Analysis
- max time kernel
80s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/06/2026, 04:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260630-e85w3afs2j
- SHA256 eac0fe213f1de54f37696890cbb432bc9764870f73218a7501e54f9b580e2e4b
- MD5 b4c58e9551fbb61bfa952bb37ba3f3a9
- SHA1 df46c8a62ce2ed694a39d70839f89413b579a039
- SHA512 82558ebf816aaefabff2f23edc93f8afafdc4e97e4f54a978c18c1e31d27b58da61937f25afa0777d533923b4b0249f08f834c341d255f6041860618f789f548
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMY:NOwqk12RGYeW4SkZP4sz9Mba
- TLSH T1FCB52915E2B84622D0BA8375C6A26645F9337C49072081CBC9B9E72C9F3F7F0597E726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 14 IoCs
resource yara_rule behavioral1/memory/3860-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024575-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/888-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000235d6-159.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022633-1283.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002021f-1370.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3860-1427-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/888-1482-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023190-1615.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071f-1965.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000168fc-2062.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f0000000006cf-2089.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001ecbe-2090.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 888 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3860 2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 888 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b4c58e9551fbb61bfa952bb37ba3f3a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3860
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 eac0fe213f1de54f37696890cbb432bc9764870f73218a7501e54f9b580e2e4b
- MD5 b4c58e9551fbb61bfa952bb37ba3f3a9
- SHA1 df46c8a62ce2ed694a39d70839f89413b579a039
- SHA512 82558ebf816aaefabff2f23edc93f8afafdc4e97e4f54a978c18c1e31d27b58da61937f25afa0777d533923b4b0249f08f834c341d255f6041860618f789f548
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMY:NOwqk12RGYeW4SkZP4sz9Mba
- TLSH T1FCB52915E2B84622D0BA8375C6A26645F9337C49072081CBC9B9E72C9F3F7F0597E726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.6MB
- SHA256 600a5dd6b528727fa9e7d0f0543acb8e1963e52985968f4283b4083957b55352
- MD5 ce2dd3615ecb8144043aa450cafc3763
- SHA1 37be866cf2faaa499f94ac7c723e418c4ac4d8ed
- SHA512 617cc45b97b5dc950b3e93eaec4818fe34923388090ac4e189965f35976451f699c37e529313dc544529d2bc8a539d2b5b3ea6839714768a79bcef841acabcd7
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMG3UNUpEisI:NOwqk12RGYeW4SkZP4sz9MbSUN+Eir
- TLSH T1B8D53916E6B84A52D07A9275C6A29644F9337C45072082CBD9B8E33D9F3F7F0497E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$
- Size 2.5MB
- SHA256 e695058dc1799e06b67e5e8a9cef49de6f4128004dc5ebecfebe34186b8c7f88
- MD5 bc6dc5549f9b490239dc27e6d0d4d4c3
- SHA1 311046b696cb0f2bd4dafa8d07d22fd956fc736d
- SHA512 a19cd5b6b782e73f85a6e1582311ad3634b7dcf77400e048eac1373a7878d3fb5866faeaca3b5b9ee740bd8fd6842ad5a99c5b3fad960f4254267126f16ebb7a
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMATjE:NOwqk12RGYeW4SkZP4sz9MbIw
- TLSH T118C52916E2B84622D0BA8375C6A25645F9337C49072085CBC9B9E72C9F3F7F0997D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 41420b9cc2026bad4e8e2260fc3501373fdc7a9c2cec7e348542c246064acc46
- MD5 ad290cf6d7d89f25dff82d356a61eecc
- SHA1 1f9208a0378585cfa9e20f510cfc0f037e96890b
- SHA512 37026475daf885240ad1b3fda34435c8cfbe3bacf64ddb493ae1559ad29132cf7c64065b28efa167e2b10580bd404cf60740b0aaf64d39f6e467577b6651e7df
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMg0Le5ji0hJ:NOwqk12RGYeW4SkZP4sz9MbqPji0Aj
- TLSH T170D52A15F6B84622D0B68275C6E26645F9323845073085CBCAB9E73CAF3B7F1857E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 2.5MB
- SHA256 b42c53284205f1aed7d4930b873ed8bd84a6b60fcad36527a6953b9edba7b250
- MD5 5e66b101d57e65016f7bf3744d711fb4
- SHA1 d61e47a296a10e63e0772c562d787fcf5e76bfd5
- SHA512 3831968febd3adaad4da775fce87d33e73e53a2cc5860b1cbd5cdcb284c35dcbd6918b3b5321227938122ea676822d6abca72fcd8207121829ec5f7cfb74f9bf
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMtD:NOwqk12RGYeW4SkZP4sz9Mb3
- TLSH T165C50615E2B84622D0BE9275C7A25645B9333C4907A081CBC9F9E63C9F3B6F059BD723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 2.4MB
- SHA256 359d67fbd91cba0c9e77f021a331f30e78882d901603ba9c2964230f719decc9
- MD5 d27cd5687c8d676b4f579063faf63b09
- SHA1 322e79035a4cb98ab684cb399dcec9e4750706b0
- SHA512 b618728b42797e0a28d6e944e8efef7cb5673dda662e7a19e7c461f0dcbda72a282e934107e882348b6764f9e35048ea12b7baa40cfde61fe6229fc533e80962
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMyF:NOwqk12RGYeW4SkZP4sz9MbK
- TLSH T145C52815E2B84622D0BA8375C6A25645B9327C49072085CBC9B9F73C9F3F7F0997E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.8MB
- SHA256 347e17f0253a223774522a17a8129e7463e5d6ea5804b16f10b8b5aca2d646b3
- MD5 77f8af43068e535c825ad07d6b5009e2
- SHA1 a84dcf1f1a26a213e479b0c16a394e10bbb9486a
- SHA512 8bfc1b50cf08248541a08b9ac8e36c3e7abbdd76418330e1d380298b0523e224c456f7712692ffce01df769c4f9b21148fafb9d4277f780e6f3932b1ff5b130a
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMT3npi63iC:NOwqk12RGYeW4SkZP4sz9MbxXpiMh
- TLSH T1A2D52812F2F84622E0B79375C6A15645B9327C550B3081CBDAB8E72C9E3B6F0997D723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.6MB
- SHA256 ef4894c57a348ac69b4e52b2876d518e603a4186fad5f287856f2d8cd4c4213a
- MD5 57d5c19bc03b2c994664999bde001ed4
- SHA1 345a4626e1eb6b561e54398f6232597b167a2921
- SHA512 20fa064f6fd44ed8e42fa54dd0493b4e6d26925d8fcce8ab8027eebee3f103b110e30be56f8ec169c5200dbb3a52169daf60173baeb736cb7de5d34c7a7d2dd7
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMKV+PAk2hMX:NOwqk12RGYeW4SkZP4sz9Mb4i2WH3
- TLSH T187C53A25E2B84622D0BA8375C6A16645F9327C45072081CBDAB9E72D9F3F7F0497E723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 2.8MB
- SHA256 34fbde29f4bfb97e1ff1bf3098877d708adda6ca87e1553bb93448bfaac7a242
- MD5 627bb046c019a4575db3dd4d0dcf234e
- SHA1 1f6105698fbe5b9fa41c6f013a7e5b3553252621
- SHA512 9c171b5d55602644d5d9f9c3a34797bb5fa1f6b2529765f72a1ba28e3cab5f276b5c69bb91a16e3941957cd0ba3625e779cd1617fe4cba9824b647fc6b785816
- SSDEEP 24576:J/sCv7It1+qwSR6JPiE2EWxGgFZe0p4Ek4niOkl/A04szE87JKTvmMtrfbJLQIiC:NOwqk12RGYeW4SkZP4sz9MbfPJLbh
- TLSH T114D52816E2F84612E0BA9375C6A19645B9337C49073081CBD9B9E72C9E3B7F0897D723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 4.7MB
- SHA256 71931424b510bc5b46ae9ee2669ccb9707e81689bf28b58350ce1c6e2f1b87c1
- MD5 af8ac1c3d5bba13a556cb6461afd7049
- SHA1 81ab0c8964225f83f4fd6cb34f44527b34fd099a
- SHA512 cd9e1f59061817b8f521ab73f0ce4236f57fe0f320703d40c2296cfc4a6c8d431c7c25311b41eff00ddc5a582da8c7bc1dbc269c271c15a2d6139988ee9d137d
- SSDEEP 49152:NOwqk12RGYeW4SkZP4sz9MbGOwqk12RGYeW4SkZP4sz9MbX:NrOfkZcGrOfkZcX
- TLSH T12C362915E2B84622D0BA8375C6A26645F9337C49072081CBC9B9E72C9F3F7F0597E726
- MD5 SHA1 SHA512 SSDEEP TLSH