Analysis
- max time kernel
120s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 14:18
Behavioral task
behavioral1
Sample
2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 4.0MB
- Sample260602-rmn3msfv2s
- SHA256 fb3612ecbaf8a5adac9bd52b5efa2f38901f647ee9ffc275a5a0f8869b001ec2
- MD5 c96df877176558c31a283ffe061d558d
- SHA1 f35aac8bbecdf25b539a50e50141b1cae912777d
- SHA512 7cb058bb468c0de50d1377ab29b799b38e06effcaf45fd81e07e5ca76ebf39b6121697211bbacd2d3b621669d79db2079cba05d405114a68e58da522826da3f5
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYq:A3k03kHR+RgFfkZc+fkZcf86
- TLSH T147162A16F6788362D0B3D0B9C5D6AA9AFA3238451B308ACB0345E72C2F377D59939735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/5324-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b5f9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/964-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5324-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/964-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e23-1247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000027a0f-1488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a901-1635.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001400000001041b-1916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a095-2074.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b5f9-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028e23-1247.dat aspack_v212_v242 behavioral2/files/0x000e000000027a0f-1488.dat aspack_v212_v242 behavioral2/files/0x000200000002a901-1635.dat aspack_v212_v242 behavioral2/files/0x001400000001041b-1916.dat aspack_v212_v242 behavioral2/files/0x000200000002a095-2074.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 964 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5324 2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 964 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_c96df877176558c31a283ffe061d558d_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5324
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 fb3612ecbaf8a5adac9bd52b5efa2f38901f647ee9ffc275a5a0f8869b001ec2
- MD5 c96df877176558c31a283ffe061d558d
- SHA1 f35aac8bbecdf25b539a50e50141b1cae912777d
- SHA512 7cb058bb468c0de50d1377ab29b799b38e06effcaf45fd81e07e5ca76ebf39b6121697211bbacd2d3b621669d79db2079cba05d405114a68e58da522826da3f5
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYq:A3k03kHR+RgFfkZc+fkZcf86
- TLSH T147162A16F6788362D0B3D0B9C5D6AA9AFA3238451B308ACB0345E72C2F377D59939735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 4.1MB
- SHA256 95985c7539ed60f9021046b138b8dfd9fa19e330ac84ea01bf10bf89ec689f46
- MD5 e5207932623927f7b9545b45f20ee0ce
- SHA1 3e84ff288b10211f4d97f8b1f1e26ef754881921
- SHA512 ed028eb98840749a855993d9c80ff3f797cdfbcf840d1a6f4bf8d4ec9d9006f84df8596944f8586f411ac59347b5425ad89cdf24028bc2d7517683f7a43c0b7c
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYqTW:A3k03kHR+RgFfkZc+fkZcf86cW
- TLSH T1EB162A16F6788362D0B3D0B9C5D6AA5AFA3238451B308ACB0345E72C2F377D5993A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe$
- Size 4.2MB
- SHA256 6674e716bd84e11d817dc3703d872f492914cdb64530eb2fd96a4e68695d2e0e
- MD5 fd973bd518e9fa51a5ffc47e9ae06b26
- SHA1 b0d839c0faeb73e2254a0e66ce7b81d954a44571
- SHA512 156f2c0ab7b839dbb3952ca068ca9e6e353ba8e07a7c136aac5cf1a21e664c5ffed861b55431de3a92f819ba71d5277d2b5bd0dc3ee543b93b02bc8376acc307
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYqZI:A3k03kHR+RgFfkZc+fkZcf86KI
- TLSH T141162A16F6788362D0B3D0B9C5D6AA9AFA3238451B308ACB0345E72C2F377D59939735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 4.2MB
- SHA256 4c8989ce66b2b07a522a2df4cd6d0c8b771cc525bddf7b1e7bf703d3f4d596a1
- MD5 f4fb8c812dd0ab2dfd257906fbc5b105
- SHA1 01e9687f2d9974bb5656aed79f28822802b6b9b4
- SHA512 85470e2ba00a0d4b2f2262ecde4248b98b54ae46063b11fce16ce611c894b400e41b15721e7b4bd1f14975bdf7181bf70eb6afe448aa9785ae939ef52942cb82
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYqdw:A3k03kHR+RgFfkZc+fkZcf86L
- TLSH T1F6162A16F6788362D0B3D0B9C5D6AA9AFA3238451B308ACB0345E72C2F377D59939735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.6MB
- SHA256 65152624cec053281022e07690f519686c9db11f0a05d103845d5548a10e0999
- MD5 6da894d776648aaceb5d979aa852e39e
- SHA1 e63d0d4754daf6d238c62bc78bab175df21062c2
- SHA512 a7badbaa3d4fef21a69dd06c2e84af7295acc6b93de79cda522c38c040bb927b66384b0225ce211f336e495996b96ed8dcc85c955e06d6070370d71ae12593f3
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYqjPji0Aj:A3k03kHR+RgFfkZc+fkZcf86Gjo
- TLSH T173262A16F6788372D0B3C0B9C5D6AA9AFA3234451B308ACB0245D76C2F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 4.1MB
- SHA256 f32eccb72ff7ce2877ea5a3b481013db644955c1b78bc132fd36edee6837e009
- MD5 c33ce4b5ac2be872f1895a2d1379f4c1
- SHA1 613a027074357fa20b503e63386ba903ed536956
- SHA512 f70eb73e1120c9eaba289a791da829e271b7ae2bc0ee7b1435cbb3c437d5896bbe1b3acdd950a694284adbfda53b618a15355bf8f8d3f7a145e7949cc625a653
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYqt:A3k03kHR+RgFfkZc+fkZcf86Y
- TLSH T1CB162B16F6B88372D0B3D0B9C9D6AA5AFA3238451B308ACB0345E72C2E377D59935735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
- Size 4.3MB
- SHA256 c99cad1efabd00b91c7c0fd2edb862d857f1be52e07cd465e6a3281ea5a4c2af
- MD5 8b4988a3494ca2461bacfdc5093d00d5
- SHA1 abdbdb76350285ea536b40122afaaf06de87d5c7
- SHA512 18c7247f87e35ea419d3c9dad33488debe3b782a3b070c7602b537f99dfcb9b9aaf0d69009d412a359bae405b3f72fa39e51d4681adf8843af6987fa70bdb8f1
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkVpYq/i2WH3:A3k03kHR+RgFfkZc+fkZcf86CuX
- TLSH T15C262B16F6B88372D0B3C079C5D6AA5AFA3238451B308ACB0345E72D2E377D59936735
- MD5 SHA1 SHA512 SSDEEP TLSH