Analysis
- max time kernel
121s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 02:04
Behavioral task
behavioral1
Sample
2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe
- Size 2.0MB
- Sample260602-chbt7abt2w
- SHA256 743cb83049542117c123b62f7e013f04192da5f0fca8d6cdb8e69d0a57f567df
- MD5 af5d389180f31a9c5b8d847ce08d5d89
- SHA1 d8bf52aa2019dbec5867a94f86f06f2cdbbeb663
- SHA512 6856e60f961eee2d577cf251abf70aedcb95f6c5649b6d1b13299b2852110ad046cdb4d9fee246cafe819ca2b1230bf835530e581ff06019f40f52de4a91b120
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyE:A3k03k2pYqUqJtb2IMpYq
- TLSH T1E1953A16F6648375D073C0B9C5D2AA9AEE3234455B308ACB1386D7782F27BE6C53A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/3244-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b58e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1936-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3244-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1936-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00ac000000027781-1270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00b4000000027781-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000001a5f9-1486.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001c00000001a5f9-1531.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0017000000000476-1977.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b58e-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-12.dat aspack_v212_v242 behavioral2/files/0x00ac000000027781-1270.dat aspack_v212_v242 behavioral2/files/0x00b4000000027781-1373.dat aspack_v212_v242 behavioral2/files/0x001800000001a5f9-1486.dat aspack_v212_v242 behavioral2/files/0x001c00000001a5f9-1531.dat aspack_v212_v242 behavioral2/files/0x0017000000000476-1977.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1936 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3244 2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe 1936 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_af5d389180f31a9c5b8d847ce08d5d89_amadey_cobalt-strike_elex_hijackloader_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3244
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 743cb83049542117c123b62f7e013f04192da5f0fca8d6cdb8e69d0a57f567df
- MD5 af5d389180f31a9c5b8d847ce08d5d89
- SHA1 d8bf52aa2019dbec5867a94f86f06f2cdbbeb663
- SHA512 6856e60f961eee2d577cf251abf70aedcb95f6c5649b6d1b13299b2852110ad046cdb4d9fee246cafe819ca2b1230bf835530e581ff06019f40f52de4a91b120
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyE:A3k03k2pYqUqJtb2IMpYq
- TLSH T1E1953A16F6648375D073C0B9C5D2AA9AEE3234455B308ACB1386D7782F27BE6C53A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.7MB
- SHA256 932cfb02da82dc83fa05ab812e009af0fe61c6d34b958c3699ccaf917f42aa69
- MD5 e4b152eb625df6f9964335af49a64718
- SHA1 061e56f8df8d447aaa620656f1ea938f84003e8d
- SHA512 a12a41eec24972db4e3251d35f27865a2927407c3caa8ab211ad95e5bc6720aed5d6f7ab673cc44b0e613ad4264f1aed7ba4902c5b9a260cef1825b4ac6f9f30
- SSDEEP 49152:A3k03k2pYqUqJtb2IMpYqKVk0QGTvntQb:A3k03k267X6EHaib
- TLSH T15AD55C26F6A843B5D073C1B9C6D3965AFE31344607309ACB0395C7682F67BE1DA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.1MB
- SHA256 92955a87fcef1daac5ceb859c80971bfc59174e357be02c3879efdf8dfc71cf1
- MD5 07734ca668dd48732c132504ec385707
- SHA1 5bf080efe55d4f90061160bdeb3ae23eb972598e
- SHA512 d8c233772102d41ada41216445a90879b2fa907b71bc25256c8419e24ef43700e77ed54732c86aa4fc00b097ddc6979b2673371ba8cd9fab62ef4b214a9ad161
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyV:A3k03k2pYqUqJtb2IMpYqTW
- TLSH T1D6A53A16F6648375D073C0B9C5D2AA9AEE3234461B308ACB1385D7782F277E6D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.4MB
- SHA256 b598eab77a12dc6341a703bab6c1cc075c5cbe59a55434ac132dc48da8370b26
- MD5 92de2f3e7fca69dc86f316fe165ab5d2
- SHA1 328cf37d05905a603a933baf096689cef7d01026
- SHA512 26a0e7e2740a46325722e1f3d8e5b1ba01b78f871047853aee438bc0d474ce393872c4dd7453d79263763cd7c40dc878d1a0db16279a34315689bf004f2bd61a
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyP:A3k03k2pYqUqJtb2IMpYqHTd9CHKyao
- TLSH T1F0C54B16F6A44275D073C1B9C9D2A65AEE7238461B308ACF1385D76C2F277E2C93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 69cf5579715277c1db4f533e7dacb19c8600e7382e12c78a8cc2f95c44d03da0
- MD5 9919c945a9db9ae100c3487949dbc6a6
- SHA1 1051d920f26a0502c2f4877d07da3bb6cc4d59f5
- SHA512 acba1e99996f1688b49740d93af76db93e0588fb8dddd5028952d7d91e8162b8ba4827794d99231dca40557e314c7519fe8b027fa74d72227dce053416569567
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqy6:A3k03k2pYqUqJtb2IMpYqjPji0Aj
- TLSH T18CC51916F6748375D073C0B9C5D2A69AEE3134865B308ACB1386D7682F27BE6C53A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.0MB
- SHA256 aa6c6ed7a1e7756618b254a9e728f8e17f6d02656a71ffa09cdf0bf6938d73d2
- MD5 c8a95d49f4a9ad198808dea7e25c7cf8
- SHA1 fedfc981253915281b29f3f60bad39e4ee9197ef
- SHA512 2e2986a9f42942a62b2e1b628c88f8f7b9d06093c313c03542af1446ef6d36ee1e5f6fa3055009d39a879700ee3adc49e3b6934d3215d910784b87c168fcd1a7
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyu:A3k03k2pYqUqJtb2IMpYqt
- TLSH T1B8A51916F6648771D073C0B9C9D2AA9AEE3138811B308ADB1385E7682F377E5D53A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.4MB
- SHA256 be9c9df018c1394de6f89c9d6e52ca25c0422427236e73d3e2db1e2e611cd9d4
- MD5 2aa49eb933484d9dfac9d9bf4e66f689
- SHA1 5dcb7c583afa79505712846c3db2675fff9291dc
- SHA512 c3d03498de373bb03c21438cb1ee77ab12240938ed0d049340eca66ae9f20d3f4bfd2236a8d4240c59bcb42e7bd3004d35d5b36b57a0b7139735f0d1abbd0cf9
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojadYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyf:A3k03k2pYqUqJtb2IMpYqOXpiMh
- TLSH T143C53B16F6A48235E073C175CAE2A69AEE3238415B308ACF1385D76C2F776D1D53A732
- MD5 SHA1 SHA512 SSDEEP TLSH