Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 12:43
Behavioral task
behavioral1
Sample
2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260529-pyachsby4x
- SHA256 0017b0a103029924583571a6a57201334cf4889cb2b061128dc99a899be87e4f
- MD5 c7a6a13bb9c821e22573bbc306b03e2b
- SHA1 a40a10f3069edca8cb261c656ccd4f3cc8d85517
- SHA512 893d4f8439c5b103c125930793f173cde88fc2722edce4ff25f7ad2896141029b56c271b2ae32f55471b7b36b9df8059e9b64ae995f98120462a7fa001a9461a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja45d:A3k03kHRJIqJtb2I0pYq
- TLSH T193A56C16F6644275D073C1B9C5D2AA9AFE3238425B308ACF1389D7282F277D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/4440-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b545-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4896-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a34c-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4440-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4896-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a0000000272ee-168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029dfc-1292.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001a621-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1970.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0012000000000673-2081.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b545-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a34c-12.dat aspack_v212_v242 behavioral2/files/0x000a0000000272ee-168.dat aspack_v212_v242 behavioral2/files/0x0002000000029dfc-1292.dat aspack_v212_v242 behavioral2/files/0x000800000001a621-1381.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1970.dat aspack_v212_v242 behavioral2/files/0x0012000000000673-2081.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4896 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4440 2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4896 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_c7a6a13bb9c821e22573bbc306b03e2b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4440
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 0017b0a103029924583571a6a57201334cf4889cb2b061128dc99a899be87e4f
- MD5 c7a6a13bb9c821e22573bbc306b03e2b
- SHA1 a40a10f3069edca8cb261c656ccd4f3cc8d85517
- SHA512 893d4f8439c5b103c125930793f173cde88fc2722edce4ff25f7ad2896141029b56c271b2ae32f55471b7b36b9df8059e9b64ae995f98120462a7fa001a9461a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja45d:A3k03kHRJIqJtb2I0pYq
- TLSH T193A56C16F6644275D073C1B9C5D2AA9AFE3238425B308ACF1389D7282F277D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.7MB
- SHA256 a638777438520f5f643ffb7cd555748101e7b312f8fcc9710f1ea88c19ec0cc2
- MD5 672e741e8f5560ec4e206065ce2fa583
- SHA1 908df9d288b97d14363667f62be0e3151f3d97cc
- SHA512 48cf69a25bf2609b8e342a74624973330b99f4b800e717ed5c3e744ff0c79370984c3410c9e9e0c71bc0fe936d0221d21a19db5f07254abd58bc0e5feee85da4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja455:A3k03kHRJIqJtb2I0pYqKVk0QGTvntQb
- TLSH T149D57C26F6A843A5D077C179C6D39A57FA71384617309ACB0395C3292F63BE1DA3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 60128bafa86ea0fc79eb8ae02b4c0502691d991f315a45cef4b68b0afb058627
- MD5 08a3926556451401c2ed62d55ec712b3
- SHA1 9d4e908c38e2ad056e047005faafec435ad143a3
- SHA512 b47127cf4c6ffee38de48b04ba6ff973c141478e3efd195091520105e4e6aab299e39f7a263c89500c161691933b5c7badd684b9a16a8976b9150007eed69284
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja455:A3k03kHRJIqJtb2I0pYqjPji0Aj
- TLSH T19AC55B16F6748375D073C0B9C5D2A69AEE3234825B308ACB1389D7682F277D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$
- Size 2.0MB
- SHA256 c31a14052bb58add34e319da2ac09999449478be8a00dc019586ac87cd91315e
- MD5 01883e796e139d1a79b2c6cad6bd10a7
- SHA1 b5d8c10653c9c51fbac9ef074e57075bac93aa10
- SHA512 807e9edbed9d4c8dbac81f14fd130b97db0ea3a9c48f532f8091f4ceef82d435b7430cb4ad13e1399a71ac083ac43f8ed74fc3bad9920b7d6df84138b5fb4b22
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja45a:A3k03kHRJIqJtb2I0pYq4
- TLSH T16BA56C16F6A44275D073C1B9C5D2AA9AFE3238425B308ACF1349D7282F277D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 2.0MB
- SHA256 3d466a91cbd2a55527d4df1cef46c70970b889e8ac6a36e135cc9b3d8cf8cf42
- MD5 22dc9e635dfebedb9bb86eaa0e070cf5
- SHA1 781401ab714f145ebb24355b1d1383bb1b27c492
- SHA512 c764860a8de8eab226a8d3146caa7e1a8e3c3719b39723bc7b89a1dc27abf9a54fa745d8af35cb71630bf3e6eb59733161377e0041a47ffe82ee17c8043ec667
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja45n:A3k03kHRJIqJtb2I0pYqt
- TLSH T1E0A54A16F6A44275D073C079C9D2AA5AEA313C825B308ADB1349F7282F337D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.4MB
- SHA256 a4868e963dfc4644919e600c0acba24d1262bbd236608e6fbd2fa9055b886e96
- MD5 2120fbdbcd789e657465bc0ce6e4e731
- SHA1 6382c2d7d4dfd4b3d318a9626b0b8a3543fdb3f3
- SHA512 56814515729fcdf65b623a6be455df27d0877121160d758ac25f0ca1a0c7ddb618b44344f10595639119a3bbf97f9412a5e9771b354658d9a7636a3616f64855
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja45q:A3k03kHRJIqJtb2I0pYqOXpiMh
- TLSH T175C55B12F7A88275E073C175CAE29656EA7238425B30C6CF1385962C2F737D1DA3A772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 2.2MB
- SHA256 fca9dd261b640c6b5178cb067356af79c6f9368e7f665301879f9440a9f03fa5
- MD5 a78a8b81587fd1d9f6272637d8b41dd7
- SHA1 93a3ba6ce7803ca8dd927cec60852846515edebf
- SHA512 20b33b7ccfc07a600c9d347a2686e1487f0d81848e13537e029f3d85d1114744ebd2be4ec40c68060cab49d17fa9e1e73609179c2e91d11bc5e51d9f0b720841
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXql585jYTqMi8CtBd2QHCHmTBW5Ja45W:A3k03kHRJIqJtb2I0pYq/i2WH3
- TLSH T113B56C22F6A44275D073C079C9D2A6AAEE3138425B3086CF1349D72D2F677D1DA3A772
- MD5 SHA1 SHA512 SSDEEP TLSH