Analysis
- max time kernel
105s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 15:52
Behavioral task
behavioral1
Sample
2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 955KB
- Sample260806-ta2jbavela
- SHA256 d16a9cb1f482f69326c3683ae611e8b8eddd210b8ae82e0299b39bd757d1b0dd
- MD5 1903bb55e316bfc744b23c612bd67954
- SHA1 187ebcba07c5556d78183f627ef5600d0be6f48a
- SHA512 ceeb99584ba466934e9f3b309d87b8e6d0197a6afd04eb6c48579f97dab0a7d8e5d9194b3394ff6fb00895cfa9e70ba84844e1543ce59f5604915e244bfad990
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNC:A3k03kHRJARJS
- TLSH T1C6259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2092-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b00000001c65f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2092-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3076-89-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a55b-776.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a559-813.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cb4-962.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c86-1280.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000b00000001c65f-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-39.dat aspack_v212_v242 behavioral2/files/0x000300000001a55b-776.dat aspack_v212_v242 behavioral2/files/0x000300000001a559-813.dat aspack_v212_v242 behavioral2/files/0x0004000000019cb4-962.dat aspack_v212_v242 behavioral2/files/0x0004000000019c86-1280.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3076 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2092 2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3076 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_1903bb55e316bfc744b23c612bd67954_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2092
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 955KB
- SHA256 d16a9cb1f482f69326c3683ae611e8b8eddd210b8ae82e0299b39bd757d1b0dd
- MD5 1903bb55e316bfc744b23c612bd67954
- SHA1 187ebcba07c5556d78183f627ef5600d0be6f48a
- SHA512 ceeb99584ba466934e9f3b309d87b8e6d0197a6afd04eb6c48579f97dab0a7d8e5d9194b3394ff6fb00895cfa9e70ba84844e1543ce59f5604915e244bfad990
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNC:A3k03kHRJARJS
- TLSH T1C6259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 f8662a83b9cf226b1c9e8af8c28c6ba3f8637ee5d29c0728aeba15a968d14f2e
- MD5 50aab4dc8820f7ec9695c409692834b7
- SHA1 82afe3acbc55e127e21c7408a0c1735e5fb3a113
- SHA512 add9337721ecd15314ad1d51aca203ea88d2f078595701abf9b3f74a3dcf50563dec8dd77cfbfc157fd82724e3d3926a7a88a47ec1903df466d7c6b7359ea98d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNC0Le5ji0hmxNrM:A3k03kHRJARJSPji0Aj
- TLSH T1AE657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 969KB
- SHA256 bc16e3dcdd635be3a59310657899dd8ce31c96e4139143127574feb08a4a2719
- MD5 c1d580b4c696a3a1a9a9248663274db5
- SHA1 2e7ab098569c3a0b37128afb82cc411debca068c
- SHA512 af2ad8a096cc4c1b3c317d5902a2a104369c11b56be9fe5874e820e5157b6c05817475ac0f4b69f267a1428b3cea81b321f181b25467831f4401fd60b863a234
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNMa:A3k03kHRJARJ
- TLSH T1D2259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 976KB
- SHA256 414bde9224d27d741f14d3b714885615157a4556eea2342068a7b9f2e8561204
- MD5 21570dc9023a544c6c6d9e7bc35e848c
- SHA1 e8063af874283a4f445a6fb1371feec27fdf1f6e
- SHA512 b2507e481f95028977b83d729d08adf7447496a1154686fa0ef47c713489276d70f83a9440116e08773e9ca4c0abdcfa4f8a972cd03882c36050474de7900fac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJN3:A3k03kHRJARJ
- TLSH T135259D07E79800E8D15AC2789AA69A22FB757C56173097CF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 976KB
- SHA256 11eca93da8d7318ad6977cb6a756e5a0e25a5961c7342c72ddf7c7c20058e078
- MD5 a2fcda813aa62afc61f7bedb313eeddd
- SHA1 2767a19f27e7c41f50d6c0692d1e0168bfa99e82
- SHA512 0403a21f2638aa255be36b9571fe48a08633ce38152c7add7ffc44b7d4c79731445367c2146ccbf846087962ad4e694d9988122a34681e48478414d301249999
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNrj:A3k03kHRJARJn
- TLSH T15C259D07E79800E8D15AC1789AA69A22FB757C561730A7CF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE
- Size 1.0MB
- SHA256 1e000a560fba4fdb607c1a7b178128c9c32f526a107fc6782f0b9047e820bbc9
- MD5 d44ea15f22dd43b8df662bf2084eaa03
- SHA1 34842762c3c2cdf1ad1fe265f03491eefb561128
- SHA512 1c03e4960a1ad8475cff19d88c9606cf9cd5ef01ceeff47c362ec6ce2b289fcf447fa5785ec022951b92985664a658371dd511ed7ba0088d650d60855e9b6a8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNxFn6wK3:A3k03kHRJARJr6F
- TLSH T15D359C17E79400E8D10AC2749AA69A33FB75BC561B2097CF1364C6162F72BD0AF3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.0MB
- SHA256 abb552abd374f208c388c990cb354452ee0679cb646e4d7fd491fa2cdc590cde
- MD5 209526edfb03db1ef8afdc8c13f0ef4e
- SHA1 4c59b4ca70ff6da971738cb79a1bd4a96bf2caf7
- SHA512 98a679ea2d603e3714ad1564a696ecf31b5453baffb61d1616916b6fd6b47e602301d9a710a5f35ab64570757c9f38d1d6cadbbafe9e878429dfa83838d34fa6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsyaJNgF:A3k03kHRJARJC
- TLSH T100358D03E6D500E9D64A8134DE9A8A22FB35BD92072097EF1358B7262F727D0BF39754
- MD5 SHA1 SHA512 SSDEEP TLSH