Analysis
- max time kernel
104s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 12:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 5.3MB
- Sample260522-ppbh8adv9s
- SHA256 021e8f7ed4f57dc46d559d07c5245004154f64f62be60e301b60c65f7aa98bd4
- MD5 4bba8a10b2809131403d9f9d31bf8f9c
- SHA1 579f9ba6d5235797ae69a80c7afae85b16add726
- SHA512 478cc36b37ddc36dba0a988590d7b5079456507afc6117ed0e440876ad1f57825021b84eebf074b9818f5381813a6d6171a66104cc34489b743244cf801bbd3e
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP43:egjOk9WOXV2VMG9rUOfkZc
- TLSH T18F46F713AD6C4661D07FBC758991D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/416-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002457a-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e7-113.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002160a-1268.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000202ed-1355.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/416-1381-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2296-1388-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023192-1617.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023097-1697.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000002291b-2041.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2296 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 416 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 2296 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:416
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.3MB
- SHA256 021e8f7ed4f57dc46d559d07c5245004154f64f62be60e301b60c65f7aa98bd4
- MD5 4bba8a10b2809131403d9f9d31bf8f9c
- SHA1 579f9ba6d5235797ae69a80c7afae85b16add726
- SHA512 478cc36b37ddc36dba0a988590d7b5079456507afc6117ed0e440876ad1f57825021b84eebf074b9818f5381813a6d6171a66104cc34489b743244cf801bbd3e
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP43:egjOk9WOXV2VMG9rUOfkZc
- TLSH T18F46F713AD6C4661D07FBC758991D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 5.6MB
- SHA256 9f722a7ff44e73bab6464a5763bc35151b6d71130dbe4d42e3ed83407d5afacc
- MD5 6ba69fb3e3200a2c6ca552f89766fa6c
- SHA1 ac458427ce27d9eaf52b554105cd9abf41fb06d8
- SHA512 a8f714fc829b767a4e749eeb496f03757976b2432e36fb896f92b101f45c1a41d98fb4b393d38e7b1c9faece8efd0397a6e29434a20b2b53c02242cbe0d70ff6
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4L:egjOk9WOXV2VMG9rUOfkZcVE
- TLSH T1D656F712AE6C4661D07FBC748D91D7A9A5323C114F21ABCB1DC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 5.9MB
- SHA256 01cd004c35bf955bd9193731d9cdae88cfc258bf50af043a8e765884d3967259
- MD5 c571fb9a2b22028e3f9b3ec0c14278ce
- SHA1 eff116b6f9293bfbceafaaf069a8f2116ebe060d
- SHA512 333aca4e20a76a1bb918e515f91546b367aba995788cf8330649af78ec7343d3fe22eaca17391fdbf106bedf5cde3c9c492973c489b0a190dc414772a5de110c
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4F:egjOk9WOXV2VMG9rUOfkZc+2
- TLSH T16A56F812AD6C4661D07FBC748991D7A9E5323C514F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 5.5MB
- SHA256 01613b33d115200559e056423851415c4bde217ca7f60cedcd5097ecd20462ed
- MD5 63e0b74b4d1dc8b4fe7528c516829e9a
- SHA1 baad040ae056e7b189bc813c5d3e51b7f9a3003b
- SHA512 18a88d34876e53cba7da6b824632f66a06c484fe0900745fc3941f22f19a15c5b5b6ed85b9bfa3b8abd6fd049ce63a90d112ab8f4d314057028d5599de68f1f2
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP48:egjOk9WOXV2VMG9rUOfkZcs
- TLSH T17F46F717AD6C4661D07FBC748991D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.9MB
- SHA256 4083ef0b78f612e18eea2eafc295ed5652ce5dc8cea004b2baeb2d074cea0b99
- MD5 2354f70914534db6ce57087da0e7075d
- SHA1 959aa591e2501b9d9a19bffa1d351bb30fe0faf4
- SHA512 672c8714370b8b9bf2ed01e1106f8a9a468f6ec70550d94999fa9b8d04fb671654265d06ecc188c94e729c944f98c11f89b0634f6983ce0bda4f45ec22490d1e
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4:egjOk9WOXV2VMG9rUOfkZcRjo
- TLSH T12A560812AD6C4661D07FBC758991D799E9323C414F21AACB0EC0FE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 5.5MB
- SHA256 82c782f0bc408e0fe35b84c07c3d20bbd304ebc90c0450ca82485daea6389659
- MD5 7bc63af43ee572e04fe47716ce4848a7
- SHA1 660f375ac1678bb8f4454d8b0bc1d1dd51ac7e4b
- SHA512 04dd60015476f73b853e689a1cb1b49f3619019f1af1a1100f173470b9b648ecffef9b3f9acd0a1cb71e3492ebae99e91489250fb403fd7a81c4f885f44eacb6
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP46:egjOk9WOXV2VMG9rUOfkZcq
- TLSH T1D846D716AD6C4661D07FBC74C991D7A9A5323C114B21AACB0DC0FE6DAF726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 5.4MB
- SHA256 e60e9d27dcf122328efae06fb347a3ee8974edccc2d3371e63fddd96161ea186
- MD5 511540613d294d59024501d0b8b7a6e0
- SHA1 3d22f6e15f3cd2e124656f1ab851c7e7b9fe78e4
- SHA512 e27a880ff7e54559fa97e9c4f5718ff4307ab60036cf81fd0928fd7577d0ab6bff2b1de2702cdd8463186023ed1b85814babae235527ef6edd61e5c717122592
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4T:egjOk9WOXV2VMG9rUOfkZcj
- TLSH T15D46F712AD6C4661D07FBC748D91D7A9A5323C514F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 5.6MB
- SHA256 305f21ae4d1105106330f7eca2f706564eea4a7ba509e0f07b196944793ebd9a
- MD5 d516836a67daae11b6b8115af31f2a28
- SHA1 5124f60f3400a1f26ad694e74c407e83935c3649
- SHA512 a6346a51e5fa14d6d355407664ddb15a8e03e164f0622c45be27d136895b9b6f1f9bd6b13b40753b5c897e815d53b8f973f9f43f33b37a06d51c2a87ca4230de
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4y:egjOk9WOXV2VMG9rUOfkZcxuX
- TLSH T18246F812AD6C4661D07FBC758D91D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH