Analysis
- max time kernel
111s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 10:57
Behavioral task
behavioral1
Sample
2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260527-m2rd4aes2x
- SHA256 52644f61134e7c1be716521ada344d35041a014c37b9c1d03b8a07bfbe270410
- MD5 d432d4d5cb9ecbf6676ccaedf8e77ac6
- SHA1 15726030d1ae766d94892597028f24d7cd25b586
- SHA512 9144a8ea8e1604051f82c40433106601bf1989619c4fa42ec5395766c6389c9e26aeeeff02785cb22c251b25934acafcab5a133fcd24f921680b595ed21bc4bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9x:A3k03kHRJv3k03kHRJ
- TLSH T17A659D13E79500E8D10AC1789AAA9A33FB757C561730A3DF2358C6152F62BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3716-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b586-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5096-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3716-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5096-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000028ea0-1257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b59b-1663.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1967.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00130000000004a7-2049.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b586-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0005000000028ea0-1257.dat aspack_v212_v242 behavioral2/files/0x001a00000002b59b-1663.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1967.dat aspack_v212_v242 behavioral2/files/0x00130000000004a7-2049.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5096 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164703\javaws.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3716 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5096 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3716
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 52644f61134e7c1be716521ada344d35041a014c37b9c1d03b8a07bfbe270410
- MD5 d432d4d5cb9ecbf6676ccaedf8e77ac6
- SHA1 15726030d1ae766d94892597028f24d7cd25b586
- SHA512 9144a8ea8e1604051f82c40433106601bf1989619c4fa42ec5395766c6389c9e26aeeeff02785cb22c251b25934acafcab5a133fcd24f921680b595ed21bc4bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9x:A3k03kHRJv3k03kHRJ
- TLSH T17A659D13E79500E8D10AC1789AAA9A33FB757C561730A3DF2358C6152F62BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
- Size 1.6MB
- SHA256 a0ac1770b6491db639311b7704e16e1d8aa411dc09e93621626a1f5418be20b6
- MD5 47cacef74916d9fa135286080e86f3ab
- SHA1 a7c628791e710b5c73877bdc2b842c817b56a8ca
- SHA512 54ebfd0c530f1d9fda34ca41bdcf0413ea73c606795814883d52179ef7b05a8a742b27fb741fa9c807fd3e5f3a58df5c56e71360a9527846cb615521ff94c084
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xqGen:A3k03kHRJv3k03kHRJAI
- TLSH T1F6759D03E79500E8D10AC1749AA69A32FB75BC661730A7DF2358C6152F63BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 cc82e556379236ff31561babb2940ea31b50de97f002c078b7079cff96736f76
- MD5 81c249f1fccdeaa63aa9118c36463423
- SHA1 971a7779253734f4b409c5295feb253aeed73d9f
- SHA512 07a96bfb6cbe1ba5668253d6456940c86a11be3b8072955342343785273113a2adc1b690f81445c89dcad67f8a01512b694e4f22e26ec1c5d6d4f8b4943cd4a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xP0Lu:A3k03kHRJv3k03kHRJuPji0Aj
- TLSH T1F9A58C17F7A402B5D026C178CAD69A66FA713842173096CF1358C7293F67BE0AB3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 56bc1b0558dbfd9ff283b172775d31621faaff46788b3c0c64874031820e1174
- MD5 bb3623aec527592872db7e9afce7fcf2
- SHA1 c35266bafebea1a2af6b60010a39e9cc35dbbca3
- SHA512 83d006f144b10d206bd059f676bcddb5a2f03d814ec9491447b9922ba207d2f604ba868f0616ee68db73d3ff12ca30a8e033ac97fdb52b6cae8a89b9da098d01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xLF:A3k03kHRJv3k03kHRJW
- TLSH T1CF758C03E79500E8D14AC1749E9A8A22FB75BC921720A6EF2358F7152F72BD06F3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 c0d87b2574fa5dc155c2b9256af8abc9f3d01030602842ddcc7182f17f1c326f
- MD5 505a174638752a34583c01f83abd6065
- SHA1 bf880727c524afe1381bda7e70026a09812a076b
- SHA512 5bdad2501c703077b0b885264549721cbb11910837cfda277724e3512ee6b593ada7a2954a37f1095ce66805ead805ac41b77bee0e00ccaf5ae1bbcd95dea9e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xK3n5:A3k03kHRJv3k03kHRJlXpiMh
- TLSH T115957D03F7D900B4E17786349AB59622EB75BC615B30D2CF239496092F72BD0AF39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe$
- Size 1.7MB
- SHA256 6b0f42696f0ebeb15b5c1d90d86c17407c67e46a679ee39e762a91497eba9a52
- MD5 e2b4b603112ef06dd2e795edb368f2ab
- SHA1 01efa673962d07630658a522ee736d422e20408d
- SHA512 6a7c83712554a909770888c103b5fdc2ada0651d588d630e81f57ccbe5a0b5be319b13321946abf1336788d015ee64eae973afc727c967efd334f03941465493
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xLV+r:A3k03kHRJv3k03kHRJsi2WH3
- TLSH T14E85AD23E79500F9D10AC1345AA99A32FB357C521730A3DF6358D61A2F62BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH