Analysis
- max time kernel
107s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 16:49
Behavioral task
behavioral1
Sample
2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260811-vbqnwafd34
- SHA256 37bdb25d062e088e9dc35b333f1de8e83d9fc53c4e2fb0faa2c2e38a93f2034f
- MD5 c618323b61174ec0e45b5149775e974f
- SHA1 51a09f956f341698f83c18781ed8dd68fd9169e3
- SHA512 35042fe49ad63d16d284267efe061fcf7ab45b2569186f816f3d3d395a2a6ecbc76d2c296b3886ed505b5e682a802a66badad18cdcd934d90e8172e16397a622
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEo2ghnUOlZ7q/cTyyCUq7lfHLJ:A3k03kHRJnUOlk0TTeX
- TLSH T1C5859D17EBA444E5C16B857486968622FB717C120B60D7CFA368C32A2F237D06F3DB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c519-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3452-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3472-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019caa-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001bdaa-2110.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c519-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x0004000000019caa-1279.dat aspack_v212_v242 behavioral2/files/0x000e00000001bdaa-2110.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3472 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3452 2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 3472 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c618323b61174ec0e45b5149775e974f_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3452
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 37bdb25d062e088e9dc35b333f1de8e83d9fc53c4e2fb0faa2c2e38a93f2034f
- MD5 c618323b61174ec0e45b5149775e974f
- SHA1 51a09f956f341698f83c18781ed8dd68fd9169e3
- SHA512 35042fe49ad63d16d284267efe061fcf7ab45b2569186f816f3d3d395a2a6ecbc76d2c296b3886ed505b5e682a802a66badad18cdcd934d90e8172e16397a622
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEo2ghnUOlZ7q/cTyyCUq7lfHLJ:A3k03kHRJnUOlk0TTeX
- TLSH T1C5859D17EBA444E5C16B857486968622FB717C120B60D7CFA368C32A2F237D06F3DB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 e4e05bec169eec1fc8bc23bd6bd3f75e34c32d5753720d7c79490e7867780056
- MD5 464c345905993068301b9daa22dcb1e1
- SHA1 0f2d7660446cac60780f5040d6d929f8314d8265
- SHA512 b4dc5ab03592e0e8bfcd3d3707f40a1c4ff5b29e3316487b56ad310444891f84b6a4ebb33ad6c2cb359c647e6c9fda061701f8f06a75cdd8144a3458b7465e64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEo2ghnUOlZ7q/cTyyCUq7lfHL10C:A3k03kHRJnUOlk0TTeTPji0Aj
- TLSH T114B57C17FAA445F5D067C178C6D29666EA7278420B30D7CF5368C3292F237D1AE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.7MB
- SHA256 6801f9451e263fe0e06a8339c29b3d5aa46ec7804d4ee408c0a14786de31d26d
- MD5 6d78fa74542b8f94599578e8d542705e
- SHA1 131cc376a1e1f352a502210ec2ef0ecc71f2a787
- SHA512 a5e60e594b72c40b2cfd48109d0df93e16e1ba2ba2def7d553dc92f826511afa885cd789376d225d562049564a42e17eb2ca4c01356d3dbf1f1e15d30003dd88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEo2ghnUOlZ7q/cTyyCUq7lfHLVF:A3k03kHRJnUOlk0TTe9
- TLSH T135858D17EAA444E5C25B85748A968622FB71BC510B2097DF6368F32A1F337D07F39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- Size 1.7MB
- SHA256 928f896764a4f825ceaec9bb44f39353cacce9eac62a0af6b80fefdaed51b218
- MD5 e6cedb2525cbf4cee71567c575a75b29
- SHA1 351d5938b9ac7234fdde5ff93f61890fc57b5086
- SHA512 86e9a64e4cb7430075ead243dd37dd4f779add2e4dc2c9a9b26d51e6a408e51628102467a7fc20891c5ec68c2f468ded4d7b193c9786ff16528fe9ea8c86ca13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEo2ghnUOlZ7q/cTyyCUq7lfHLv:A3k03kHRJnUOlk0TTe9
- TLSH T1C6859D17EBA444E5C16B857486D68622FB717C120B60D7CFA368C32A2F237D06F39B65
- MD5 SHA1 SHA512 SSDEEP TLSH