Analysis
- max time kernel
113s - max time network
100s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 15:15
Behavioral task
behavioral1
Sample
2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.9MB
- Sample260522-sm1bcaft4q
- SHA256 e550f0dd7d3be6cc426df01607f5b8487845794804693fa2af960455bb3d348d
- MD5 a0f225bdc87c22549fe9db2e511a327a
- SHA1 1078434567b75b0cd7ffd9fd45c54da0113f8e4d
- SHA512 e7b607230b81c17336930bdce61bccd0d98d4c3ebdd3bc232c3dff0b225b580b73337936d2deb2f050a5bc996d1dbf5b8f4b9eaf6ea06b69ab3c658726c7f005
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2I:A3k03kc/vBFfkZck
- TLSH T143D53B26F6788332D073C079C6D6AA9AFA7234425B308ACB1349D72C2F276D5D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/5036-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b6b6-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3856-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5036-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3856-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028da8-1270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001a60c-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b6bc-1592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a7eb-1870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001c000000025e78-2260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b6e3-2258.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b6b6-6.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028da8-1270.dat aspack_v212_v242 behavioral2/files/0x000800000001a60c-1380.dat aspack_v212_v242 behavioral2/files/0x001a00000002b6bc-1592.dat aspack_v212_v242 behavioral2/files/0x000200000002a7eb-1870.dat aspack_v212_v242 behavioral2/files/0x001c000000025e78-2260.dat aspack_v212_v242 behavioral2/files/0x001900000002b6e3-2258.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3856 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5036 2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3856 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_a0f225bdc87c22549fe9db2e511a327a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5036
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 e550f0dd7d3be6cc426df01607f5b8487845794804693fa2af960455bb3d348d
- MD5 a0f225bdc87c22549fe9db2e511a327a
- SHA1 1078434567b75b0cd7ffd9fd45c54da0113f8e4d
- SHA512 e7b607230b81c17336930bdce61bccd0d98d4c3ebdd3bc232c3dff0b225b580b73337936d2deb2f050a5bc996d1dbf5b8f4b9eaf6ea06b69ab3c658726c7f005
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2I:A3k03kc/vBFfkZck
- TLSH T143D53B26F6788332D073C079C6D6AA9AFA7234425B308ACB1349D72C2F276D5D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.6MB
- SHA256 fbe653355e1f0c1525e075b8d5df0f2d9384c3a0dfeff7c97839eedff658c6f7
- MD5 23acb1b5e944648f0032babe53090ae7
- SHA1 faa3f4b135341495c95427fe9de908ffcf2f1638
- SHA512 52c922751a1408f3df549ec86d1dceabfc3f5d1091fe09e0591d4f8c67ecc7fb962aa8234945c43400b161a9c619618d837be65311c294510580364567293ea3
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2IRVk0QGTvntQb:A3k03kc/vBFfkZcklHaib
- TLSH T169065C26F6B88372D073C179C6D7AA5AFA72344657308ACB0345D72C2F276D1DA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
- Size 3.0MB
- SHA256 1f0bc50d6a5e66b3f29653469212f2a960dd514e29bf6de875818b51adb1dc1d
- MD5 698b163115a1d20e4edaa53497bcd810
- SHA1 fcfaf4ae1412738a18c19d276d99be912fdb2f97
- SHA512 741dba90b87e10d85e58e160fda71696086bef21b7499ce8f65ec45e825e4efbc3f9eeea3184cb0a1560571146a62a689bf48284e0aacf68d1ddcdd021b48bae
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2IcBPVAU:A3k03kc/vBFfkZck7BPVl
- TLSH T125E53B26F6788332D073C079C5D6AA9AFA7234425B308ACB1349D72C2F276D6D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$
- Size 3.0MB
- SHA256 ac928feebe4908f6d628c3837870721fb913b46df426823b1645704beb933589
- MD5 e96bdec561fbdf7fa809df40a893420f
- SHA1 001ae15ec149afe57778109aecd1b1553dec87a8
- SHA512 7c5a6bf7bdf981bc934b02f9692d966ebbe6379190b731536d49161bd751d793e565626e1ba24c7efdba95eb87ea558b1d6b456e999d2b6f4487a8b006d6689c
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2Imw:A3k03kc/vBFfkZckE
- TLSH T1D2E53B26F6788332D073C079C5D6AA9AFA7234425B308ACB1349D72C2F276D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 50271b2dbaa4dcceff4a4c0bbaef3f69a85cd322d30dd4a1312f4281ba27a25e
- MD5 d08a8a7eec2c36c5dfd6a4ebf3702be4
- SHA1 3b196d5ffe83998f583b5a19067ebfa0e5874a37
- SHA512 768dee207fc96d1a27a20742fc7b345f1a4db143c091f3730f921d84d8ed2f6e85e2b2b7f762b8de84995695459407b03b0bc0ec32834c4d7a4c57b23066c572
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kc/vBFfkZckZjo
- TLSH T145F52B26F6788332D073C0B9C5D6AA9AFA7234425B308ACB1345D76C2F276D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.9MB
- SHA256 521874e35638bca1280e16647b7d7fd3488f408bda22479ef14ad587b55918b5
- MD5 d784b4a434734a961cb8f672fc4189d9
- SHA1 bd84fd815e9bae3557b8afad61b79cd4eacb6a3c
- SHA512 ea888a6d07bf7b9f72acafeb5f005a11474b4db0b437a9a0eccfc6483c518b75c1ac0070dded431504634fbc39a6ec22b3e2a37628936c1ae5773a850fbab73b
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2Ig:A3k03kc/vBFfkZckr
- TLSH T165E53A26F6788332D073C079C9D6AA99FA7238815B308ACB1349E72C2E376D5D536735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
- Size 2.9MB
- SHA256 743c5f8fa41bc26ac2abc9cd7d748b46bbcce60dc443a9e0a562420004818dae
- MD5 61adfb6d7fa13212beb586dae4ef7b10
- SHA1 5fff9f9afe92554bc3efd15c97f6c29a1436d589
- SHA512 52a8a678f0e429833f30367517adb4deda52ff7cb9c921ca6aa501d83f48d397d5c08067d35d95a759d09df8e205429292f080758bc8afcc933ccd0dac9c39ea
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2Ip:A3k03kc/vBFfkZckW
- TLSH T1CCE52A26F6788332D073C079C5D6AA9AFA7234425B308ACB1349D72C2F276D6D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$
- Size 3.0MB
- SHA256 2a9141ddb01b37336fb99d5e981658b4a65272a6af98e48c33d798eae6f81074
- MD5 ad3d8b626941142111ca11613955891f
- SHA1 9238b49c43f3fdf947c938166bb3a8463bdba7aa
- SHA512 07f3ce10fe1a118126cef2528994a01cea14c78343c35424e55769901e749563dc6986f513dec279c77c19366b7c81e380d696de96dee088aecf3872ce915d55
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbkqJtb2I7:A3k03kc/vBFfkZck8
- TLSH T193E52A26F6B88332D0B3C079C5D6AA9AFA7234425B308ACB1349D72C2F276D5D536735
- MD5 SHA1 SHA512 SSDEEP TLSH