Analysis
- max time kernel
77s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/07/2026, 19:35
Behavioral task
behavioral1
Sample
2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.2MB
- Sample260706-yapxqscv21
- SHA256 5e9c6332679139fe94482b4edc9f812c16024f1c9e7231606c664115fe66587f
- MD5 ec723c1bc97052d2fe05c59c41b13525
- SHA1 4ecbd5c1b63693c04e3573cc95255644af35bfcd
- SHA512 3aa997743e0dd519434e3c302629615e2104be279e8b33eaf70f5ec211300e22302a1167122271c9781b938fca3f4b8aed109409111876f82731a1c727044212
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeRpKG45jcAkSYqyExZe0p4Ek4niJ:A3k03kHRJ7pYqLeW4SkZP4sz9Mb
- TLSH T18EB54B16F6788372D0B3C0B9C5D6AA5AFE32344617308ACB1349D3282F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/1836-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024670-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3980-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6a5-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1836-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3980-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023620-137.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002130e-461.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021309-463.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024685-1603.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00240000000006d1-2016.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024670-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e6a5-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023620-137.dat aspack_v212_v242 behavioral1/files/0x000200000002130e-461.dat aspack_v212_v242 behavioral1/files/0x0002000000021309-463.dat aspack_v212_v242 behavioral1/files/0x0008000000024685-1603.dat aspack_v212_v242 behavioral1/files/0x00240000000006d1-2016.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3980 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1836 2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3980 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ec723c1bc97052d2fe05c59c41b13525_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1836
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3980
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 5e9c6332679139fe94482b4edc9f812c16024f1c9e7231606c664115fe66587f
- MD5 ec723c1bc97052d2fe05c59c41b13525
- SHA1 4ecbd5c1b63693c04e3573cc95255644af35bfcd
- SHA512 3aa997743e0dd519434e3c302629615e2104be279e8b33eaf70f5ec211300e22302a1167122271c9781b938fca3f4b8aed109409111876f82731a1c727044212
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeRpKG45jcAkSYqyExZe0p4Ek4niJ:A3k03kHRJ7pYqLeW4SkZP4sz9Mb
- TLSH T18EB54B16F6788372D0B3C0B9C5D6AA5AFE32344617308ACB1349D3282F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$
- Size 2.3MB
- SHA256 9025ded84abb26e64171aff67d178b5fdef34973cb2b1cf050a02ba1eff032df
- MD5 5158e9373a579ef39a1d7c1f14023a07
- SHA1 b5db90e5f481e97aadf305492991b169677aa523
- SHA512 59aa2ab6cc629c3cc09e9382f8a62c8f86d150f2d42c7a8fc5d62595e2c02849fbe6b2f339514cc91d925eba15bc88adfd932ffacfb18717c9d124a72030272c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeRpKG45jcAkSYqyExZe0p4Ek4niH:A3k03kHRJ7pYqLeW4SkZP4sz9Mbjw
- TLSH T195B54B16F6788372D0B3C0B9C5D6AA5AFE32344657308ACB0349D3282F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 e7468b9512dc3440029e0438d14945c7b80c6430a3751c6c73d4ae19f59fd162
- MD5 7fcc35893de5899bdbfb6115ec2b9408
- SHA1 3af9966b9b5471457ee80b45e6257ab559f68fe4
- SHA512 66eba9f52ff7567b5d2523a1ff9cc84aa067d4052c35574765268e453d8d28a3a1fb9e8f8870323b706d515d64ad0fabd544451be629f617a5790b8865fdb00d
- SSDEEP 49152:A3k03kHRJ7pYqLeW4SkZP4sz9MbBPji0Aj:A3k03kHRp6YfkZcRjo
- TLSH T1A6D53A16F6788372D073C0B9C5D6AA9AFE32344657308ACB0349D7282F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 2.4MB
- SHA256 ed805ade68e29e1da27befd3cebc713490d3204d874c28d6703f075d29a5fd50
- MD5 b850c75f1d3d74364341c8d6bd46b4d9
- SHA1 292155493f0dd843eda0aeae1a751f70a6e20aaf
- SHA512 c383adfd61eded4dc84a5e8e8ae73db1a7146c2ddffba79cbcb30d8548b67a41b33b98ed55bd3a922aed5c26e59d097b344cb4c5fd48c5b67b0382f36925290c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeRpKG45jcAkSYqyExZe0p4Ek4niB:A3k03kHRJ7pYqLeW4SkZP4sz9Mbq
- TLSH T101B53A16F6784362D07AC0B9C7D6AA5AFA33344517B086CB0385D33C2F277D19A7A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 2.2MB
- SHA256 d59ee257839dd191774bf0a67913e573f4cfbbae9f3a711f4a00c2f1ee91f233
- MD5 3a67e2d30ca360538077f485003fa9eb
- SHA1 8e2270fbf274ea2ded785cf8452214f08289a363
- SHA512 e9ba7ab65c559baf5d9f7ac5587624335680dbdeaaa36bd1ff32c34235b02b16d912e45d73192de5a8558d206fc845f3675e6d8c646003a515b5c8b74b50e524
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeRpKG45jcAkSYqyExZe0p4Ek4nid:A3k03kHRJ7pYqLeW4SkZP4sz9MbK
- TLSH T190B54B16F6788372D073C0B9C5D6AA9AFE32344617308ACB1349D3282F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$
- Size 2.4MB
- SHA256 c2cb7ad30c9fae188cb61e38f55fb509eddebed4b5c172e08d423c2feeda44f3
- MD5 3d87b78a9e98a847cb5b99d48ebdc0a2
- SHA1 22e04325dbe2791be2ee9054c1feeca6ca87da2d
- SHA512 590c8a21881acd69d095b79153de960634b345edf932d6f55029947e187c99a8e12f52364f32940ac96f632d87965ddada906526225588c3479eca73a9e2ced2
- SSDEEP 49152:A3k03kHRJ7pYqLeW4SkZP4sz9MbfC17IwZ:A3k03kHRp6YfkZc07IwZ
- TLSH T1EEC54B16F6788372D0B3C0B9C5D6AA5AFE72344617308ACB0349D3282F277D59A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.7MB
- SHA256 c3a812e3c88f010ab8adad119a790d944998ca826c4b25645dd3ba8ac9dede7c
- MD5 3ab0bcbaa8bae8868dd0dd2a278dc540
- SHA1 411ad0639daeb1104f9ff45a05a876318bc2b0bd
- SHA512 417c7fec2765ec0f4817c858ecadd54a960b298b7351167ce66ce002417ba6495311aa7c66086d26e70fb55dcddecdb2dc23db86ef65ac8b946331c14d546d14
- SSDEEP 49152:A3k03kHRJ7pYqLeW4SkZP4sz9MbgXpiMh:A3k03kHRp6YfkZcMpig
- TLSH T1B6D54B16F6B88272E0B3C175C9E6A656FA3238425B3086CF1345972C2E377D1DA39736
- MD5 SHA1 SHA512 SSDEEP TLSH