Analysis
- max time kernel
110s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 16:28
Behavioral task
behavioral1
Sample
2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260527-typjnaev7s
- SHA256 b37a7e28eed7e64ab974f2d92c3e708718d7311f41fe2a33119b53026ecf6810
- MD5 2bd65d28866b645adbeb6e19f9afcedc
- SHA1 c37ff46577b7c00a0b43ebb13c8242ba111fd2a8
- SHA512 d60803badc0a41bb4c498ce6d59f607ecc1b2e7a30b3478b3a0292fb32668a548b57b4f5304a7cbe530c335caaeed5e523cc4d956194fc3e302e655b945a906a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMf:A3k03kHRJARJg3k03kHRJARJF
- TLSH T1F6959D17F79900E8D10AC1789A969A22FB757C561730A3DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b595-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2684-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a2a8-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4936-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2684-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00090000000279b7-1438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b59f-1617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f00000001041c-1866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1971.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00130000000004a9-2084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b0000000004a9-2142.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b595-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a2a8-12.dat aspack_v212_v242 behavioral2/files/0x00090000000279b7-1438.dat aspack_v212_v242 behavioral2/files/0x001a00000002b59f-1617.dat aspack_v212_v242 behavioral2/files/0x000f00000001041c-1866.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1971.dat aspack_v212_v242 behavioral2/files/0x00130000000004a9-2084.dat aspack_v212_v242 behavioral2/files/0x001b0000000004a9-2142.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2684 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{801B79ED-F2FF-4982-A51E-9DE43565C5B5}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4936 2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_2bd65d28866b645adbeb6e19f9afcedc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 b37a7e28eed7e64ab974f2d92c3e708718d7311f41fe2a33119b53026ecf6810
- MD5 2bd65d28866b645adbeb6e19f9afcedc
- SHA1 c37ff46577b7c00a0b43ebb13c8242ba111fd2a8
- SHA512 d60803badc0a41bb4c498ce6d59f607ecc1b2e7a30b3478b3a0292fb32668a548b57b4f5304a7cbe530c335caaeed5e523cc4d956194fc3e302e655b945a906a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMf:A3k03kHRJARJg3k03kHRJARJF
- TLSH T1F6959D17F79900E8D10AC1789A969A22FB757C561730A3DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 2.0MB
- SHA256 970e928d1367777ef24f7191caf1d7e3fa9716095ec43f0f57f40d0076721549
- MD5 fa19583465cfe3826363234dca7b8107
- SHA1 de1e82a276dd4c3301e0380f348a854e176e2e7f
- SHA512 7cb97db9f806d931cdf4982f07b5415d5058eb4d12cbbc8ee246facb4811f36e44548e8c1e971d947d8903993593cb44ecade2612088db19c95266148d5ddfed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMM:A3k03kHRJARJg3k03kHRJARJK
- TLSH T15DA59D13F79400E8D14AC2749AA69A22EB757C66173093DF2358C6162F73BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.0MB
- SHA256 1f6abd9dc8dfa6d0fc86fa97404131208de7c195291bc71e466a14cd4dd75bc2
- MD5 fef008a041ecb0c13433eb42478b68a7
- SHA1 1189d743f45ce5385d7a5871f33c305ae59b7d1c
- SHA512 93d9aafe89d8aa90489680a90567bad82c30275e34054751b475e623116c03add43a3cdf8c55d5e98a2fce9357d8d3b7a6b23fd91c62c949f1f85a00f915018f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancM7:A3k03kHRJARJg3k03kHRJARJzBPVAU
- TLSH T14B95AD03F79900E8D11AC1749AA69A22FB757C56173097DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 2.0MB
- SHA256 defc1a24d7299acef0de04076fce6269bdbc410ba7d6abe56cdd456cc5804c2c
- MD5 6d0965ad3ede50b2378bbcc88c310315
- SHA1 7a951b98d7d2caea41a8833271e995a9ca9dc816
- SHA512 8c56dd4e963369199fe4cd0418e6feb6a8fc5c0ece62613a411951e6c63101b2fd8c25e7867519b15220a30c18f545b2a01dc7777012d444e2f3b934514c3395
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMu:A3k03kHRJARJg3k03kHRJARJjw
- TLSH T1D695AE07F79900E8D11AC1789A968A22FB757C561730A7DF1358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 52b44f0d00adf4d3eb93269d1f8f0d8aee324b27c4aa43d07c3c070a6e000eec
- MD5 3471b22ee9f794dea98c54b56a62dfaf
- SHA1 954ce067212c3b5335a4b586f657d89020558231
- SHA512 eb9359a824688872eba2cf96bb176d64b961213f2bebae81da68b15e212cd0f0f8c24b223ffe9c0e748b9be6fe646d3b0de61339787d51b60df5d4141b1a9f5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancM3:A3k03kHRJARJg3k03kHRJARJBPji0Aj
- TLSH T12FC58C17F6A801F9D066C178CAD69A66FB717846173097CF1358C6292F63BD0AF3A360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.3MB
- SHA256 160ab42bb5814f10e35929b0d7fce8f2e54b62366958903a6515df5f3d0cb060
- MD5 d3f257b910b5fec1229bd38f35b54766
- SHA1 106f285ff723ba6eedd16c49f9aff784546d38c8
- SHA512 d3bc2dccb3c3d19bd325d36ec43ec3d9f5420813d5da8150055c2fe4eb9000bfc034115cb904d0854ef4267fa73c3c9581e8bdce48393e401d8c1cf2de327076
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMM:A3k03kHRJARJg3k03kHRJARJgXpiMh
- TLSH T191B58D03F7D900B8E16786349AB59622EB767C525B30D3CF239486191F72BD0AF39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.1MB
- SHA256 34a7b21ce84d414209ed1ee06e4a9a00a4c67c11c7a70c3ead0d8dcb764785d0
- MD5 1a1dd8c364a84c69ecbb3a0da981d285
- SHA1 c4177010770d40022c7e64a9a0bd1971988be3b5
- SHA512 8a73fc0be2a4024340489d6b6058c779d31f5f953f0568109c42f68ce87985d0284f5f1142bfe887c872b09947f83709625cf4b45ac20d0280b69109973d0f55
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMg:A3k03kHRJARJg3k03kHRJARJxi2WH3
- TLSH T1D0A5AD13F79900F9D11AC1349AE69A22FB757C52173193CF2358C61A2F62BD0AF3A395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.9MB
- SHA256 cb1f220061e90402416b857ec83e706409383790f0742c7e73d735a77ed9fd0d
- MD5 edb2a70e43e997016c3079c243306ecc
- SHA1 29dfa68318077022e55fef0386b9476f470d8dd4
- SHA512 5f6c892a88e3b2ff4b6e37dca7954dc2d94a6c2102924ed8a3e71a35cf578607a494b0a008dd9b3f126dcad0236b5695c353cb74cfbd2b7e85eabf0721c2c489
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/pIv0qF3mnXoZ643mnXoZ6i6cMJlancMH:A3k03kHRJARJg3k03kHRJARJ
- TLSH T108959D17F79900E8D10AC1789A969A22FB757C561730A3DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH