Analysis
- max time kernel
105s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 16:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
- Size 4.0MB
- Sample260803-vbeavacd39
- SHA256 5fa8f2209c7552dc98631501a761f8910ff923f6ebfa973995b59fb264bd3460
- MD5 d4470c8873cbc027bfb91b4d2d33d9ea
- SHA1 04332fde1777661338f5edd6f4f71d64576ba922
- SHA512 c0c371594966f47ed1c1f009b8b79b90b61fa07ba0ffbed3b572c4c827db3fefc817a8f2d857872ede5f6049fc14872b0ca7e1e497b942f869e8a92ff914c7ce
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2I:uCYhv7StGtfkZcBrbr+
- TLSH T114164A12B7F88726E0B79274C9E69695EA733C515F3087CF12845B2D2E32BD09936723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2864-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244ed-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1540-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002172c-817.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000021e5c-1597.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000021e5c-1620.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2864-1621-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1540-1760-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-1947.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000001da74-2076.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1540 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2864 2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe 1540 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d4470c8873cbc027bfb91b4d2d33d9ea_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2864
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 5fa8f2209c7552dc98631501a761f8910ff923f6ebfa973995b59fb264bd3460
- MD5 d4470c8873cbc027bfb91b4d2d33d9ea
- SHA1 04332fde1777661338f5edd6f4f71d64576ba922
- SHA512 c0c371594966f47ed1c1f009b8b79b90b61fa07ba0ffbed3b572c4c827db3fefc817a8f2d857872ede5f6049fc14872b0ca7e1e497b942f869e8a92ff914c7ce
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2I:uCYhv7StGtfkZcBrbr+
- TLSH T114164A12B7F88726E0B79274C9E69695EA733C515F3087CF12845B2D2E32BD09936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 4.5MB
- SHA256 e981b86947b90f20a191b91f9e0535342effc1cca18330952b2326e8136dc6a6
- MD5 0afa4c93ee2564ab6b189c4a73bdd4e2
- SHA1 ffbdc28bc84b015dd5edecd8ec1543f6661da48d
- SHA512 87baf209937d1e9608e685e521a82a46d5087b3f2ebdc9944b50f93d415a95c2a1978e90d0ace1e7efa5ad6c6b45504208ffe2bcfe97a1ede53a2e121f500684
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2IkUidGl:uCYhv7StGtfkZcBrbr+ddGl
- TLSH T199264B12B3F88766E0B79174C9E69655EA733C514F3087CF12849A2D2E33BD19A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 4.1MB
- SHA256 b245842d22e7d4791a0dfa69892d86e2556c31377d8595012c29e77620250df8
- MD5 203579b5f495c6371be42c43b53cb191
- SHA1 8ad3d10afb3d442be75c36f659c6c6cf39cbb22f
- SHA512 944cec2bab685139d5dc28bd6910ae97623786f90606803d1ec396b52d26f157184e04f9b535b0be2f71cf7dd23d494436b8d74123e7a52c4358c41fb2515d7d
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2Imw:uCYhv7StGtfkZcBrbr+E
- TLSH T10A164A12B3F88766E0B79274C9E69695EA733C515F3087CF12845B2D2E32BD09936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.5MB
- SHA256 5a1b7b0e8e434ef6d0ce73e69818d231c003143df93061a997124bf16291c408
- MD5 e510e159dd144636219e6704fd99dae0
- SHA1 465b01d50bb71801019abfe3dad08d20063e21a5
- SHA512 fd3e95858f886ed11069216d764dfd9a492810f6d8aec264464002362ad3b381861f80b1b4d615649b4dce3ecf75bbb5ed65e1996cc91d820dfea08819446b3f
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2IQPji0Aj:uCYhv7StGtfkZcBrbr+Zjo
- TLSH T13E264A12B6B88726E0B79175C9E29695EA733C415F3087CF12859B2D2E33BD18936733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
- Size 4.4MB
- SHA256 290ad4cabf238df2bc6d4c070ecb2bfb9fc6769ab538951e72b2b7774d35c3f0
- MD5 7d57a208957774a8f39fd366caeb6be4
- SHA1 735b9b06f1511ecf018cc4bdfb0baa449fbf9ab0
- SHA512 7c38264d5dc16fe7e364b9502c9a5d31512ecc175c97ec1b1391f2ab93a9afb3c2f6b691e9e1d7c0d2e9d9c26d2d91c44037173c548d44d81e4eda8afa105157
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2ImZkk:uCYhv7StGtfkZcBrbr+JF
- TLSH T16C264A16B7F88766E0B79274C9E69665EA733C514F3087CF12849A2D2E33BD09935323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 4.4MB
- SHA256 6c409e6a954248ccff69014c3098c36575e6ca70f55797e3f2f31bb87db06b9e
- MD5 fc198675d20959af90722ed20267ebca
- SHA1 bdff7e80a8c347a868ff19b185f0bd592140cc78
- SHA512 0bad6ecb83553391ac4fc7dbd9251a9b3cdcfc5e128986031908f980ddb2ffeb7b712a7ac657bd28741e1e10664f6ba92c22121f5f1faf878c319b78e1ffc924
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2IjXpiMh:uCYhv7StGtfkZcBrbr+kpig
- TLSH T1E0263912B7F88726E0B79274C9F69655EA733C515F3087CF12845A2D2E32BD09A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 4.0MB
- SHA256 dfb8822d0e3e45d15149ba160d76db282482e72c664824218b1f54e0fdcbf73d
- MD5 e79f3aea791aa418831a119b2111881c
- SHA1 52d619cfe02b52173c7f65aa3cec0d5e6a946ae7
- SHA512 f3444b4505050250ead7582c26b2cd0139bd34dd77aef3463c1b44e40bc5fdb71fa598082d2bb1dcf2fc8f3bdc9b7fb48948c98a83b656a288ee4d803f903bf2
- SSDEEP 49152:/a1nTzmDta4IhKPgssSt2ggS1OeW4SkZP4sz9MbE56ru56r+qJtb2I:uCYhv7StGtfkZcBrbr+
- TLSH T107164A12B7F88726E0B79274C9E69695EA733C515F3087CF12845B2D2E32BD09936723
- MD5 SHA1 SHA512 SSDEEP TLSH