Analysis
- max time kernel
119s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 16:52
Behavioral task
behavioral1
Sample
2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260527-vdd3vsdt9p
- SHA256 2ed40b66e30c37f72c405aeb733a63b64b7cd936f7ba194af7d4c725c6dc7a6f
- MD5 641022c770e5abad09fc674b37140ef8
- SHA1 d7bdfb21fec037c0f3d2075b06b115a3ac428f38
- SHA512 62f50daecb7e49ab45db86a453e2612cd8fd52d9630569118291de00251cdc1e4e8244d5e43b271ac1d059a327155127aa28543c2a58a06591e74be74c3b2832
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPe2yfZe0p4Ek4niOkl/A04szE87h:A3k03kHRJgeW4SkZP4sz9MbkqJtb2I
- TLSH T18EB53B16F6788362D073C0B9C5D6AA9AFE3234465B308ACB1349D32C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5320-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b45e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a3f9-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5320-51-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2780-64-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028e3b-1262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a52-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8d2-1642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1983.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000000673-2096.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b45e-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a3f9-11.dat aspack_v212_v242 behavioral2/files/0x0003000000028e3b-1262.dat aspack_v212_v242 behavioral2/files/0x0008000000027a52-1385.dat aspack_v212_v242 behavioral2/files/0x000200000002a8d2-1642.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1983.dat aspack_v212_v242 behavioral2/files/0x0014000000000673-2096.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2780 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5320 2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2780 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_641022c770e5abad09fc674b37140ef8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5320
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 2ed40b66e30c37f72c405aeb733a63b64b7cd936f7ba194af7d4c725c6dc7a6f
- MD5 641022c770e5abad09fc674b37140ef8
- SHA1 d7bdfb21fec037c0f3d2075b06b115a3ac428f38
- SHA512 62f50daecb7e49ab45db86a453e2612cd8fd52d9630569118291de00251cdc1e4e8244d5e43b271ac1d059a327155127aa28543c2a58a06591e74be74c3b2832
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPe2yfZe0p4Ek4niOkl/A04szE87h:A3k03kHRJgeW4SkZP4sz9MbkqJtb2I
- TLSH T18EB53B16F6788362D073C0B9C5D6AA9AFE3234465B308ACB1349D32C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.0MB
- SHA256 cf9590d21b39b7d307e288e753b0bab4feec8d40c0fa935e85dec097aa94220c
- MD5 03c21e6b2cc436eb6e1d466395f2a648
- SHA1 c5898e970a4454a2935ba88656cae2a486a30100
- SHA512 76b2fc90ef4fbfad5cb9e749d69452029e08f3cb1ff3508b7439f051922dd939f9a931b408b9b5b4b24d3e47d79eff854158bf91eaa1d28cce9009bf0d6f0c35
- SSDEEP 49152:A3k03kHRJgeW4SkZP4sz9MbkqJtb2IRVk0QGTvntQb:A3k03kHRifkZcklHaib
- TLSH T139E56C16F6B843A6D0B7C179C5D7AA5AFE31384617308ACB0359C32D2F277D19A3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 2.4MB
- SHA256 8c7a2be576b5564f19f06609a8b12353af90f275b9e82fcce7728d919b69a669
- MD5 9dcab5a16cf4eaf7a46001d40afb69ef
- SHA1 4356bc5aee14d1c59709dc0b1ee2608fcf75532f
- SHA512 7b91463d33f620f2df008889fda81aed293592af038ff3385b5820c208ef1af7330f6e63bb502d0bf3e929561adb5dcafb598c8bd3536b01457cd4cd6dfdf900
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPe2yfZe0p4Ek4niOkl/A04szE870:A3k03kHRJgeW4SkZP4sz9MbkqJtb2Imw
- TLSH T195C53B16F6788362D073C0B9C5D6AA5AFE3234465B308ACB1349D32C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 4cdf69d57ddafb18634367c69bb65db810041029de47164051045479620dad6c
- MD5 21addf972b7b8b80f428b6188399cd7e
- SHA1 796b038dda1c8f8397b277ea1836c650ebc47fe9
- SHA512 9a49984116931563bcd30afcff150dc44f1f1022a23f32ed48a55240e8200b0eb94581d2e5d67bd4fa7b669d52fb75aa02acfd7fbba79a5e03ba7b6342dac932
- SSDEEP 49152:A3k03kHRJgeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRifkZckZjo
- TLSH T1A6D52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
- Size 2.4MB
- SHA256 c825d316f6ce813f9f4fd5ebcccf8d1444ca83cc0aca1f4ef89c5f66e8910ad1
- MD5 8e6302754a683a5bda1a4c576d178280
- SHA1 263f7d79c8ff6c6e2da0acc6599a36742a625e8d
- SHA512 6eff27d17563dd3829127de81013780b589b39a7cc94b82bbcd76862ac302dead1d0617f44fbdb3966e0a8fb558a5ddc908c88075db3ee75df6573458ff92a69
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPe2yfZe0p4Ek4niOkl/A04szE877:A3k03kHRJgeW4SkZP4sz9MbkqJtb2Ig
- TLSH T16CC53B16F6B88362D0B3C075C5D6AA5AFA313C465B308ACB1349E3282F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.8MB
- SHA256 8ef9efccf68105f421d3cd276b937684a8c0ff153bbde54bd6d2e721ae7b888f
- MD5 ea560cda20733d66e5c13125b3c0c9c3
- SHA1 dd27fd6368183fc32e573e231491925f76b936bc
- SHA512 fd203afc64617bbc347bda1d9d2313edae7e118741b3c8ff4b5dad9d6d72b01037e62c72a89860636a318a6023eefe3076625e6673e8c1833c31f1cee6588d26
- SSDEEP 49152:A3k03kHRJgeW4SkZP4sz9MbkqJtb2IjXpiMh:A3k03kHRifkZckkpig
- TLSH T1B6D53B16F6B88332E0B3C175C5E6A65AFA7238425B3086CB1345972C1E377D1DA3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.6MB
- SHA256 5876467b79b115f8752058b92178ee81854b0183faf01b547d8f4d5c06161293
- MD5 739713863b93ffc1eb58cd2075105d8a
- SHA1 6f9dddff163506123097149a8a429c57e9f0c142
- SHA512 51c9a5f48352d54149326bf4a10960f73ba2861ac0dbaa367da568502df5e6c0cea0c01c8443979317ddd491cb34ac9d6ca21458487d053f732d3aced21f7370
- SSDEEP 49152:A3k03kHRJgeW4SkZP4sz9MbkqJtb2Iai2WH3:A3k03kHRifkZckJuX
- TLSH T107C53B26F6B88372D073C0B9C5D6AA5AFA3134465B3086CB1349D32C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH