Analysis
- max time kernel
119s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 17:49
Behavioral task
behavioral1
Sample
2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.1MB
- Sample260608-webjsscz3v
- SHA256 f930cb13ccf1a2cc556136e071ed059504736bf97334bd11fefe7e0992f1bb73
- MD5 e0f6b4f3278938159150267ab9536b99
- SHA1 16a060dea7a7cd1b86c4528a053a11acd8b2368e
- SHA512 532a178e1dbb4ae89f26515c290fb42372a240aff03184ef5693b76367f854b081d8cccefd80ce373a36a302d7d19e10399088069aebd1b340e286aeaf9ddcb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEZRyeYTqMi8CtBd2QHCHmTBW5DGjg:A3k03kHRJTqJtb2I8qJtb2I
- TLSH T10FA53A26F6A44365D073C075C9D29A5AFA323C825B308ADB1349E7282F377D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4580-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4d3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1576-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4580-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1576-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00690000000272e6-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028ddf-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a60a-1534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a0da-2064.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4d3-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x00690000000272e6-746.dat aspack_v212_v242 behavioral2/files/0x0002000000028ddf-1279.dat aspack_v212_v242 behavioral2/files/0x001f00000001a60a-1534.dat aspack_v212_v242 behavioral2/files/0x000200000002a0da-2064.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1576 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4580 2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1576 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-08_e0f6b4f3278938159150267ab9536b99_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4580
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 f930cb13ccf1a2cc556136e071ed059504736bf97334bd11fefe7e0992f1bb73
- MD5 e0f6b4f3278938159150267ab9536b99
- SHA1 16a060dea7a7cd1b86c4528a053a11acd8b2368e
- SHA512 532a178e1dbb4ae89f26515c290fb42372a240aff03184ef5693b76367f854b081d8cccefd80ce373a36a302d7d19e10399088069aebd1b340e286aeaf9ddcb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEZRyeYTqMi8CtBd2QHCHmTBW5DGjg:A3k03kHRJTqJtb2I8qJtb2I
- TLSH T10FA53A26F6A44365D073C075C9D29A5AFA323C825B308ADB1349E7282F377D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.6MB
- SHA256 cf5dbe826f3241c25dd6100f6c3e002d99bf5a62b82d35702a5c85a241c96a76
- MD5 f68d304ab2e44412ea724a381f8ed70c
- SHA1 044890b9925926593883eab8eed0fa12a6bb334e
- SHA512 51d2a7ad5a04e3ffbe2898bd0032770b55c544d225031a5860c9d2f08930b496ef248ee1d56dc711740339356c0bacb2b5b466ecbe7f9a7c39654e046b01b2ad
- SSDEEP 49152:A3k03kHRJTqJtb2I8qJtb2IuTd9CHKyao:A3k03kHRxlVCqo
- TLSH T181C55B16F6A44265E077C175C9E29656EE323C825B30CACF1389A7292F337D1DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 e62f68417ba24f3d576a90390636efced1f05f460eb5d5c663f7d3a716587bb6
- MD5 e2d97166c0db3e529a5f0c503e26439b
- SHA1 530a36f6f5524bd83223ec4c736f6c9105e92ec6
- SHA512 c5f4cb7361dfa52d5b47a5bb085c40fbf0afac1e67fec2b376994e63954ba7da97b9947972991c922728ec72ea28c5970d736b7b02279370b20a43ec9306aabe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEZRyeYTqMi8CtBd2QHCHmTBW5DGjS:A3k03kHRJTqJtb2I8qJtb2IQPji0Aj
- TLSH T1EFD53A16F6A48375D073C079C9D2A69AEE3138825B308ACB1345E7682F377D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.2MB
- SHA256 ffeaa5d135a3850d606c1bd142ccfc5058f5fd39bf05db8355e4e7dc9f63f549
- MD5 f5658ef207cfed1bf672810fcc1ebdff
- SHA1 6b1810ecf19cb46cc6c27c1b11cf447ceb0444ef
- SHA512 0db9233e04e969131f293d8b0e3572fee23eba823e1a33483c0efbc010ae2504a8cb5088b5175a20c9f2243139b97e33fe7ab5a430e9471029a8937815f04d13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEZRyeYTqMi8CtBd2QHCHmTBW5DGjm:A3k03kHRJTqJtb2I8qJtb2Ig
- TLSH T1D9B53A16F6A44361D073C075C9D69A9AFA313C825B308ADB1349F7292F337D5AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.6MB
- SHA256 6cac86c037687592f868e9dfad1cb5666e4d963ca188a0a6fb2e28a1665a09e2
- MD5 522ad3d880be15a4417b838acc4ad8b5
- SHA1 e6da86f998e9869ddd0b32b560bfe2903611202f
- SHA512 e51baab307944fdd27d61812af663c17b8122667ca91addbe2ea86b350309c6aa5771d2bd64db0f9ee3dcca817772d036daf73f4c4169bca0ec6d7370ae937f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEZRyeYTqMi8CtBd2QHCHmTBW5DGjM:A3k03kHRJTqJtb2I8qJtb2I8UOlk09
- TLSH T1B3C55C26F6A486A1D077C079C9D29656FA313C425B30CACB5359E32D2F337D19A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 2.4MB
- SHA256 d1421fcc88396feb6053b9830a311eba960b685ba1750f776e2b07eea2c583d2
- MD5 60348124d915b73601e523452f3ff865
- SHA1 45cd6c9f53c3196e93d876d4828193fd8f1c3666
- SHA512 eec64f61fad0b4036bb62a23709d7eb5422c6aee4eb0dedcc09d4df3decf387d2b1a5a37031152d38bb740520d92efc20754b6885be5ded2a5a1908efd3b1985
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEZRyeYTqMi8CtBd2QHCHmTBW5DGjP:A3k03kHRJTqJtb2I8qJtb2Iai2WH3
- TLSH T154B54A22F6A44275D073C075C9D6A69AEA313C825B308ACB1349F72D2F777D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH