Analysis
- max time kernel
95s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/07/2026, 04:28
Behavioral task
behavioral1
Sample
2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.9MB
- Sample260713-e3netsby8j
- SHA256 7eb223097d7838a230ef02141bcd595373241f3012eba9f73afeee835d42e490
- MD5 4ec25312b7f41b17ba155ffe5b31e136
- SHA1 1ef81a30e5b8d1bff4146085ba59192f5a2c62e7
- SHA512 02974271be51d9b5238ba432b6edd65c45ea3148c9e7343d5324d29ed34971363ef1a3173a7d525f77e4d2436f378ce0d91a0bc493426321ba240720ae3e057a
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2I:A3k03kHRlfkZckc
- TLSH T12AD51916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/1980-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024543-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3760-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6dc-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1980-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3760-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235ae-163.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000021638-1075.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0024000000021638-1277.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023173-1640.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1973.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f00000001d884-2072.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024543-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e6dc-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235ae-163.dat aspack_v212_v242 behavioral1/files/0x0010000000021638-1075.dat aspack_v212_v242 behavioral1/files/0x0024000000021638-1277.dat aspack_v212_v242 behavioral1/files/0x0004000000023173-1640.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1973.dat aspack_v212_v242 behavioral1/files/0x000f00000001d884-2072.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3760 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1980 2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3760 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4ec25312b7f41b17ba155ffe5b31e136_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1980
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 7eb223097d7838a230ef02141bcd595373241f3012eba9f73afeee835d42e490
- MD5 4ec25312b7f41b17ba155ffe5b31e136
- SHA1 1ef81a30e5b8d1bff4146085ba59192f5a2c62e7
- SHA512 02974271be51d9b5238ba432b6edd65c45ea3148c9e7343d5324d29ed34971363ef1a3173a7d525f77e4d2436f378ce0d91a0bc493426321ba240720ae3e057a
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2I:A3k03kHRlfkZckc
- TLSH T12AD51916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 3.4MB
- SHA256 0c546c2d9d72d7bc4c63a45ace89c364e192a2cddb9110844827b653d4cbc8d3
- MD5 a4e6cfe5462e1248ad1c1b102d3bfb03
- SHA1 922b2cfc421e036d1813f4a94145ceac5878f9ed
- SHA512 b087bc0da200bc39ab8bdcfc2fa1d3d02a965a7e4181de579923f424428439441c4d0e346f2bb60670e46ed111d2d09c448efed150056d8dedca7216e32fc870
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2IkUidGl:A3k03kHRlfkZckcddGl
- TLSH T1DEF53B16F6B88366D073C079C5D2AA9AFE3234465B308ACB1345D32C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 f640a192143ec3fd4656dcd2275958a5644d1b507cec9acfab449d1dab8551d1
- MD5 ed7d37b1f45db239cfc398f906b2c719
- SHA1 ec96877158f16df79ecea5ff57b41a1411e287ba
- SHA512 a9087cd241bba0c6ae49c9024e57bfa1326b8d7b40b8cd5dc09200ff302cfdd9a0c8fb63ac46bbeea31d19057a297ab850439bd911071a953b8c9dbb2d5de39e
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2IQPji0Aj:A3k03kHRlfkZckcZjo
- TLSH T1D8F51A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D76C2F277D5963A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 3.0MB
- SHA256 072169cd4165dfaf34ed419b404d2c2f4b16a8b92f5880350675c6412f5b3802
- MD5 9c4828d32238a5be0f6d10a411a96e4a
- SHA1 c7f91d7233f3b325b95a1e9670c511e1fc519ce1
- SHA512 5fefc9c13221e480ee95dbef9f502e50074dc368c5af2ec84d10e70e4e0ed8a6ef862a4b5730a8c5a8f7a1391978622097d6657737ee63eccebcbc302f95f612
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2It:A3k03kHRlfkZckcy
- TLSH T192E52916F6788362D077C0B9C6D2AA5AFA32344257708ACB1385D33C2F277D5997A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 3.0MB
- SHA256 2b821287dcb0a3a077abd1f7c8c4fe12775f58d7324751cc81e29e698cb51409
- MD5 f778ca15ede21b8d1b1fe773965df59a
- SHA1 9fabb61f5ac6491c0177d148a1c3b6685d58239b
- SHA512 e8986836cc9fc31ade1e85f2602ae1809f37a9f575d90f62fc27ed61ce9c3a93e44808084ddaadf26ed86eace1884c3da64a59eab13d93ad3a761e316b197bab
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2Ig:A3k03kHRlfkZckcr
- TLSH T1D6E51A16F6B88362D073C079C5D6AA9AFE3138425B308ACB1349E72C2E377D5953A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$
- Size 3.1MB
- SHA256 b699554d6755b3a3571bf2094e3b3fe03d5e3ed335d36340a0949e4e9fcd9ce3
- MD5 1a0bea64dab75c634871c28530f81a57
- SHA1 32e2abb4223c8ca7dd44308eec8d25390ff5c4f3
- SHA512 4b25ade49aacfbbd2ea9ff1fc5760755ee02a073c5166777d40a452dddd35e4f63c335bd1928cfad2135c6e23646d7c4ed663a8f704082de6184de8b25b02823
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2IKw7OB5:A3k03kHRlfkZckcF7
- TLSH T1BDE52A16F6788762D073C0B9C5D2AA5AFE3234425B308ACB1349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.3MB
- SHA256 de7c39aa56ca7d8e34fa9cf6692fec63e530fb3569d64fa8c3bc21412e548f56
- MD5 85d4a209a319a8e3b3dbece2d699d1bf
- SHA1 aeb66152b50e96272e0f34b107be32d2dda5cd69
- SHA512 3ee3161042db8c94594b6a3b3562568bee40f5b3f5ce4a54b0b51ae786115bd51b84c628509ee1043f30cc7e9538bd1ed98653e8c701b06fa85e5e98883794e9
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2IjXpiMh:A3k03kHRlfkZckckpig
- TLSH T18AF52A16F6B88332E0B3C175C5E6A65AFE7238425B3086CB1345972C2E677D1D63A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.1MB
- SHA256 ea936e24fae6f8255baf04a2f793f3325e12d1df291258caa280150a744c138e
- MD5 ce04bad5ee810336a7a5b185ec58f8bf
- SHA1 a99a09c3e558f507c621b19073540cd007023834
- SHA512 38e6e8b0576e0fbf09bab5a1b5500b13df09129e142f5e10a2b2b96d87b2f8af2092136e4a1e06b36e3222caf83a88af68d3bab64ccacd343572a4d94ed4e6f3
- SSDEEP 49152:A3k03kHRJ7eW4SkZP4sz9MbkqJtb2IdqJtb2Iai2WH3:A3k03kHRlfkZckcJuX
- TLSH T137E52A26F6B88372D073C079C5D6AA9AFA3234425B308ACB1349D72C2F277D59936735
- MD5 SHA1 SHA512 SSDEEP TLSH