Analysis
- max time kernel
123s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 17:06
Behavioral task
behavioral1
Sample
2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260522-vmvrzabs6l
- SHA256 027afcea84f9ee9e7ff5030a91957131638e659d6f13a834e910122bd3f277b8
- MD5 bf59e9b668d27b75086971ed82567d39
- SHA1 3985c5a97db844f1b7197507adf3e64601649c84
- SHA512 aaad776115c0a999c6049bc8668251cf090b4a6b6b98fdb6de1fc735ab8bfe5c3a87bc248f01a6fa4c0213cd4cb6d8d9ba4499b0557a5785f1ee01fc6a75dcc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9a4:A3k03kD4U2v+P3k03kD4U2v+e
- TLSH T14E95AD17EB4400B5D20781355F9DAA32F7F9B8710B30A3DB67989709AF71AC0A73974A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/3488-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b47a-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2464-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3488-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2464-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e1d-1270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a7b-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a88c-1750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001e000000000478-1982.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025acf-2090.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0016000000025ac4-2241.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b47a-6.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028e1d-1270.dat aspack_v212_v242 behavioral2/files/0x0008000000027a7b-1378.dat aspack_v212_v242 behavioral2/files/0x000200000002a88c-1750.dat aspack_v212_v242 behavioral2/files/0x001e000000000478-1982.dat aspack_v212_v242 behavioral2/files/0x0003000000025acf-2090.dat aspack_v212_v242 behavioral2/files/0x0016000000025ac4-2241.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2464 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\javaws.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3488 2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2464 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_bf59e9b668d27b75086971ed82567d39_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3488
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2464
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 027afcea84f9ee9e7ff5030a91957131638e659d6f13a834e910122bd3f277b8
- MD5 bf59e9b668d27b75086971ed82567d39
- SHA1 3985c5a97db844f1b7197507adf3e64601649c84
- SHA512 aaad776115c0a999c6049bc8668251cf090b4a6b6b98fdb6de1fc735ab8bfe5c3a87bc248f01a6fa4c0213cd4cb6d8d9ba4499b0557a5785f1ee01fc6a75dcc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9a4:A3k03kD4U2v+P3k03kD4U2v+e
- TLSH T14E95AD17EB4400B5D20781355F9DAA32F7F9B8710B30A3DB67989709AF71AC0A73974A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.6MB
- SHA256 fde1d6a76325438c4b065a27870e89064cb82b0ebb033fb3b1b94eec1a983352
- MD5 70ed1f71acc1c1cd6e1a06705d0eebd1
- SHA1 08e760a7e06f63e1500f3bb37aebdcca398cbebc
- SHA512 5800c2f6f27f0515fdeddacd69a9c52d6e514a4a59b956cd5e5ef66523955ec14393baeb112b3d353e1043b9086655323ec4bf8a89e470befbcbb93d11919ace
- SSDEEP 49152:A3k03kD4U2v+P3k03kD4U2v+bVk0QGTvntQb:A3k03kc/vy3k03kc/vrHaib
- TLSH T1DCC5BF17E78801F5D15AC2358B9AE622F7B5B8610730A7DB13A8C7096F73AD0AB3D705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$
- Size 2.0MB
- SHA256 3761caae3984aace95fc0165ae95f4c117c5e06d13914ce65f8c9ab5f9cc6cd6
- MD5 3dc18d123822b0e89d5e4ed510cd70b8
- SHA1 dc73bc79a5b349c05fcde622dc7d5d6ec085b70f
- SHA512 cff5912558271f38cbf4de798190bc6018e96b0f9ec2528f5144ca308f37cf0705f19afdef3f090f115d413c84035f47e72288e1b2d6548bf69f98ded1621754
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9aT:A3k03kD4U2v+P3k03kD4U2v+Ew
- TLSH T194A5AE17EB8400F5D20781355F99AA32F7F9B8710B30A7DB27989709AF71AC0AB39745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 c9f7f2271f8a1418983ac49a572e52d278d70640bfacab937a109692f29b694f
- MD5 5ffd53260c9fc8686f19d7b61705d3a7
- SHA1 2729753ea1b430f17dc00b21387cedcde8f3eb3e
- SHA512 9cd69355a06a4031d1f17fccfc32b56e60c5d2143e4fad554094b5aabe8236e27c97cad0611e0d36ad2245e4bc0d3176a37a44dc1f58b48a3bbd1105e8f4f748
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac:A3k03kD4U2v+P3k03kD4U2v+OPji0Aj
- TLSH T1FFC59D17F75441B1D023C1358FDAA666FAB978A10B3097CB2388D71C6F72AC0A73A765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.0MB
- SHA256 71dc0b250767b61d22cf72191294d0b2494944d00d3a6a72b7069edd5e9d36f8
- MD5 129618bf0ecade86f2da2397f27ec320
- SHA1 07c2b8322437c072c4cca830f5a31efabe6012bd
- SHA512 4fadabda4df5b3aa58b4290de8ac83d7322dea060d84afd1a2571a3a54c4a2cda6989b1dc4aabab0c4ef5e7f008444b289116283bc425f61c8949fe2505f864a
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9aw:A3k03kD4U2v+P3k03kD4U2v+2
- TLSH T1A9A59D17EB8400B5D24741319F8DAA31F6F9BCA10B30A7EB2798B719AF716C0A735749
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.3MB
- SHA256 791ab9e054c14fab5e0f2e1f59bfbb4b20d5667f05c0518b0911fb75df05b9b4
- MD5 b361b73e3f4003891869f47209a6d486
- SHA1 6b726b7b0f572294cc7d0b51c70012205df15788
- SHA512 55dc626fe5f71fe8fc12ddffbd8c214c2972aac74808ec3d599a76cec9cb6e72e014c5405379362fe2ccad2b311adb88398b71f1759f5f9100a69d391cf3fb1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9a1:A3k03kD4U2v+P3k03kD4U2v+FXpiMh
- TLSH T16BB58D17B7C440B5E26342315FA9A661E7BABC714F3093DF2388960D6F70AC0AB35B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 2.1MB
- SHA256 c18f23ced38b767859106c474f746bda97982739014ab39d32ef5b82a7d25749
- MD5 ba8aa20c1a787d2ddb5768f24ef1ad3c
- SHA1 b3434d04e758cd342ae69107cc9fb635fa293804
- SHA512 fb11c970162cfd1df255998364e9639bb928bb53b009ac071e65f62f3065dc4c4b64fdc15d0eae3dba54be9f7aeae3381c5d70d8e901d005dfa1bf519a7f4939
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9aF:A3k03kD4U2v+P3k03kD4U2v+Mi2WH3
- TLSH T1F2A59D27FB8400B5D11741315F9DA632E7F9B8610B30A3DB6798A70DAF71AC0AB36746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$
- Size 1.9MB
- SHA256 5a7bba3961a96181eece05b7cb1dc6d8442a6c22098eaa58a7e4931576ad590c
- MD5 4ece9e38686997c3b9ef87e1b494ec46
- SHA1 f5c83ffb732ea2c43610faa5bf866eee0102144a
- SHA512 d9a5dc09efea7b39267692b4719bd41151265177cd04ec04a2509a16aa4592eae3dc9353ae6c3c1790117bdae1ce49ebf65f934bbb301bd4edd84a6f7c2191d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3g9ac/oL3mnXoZ643mnXoZ6ia4U2E+mRP3g9a5:A3k03kD4U2v+P3k03kD4U2v+T
- TLSH T130959D17EB8400B5D10781315FDDAA32F7F9B8610B30A7DB67989709AF71AC0A73974A
- MD5 SHA1 SHA512 SSDEEP TLSH