Analysis
- max time kernel
104s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 18:55
Behavioral task
behavioral1
Sample
2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260820-xk6gsstemd
- SHA256 aaa0321a638c18dae858788e384f0312d4c0c3a94c3c7402f8f499925fb02ce8
- MD5 a15761c2118707d0e40a2d762923a851
- SHA1 5e9d42221c11d541a419f17b61d66cb788b6f8bc
- SHA512 26de1c2cc744473871a20dc52835b6531845cc4fdcb475f2f3f8cfdd8ac2a0241a656198f347062f2d25eaa6f5d8d54a5cc07bb0742da43c5c9a2c8e5d1d5111
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyE:A3k03kHRJgpYq
- TLSH T124558C17F6A441B5D063C1B9CAD2AA66FE713846173097CF1358C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4368-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244a3-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4244-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4368-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4244-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021321-505.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002149a-682.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244ab-714.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021787-764.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00140000000202d7-1537.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000006d1-1982.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e48f-2077.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244a3-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021321-505.dat aspack_v212_v242 behavioral1/files/0x000800000002149a-682.dat aspack_v212_v242 behavioral1/files/0x00070000000244ab-714.dat aspack_v212_v242 behavioral1/files/0x0002000000021787-764.dat aspack_v212_v242 behavioral1/files/0x00140000000202d7-1537.dat aspack_v212_v242 behavioral1/files/0x00070000000006d1-1982.dat aspack_v212_v242 behavioral1/files/0x000200000001e48f-2077.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4244 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4368 2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4244 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a15761c2118707d0e40a2d762923a851_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4368
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 aaa0321a638c18dae858788e384f0312d4c0c3a94c3c7402f8f499925fb02ce8
- MD5 a15761c2118707d0e40a2d762923a851
- SHA1 5e9d42221c11d541a419f17b61d66cb788b6f8bc
- SHA512 26de1c2cc744473871a20dc52835b6531845cc4fdcb475f2f3f8cfdd8ac2a0241a656198f347062f2d25eaa6f5d8d54a5cc07bb0742da43c5c9a2c8e5d1d5111
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyE:A3k03kHRJgpYq
- TLSH T124558C17F6A441B5D063C1B9CAD2AA66FE713846173097CF1358C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.8MB
- SHA256 4d6502f4c3b8e3c51c3fddccad089a14ddd5d478345e0ae9b0ca788403c4dbd5
- MD5 f68552f54a11c780812045900691d5b3
- SHA1 3493ab257dd5fb3c28acac961c345504de738029
- SHA512 b62b2ec485404527c48beab14d5d255ad2240573e4486f05d87f140c697cb0ae2d3807dc2ef726a9d24d552af1c3626d94756d7517705c12f4cffb9665795759
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyEX3Td9CHKy7GZO:A3k03kHRJgpYqHTd9CHKyao
- TLSH T11D957C12F7A401B5E073C179C9E29656EA7238461B30DBCF139896292F33BD19E39B71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 e1c496945688a00a89beb470fbe82d61c1180bfb584d95e280f53ce54ddefd5a
- MD5 549ad2bd841977dc68c8bffc4537dfca
- SHA1 9740e5495773463aa7c1a62574565fc1b9fd372e
- SHA512 d44d9f438a29081a21871fc1e69b4156af66ecdfe59ed8082f3de1d4843db2b04d25a201797465e074911f5b055ce8f80c7c556a779eef9ff0b3d338d3580abe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJgpYqjPji0Aj
- TLSH T1C2957C16F6744275D073C0B9C5D2A69AFE7134861B308ACB1389C7283F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 1.4MB
- SHA256 89163df58a02d8535bf7647de86ac1893486fafae7b7df83716fcaa50dbae41d
- MD5 cdb1ff86ca3b02731af82b2a172db78a
- SHA1 5adb5a47404126ffb8d241a30dfe8066ca45fdb1
- SHA512 7bbcd6b44ff0facf7ba2ed1dd14a58f5c57bc09288a296100e5d08013c059966ccd5e05f914d7f503c3ebe2382681003bc6c752266f17cdc190a3604ea9b0af1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyENj:A3k03kHRJgpYq9
- TLSH T1C1658D17F6A445B5D063C1B9CAD2AA66EE713846173097CF1358C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe$
- Size 1.4MB
- SHA256 581616683c1878bcfed10e8629ea10aa44be024228c4ff72cfe6fac33efe629c
- MD5 99294c099750818df0dcd9077a5b6bdd
- SHA1 4014f55fa3587701b79b6e92a9d523f84d6bb247
- SHA512 0290c4a79a104efc10420f218fdccae27b83304fe352f0e2541ad25feba2a8c5da847e9985114cd276eddd0938cfcddecbc5e826693edfb767df64e1384d1872
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyElT:A3k03kHRJgpYqp
- TLSH T110658D17F6A445B5D063C1B9CAD2AA66FE713846173097CF1358C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
- Size 1.4MB
- SHA256 81e58dee77f2d1d912aed8a33966a7fedaed897614679934ed58ed49bc803774
- MD5 77c6788edd3b24066a3dca48045ec929
- SHA1 8f5ea3300ac6d2f6ce57419f1c35630ad2cfa0fb
- SHA512 81783721d56d7835bb19130018db19a482b4ae175c26c277c268fd78f1cdc0152222b32e56f7cf7a73895adb80214d9b790732a70b9035026fd6163bebacfca9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyEOf2aps:A3k03kHRJgpYq0s
- TLSH T1DF657C13F7A405B5E073C179CAD29A66EE71384617309BCF1358C2292F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 1.8MB
- SHA256 72e9f60b659281827f8d71557016b84b5236ac135a699f55a422cbd63a36d8bb
- MD5 0d060a3a3c5494fa6e41afb6d5b4e91d
- SHA1 172a2a6e20b0ce4c889d586ef2c8e6537925c893
- SHA512 7fdd49f6afcc095eaa451f7be67a21cb71f91f0506ad63e722071f516200e98404d37d3a7db3d95d06c97243fab048f888f7b04fff6850f35ad4f46ea89a7959
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyEzUOlZ7q/c9:A3k03kHRJgpYqTUOlk09
- TLSH T13A957C26FA6445F5D077C1B8CAD29656EA7138420B30D7CF6358D3292F23BD09E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.8MB
- SHA256 506dddb6a2da25c9962d77a66c9b185cf82cd506f6d11f1df9cb08f550ecf2a6
- MD5 01c4e85c95d551a26ab98fbc293720ab
- SHA1 bb36e259196aad3f5c9633daa035a83565c5a98f
- SHA512 41785d966e49a7a73e06f5e558c3b5302a84f70452c62c59930390ba072d94a58f97a08c50c65e4ae4c1768999d7d2275e4b11961e1aea132e601f93c977e00b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyEu3npi63iC:A3k03kHRJgpYqOXpiMh
- TLSH T1AA856B12F7E44175E0B38274DAF29656EA767C525B3086CF2384861C2F72BD0EA39772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.6MB
- SHA256 4c3344dbfddd46520eaa026900e842ce29cf54d7f52c9bc2944842cccb40962a
- MD5 dd27c930b0e5b771244043740957fb82
- SHA1 bbea30c96cfe5168f0c39ea47ce37b17d9ed8017
- SHA512 b955e895a8d215a49f76b697ed041be2f759b6ffcbfad54c6ae82331575bed3553251ac426446a275178e049c9c188814851b666443359ac6d932f4a916b5e81
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEo9hs5jcAkSYqyEfV+PAk2hMH3:A3k03kHRJgpYq/i2WH3
- TLSH T1BD758D23F7A445B5D063C175CAD6A66AEA3138421B3086CF1358D32D2F63BE19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH