Analysis
- max time kernel
91s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:15
Behavioral task
behavioral1
Sample
2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260804-tqaersvbjd
- SHA256 6edf68b6b514442ebdeda549b8900287d68f910e3ef52712ff6a6fade5d39d91
- MD5 320cc72c22a4b06be943c76116462112
- SHA1 5562894bc36200e08ca8c04645f8b913012bd418
- SHA512 afc92fa0edfef712d0a04ad1ac5de3b7db682d38cb6fd1ab4af8905574f38db93853e0a2f36489a7b6fe02015c55eeab5bbdd79d579512db9cc09cc7a8e6d356
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5TvN:A3k03kB56rH3k03kB56rG
- TLSH T15A957B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3540-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ca-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2492-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3540-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2492-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245cd-137.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002300000001ee98-1485.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002900000001ee98-1528.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00090000000245ef-1676.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000723-2011.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ca-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x00070000000245cd-137.dat aspack_v212_v242 behavioral1/files/0x002300000001ee98-1485.dat aspack_v212_v242 behavioral1/files/0x002900000001ee98-1528.dat aspack_v212_v242 behavioral1/files/0x00090000000245ef-1676.dat aspack_v212_v242 behavioral1/files/0x0003000000000723-2011.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2492 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3540 2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2492 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_320cc72c22a4b06be943c76116462112_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3540
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 6edf68b6b514442ebdeda549b8900287d68f910e3ef52712ff6a6fade5d39d91
- MD5 320cc72c22a4b06be943c76116462112
- SHA1 5562894bc36200e08ca8c04645f8b913012bd418
- SHA512 afc92fa0edfef712d0a04ad1ac5de3b7db682d38cb6fd1ab4af8905574f38db93853e0a2f36489a7b6fe02015c55eeab5bbdd79d579512db9cc09cc7a8e6d356
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5TvN:A3k03kB56rH3k03kB56rG
- TLSH T15A957B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.9MB
- SHA256 2222194d829e6cbd65640cc6ee15ccfa066640e0b32b85b589393aac3eaa8fc9
- MD5 c26f61db685584c4bf040fa630bb30c3
- SHA1 ca2317d094d566447ad5132c141e34e2f1e94832
- SHA512 b72a60cbd0274a5ea83b8b0163ad5d4256f93fedc97d8782eb7f0e60f2aef0bbe4bde8a3201cab07c53e4e6d4464dfd7715c9a24fcf53ec0eb8abbfaf4095440
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5Tvs:A3k03kB56rH3k03kB56rqW
- TLSH T111957B13E6940FE4D10F81749A964662EA737C121F2097DF2358AE153F72BC0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 c6900a13886d58f22a0e06fb4196b587b07ad769bda7e08af239401d3b30c79b
- MD5 c39f68a181a440532c57186d2441c363
- SHA1 de3a3bc4aa7001f07093aba16c5015d2ee4b9a67
- SHA512 b259667ec4acb5ad27a94a441ae38dd2908a794099ef5c71e954b602f29cb268093d5d6f6d14e40be9e293be9cb29a768eaf86879a0461d8e900662e389f7926
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5Tvq:A3k03kB56rH3k03kB56rkTd9CHKyao
- TLSH T1B9B57C12E7940FE4E02FC1749AA54622EA737C561F2097CF1354AE153F32BD0AA39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
- Size 1.9MB
- SHA256 541072655bacd897e01c0338333240c1c51eeaf430e1f43582fcd922466ee9f8
- MD5 bbad8d0b5787223978f1804656fdea1f
- SHA1 8acb78806ca7f98076eee3ba7ba946961438bfd5
- SHA512 ec1e85d2ca992d48e6e26572f24edddd04b1f33586d80632bff47d91cb08a4340991d8d4c0d5043b013744bc5095c1f879572b324f7cac7a6e2767c07d8df3ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5TvY:A3k03kB56rH3k03kB56rII
- TLSH T143957B03E6940FE8D10F81749A958662EA737C125F2097DF1358AE153F72BC0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 8803c07481e7bd712e98d7d36f712b304e7ad72915b6a056808085ca0cd6c351
- MD5 1ccf1ff3713efaac33d3a2f40090bafe
- SHA1 aec8e2594fd274720df2969e86bc954ea51928c6
- SHA512 f431123059f58e42aa23a9e113969a953e03d17b1e6bed73ece42488c2329091e3fcc73c39dec6057fe57f2706143e108a2c367f55ab5a3014b478d63af67fd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5TvF:A3k03kB56rH3k03kB56rGPji0Aj
- TLSH T174B55B16E6940FA5D02FC174C5D69666EA733C421F3097CB1354AE283F72BD0AA3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.9MB
- SHA256 ff6bae492d64096d6bbea723da91a8a22bf8d40a9ac30d19fdbf27dd36495757
- MD5 9ce440805363adca92371b69e6dae5a5
- SHA1 2fd1bd4627d19899563ced69a878db4a6cd31dd3
- SHA512 54c95957a1e02b8b10e7a070762124c6fb0dff6f1374b15039dfc11708cd39dcb068173c03584944b42cff2c7845be4194072a4c05993261ed3e40b220efded1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5Tvy:A3k03kB56rH3k03kB56r7
- TLSH T14E953806E6940FA4D10F8174DB954662F6737C125FA093CB13D4EE3D3F72A806ABA297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 2.2MB
- SHA256 a8d80e3aa3d3c953cab604a8ac5cc48efdc48c7540bddd15e457a3725090190e
- MD5 d675dd53f4ca2529c83ddade5b5f4b18
- SHA1 0007428ea4c517114bba55b059a6d11a50b6f50d
- SHA512 858536d33261d80fbac1fc53b11a37d4a64c339640f4b81af4ff43208df8ac224f3131216ffb59d8dbb231ffcdb4ae7e80cac7e5a75ab0630534336d388ca470
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5Zg3mnXoZ643mnXoZ6iLa5D5Tvm:A3k03kB56rH3k03kB56rdXpiMh
- TLSH T145B56C03A7D40FA5E16F82309AA54662EA777C515F3093CF2354AE193F71AC0AB39763
- MD5 SHA1 SHA512 SSDEEP TLSH