Analysis
- max time kernel
115s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 14:28
Behavioral task
behavioral1
Sample
2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 3.1MB
- Sample260604-rtgbdagt9w
- SHA256 9df1f9304d52936e79a2f7f2a045e7cc17e8df5ce53c4383771e21d791119346
- MD5 f291ed292bcabb5d64c95cc0bf4b210f
- SHA1 0070cc0b06db7cfd2b1e9dafa8b472b5e902759f
- SHA512 282de411117ce500d58d583b5f4859d561b8b5e735929a4338fa7778ccc1392dec2cd4e604d36c786702f881b946b3534dceff72f8c5d1fa6af6701a6731e8d0
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9Mb:A3k03kHRXfkZcBrO1lkNufkZc
- TLSH T1A0E53B16F6B88722E0B7C175C9E6AA5AF9323C455F3086CF0345972C2E27BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2612-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b3ef-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3164-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a3f9-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2612-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3164-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028d78-1288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a52-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a9a6-1543.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a8ce-1653.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0011000000000673-2072.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001900000002b3ef-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a3f9-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028d78-1288.dat aspack_v212_v242 behavioral2/files/0x0008000000027a52-1378.dat aspack_v212_v242 behavioral2/files/0x000200000002a9a6-1543.dat aspack_v212_v242 behavioral2/files/0x000400000002a8ce-1653.dat aspack_v212_v242 behavioral2/files/0x0011000000000673-2072.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3164 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2612 2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 3164 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f291ed292bcabb5d64c95cc0bf4b210f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2612
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 9df1f9304d52936e79a2f7f2a045e7cc17e8df5ce53c4383771e21d791119346
- MD5 f291ed292bcabb5d64c95cc0bf4b210f
- SHA1 0070cc0b06db7cfd2b1e9dafa8b472b5e902759f
- SHA512 282de411117ce500d58d583b5f4859d561b8b5e735929a4338fa7778ccc1392dec2cd4e604d36c786702f881b946b3534dceff72f8c5d1fa6af6701a6731e8d0
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9Mb:A3k03kHRXfkZcBrO1lkNufkZc
- TLSH T1A0E53B16F6B88722E0B7C175C9E6AA5AF9323C455F3086CF0345972C2E27BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.8MB
- SHA256 d795234027779a7ce0bb8af9a2f0b971a7aed316a70f2dbaca129c93449603a7
- MD5 e26e50abd5df2737b48b7fc1d741ee15
- SHA1 33daec5ef075ec8bcefd2f76357c9e5a4d9cd900
- SHA512 4bb7e6a5e2c28155962b7cebfdf9f865a9dbb00b10cb84d344020b25dfbf4e5197c2cf50f76eb52ada3426abd98f24fa96e3665a05fb382051c5e0b97522bba4
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9MbMVk0QGTvntQb:A3k03kHRXfkZcBrO1lkNufkZctHaib
- TLSH T167164C16F2B84762E0B7C179C5E7AA56FA323C451F3086CB0355972C2F27BD18A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 3.6MB
- SHA256 4c6a7f56551b327e1d5b341dfeccc09249f7819b4b0a4bc28260fdd8c0902903
- MD5 b5414630e0fc5725fa8346ada7f96bf2
- SHA1 0f722ba2765fdb6a8cb8cbd6fdff9e22fa7a248b
- SHA512 23d8815a7d135a38b164c7ea2378b3f9d90f46fe502611499be9ecffc3f140d9a6def2cefa180fa0a022278fd8a59988908e9f2cb1b88047645e97b396e3a6db
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9MbVTd9CHKyao:A3k03kHRXfkZcBrO1lkNufkZctCqo
- TLSH T18D063A16F6B84762E0B7C175C9E6AA5AF9323C461F3086CF0345972C2E27BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 3.6MB
- SHA256 c292a6669d8323e75b0b9f1e037636ef227a39393081fdad609924fdb58432ff
- MD5 87027303ddc983eb89d66c547040f1b8
- SHA1 94a4a750d865c13f207180631fe02836976d3777
- SHA512 e259d00c3f3e3b5cc4f667d9a8a1a4020048100909a24c3747ed99d96abdef5061c3e16b309ced0942365675c32d217f46e47a0b1e1b9182df362386dfc092ed
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9Mb9UidGl:A3k03kHRXfkZcBrO1lkNufkZc1dGl
- TLSH T1F7064C16F6B84762E0B7C175C9E6AA5AF93238461F3086CF0345972C2E37BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 8d82130146f7e6c482e8a62f11f911481c65123f6d5ec7988ad3ef0489a295e2
- MD5 708023bb5031f0ef6da981a351af9b05
- SHA1 381f308218f9dc9267768f5b3d5cbb03c0930145
- SHA512 7b3c4316c38d17ee54665919c33ab670b09704568fb4fa36cb4215881c80a4512f5991f5bf4b287e526656e5a51d394bb26bb507bfd9578700cfffb60a143f7e
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9MbBPji0Aj:A3k03kHRXfkZcBrO1lkNufkZcRjo
- TLSH T1FE063B16F6B88732E0B7C1B5C5E6AA5AF93238455F3086CB0345972C2E27BD1CA35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.2MB
- SHA256 36beb4a48edfa72d0227d1d65afbb3d5d0741bc6b7f6818c6dff57d4aa9bc792
- MD5 440e6b4adad426be52f50cb0ec417065
- SHA1 6f24fad11133762ccae9dfeb4687baebb7e1479c
- SHA512 8582516ba04c7aaa1ffb84a7b59ec0af99c8c423731b474e1a6ca0469c045b8a306464830bcac75cf8bab38a3ddc50fa89c5d1de72f5f62f35aa03ab40265f06
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9Mbj:A3k03kHRXfkZcBrO1lkNufkZcj
- TLSH T158F52A16F6B88722E0B7C175C9E6AA59F9323C451F3086CB0345A72C2E37BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 3.4MB
- SHA256 f997349a048396a270c8e10ee0622b8bd94c8c433e0b6a5a9118299ad52b1e23
- MD5 9ec34fdd5bf8645afd5a6e18c3805094
- SHA1 0a1cccdb4c2742abb530eca47f434a046ff3e1ae
- SHA512 63137544f61a4eaf23f15b056c15e22fdc3d1d3f80f003a946777193c2f34ef3e271485c2844f0d4ac28f1b55f4fecb5f2ec4aede5d207e6c2c005ce1799e097
- SSDEEP 49152:A3k03kHRJ5eW4SkZP4sz9MbE56rO1lkWu0y2eW4SkZP4sz9Mbxi2WH3:A3k03kHRXfkZcBrO1lkNufkZcxuX
- TLSH T15BF53B16F6B84733E0B7C175C9E6AA5AFA3238455F3086CB0345972C2E27BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH