Analysis
- max time kernel
109s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 04:38
Behavioral task
behavioral1
Sample
2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260601-e9m3msew8k
- SHA256 9505ff1ec8550b74149fe4626c1f6b44ade4b1b5d7cf34e0f7d8b5dfa5020976
- MD5 9b4329648c60fdcb7efa65c04cf8009d
- SHA1 dfe076e8ecb6a2b864c7836cc61c7a397c810b40
- SHA512 63fd1d3dcd71adafcfcf03da82d055ad1c55e0d839eb19087ebe1320280e4986e312fa45a5f9f5d12f92578492dcc3fd68b6dcf476bf09437cd8ea00517fe172
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrM:A3k03kHRJP56rXPji0Aj
- TLSH T13F755B16F6A44BA5D02FC078C5D2965AEA733C421F3087CB1354DE293F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/3172-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4d3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/680-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3172-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/680-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0037000000028c3a-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e3e-1264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001a60a-1550.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0021000000000476-1974.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002e000000000476-2070.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a0da-2082.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4d3-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x0037000000028c3a-1027.dat aspack_v212_v242 behavioral2/files/0x0002000000028e3e-1264.dat aspack_v212_v242 behavioral2/files/0x002000000001a60a-1550.dat aspack_v212_v242 behavioral2/files/0x0021000000000476-1974.dat aspack_v212_v242 behavioral2/files/0x002e000000000476-2070.dat aspack_v212_v242 behavioral2/files/0x000300000002a0da-2082.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 680 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3172 2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 680 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_9b4329648c60fdcb7efa65c04cf8009d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3172
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 9505ff1ec8550b74149fe4626c1f6b44ade4b1b5d7cf34e0f7d8b5dfa5020976
- MD5 9b4329648c60fdcb7efa65c04cf8009d
- SHA1 dfe076e8ecb6a2b864c7836cc61c7a397c810b40
- SHA512 63fd1d3dcd71adafcfcf03da82d055ad1c55e0d839eb19087ebe1320280e4986e312fa45a5f9f5d12f92578492dcc3fd68b6dcf476bf09437cd8ea00517fe172
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrM:A3k03kHRJP56rXPji0Aj
- TLSH T13F755B16F6A44BA5D02FC078C5D2965AEA733C421F3087CB1354DE293F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 2.0MB
- SHA256 a186452ac89dfd84c722683fa6e031f69186753178abc53066494795c51051bd
- MD5 b05714f091c58e16aadcb4e9f93a9478
- SHA1 38185f817d7cf0295ee233175a95d8d17db032e8
- SHA512 96e7f79a9d8f8aa7bcc17fc311114b341661e4c64b4e5e62b1c0e03121b567f096af302305280e61bb8724783f4e8c76a5955426d76ff19939bc3d870e491922
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMe86n9kAJ9w:A3k03kHRJP56rXPji0Aj1T9t2
- TLSH T196A56C16F6A44BA5D06FC174C9929656EA733C421F3097CF03949A293F37BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 281904723c23283461d912d6eac7e7da95981b4d2a73e174d20cc25bb01813ba
- MD5 2d36e4f3e6ae488ecfec3460efb061ff
- SHA1 ba79f11b7f00faefb959843f5196d6dcbbdf72f4
- SHA512 07593904c74a1074324b44f6f44f3cf1569d93959be780ff25d7c84ffd7a1ef7452e27124be7550adbc152ccaa8efb295770f25de201d2dc23ca63ef2c40899a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMD0Le5ji0hJ:A3k03kHRJP56rXPji0AjKPji0Aj
- TLSH T1CAA54B16F6644B75D06BC0B9C5D2969AEA723C421F3087CB0345DB283F27BD59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.5MB
- SHA256 99b21af321bae0654505604f88d6bdec7d25931d051e5660b6649820fa0d73e5
- MD5 47c9535b004b0290ee1706f1e2aade72
- SHA1 be3703c05961918c95e871a73cfccd326f5ca88f
- SHA512 4b04f17351fca42be5656312d1906123b2daf6cfb969fcfde4eba87532273285fbef5670da0a882a1a3d319e3a6e625a798061535880c658ccb4dfd9fc588bd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMuwE:A3k03kHRJP56rXPji0Aj7
- TLSH T1B7756B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.6MB
- SHA256 420329a3f7679ef9f7fd1cbb55f46898d925774419bdfed93a19173eeee9dfbd
- MD5 00a6e65dd6ef14fedf0147d73c15f996
- SHA1 586753ad5554dd3ca08e69261d10213763d24abd
- SHA512 fb1ba2051e26c87d61b9cf82a89a7c0b0f71ef37a58be7045d6ae61dd336dfad74ab6e7f6b96b587344efb377f927d4519b1066d3177a7d5395ab8ce0f3efc78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMPF:A3k03kHRJP56rXPji0Ajq
- TLSH T117754A16F6A44BA5D06BC074C9969656EA333C421F3087DB1354BF293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 0b4287aa942b34077992903ce6975faac851c29afe3d7fe5ac06739139c0a1a9
- MD5 eda00e1ac9c6b7f6c0b5114ec8af415a
- SHA1 027a9f09d12798a7855c0f53c8c3267a8bc0c832
- SHA512 b8d474fce51d3eb5cb66b167698f4123aa3b10ed1f490ff756453bcb415fa2b0f8e19d609438653ff152e2d1203744db00f0ded1785354126231738d3808f0c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMu3npi63iC:A3k03kHRJP56rXPji0AjRXpiMh
- TLSH T150954B12F6E84775E07B8274CAA19656EA737C515F3087CF13849A2C3F72AD09A39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 1.8MB
- SHA256 da89d2e5760f06a12370e504d9bceec5736aee41ee2a70f24d82c07612aeef0b
- MD5 c9a12e33f6e5c82604cfbecba4435551
- SHA1 fe0c34a3d37622e7aa32314087d2f5069273de5e
- SHA512 a08d2f3b829ed0544582b998600d878414d6c9d6ded7514ddb8ffaf875e934f2f6d5efedaa0f3bad048f3d02bb97335e906ba127fd1da650bac01034e93f06af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMIV+PAk2hMX:A3k03kHRJP56rXPji0Ajvi2WH3
- TLSH T19B856C22F6A44B75D02BC174C9D6966AEA733C420F3087CB13549E293F677D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python3.exe
- Size 1.8MB
- SHA256 759eb1f0b972be04efd2734a50c4c423da066439e5d0d7ba2d768e54362d04fb
- MD5 dfe4c99d9fabf6c0e53be39b25f8f44d
- SHA1 1d78780d4c17ed1f08b28c918373ddf94d585ace
- SHA512 ecf69c53be3a6babb23260ed506123bd3620902ddcee7b01c4a2c89d9a02145e0b8e7dd9b947541e413884a67c45d4f02f362bf96de615f93c6a0e239c4f284d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FQbiYT/0Le5ji0hmxNrMfV+PAk2hMX:A3k03kHRJP56rXPji0AjYi2WH3
- TLSH T12E856C22F6A44B75D02BC174C9D6966AEA733C420F3087CB13549E293F677D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH