Analysis
- max time kernel
90s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 18:33
Behavioral task
behavioral1
Sample
2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.2MB
- Sample260802-w7msjaeb44
- SHA256 1e64f8b3c08b772cc646c048df49e885f3c8618f8ea71d361785cefe694e493d
- MD5 55e7202767ad63c4a38ac4d15fafb36a
- SHA1 341d0fc95673e28de29c30777b0f7475aca1ae3a
- SHA512 b4ec049a47d84204ff7152fe24b1516f3fe7a04fa90da04333b187b1b04bb000805c15e3d5ee1b56ceddb322883ef50d61d460c686ba562588ed0310c6fa16f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uOM:A3k03kHRJ2qJtb2IJturNp5l
- TLSH T19FB57B13FA6406F5D026C074D5F35A96EAB038061730AADF4398E7293F63BD15E3A7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3516-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024610-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3136-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e44f-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3516-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3136-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023667-168.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0027000000021641-1263.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00170000000006d3-1542.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001ebf5-1979.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e50d-2083.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024610-6.dat aspack_v212_v242 behavioral1/files/0x000500000001e44f-12.dat aspack_v212_v242 behavioral1/files/0x0003000000023667-168.dat aspack_v212_v242 behavioral1/files/0x0027000000021641-1263.dat aspack_v212_v242 behavioral1/files/0x00170000000006d3-1542.dat aspack_v212_v242 behavioral1/files/0x000500000001ebf5-1979.dat aspack_v212_v242 behavioral1/files/0x000200000001e50d-2083.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3136 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\RestoreStop.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3516 2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_55e7202767ad63c4a38ac4d15fafb36a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3516
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 1e64f8b3c08b772cc646c048df49e885f3c8618f8ea71d361785cefe694e493d
- MD5 55e7202767ad63c4a38ac4d15fafb36a
- SHA1 341d0fc95673e28de29c30777b0f7475aca1ae3a
- SHA512 b4ec049a47d84204ff7152fe24b1516f3fe7a04fa90da04333b187b1b04bb000805c15e3d5ee1b56ceddb322883ef50d61d460c686ba562588ed0310c6fa16f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uOM:A3k03kHRJ2qJtb2IJturNp5l
- TLSH T19FB57B13FA6406F5D026C074D5F35A96EAB038061730AADF4398E7293F63BD15E3A7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 2.7MB
- SHA256 edd2b87ae4f5c6a2fe504393e527d11bfcb503a57e9231d96d1aac7c40a7d562
- MD5 348f108175cd29a328757261ce9706ef
- SHA1 61c94c0e3e68273e033da15edc1d8589ecf329c3
- SHA512 6ef6f0de0c12cbaedfb5f604893127c156f674d773ff6f187994df61610e71f21bb68e83ff3ee49831f2a04f5cb99ef46d0d660f2a09ff405c9926c6059f8808
- SSDEEP 49152:A3k03kHRJ2qJtb2IJturNp51Td9CHKyao:A3k03kHREa6dNCqo
- TLSH T1D3D58C12FAA406F5D067C174D5F35A52EAB138451B30EACF0398E7292F23BD19E39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 27a20d14c1cf481f944381b426d0fb91ea45c59d4c9e6822faa71e4f29cba091
- MD5 90d688a5dd1895e94353d864bf47b92a
- SHA1 d516ab0929f8d69bfaf7d2adda272014760c7ff5
- SHA512 09aee0efb4d5921d663623a43def2c62a1072ad8fbe259c5a6e0bbd4a5e34e5502fae4f5746143773c464650627dc5733951884e58ea7cbfe271116af58901b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uOg:A3k03kHRJ2qJtb2IJturNp5hPji0Aj
- TLSH T1A9D56B12FA6407B5D022C078C5F35A9AEA7134461730AACF4398E7393F67BD19E3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.3MB
- SHA256 a29002123b81f82bd6470e8773a898d9c266e369601a0bbbf88baafdc1a41e90
- MD5 27d200e70f8ecb5298b00b132f218022
- SHA1 adbce2ceff68cd1a194038e0a774eb805b3e2ec8
- SHA512 5d44b3e8959805de3f95888066890fda81f4b06a5de9b03448d7b59bbfe9c0b3a029463f4a1694cf8308dab2c9c1159d55cbd20bd327daf59010303ce65b8d33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uOZ:A3k03kHRJ2qJtb2IJturNp5K
- TLSH T108B55A02EA6402F5D02EC074D7B35656FA72380517B0A6DF43D8E63D2F62BC15EB97A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.3MB
- SHA256 d8e951acc73bce85f6de4295ca6692ec5e6c10e6d0592aa4ee27bce398967a64
- MD5 7c254347eea5840479b5373d9127ead9
- SHA1 d70deb4b9b1907363007f6331f8e7422cf4f971b
- SHA512 97b3a3c6dd52e33ce95b06aace2738756a5684e7acd3c3e4e89a5307002150f48a5b049c73f78e17f8d9f79fe585a05bf92f52f7e74c30d15052ad62f3fd4ec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uO8:A3k03kHRJ2qJtb2IJturNp5D
- TLSH T140B56B02EAA406F5D066C074D9F35A56FA703D451730AAEF0398F7292F72BD16E397A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 2.6MB
- SHA256 e7534c255ec59f74370c23c296ea077fde3303db0123920a71241109d9eb59e7
- MD5 7ecf6f2cc54f6c21fa7b675206550a86
- SHA1 371424665939a511407ded1df43889af99bbff14
- SHA512 0caca9fa384ad5b25d6c4dbaeb4bb40e280552378a9877813d982059f02a57763a71794cb566a9851b244ddf5b25b5ca182f04ed3ff2fe6be452b735b5fe8d92
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uOZ:A3k03kHRJ2qJtb2IJturNp5AXpiMh
- TLSH T1C1D57C03FBA402F5E073C27495B25656EA753C415B30E6CF1398A7292F72BC19E397A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.4MB
- SHA256 a7eb0d4ecc183de03fec20ff82ff8ef12bcaa3a4ef5767069b99eec878f17571
- MD5 eb74beb2f3c74cdf4759a44637bfd8a2
- SHA1 9415aed58935228e09edc4bf70f3d005467ac603
- SHA512 d0591c93ad3c2abe46fcfff287a5e8ff1363e4121c87ba06b9d61fc8de077c4364c23abc73fe04b82d2bcbff0445f329edb256b3ca693b571d218eea15df5bf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcRFYTqMi8CtBd2QHCHmTBW5MM0uOh:A3k03kHRJ2qJtb2IJturNp5Ri2WH3
- TLSH T1F3C58C13FAA406F6D026C17495F35A56FA7038060730E6DF4398E7293F62BD19E3A7A1
- MD5 SHA1 SHA512 SSDEEP TLSH