Analysis
- max time kernel
101s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 23:29
Behavioral task
behavioral1
Sample
2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
- Size 4.9MB
- Sample260802-3gpmrstdpf
- SHA256 d119829c7ec1b22b246874ae756dff7581aa1504790837bd94142c071e144f68
- MD5 e89d8bdeb11975fc16e582656c8f3757
- SHA1 3b5c7b9fa79c36b0a1e3f05c4b2704a2ccb7b60c
- SHA512 f00d96542ee308fea58214690a9db13ec5ad147b305d6a1d46619dd7b9e17987527d90747f6e61fd4a59032b8f48cbeffc6609b7f8f391f2580ff79676d0c29f
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz97:jr211Kn0fkZckcFfkZcBrh
- TLSH T198363B15F6788732E0B3D0BAC5D6A79AFA3238455B308ACB0245976C2E377D5C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/872-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024566-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3316-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/872-16-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3316-23-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216fa-1250.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024592-1678.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002307c-1710.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1972.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024566-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00020000000216fa-1250.dat aspack_v212_v242 behavioral1/files/0x0007000000024592-1678.dat aspack_v212_v242 behavioral1/files/0x000300000002307c-1710.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1972.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3316 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 872 2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe 3316 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e89d8bdeb11975fc16e582656c8f3757_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:872
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.9MB
- SHA256 d119829c7ec1b22b246874ae756dff7581aa1504790837bd94142c071e144f68
- MD5 e89d8bdeb11975fc16e582656c8f3757
- SHA1 3b5c7b9fa79c36b0a1e3f05c4b2704a2ccb7b60c
- SHA512 f00d96542ee308fea58214690a9db13ec5ad147b305d6a1d46619dd7b9e17987527d90747f6e61fd4a59032b8f48cbeffc6609b7f8f391f2580ff79676d0c29f
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz97:jr211Kn0fkZckcFfkZcBrh
- TLSH T198363B15F6788732E0B3D0BAC5D6A79AFA3238455B308ACB0245976C2E377D5C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
- Size 5.0MB
- SHA256 0b862157f294293449f45019cc990df5430e47efb8090b739c9b09aa02d39ac8
- MD5 f54122073e7bcb6010d635055d9d2def
- SHA1 b042081095c7e189b1f86f2c1da4b0aa94326569
- SHA512 5023da7bf62f5b87478dcf9b2bcf9b9d32ebf3508459a8ad3148d5ccd4dab481ca69673b3a91e0856ac5783391c105758c2d7f20b18a7ab11f9a787eae728514
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz9P:jr211Kn0fkZckcFfkZcBrh3I
- TLSH T10D363B15F6B88732E0B3D0B9C5D6A79AFA3238455B308ACB0245976C2E377D5C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 5.4MB
- SHA256 f1ec56274d01f6a5060c37beaba693a55b0c751634dd46aed6e78aff31148601
- MD5 e8f9a9dd8ecb522c5bcba622465efc0c
- SHA1 370331672f7a660741312ce4ee6d0e982334aa98
- SHA512 0b86017cc19f0fcf49e29366788a2ac17b562d7fd1758a0f950db0247fe09689ff4b8116e85dce3846ca26a08009717d41d5f03637a6764ff8b4a9113ce5a1e2
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz92:jr211Kn0fkZckcFfkZcBrhW2
- TLSH T109464C15F6B88732E0B7D0B9C5D7A69AFA3238454B308ACB0245976C2E377D5C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.4MB
- SHA256 d1fbafc813a6f1f4093c0a4a2dfcd520cd03a71d8b54f76c90fd7144588480b9
- MD5 d60dd16d9dd86ecf227199b7f7373333
- SHA1 4ecd9f413248fa219e16181469100a5f4b33a029
- SHA512 e794c8aa8aa6d4ed66f4c914c92ab10bccdd7d3526d78ebadae144a6a8f59fb4002504a2b4873e60f940cc1737c07296912df31aeff6b170d4440ad5b347d0b6
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz93:jr211Kn0fkZckcFfkZcBrhZjo
- TLSH T117462B15F6788732E0B3D0BAC5D6A69AFE3234455B308ACB0245976C2E377D6C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 5.0MB
- SHA256 43b7ccbe1bdb23f6e512aac8b1149966106b49b5d61a9ea043c386c8820f0759
- MD5 a21b019dd943f7667eb98f74cc5a3132
- SHA1 6da22886db65e97fbe67b74a53944e164ab55b4b
- SHA512 740b3fa00e4565c65fa691671d52cba15a78a3ae655ae1795501b85687340b006928181bbd127ec42182bb6b1787a47b5edf09e35498b2c4bfedeb0d2f856273
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz98:jr211Kn0fkZckcFfkZcBrhr
- TLSH T1ED363B15F6B88722E0B3D0B9C5D7A799FA3238455B308ACB0245A76C2E377D5C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 5.3MB
- SHA256 9fb19371c3a62f36cfafe662667055d189d41547efd72016bf9bcbac12074a6e
- MD5 dd90c084bf126c57ccaa21f5e0e651f1
- SHA1 067e62eabc62864e9d0c9447512f8bb70210d7bf
- SHA512 199db30e580adad74bd65fb3bc26dd149e9f4c2ca469d613b3bf2541d021ed2d7840ed7b789275233db50268c13c57dbac6e24108021469fc8f0312a96d63275
- SSDEEP 49152:TuTl3EZpBh211Waw30zk1xH4eW4SkZP4sz9MbkqJtb2IdqJtb2IEeW4SkZP4sz9Z:jr211Kn0fkZckcFfkZcBrhkpig
- TLSH T193462A16F6B88732E0B3D175C5E6A699FA3238425F308ACB1245976C2E377D1C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH