Analysis
- max time kernel
95s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 02:18
Behavioral task
behavioral1
Sample
2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 3.1MB
- Sample260718-crpseac17m
- SHA256 2bd5636380241d656118fcd0bd572d5e6b837af52f7027c5b4abe16d10792893
- MD5 bda353b33acae8774331eb00131b0c37
- SHA1 de242099d5ad25fc411cf16444d4aad1373c8531
- SHA512 81e151eef486b755b5ab84cea93588cb7768cb24394204c328ca4564ef44b515c0f7fea30341865061d832530e00ec5366a2affaafe2083543cb621a301ee373
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2I:A3k03kHR+RrfkZcMY
- TLSH T104E52A16F6788362D0BBC079C6D69A55FA333C410B708ACB1285E33D1F376D19A7A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/2768-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244ed-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5020-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2768-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5020-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000215b3-72.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002180c-1138.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002160b-1279.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001b363-1377.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001d00000000070d-1524.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000016fda-2095.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244ed-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x00080000000215b3-72.dat aspack_v212_v242 behavioral1/files/0x000300000002180c-1138.dat aspack_v212_v242 behavioral1/files/0x000300000002160b-1279.dat aspack_v212_v242 behavioral1/files/0x001400000001b363-1377.dat aspack_v212_v242 behavioral1/files/0x001d00000000070d-1524.dat aspack_v212_v242 behavioral1/files/0x0010000000016fda-2095.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5020 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zG.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2768 2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 5020 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_bda353b33acae8774331eb00131b0c37_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2768
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 2bd5636380241d656118fcd0bd572d5e6b837af52f7027c5b4abe16d10792893
- MD5 bda353b33acae8774331eb00131b0c37
- SHA1 de242099d5ad25fc411cf16444d4aad1373c8531
- SHA512 81e151eef486b755b5ab84cea93588cb7768cb24394204c328ca4564ef44b515c0f7fea30341865061d832530e00ec5366a2affaafe2083543cb621a301ee373
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2I:A3k03kHR+RrfkZcMY
- TLSH T104E52A16F6788362D0BBC079C6D69A55FA333C410B708ACB1285E33D1F376D19A7A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.4MB
- SHA256 2ccd66ba4897b126aef38ec750b564192c447e7134cbf8953bd52e76d652ed62
- MD5 745a864f4ff71434b6bbe20765bc5263
- SHA1 3b2ace514e9bbe50af2a2c679ea61a57f58b8deb
- SHA512 4ebd9c4161b98daf4ce42d158001c0e1be726d04d626c2e0000c24dc5eb234dad30c960c7dc1b7456dac4e14550d145a91f653fd0e6ca8f1c3db00fe925f589d
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2IwUN+Eir:A3k03kHR+RrfkZcMY9E
- TLSH T135F53A16F67886A2D07BC079CAD69645FA333C410B708ACB1295E33D1F376D59E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.5MB
- SHA256 ad61c26ae962a17c620dc73fe218afb9cbbfbbacb924f4af682284af89cedbf2
- MD5 25b0bef9d8a55f2755d3a91ae6db358d
- SHA1 1d9e501c81b107a08f54735b11729b0a45031a7e
- SHA512 c649925aed04683b9058a399914a33f9f0178835527d10c8f8d70d44a0bbff773f0e8fa5753267c898027acaaf6600448f9183452a652335fc65361f4f36d1c0
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2IuTd9CHKyao:A3k03kHR+RrfkZcMYVCqo
- TLSH T1D7063A16F6B842A2D07BC179CAD69655FA323C450B708ACB1385E33D1F337D19A79B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 1155e808b6c4e4d0a250e17874bcbfc94f094daced0cbd772455e7121cb91943
- MD5 9f0ee8d9d5216a7c92b93863373ef9ab
- SHA1 2714289697bf98c23f50f39ad44ad0697b702bd8
- SHA512 1c4b87596b94f9079ebed9d8e45043269b6871918145c018cdd7a0703c41209c75b1420fa0f338b01121f84fa5c64c546f6d13f021e057c6b58b47fca1e69f84
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2IQPji0Aj:A3k03kHR+RrfkZcMYZjo
- TLSH T1D0062A16F6788362D07BC079C6D69656FA3238414B708ACB5285E33C2F377D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$
- Size 3.6MB
- SHA256 d0374556a445a91fe5a98dc558049dab27bb8444fad63974cf444f02debc0d7d
- MD5 80f95009828ca98b758166bc53a6bce2
- SHA1 c19aa826c57a64f85e5aaae48c04247616c829ed
- SHA512 30625b437dcc89264ff20a9d72c2375fc38bf92fe48354310fb7f430cddea1c436eb034a2431f6db1c3a2ee57c29354bc56a469f7c9c53bf54bb8d8697d52218
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2IcAMDFoiq5P:A3k03kHR+RrfkZcMYvqR
- TLSH T196062916F6B842A2E0BBC178CAE69655FA323C450B7086CF1295E33D1F336D19E75722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
- Size 3.4MB
- SHA256 af6c55a17663a9a75a3ec6cadd76c4f36af391d3ee8acac69abd0df706cf6519
- MD5 3f08740d69eddede3185e30a968e240e
- SHA1 6831a4d4964299db60df860ca6410f22d35d9ec4
- SHA512 2eb53946ab5feca21056aebc63018ec1d7ffef1c10355b99fd945a8555b1e17ca481749da99dd189074cf62b64cbc2311f66fc0d620c0a5b671b52b0d8983f1f
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2I71lkWu0ya:A3k03kHR+RrfkZcMYw1lkNa
- TLSH T1DFF52916F6B84262E0BBC174CAE6A655FA323C411B7086CF1295E33D1F33AD19A75723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.1MB
- SHA256 0296f7513d90db22204c2335e4821254847ccb7bf022f9d8029da7e15d45e865
- MD5 a55aeb70efafb6612091fb4d8891bf23
- SHA1 08fafb79ed7953b4292a71ecb073610ee6bbf218
- SHA512 9783b8c106fa6a538a120a51ac36688ffc3b1bc7b64da14c279d11b57516b740e75a6cd1b63bf2deb30cf14daf7c768388aaace1910bf4d351c4883dfc48bd8a
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2Ig:A3k03kHR+RrfkZcMYr
- TLSH T1EFE52A16F6B88362D0BBC079CAD69A55FA323C410B708ACB1285F33D1F376D19A75726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 3.1MB
- SHA256 033f274768a729fd709eab39de27a61af52b7b4be466dcd2fdcf1492bae4cff6
- MD5 cf3145a45c18248b5ba35c59d87310a0
- SHA1 152fc2e2644bd8f5237eec1dc9b2a25d3ac3abd1
- SHA512 f28a46a3caf0eb2f22e3e850405e0445426a33719c0996f70fbdba3e6bab92c48a2559395da9b07480692c8c0e466d6932a89eca1d4b7911f1b20fa3fcf44fdf
- SSDEEP 49152:A3k03kHRJARJReW4SkZP4sz9MbqUOlk0YqJtb2I:A3k03kHR+RrfkZcMY
- TLSH T191E52A16F6788362D0BBC079C6D69A55FA333C410B708ACB1285E33D1F376D19A7A726
- MD5 SHA1 SHA512 SSDEEP TLSH