Analysis
- max time kernel
86s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 14:19
Behavioral task
behavioral1
Sample
2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe
- Size 3.1MB
- Sample260803-rm76hsdk6v
- SHA256 133d62f7a59a750b4335a4b8056134e361f5724fd3e6c3a9459b082dffc74b9d
- MD5 9095ba41a3e9eb88c60e043650a34724
- SHA1 111b41cc89c221281c02f57a1a47747eda87623c
- SHA512 49979e85f9995a8673a1ee2f388ed365fae6a86dfce6db3f728cd006432d249d48f704d970c80b82780b3658bbb8c597a41e90375e49ccefbc1c35963e7ef68e
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYq:WYrRokKrOO53up6r2wjoK6
- TLSH T166E54B1DFEA48E31E073817589A2A75DE9767C510F3086CB1284BA2DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/3192-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244e2-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1716-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000016909-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3192-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1716-23-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000016909-96.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-431.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021719-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244f8-1029.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001900000001e440-1303.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000073b-1631.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244e2-5.dat aspack_v212_v242 behavioral1/files/0x0003000000016909-12.dat aspack_v212_v242 behavioral1/files/0x0010000000016909-96.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-431.dat aspack_v212_v242 behavioral1/files/0x0003000000021719-747.dat aspack_v212_v242 behavioral1/files/0x00070000000244f8-1029.dat aspack_v212_v242 behavioral1/files/0x001900000001e440-1303.dat aspack_v212_v242 behavioral1/files/0x000400000000073b-1631.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1716 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3192 2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe 1716 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9095ba41a3e9eb88c60e043650a34724_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3192
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1716
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 133d62f7a59a750b4335a4b8056134e361f5724fd3e6c3a9459b082dffc74b9d
- MD5 9095ba41a3e9eb88c60e043650a34724
- SHA1 111b41cc89c221281c02f57a1a47747eda87623c
- SHA512 49979e85f9995a8673a1ee2f388ed365fae6a86dfce6db3f728cd006432d249d48f704d970c80b82780b3658bbb8c597a41e90375e49ccefbc1c35963e7ef68e
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYq:WYrRokKrOO53up6r2wjoK6
- TLSH T166E54B1DFEA48E31E073817589A2A75DE9767C510F3086CB1284BA2DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 3.2MB
- SHA256 51a6f6f6f18699a8d309bd66fdc1d346798f834bc8d912d176e066a5f4115180
- MD5 494d4a2309c68a204688e600915eef40
- SHA1 dd50e3838d5a864b8247be170f26da5d3e0b0b83
- SHA512 634bd341f8170defcf1846f780ab7a1b191ce6174fef850e912f4d626072af22d717fb0d497e21779454eaa2fc3145515b5180956b0695fd6408a75f5e6665e6
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYqdw:WYrRokKrOO53up6r2wjoK6L
- TLSH T15AF54B1DFEA48E31E073817589A2A75DEA767C510F3086CB1284BA1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 7652b0a0b31a550d787649786bbf100bac77ba0a0c33cee557e2b944af1d4bb0
- MD5 9ff5ef3fbb4969a800c0f135e3284d5c
- SHA1 ae000e42b395821e722cfded679e426e965b6722
- SHA512 95d149c37c6dce3d3a02360a64f573d4ad7f2e172a73324c966c01925f20eb7e42670f9dadc62644d33c767a55e7cc5ec8c78156313cbc87808fa5a4ffd91950
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYqjPji0Aj:WYrRokKrOO53up6r2wjoK6Gjo
- TLSH T168063A19FEA48E31D0738175C9E2A75EE9727C511F3086CB1285BA2CEE32FD19935722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
- Size 3.1MB
- SHA256 224d04635d5d9d713cd1b37c088d9a291065d04dfebef9309afd7eb4ff66aa35
- MD5 e7111fdbf03b952f3feb963c55b7b05f
- SHA1 63a848a2d95a61b8d050651521ef127c217beed1
- SHA512 283e79c2c7f4308aaeb6dcd7d57640427e9d5a590deae95c776e4059b3accdb03b180b26f647d12d4126d8169a295a31eb00edfac5c9b537f4f768ea2f5ed2ff
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYq5:WYrRokKrOO53up6r2wjoK6w
- TLSH T11AE55B1DFEA48E31E073817589A2A75DE9767C510F3086CB1284BA2DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 3.6MB
- SHA256 b423ee739a8b4e8f1ba71cdec708b0927932306f1d1e15ebd2b2d3a0963879b6
- MD5 95e76ef38fe9b8fac4841356445438e9
- SHA1 812147a9c49ad32ade8b3f490b82264952a83502
- SHA512 4f5029af5b7207739a8c40432014a058192a6d38c15f08c9f2219a5edd052e585067045cbc7f2b82bfb873c0928db658e4a96a05e85078343c7fdaedf7494736
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYqTUOlk09:WYrRokKrOO53up6r2wjoK6G9
- TLSH T1E1065A1DFEA48E71D077817489A2935DEA727C510F3087CB6284BA2DEE32FD19935722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 3.2MB
- SHA256 af0e9b8add73280d94888927314067fdec30141215a08f498461fbe495fb658e
- MD5 9db18480032fa92dcdc789143c2eff69
- SHA1 4bd757a8283a357a7ec0b57dca9f5ff6ff8a1f3c
- SHA512 abde83f70a2756181a3629f163ad121012d96636193ce43cc561222076580a9670da2591487cc5f38874695754d5a6b9fe5b3536b55ac68986ea967804e602db
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYqk:WYrRokKrOO53up6r2wjoK6t
- TLSH T183E54B1DFEA48E31E073817589A2A75DE9767C510F3086CB1284BA2DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 3.2MB
- SHA256 d345f5cd654671fa0ffc2657a7e492114dd5932bc4bd88364930edfc7d1dbd1b
- MD5 7ca0c3361d70f43e38d74ba0ab6eccf5
- SHA1 d34b76f9f43f49ca307e9785b56ea054f1d1ba94
- SHA512 5cc476870892a238992ded0ab7225b0f76206826621d9d675524d9a33a3eb678cf52d8c51c8a3f3423ba0f57d4c32e9460567ed3dc3f3855acdf67fc225d9196
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYqt:WYrRokKrOO53up6r2wjoK6Y
- TLSH T15BF5491DFEA48E31E073817589A2A75DE9767C510F3086CB1284BB2DEE32FD19935722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$
- Size 3.2MB
- SHA256 b46d3594a6ccccd1594aeebcf47acf415b1e5d7146d60d57270925d8231cda2b
- MD5 7f88a5e8b7474a3a1a704de3bdabcd94
- SHA1 552cce8ad3d734811f3a01f530f547af7a17b14d
- SHA512 8601576c09ff09508154351c56a4ff5ccbd0e7019a1e8d7204b3921edeffb16d05027a3fe2915852cbd026b8e8f8bf7863b9578249d9c863917f889a9b730e6f
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGpYqQj:WYrRokKrOO53up6r2wjoK6Dj
- TLSH T16AF55B1DFEA48E31E073817589A2A75DE9767C510F3086CB1284BA2DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH