Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 11:01
Behavioral task
behavioral1
Sample
2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.4MB
- Sample260523-m4py2sa14w
- SHA256 01971c1251f943afcf1a2667bb17c389291f1da7dc76c5487bdd3a5f529f63c4
- MD5 2cf3e5cbefa2ff7284911cd06c9cfc6f
- SHA1 a9ca41fcf56105abf8ab819b09e8eefbde915566
- SHA512 52f5caad32348fc41cdaa2853833f0cf2c408bf67574b90c819326b50520e671e22f7b2e8b50ca435b182af56d3ab21c3846489a6aadc26153e0b3e53bde4d8f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mb:A3k03kHRWr+FfkZc
- TLSH T119C53A16F6788762D077C0B9C5D2AA5AFA3238415F3087CB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/1892-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b00000002b538-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3984-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a3f1-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1892-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3984-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029c7f-1015.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028dd5-1268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a609-1529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001c000000000476-1972.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0027000000000476-2055.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001b00000002b538-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a3f1-12.dat aspack_v212_v242 behavioral2/files/0x0002000000029c7f-1015.dat aspack_v212_v242 behavioral2/files/0x0002000000028dd5-1268.dat aspack_v212_v242 behavioral2/files/0x001f00000001a609-1529.dat aspack_v212_v242 behavioral2/files/0x001c000000000476-1972.dat aspack_v212_v242 behavioral2/files/0x0027000000000476-2055.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3984 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1892 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3984 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1892
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 01971c1251f943afcf1a2667bb17c389291f1da7dc76c5487bdd3a5f529f63c4
- MD5 2cf3e5cbefa2ff7284911cd06c9cfc6f
- SHA1 a9ca41fcf56105abf8ab819b09e8eefbde915566
- SHA512 52f5caad32348fc41cdaa2853833f0cf2c408bf67574b90c819326b50520e671e22f7b2e8b50ca435b182af56d3ab21c3846489a6aadc26153e0b3e53bde4d8f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mb:A3k03kHRWr+FfkZc
- TLSH T119C53A16F6788762D077C0B9C5D2AA5AFA3238415F3087CB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.9MB
- SHA256 0830b3585b3eb635836ab71f94b3f878eb57cef7824586ba860bb7fde9bd1438
- MD5 3a6960a82292d6811c809dce9f1004b1
- SHA1 0aebda63cfb6161a2e81f770205e193c3ec130d6
- SHA512 fe9ca771106d2f72e77ee5232e94fe7a9e1c38e393ed1cad85aad553a4a435cc49f94e83b03a73ee2462c2358b7f499b7f709a27ee94752029bf8ca421d565dd
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9MbVTd9CHKyao:A3k03kHRWr+FfkZctCqo
- TLSH T145D54A16F6B84762D077C079C5D2AA56FA323C465F308BCB03459B282F277D19A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 b61e7303652b541428815e080db5953686c6fa2da444c36d4db1a11dc0554829
- MD5 dfceaabab693f29ae1824cb94aafc976
- SHA1 36986aa0853eaeabef741d9df068fd6d012cc4ed
- SHA512 7f745a9acaac5865bf7714a0709a541e4505837d8850c20ac2c17eb206701e4303aad23ffc3a3ba1b922f48767a1f8ae90759065711d8931083814e6b25f26e0
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHRWr+FfkZcRjo
- TLSH T1C7E52A16F6788762D077C0B9C5D2A69AFA3238415F308ACB0345DB283F277D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 2.4MB
- SHA256 51053eccc1fb8ba6c4feedabb6ff539308159194eaeb274b23f2fdad160180ab
- MD5 c0733a1a6ee2b29e69fa40c6f00efecd
- SHA1 05d8c52e9084b53268f4fe32a2d458a4996a0a73
- SHA512 e76c68fe7da37b82fa5ec6bf24bfc4b125047a43bf85a4d19c40a6f081b5954927c4f375c807c986a03170a249c0aa453c4b7434f1c175bda05a10b2b49efc3f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mbu:A3k03kHRWr+FfkZcu
- TLSH T1A4C53A16F6788762D077C079C5D2AA5AFA3238425F3087CB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.5MB
- SHA256 20749ef6478ef7eac6b9997d023983d376863cb648f0238a1833cda419ef521d
- MD5 1a4c209767b82b6fa52ccfe0d87afcd6
- SHA1 0d2050433e1a01cddc3344f4047df0e884f50a37
- SHA512 6372720f7f9f0048de092355d02c8b84944d0f3e04bf29d279fe6d42dc58f9c6eb50405ad17a468b38e03ba96e27521f3ba3e567eb62627a6091cf5a708706b8
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mbj:A3k03kHRWr+FfkZcj
- TLSH T18BC53A16F5B88762D077C079C5D2AA5AFA323C415F308BCB0345AB283E377D5963A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.8MB
- SHA256 ae2c4d5dbaa5d75148e8ddf61e887a92aca1da549569b0fbefc1b5c2048240dc
- MD5 013adb0be61352c80140aa8d462eecb7
- SHA1 e095777ff1aba92b166854cad77c2c86c51fb43c
- SHA512 4142b152976372eeee70715f51f66f5959cf79b26928ca8b79f8d406ee3384c78ca7323f57c782e8a12fd5852282907f0b61fd7db84092279871c1d2da237539
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9MbgXpiMh:A3k03kHRWr+FfkZcMpig
- TLSH T1DDD52A16F6B88722E0B7C175C5E6A655FA323C425F3086CB13459B2C2E376D1DA3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe$
- Size 2.6MB
- SHA256 241b8f24194b59dcd539cd2476f06d8c4255b08ff6d01ae6150f61e257ef86cd
- MD5 ead9b1e71c76a2aed0078a3ef1acb33c
- SHA1 c3c20f018ec7b5ef482c3abeb4ddf9a51157b9d5
- SHA512 c44696dc3cecb982292c8cc2ef97d9519e787c3ea4aa4af8a022f686e5a23540b60bd5d6d7a702f6974ae5404af1d9cdbe05485fef954ef4793eea659b54449f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mbxi2WH3:A3k03kHRWr+FfkZcxuX
- TLSH T166D53B26F6B88772D077C079C5D6A65AFA3238425F3087CB03459B2C3E277D19A36726
- MD5 SHA1 SHA512 SSDEEP TLSH