Analysis
- max time kernel
95s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 16:27
Behavioral task
behavioral1
Sample
2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260807-tx3d5azclf
- SHA256 9f25aaacadaf7fb86cd0208eec3a494e36aa93274e88ed36210a777557459a9b
- MD5 224a9e065d4ab58fc74b2e4a1febf897
- SHA1 e140eb221895005cb9e5e1278029bb51dc965224
- SHA512 2c029115c8b232fdb4233abf714faa678250544b07e5280567c3ce2a37dfbfaf2774b2533d7c6846a457cd66aa6f9eb300632bdaecbf2cd6600b8d8cf4cb9c1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwRF:A3k03kHRJPpYqmFiy
- TLSH T174A53A83EB558DB1F05E8434C9829639E5327E5907E34ADB134EBB195F327C86AF8324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4192-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244be-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1996-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4192-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1996-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000021489-742.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002312e-1637.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000072b-1964.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001800000001dadc-2075.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244be-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-13.dat aspack_v212_v242 behavioral1/files/0x0007000000021489-742.dat aspack_v212_v242 behavioral1/files/0x000400000002312e-1637.dat aspack_v212_v242 behavioral1/files/0x000400000000072b-1964.dat aspack_v212_v242 behavioral1/files/0x001800000001dadc-2075.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1996 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4192 2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1996 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_224a9e065d4ab58fc74b2e4a1febf897_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4192
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 9f25aaacadaf7fb86cd0208eec3a494e36aa93274e88ed36210a777557459a9b
- MD5 224a9e065d4ab58fc74b2e4a1febf897
- SHA1 e140eb221895005cb9e5e1278029bb51dc965224
- SHA512 2c029115c8b232fdb4233abf714faa678250544b07e5280567c3ce2a37dfbfaf2774b2533d7c6846a457cd66aa6f9eb300632bdaecbf2cd6600b8d8cf4cb9c1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwRF:A3k03kHRJPpYqmFiy
- TLSH T174A53A83EB558DB1F05E8434C9829639E5327E5907E34ADB134EBB195F327C86AF8324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.5MB
- SHA256 5afca35104a3d7f8735bbc34164e50c0fe9648728117d6327bccff9e1165706c
- MD5 256e4731131869d1563697567b95b62b
- SHA1 64af8174fe9ba8b50937c14d1a3b51aa135c4766
- SHA512 c7f15afed2d708d47370f03e01d9cd9aba62db170aac92675badfdbe5d6b982eb49803be2c23e198a9917659f0c789b5b1cb946b58f19a0a62d3b63d5db4e32c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwR9Ur2d29dBrh:A3k03kHRJPpYqmFieUidGl
- TLSH T111C55B43E7954DB5F05E8034C9828239E9327D590BE386DB135EBB295F327C86AF9324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 2ac834f20810062a5bcd3a60f4198720c37066dab20c40454a5c0ccbed583af1
- MD5 1728950ab45174e518f86214eaddf23e
- SHA1 509ed51638fd073d7f2a6c7718e5c88d0b4884b9
- SHA512 d5f55510cefc22a37194ad39f6c06e27e5d99f5aa49cbde432566fe945ba4c9b389319946388379281c8fc258b2348fbfa8573c6a775642ca85b64d188d1609c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwRB0Le5ji0hmM:A3k03kHRJPpYqmFiyPji0Aj
- TLSH T186C54B42E7658E71F06AC074C8C29679E9323D4907F28ADB124EBB296F337D956F5320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.5MB
- SHA256 16cc2ec9db18cb63954bccc4331955bdec884b305f5850b21544069b67ca07f8
- MD5 f9c8cb930f112442849c97e6e55b099d
- SHA1 e1e4efa64caa634805095cb79a119b475cda002a
- SHA512 f30efe0685253e0a254e8b57c565fe0ab5e276cf79a812d4f6e52f5c706de98cc6cb43522ff7e4b4c9960d07e5cd07d9cf10a4368e877dd11888cbdc05979f4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwR9UOlZ7q/c9:A3k03kHRJPpYqmFiCUOlk09
- TLSH T1ADC55C43EB558DB1F15E8434C9828239E6327D5907E386DB625EBB291F337C46AF8720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.5MB
- SHA256 37a64368553cf650226493ea59f23e8700c6ee10bff90fc47f4d4f045b7c02a1
- MD5 bde0dc91828348ba98b128d732ae1dd8
- SHA1 de723c1e85c5b0ceff5a81511050be3d1188d867
- SHA512 424f9717bdf81a904152e312b5012be02882d298037d48e9cbfc5d3c27234b269911b9a1ebd8f7bc757ab1aada556c5904a669f4cf7a5cb3b4fa8af4329638f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwRg3npi63iC:A3k03kHRJPpYqmFiZXpiMh
- TLSH T1A3C55B43E7958D71F1AA8530CDA1823999327E590BF386DB238D7B195F327C4AAF4321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 2.5MB
- SHA256 8a25ab862a557f57823c263dc25fe49a0c32493dd0a62e6016932123e8260ba3
- MD5 c5d64026a0fa54f372ad4676f06cf72f
- SHA1 0a973ed5634a10c6d0e685f5edfb4556fc8d64b1
- SHA512 1670f575a2185774eddffb1af82fdceadfd92a516c8333d421ea9adc34155b0e6efafbe90de0c40c06fd4538823fc049ee1b2cdb466277636efecf440005aa6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgYge5jcAkSYqyEGFiwRxV+PAk2hMHj:A3k03kHRJPpYqmFigi2WHj
- TLSH T12AC54A42E7A58D71F0AA8530CDA182399A327E590BF386DB234DBB1D5F327C499F4721
- MD5 SHA1 SHA512 SSDEEP TLSH