Analysis
- max time kernel
93s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 22:35
Behavioral task
behavioral1
Sample
2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260804-2h2s2ssbkf
- SHA256 a909c328dee473a3befaf8c349093deff040c6fe56f2f1d06f8046220e6d7b1d
- MD5 979551700ec03ac957a47bab56d8bc70
- SHA1 0da73f31e87d25b0cbc868da0317b9845c9dd504
- SHA512 b00d43315755e98b07f654c3310a0e4c83499e25b8c52ed5d0886cdd3a69377276ebab7e46d5ea24903c5046e51248ab00ae7928eb7b687c1ff1f1958ece01ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEus:A3k03kHRJARJVpYqj
- TLSH T1DE657C17F7A441B5D067C179CAD2AA56EB723846073097CF1398C7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4644-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245d3-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3376-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4644-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3376-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216a5-1280.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000e00000002031c-1485.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b00000002191e-1537.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245f4-1616.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0011000000018131-2002.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6f1-2241.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245d3-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x00030000000216a5-1280.dat aspack_v212_v242 behavioral1/files/0x000e00000002031c-1485.dat aspack_v212_v242 behavioral1/files/0x000b00000002191e-1537.dat aspack_v212_v242 behavioral1/files/0x00070000000245f4-1616.dat aspack_v212_v242 behavioral1/files/0x0011000000018131-2002.dat aspack_v212_v242 behavioral1/files/0x000300000001e6f1-2241.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3376 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\elevation_service.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe$ 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3376 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_979551700ec03ac957a47bab56d8bc70_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4644
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 a909c328dee473a3befaf8c349093deff040c6fe56f2f1d06f8046220e6d7b1d
- MD5 979551700ec03ac957a47bab56d8bc70
- SHA1 0da73f31e87d25b0cbc868da0317b9845c9dd504
- SHA512 b00d43315755e98b07f654c3310a0e4c83499e25b8c52ed5d0886cdd3a69377276ebab7e46d5ea24903c5046e51248ab00ae7928eb7b687c1ff1f1958ece01ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEus:A3k03kHRJARJVpYqj
- TLSH T1DE657C17F7A441B5D067C179CAD2AA56EB723846073097CF1398C7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.5MB
- SHA256 01b3ac3386d40a0fd4621b59619e0b717ffbb2a6e54e2615b04e8d2c569f1a71
- MD5 bcc77107be2889c36b463f7a00500336
- SHA1 c29808f8e35d34ea75c5726dc14c0c3d86aa89e4
- SHA512 8aa277ee3f99dd8172742761d5dd5d11a36ec3d2972ec9a3f13ac05d66cc3a513ba0b3f9ccdc8a73a756b8b1c4b0fe9c7190902f778b73042b7b2136ffbc8838
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEuIhk:A3k03kHRJARJVpYqPW
- TLSH T1B3758C17F7A801B5D067C179CAD29A56EB32385607309BCF1398C7292F23BD19E3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 1.9MB
- SHA256 aba633293c5ad0343ee1aeb914d96e73c90a518c73400ed819f5beb78ede7f1c
- MD5 b60732f9fb815c28a785a0bcbaba710b
- SHA1 551aa278defb04b17417fcd62c188a443040474e
- SHA512 fdfb1d564b9cc3ae4c22173181daec61bee701b743d1eed699e9fb8da4c9538751f57e5be7297023a348f84670fc9dc88825238bc2bb350c94d0c87b719b5266
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEuo3Td9CHKy7GZO:A3k03kHRJARJVpYqjTd9CHKyao
- TLSH T19D957C12F7A401B5E077C179C9E29656EA7238461B30DBCF139896292F33BD19E39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.5MB
- SHA256 fbc9469d4eb0b238564d2332f46960b910af236421b6ce6abe4dab89cc62c743
- MD5 fb108628fbffc4b81354244fc65d181d
- SHA1 9601e422fe5568de130ffd012f87f1178845c275
- SHA512 3bfa49918638617ca228aefb96bfa3668ef5b6b2e6145d6393f0713ddaddf0aa5ba75dbde6889eedbb6fd0cac5561fdf7a9900bc4abd5678ab46fcbee5903d80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEusTjE:A3k03kHRJARJVpYqBw
- TLSH T1E6758C17F7A841B5D067C178CAD29A56EB32385607309BCF1398C7292F23BD19E3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 0382baab75ecae5dd5232d0de7463d755906fd8fab4fc8b56b97be3d228f6c56
- MD5 f84958a0727f5fcf11639a7846c3e908
- SHA1 649f5b75883c665b3298340061216fe8bcd073a9
- SHA512 af6f1c13487ab2a957e3c031704a05679b5b903e0a7cbdae1636faf57e31d088dc953b6dd37581f78fe0a0ae1c421b734f5013a406f3bad8bdcf13e712215904
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEu00Le5ji0hmxNw:A3k03kHRJARJVpYqfPji0Aj
- TLSH T141956C16F66442B5D073C0B9C5D2AA9AFE72344617308BCF1385C7282F27BE59A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.9MB
- SHA256 ccc5621dd16ee6dc5a2a00f4d954244f6661ae31c410805d92c60ecdf31f9213
- MD5 99cb10cc78143fc95b0ea46f2fa203af
- SHA1 ed790285b330536f8115e7408ce5a050bdd69ce8
- SHA512 1644ce8a6f762c3282f7e2c0a2229e6ba21801ebc168badce8b516d1f2271f5b6c620fc4185a0ef9f7e3015b643d1c0d635ab76a35519d561431aac322abffe0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEu2i6:A3k03kHRJARJVpYqdi6
- TLSH T1A5953983EB558CB5F05EC474C592963AE6323D1907E386CB134EBA192F367C85AF8325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 1.8MB
- SHA256 71113ea1eb47dd12a8df506aeac8a0aed156286c33f38f3a2ffa0e7ac0a6c78a
- MD5 f4338827edf815be0c20f011b4cc5e45
- SHA1 c75b17fe6ee0a5647809959a1f4e59c412604383
- SHA512 1b007f3730b099315eaafdebe34deea081695bc60ee0d3fcbeb313c17f3c12c6e7789f4f50b9f055a7f4a4bb1f207288320caacb7ca01122301ce1d22d7ff464
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEu33npi63iC:A3k03kHRJARJVpYq6XpiMh
- TLSH T130956B12F7E841B5E0B38274CAE29656EA767C525B3087CF1384962C1F72BD0DA39772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
- Size 1.4MB
- SHA256 162d888eff5fdd9d7e2c86e1c2f9cd0c9874d816ed1a394df240013724327444
- MD5 02ac2935d71ee1498791a0446dbb3422
- SHA1 5fa4978a46a1907df98c1eb84870f46dc5d7f979
- SHA512 3615199827e597513566c3251c3b6c595cc9c26af7c4b249ad5e5dd0e574bafa9e8927d53ee83557fddac757d130f4ba141c824fba2da951073faaf550664a2b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+cJuRagAbD5jcAkSYqyEuL:A3k03kHRJARJVpYqy
- TLSH T164657B17F6A841B5D067C178CAD29A57EB31384617309BCF1399C7292F23BD1AE3A361
- MD5 SHA1 SHA512 SSDEEP TLSH