Analysis
- max time kernel
83s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 17:46
Behavioral task
behavioral1
Sample
2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260803-wcl8hsdb45
- SHA256 c7d5d01215d3d32cc9354bfef66874ba2b2f60e5f1df192d2f65ac6277ef03f9
- MD5 77ea8f506897567ab18aebebb9941880
- SHA1 d4f2116b11f8c0738dd38096fab30d39eb075df3
- SHA512 a763470c3d6ff15e2a5e8c7d68dd23b67558139dcd50e730510788863323fad43a830b3d1661d1c80f4684e77a2d6c2e02b1becca163c153d1f4a8800f533ff8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmC:A3k03kB56rI56rX
- TLSH T12A357B17A6880FA8D11FC1749A964662E6737C025F2097CF1354BE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4616-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024363-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2932-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4616-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2932-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002344a-162.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128e-382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021291-401.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021667-1289.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1984.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0014000000000727-2185.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024363-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x000300000002344a-162.dat aspack_v212_v242 behavioral1/files/0x000200000002128e-382.dat aspack_v212_v242 behavioral1/files/0x0002000000021291-401.dat aspack_v212_v242 behavioral1/files/0x0004000000021667-1289.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1984.dat aspack_v212_v242 behavioral1/files/0x0014000000000727-2185.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2932 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4616 2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2932 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_77ea8f506897567ab18aebebb9941880_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4616
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 c7d5d01215d3d32cc9354bfef66874ba2b2f60e5f1df192d2f65ac6277ef03f9
- MD5 77ea8f506897567ab18aebebb9941880
- SHA1 d4f2116b11f8c0738dd38096fab30d39eb075df3
- SHA512 a763470c3d6ff15e2a5e8c7d68dd23b67558139dcd50e730510788863323fad43a830b3d1661d1c80f4684e77a2d6c2e02b1becca163c153d1f4a8800f533ff8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmC:A3k03kB56rI56rX
- TLSH T12A357B17A6880FA8D11FC1749A964662E6737C025F2097CF1354BE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 cc84ff8a93aab607d91efe1e1645058afc9e36c3032c0731bb1924c7abd3bfb5
- MD5 297c726006a2ae6f6d35f2b8f1d6ef81
- SHA1 44882e6f730f5c5d6381e08a6d15890027852aef
- SHA512 97b166f16be14801ea88eb191c28ccf7172014a38fca89737eba36a8c32a0dd3a23f1b4bd024582676faca8a6ac88cab24858331b7eec446d07f1f98d56d7a99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmC0Le5ji0hmxNrM:A3k03kB56rI56rTPji0Aj
- TLSH T1D8753916E6A44FA5D02FC074C5D29666EA733C425F3087CB1354AE283F37AD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 1.2MB
- SHA256 49d8556a7b509e3640c699a69a53e4361de6d0a83350d35d0db245b80da7b94f
- MD5 3b11dc5b7a9237f8d18d7d33a73fb8f3
- SHA1 3bdb39df5fe982a525e3df2864a545823a113215
- SHA512 1b06de9540e599ff6072e462e095527ef7a84650339d55601584038a81d64448c99c67aae697857bb8f024f82211501f92cc25d79e6cd590dbab6b485aa4d776
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmrD:A3k03kB56rI56rU
- TLSH T19255E306E6880FA4D11F8174DB954662F6737C125FE093CB13D4EE3D3F32A806AAA657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 1.1MB
- SHA256 c3fa2e3801ecb5bad8801a99804109777e148002f6003b65d05a0e02bb284603
- MD5 505525cbe0d723b8aff4bdf012847aea
- SHA1 2e45979da1caca0025493bcda0f9d60e32994f11
- SHA512 13aa571823cfdca84d5cf8b1b65c945d49703de521e13320c90693bdae0065ce7e2fdc9f7818898459ef815e2d642dcf85000a7c67dcd78a6a76be08fa887efa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmtA:A3k03kB56rI56rJ
- TLSH T112457B17A6880FA4D11FC1749A964662EA737C025F2097CF1354BE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 1.1MB
- SHA256 33e34cc07e71237523abc9c5c361617e4b344f52408e96a547f261ed46907593
- MD5 022529d5ca77845f00d7bd49b1fea192
- SHA1 424efaa2cfaa4fc957aa9679b943ad466f30d93a
- SHA512 26cf27b5ff119e634632d909a520cb8b4590468b523ea8edb24169c4b285344aa15a6273662dd25fca61475544716814afc3b717931a62e2b3e01aaec09e69ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5Tvinrmm9Q:A3k03kB56rI56rQ
- TLSH T128457B17A6980FA4D11FC1749A964662EA737C025F2097CF1354BE253F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.2MB
- SHA256 368e7125ce807ab62d1e54e7d2029079ffd37287b582e8a6444dd9a7cb6964e3
- MD5 c17311377df6f6c8d43d9fb637ad50df
- SHA1 11e09430ee6f9f085b7d6f493a9728a59cfa9cd7
- SHA512 d9de94baaf7a5f5ec7fe3887523fa2236666bebe59322e1ce792b8e4dfa3dee59bc49e8062056aa257da2e9306f710dbd788725e25446d1b33bac88c71c3c9b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmgF:A3k03kB56rI56r9
- TLSH T1D6456A02E6890FA4D25F8134DE968662E6737C425F2097EF1354BF253F327C0AA3A657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.5MB
- SHA256 59df734f6d7a5973b0b2ee760f8168cdccc36353f679af4a6fdbbf6c0dc5fefc
- MD5 894426ecc1251a72e570fe9cd5e00db0
- SHA1 5d3d3715086d1cecd58ce694cb0d897c0b5de09e
- SHA512 fccf9b19b84bbee2ce740535e186e0c3ac533070578051c5ee4e15af871675370aac233fcaa1cfb5e8116579815df466fe6846df7459349ca7940846bd82583e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5TvinrmJ3npi63iC:A3k03kB56rI56reXpiMh
- TLSH T18A754A02B7D84FA4E17F82309AB54562EA777C525F3093CF13946E193E71AC0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$
- Size 1.2MB
- SHA256 fbc99c7ffa192cc271b9ac7598d3828c01941c334a14bb5edfa8b3d875ce15cf
- MD5 e99251fbee03c956d84dfff087f7b823
- SHA1 9422b6c4927f5814b3588d77538a20763c05f632
- SHA512 da9eb4759071eb71c66ea940cdfb141be32ecd074d2beb6843b68d699dc63a434bde458f45fb551861ee73c872bd801cb27d5b9fb62342d44d3c83ec1c6706a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipm2AVD5Tvinrm2IiG1W:A3k03kB56rI56rLIiGQ
- TLSH T1DB558D17A7D80FA4D06F82749AA54562E6737C025F2193CF1354BE293F72BC0AA3A357
- MD5 SHA1 SHA512 SSDEEP TLSH