Analysis
- max time kernel
142s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 04:38
Behavioral task
behavioral1
Sample
2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260629-e9sm5aev3m
- SHA256 a77f1e8275255158b4fc19ce3ae9d08227f3dc5575ae2e2d6e49f64e43dfd3b8
- MD5 9cea1f08e320da1ac1289dfbeea0ca5b
- SHA1 0582595c88add1607275041efd18b73de1b00b1c
- SHA512 0fda5d6e1db347bae075f6098bf23f6d3cdc5a8c016ff79f13b3c19a4d6ed4a7b53b5825039d08743a80b515a7b76c9c45e2f3f259bba826a3b6e1b3e03f542d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrM:A3k03kHRJf56r0Pji0Aj
- TLSH T1A2856B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246ab-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4636-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1052-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246b4-708.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214e4-710.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000006d3-1380.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001700000001db2b-1710.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b0000000202c9-2065.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000246ab-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-11.dat aspack_v212_v242 behavioral1/files/0x00070000000246b4-708.dat aspack_v212_v242 behavioral1/files/0x00020000000214e4-710.dat aspack_v212_v242 behavioral1/files/0x00050000000006d3-1380.dat aspack_v212_v242 behavioral1/files/0x001700000001db2b-1710.dat aspack_v212_v242 behavioral1/files/0x000b0000000202c9-2065.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1052 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4636 2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9cea1f08e320da1ac1289dfbeea0ca5b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 a77f1e8275255158b4fc19ce3ae9d08227f3dc5575ae2e2d6e49f64e43dfd3b8
- MD5 9cea1f08e320da1ac1289dfbeea0ca5b
- SHA1 0582595c88add1607275041efd18b73de1b00b1c
- SHA512 0fda5d6e1db347bae075f6098bf23f6d3cdc5a8c016ff79f13b3c19a4d6ed4a7b53b5825039d08743a80b515a7b76c9c45e2f3f259bba826a3b6e1b3e03f542d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrM:A3k03kHRJf56r0Pji0Aj
- TLSH T1A2856B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.0MB
- SHA256 d77f0032bc4e3ab4020f10be6a59edffb4700c25182caa0d780ec969a5c43547
- MD5 4034e148900b7bc7de8a42c59701b67d
- SHA1 2d902bf44b84786fe243eca3aba1d57f9c29aa8b
- SHA512 9f0cfc69991fdc23dbdd99a33d2da65389e3648d590241e00ee0da96f582208f2a590424ea400dfd18ad97dbb590ce9360ccbacd84ed11e61943d77c0d02dc58
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrMRP:A3k03kHRJf56r0Pji0AjyUN+Eir
- TLSH T190954A16FAA84AA5D02BC078C9D28656EA737C510F3087CB13549B2D3F377D59E3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$
- Size 1.8MB
- SHA256 61d3c09527d3550cedd9d8e157083e42066eaaf5695a2aa6fa735c1b7763e20d
- MD5 e63dfe027e31e01ca601023906b4b09c
- SHA1 7f09f60c8671cfa9d35c4d772dcc5731578c0747
- SHA512 92178988d35a657b860cd207b3a8aa2f3b6f6a02ae4126d45a93a379dd4261bd59a6082d4a3b99efc045152c2b50e5d1d40eb749e5872355e836f62af04e0090
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrMef:A3k03kHRJf56r0Pji0AjMI
- TLSH T148855B16F6A40BA5D02BC178C5D2965AEA733C421F3087CB1354DE293F63BD19E3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 6c9608d9d17592534cc7d9e226419bc20b547e72dfa4bf7ef1ca765832c7df49
- MD5 f55c763c57f58d29cb68561124f99153
- SHA1 0772d175eae79e9b3d1393ef5384f9d74f62cd84
- SHA512 43589ca9a9cfe64b9f17085b61c1652fcfb0fa16a9413ce5960a77425413a9a3895f123961b6a0cbdf7c9ea84c38da8d0b1848777fd46730536fc2b854e10487
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrMDD:A3k03kHRJf56r0Pji0AjKPji0Aj
- TLSH T16BB55B16F6A44B75D02BC079C5D2969AEA723C421F3087CB1355DB283F67BD19A3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 1.7MB
- SHA256 019e1cfa985d02ba76e17bef6b7ffefd73bb449b1346c88b43d1efac70e2f0b9
- MD5 d02924b3eb352b0fdd72c93bf9652286
- SHA1 f2b0fcec52f4db1f7c633d45a8fdb940741cced8
- SHA512 5bd5fb5a717bfa2a8fb820dd4fd4ae1d9e1040e320d4134fd56d6623fc969139ba10559b47f43093b90e8cf20e9ebc465f3ef216cad932675cb08faaec5b3d8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrMtv:A3k03kHRJf56r0Pji0AjG
- TLSH T176856B16F6A44BA5D02FC178C5D2965AEA733C425F3087CB1354DE283F63BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$
- Size 1.8MB
- SHA256 fc6732caac1b83bfc3c6f99a9bdf9d1e2f9e4331201c110982601985dd2488ec
- MD5 ec124564d650d1c060adc89758092f71
- SHA1 db1e36ce5880349ae2c832de7fb6863c7caeb7e2
- SHA512 763c76b82db3c5b346f0abfd27fdff5107237084343577b6b231fa6309cc1cb5de3d41e456272d50db79669e3549b48b1fa9a1747dc587dd6031b317ecce7cd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrMO0:A3k03kHRJf56r0Pji0AjBs
- TLSH T161856B16F6A40BA5D02BC178C5D29656EA733C421F308BCF1354DA293F73BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.9MB
- SHA256 868004770ebcb53430f71f4eef890d005a41372f47669ef0da7fe139fe66af62
- MD5 6dfb42a244b8e4a93ced88afcbe91827
- SHA1 d574e9174ed1b80fb670791a27254c5311ef6635
- SHA512 08e5ead496b232ef5bd199a5257dac355a601bc146adf9dcb913f6d30a9020e940b1afcc20b0107b11190ed94e32f1cec4db319adab58d806c3cbec3125e0cb5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccaE2xazD5TvinrmbP0Le5ji0hmxNrMfA:A3k03kHRJf56r0Pji0AjYi2WH3
- TLSH T1F6957C22F6A40B75D02BC174C9D6966AEA733C425F3087CB1354DA293F637D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH