA2D07BC074C9D29646EA333C414F3087CF5295BB697E337D19D36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4884-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243a4-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/516-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4884-58-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/516-65-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000243ae-1225.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a8-1264.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003500000001e0ae-1535.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000719-1978.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243a4-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x00080000000243ae-1225.dat aspack_v212_v242 behavioral1/files/0x00020000000216a8-1264.dat aspack_v212_v242 behavioral1/files/0x003500000001e0ae-1535.dat aspack_v212_v242 behavioral1/files/0x0004000000000719-1978.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 516 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4884 2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe 516 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_cd11adfcd453cffffd69fabb5e074989_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4884
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 82bbc4d8821b5d77f5901042e8e2b3ffe1a8544863f395ecde82849062e69ff7
- MD5 cd11adfcd453cffffd69fabb5e074989
- SHA1 f5d9c6e57c793fcdbc3c688675600db9efdbd330
- SHA512 a2ecce19c1e8eea323045b3b08b9449aef2498e09556822df57ad59b3cdd4530f814119ba1837773865eea04e6188634827b84d679dc87d6e72417f38a25a211
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmPu:TagnTkLfUTpnqJtb2Ij56r1
- TLSH T16F854A26E6688BA2D07BC074C9D29646EA333C414F3087CF5295BB697E337D19D36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 f696e14ede5cd9f1628fe9475bf2bc7eedc5905240252217bf479bcf265ccc48
- MD5 fe371a5a097a451fa70e05c36bf00761
- SHA1 6b380f871dd1c1a0571318ba6b9bbb8115facc41
- SHA512 88180d07affcefbedb17271d9ceef3f420f6610e7f1c559f655bd06b71bb094f22c289ffc8c0b162a1ca08a4c62638677901942e5b170f83198739fd2c24ae54
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmPK3U:TagnTkLfUTpnqJtb2Ij56rlTd9CHKyao
- TLSH T115B54B26F6A44BA1D07BC574C9D29646EA733C510F308BCF4295BB292E337D19D36B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 319c191ad633eee6d8f9be79779c213d1efc0a8be9a89e2befa074b9b265f0c2
- MD5 6553a18a9e129019ee7d21da524cd2e7
- SHA1 e5cb2b91679ededde6fa36a58845508dfe065c4e
- SHA512 9c85007895e2a251ea909a6f6eecda1ebfc6845dd04a4a3b5d79ab7f1d92c437a20dfa0712ac939ace8c251d3ec8fbc0d1cde69fda73862c5ac99171dd70eafc
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmPe0C:TagnTkLfUTpnqJtb2Ij56rxPji0Aj
- TLSH T1ABB53A26F6788B61D077C0B9C9D2964AEA323C414F3087CB4295AB6D3E337D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe
- Size 2.2MB
- SHA256 961174bd9679d7bbdc2192c7f4e59d56e36ba8b44d5648dbec8a5c80f33a63b5
- MD5 b92a79bf010e71b1046c9bf6ab49e036
- SHA1 69d2d919247d2a34e25e9ecac3a08b80f58c64bb
- SHA512 c65f34bf586439f543e167e5fafd7d1f794fff892d41ed08fe646fe46208fe71a6eb0a24aeb778286cbb51eba69ad37d40ef942e3674d304779a0263f72aa20d
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmPsi6:TagnTkLfUTpnqJtb2Ij56rTi6
- TLSH T11EB53952AB648EB1F06F8474C9928229E6333D550FE246CB528E7F196F333C959F5322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 1.8MB
- SHA256 6a772685d19a3dff88d1c36e3743f32c928107feab64cf4a72036d739bfecc27
- MD5 f59bcfaf6808a6a79c57b3a602e0c839
- SHA1 467863028d14955209e3f21d7d166d23006d4772
- SHA512 654bfb919c0e9f09d793755b98fb061b58765290959ed7ded3a19913fcf4f3acee48bd1f75196aa56873d5bc2930c27feffb0efd156d1fcc906c5caf749755ad
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmP8F:TagnTkLfUTpnqJtb2Ij56rz
- TLSH T17D953B26E6A44BA1D0BBC074C9D29645EA333C810F3087DF5295BB697E337D1AD36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.2MB
- SHA256 eec14102c0e71e4ac421309209213cf56e8f11e719c6401bf12eea3f20642783
- MD5 ce616d1ce52532d7c564cd659892aa12
- SHA1 392db64dc70576eac7ec4281f8a312b804d94eed
- SHA512 33ac62bfaf3da04dc0fb2f69ac7b67b4ef7c381b03bc945ec27897801e01c1be0908943a77634ba468529c5b41e7f14c73fd174bbc6a01e487c051bd448eab8f
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5kD5TvinrmP135:TagnTkLfUTpnqJtb2Ij56rwXpiMh
- TLSH T112B53A12F6A88B71E0B78574CAE29645EA333C514F3087CF5295AB2D2E337D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH