Analysis
- max time kernel
91s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 00:44
Behavioral task
behavioral1
Sample
2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260821-a3klqatsdt
- SHA256 d9156a05c9a0a2d672f6061ce6767546862b17fde81a4532700cca047a7fbc05
- MD5 283011e36f625ae5e11398e16354beb1
- SHA1 12bc871c22ab47d11f344fdbb7b40676258ab7e5
- SHA512 2d9c876ccc99229d836c2e0050fdcb1db3e5bfee7506d7598a51df4c5412db3af4e0c0b34e3674fa7581cac4ea90cae179cac7a66cbb57fb2d4e145f7a499ff1
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5EN:A3IqJtb2Iu56r+3IqJtb2Iu56r
- TLSH T1C0951915F6688F65D07FC079C5D2969AEA333C425F308BCB0245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4336-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024252-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4132-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4336-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4132-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002344a-155.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-314.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002264f-1230.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e0fb-1636.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000006fd-1977.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000729-2100.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024252-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x000200000002344a-155.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-314.dat aspack_v212_v242 behavioral1/files/0x000200000002264f-1230.dat aspack_v212_v242 behavioral1/files/0x000500000001e0fb-1636.dat aspack_v212_v242 behavioral1/files/0x00040000000006fd-1977.dat aspack_v212_v242 behavioral1/files/0x0003000000000729-2100.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4132 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4336 2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4132 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_283011e36f625ae5e11398e16354beb1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4336
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 d9156a05c9a0a2d672f6061ce6767546862b17fde81a4532700cca047a7fbc05
- MD5 283011e36f625ae5e11398e16354beb1
- SHA1 12bc871c22ab47d11f344fdbb7b40676258ab7e5
- SHA512 2d9c876ccc99229d836c2e0050fdcb1db3e5bfee7506d7598a51df4c5412db3af4e0c0b34e3674fa7581cac4ea90cae179cac7a66cbb57fb2d4e145f7a499ff1
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5EN:A3IqJtb2Iu56r+3IqJtb2Iu56r
- TLSH T1C0951915F6688F65D07FC079C5D2969AEA333C425F308BCB0245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.9MB
- SHA256 93362b96df6338e15415991d6c1951cbef4bc2934ed2ebdcbeb81f3c7071147d
- MD5 8c2fc5dea889ad2bf8e11932fcb34fd8
- SHA1 9efc96852dbec0cf00cfee2f6be61f353c2d8c6a
- SHA512 a44e1ac602f8e9bef587c2764f8feb76c029656b62d72e1cf585015ed1925efd9f6ea098eedb85fdbca5ae03c65918647fbde0c485bea106dddbe3eb794e3900
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5EA:A3IqJtb2Iu56r+3IqJtb2Iu56rVw
- TLSH T1A3951915F6688F65D07BC079C5D2969AEA333C425F308BCB0245AE283E376D5D93A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 16f27a0d6c5700a2638f2dc4b41fb947a75a9a3b61d8f4968ea2de1668d33eb3
- MD5 550fd27d40fae833101b9944b9cf5eb3
- SHA1 ae5adf16091029bfa4b853c84caad0b1dba02008
- SHA512 fdcb5f8894e761f529aba64b92336ff046d7f88d98e0b6dc34dc8df33b38541d42bd53e5e9f8a4258dbd9a1892909271fbaad877bbada6e91fa51bffeaa310a4
- SSDEEP 49152:A3IqJtb2Iu56r+3IqJtb2Iu56rbPji0Aj:A3ICr+3ICrjjo
- TLSH T17BB50815F6648B61D07BC079C5D2969AEA333C425F308BCB0285EF683E276D6953A733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.9MB
- SHA256 5081eba3b9eb8ca7418712025c99b8bf209dbffd2e82be226ede3ea4267d64a6
- MD5 036aabe8fe79fa21c1e4934c2e66f34f
- SHA1 c3e67b7da0c41b6e457b6dc38b3d5db0b23e1a27
- SHA512 cb650eaeab9bb77ba238b08b1a008540577fb84440a7fc55e0e6bcaa5e98bc4a189f0f82bca8aab061de2b13f33664027707419e13700fe18e232d9140a708c5
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5Eu:A3IqJtb2Iu56r+3IqJtb2Iu56rs
- TLSH T11095D515E2688B65D06FC075C692969AFA333C415FA087CB0285EE3C3F376D1997A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.8MB
- SHA256 c9dda23cb2f661345e4942c5acf21f69a3b846042e82cfdfecc2352bb5a13a10
- MD5 3b9a67f5f6a82901eb5c1ef8c79baf2b
- SHA1 7a2aaae7b398f73354dc6c68dcb871115cf9eae0
- SHA512 5cca3bae3768e3090539635087de0c7ec134c0edfbaf5047a44f1132fe1159bbf9e35caea52659fce639e49f85e708744aa3152bf300e51878722ef9bebf00b2
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5Ex:A3IqJtb2Iu56r+3IqJtb2Iu56rb
- TLSH T192951915F6688F61D07FC079C5D2969AEA333C425F308BCB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe
- Size 2.3MB
- SHA256 2f8c2adf693f49783bbc21c2e8b1a5d3549fb45d1348b3c251f1c72b3703e596
- MD5 06c1248777ea6541bce530fa9aa0fe8a
- SHA1 0d861cc53084808e5dd0d895dc64a267943c19ca
- SHA512 7f729838e362c09174ceb95708108fe2c1bc62c96ac60a18f9d7bb0e3b6f8f1d0abcfb14404db32c00209abc116ccc454e631ba6db4b68baebb575cc7861726c
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5ED:A3IqJtb2Iu56r+3IqJtb2Iu56rhi6
- TLSH T13DB5E652A7648F71F06FC074C4929669EA333C454FE287CB124EBE293F3668995F5322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.2MB
- SHA256 49cbfd0ac0847b6062a21f8ac9d85262b9d68b70a10d04ee44f48654e69ad78e
- MD5 aab3d4a454a4aa642f45baee4c8c5e34
- SHA1 e3c3a969849299f441866715a0f44e03be22c3e6
- SHA512 a51c2aba1723e7b8fd4d83a52b324cef665e5c86132d3994032a03fc32f9d369d8fa63fe09c5d7b26ea07dc5521a3e781aa675dfd3e8c3bb07b54302f01a0026
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm7LaC3mMYTqMi8CtBd2QHCHmTBW5Ea:A3IqJtb2Iu56r+3IqJtb2Iu56rGXpiMh
- TLSH T1E7B51815B2A88B65E07BC175C9E29695EA333C425F3087CF1385AE2C3E726D1D936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.4MB
- SHA256 108e2da99bcad71a7518dce286659239a161db06a18ac7b70d6b497606378317
- MD5 04debb97a4006c75831f66523916d432
- SHA1 4192351a618794aac6251f855f90fb8f586b034c
- SHA512 21d97bd6195f44b4a356ecc5d287c1fc7822d9eed57619ef60deb7c4cf8f831735a810bf87d50ba841dec9d203d54788f4f2e84e277fcd135a3e1492bf8f6272
- SSDEEP 49152:A3IqJtb2Iu56r+3IqJtb2Iu56r9HJHYRO4R06Qmo7fE:A3ICr+3ICr9HJ4vK6QH7M
- TLSH T1CFC55B15F6688F61D07BC079C5D2969AEA333C425F308BCB1245AE283E376D5D93A723
- MD5 SHA1 SHA512 SSDEEP TLSH