Analysis
- max time kernel
89s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 18:53
Behavioral task
behavioral1
Sample
2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.8MB
- Sample260801-xjs53stfpg
- SHA256 5227b9d031af10ab3bc06902d9155646f6bb5b159b4a4fbe741ea6d52fc4a3c4
- MD5 f0b42bd9f3f9b6b842ba15897ac4bf22
- SHA1 cf82d6dba5909ce6c472268b4bd687490729174c
- SHA512 299229d55399f9a3d729494f5516fe95c02f1feccf9fca297ea0986f628245663db8b99d63d588552317b9cfe66d2a9ffbf2c8ffa2a62459237bafd9e49c04a9
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0Aj:A3k03kCrQR5jocT1Zjo
- TLSH T162D53A16F6A44775D077C0B9C5D2969AEA7238421F308BCB0385DB283F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2552-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2032-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002464e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2552-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2032-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212df-485.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000021279-487.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000000072d-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022add-2061.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000000723-2193.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000800000002464e-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-13.dat aspack_v212_v242 behavioral1/files/0x00020000000212df-485.dat aspack_v212_v242 behavioral1/files/0x0010000000021279-487.dat aspack_v212_v242 behavioral1/files/0x000700000000072d-1530.dat aspack_v212_v242 behavioral1/files/0x0002000000022add-2061.dat aspack_v212_v242 behavioral1/files/0x000b000000000723-2193.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2032 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2032 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f0b42bd9f3f9b6b842ba15897ac4bf22_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2552
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.8MB
- SHA256 5227b9d031af10ab3bc06902d9155646f6bb5b159b4a4fbe741ea6d52fc4a3c4
- MD5 f0b42bd9f3f9b6b842ba15897ac4bf22
- SHA1 cf82d6dba5909ce6c472268b4bd687490729174c
- SHA512 299229d55399f9a3d729494f5516fe95c02f1feccf9fca297ea0986f628245663db8b99d63d588552317b9cfe66d2a9ffbf2c8ffa2a62459237bafd9e49c04a9
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0Aj:A3k03kCrQR5jocT1Zjo
- TLSH T162D53A16F6A44775D077C0B9C5D2969AEA7238421F308BCB0385DB283F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.2MB
- SHA256 914f30952315a35ad3829003a1f83edb4e90e53f635d494b1a2822906674199c
- MD5 c190f7d936ed200daf591a57fabbe10b
- SHA1 5e20add1f7e01325b92d282d389e2b8b36e9e9cf
- SHA512 6057f6c84b7deb6dace3563cf5db3f232006abd5c3d40e2da37026cb899f5e98c3ae08b397be90cc678a1f5ecbbab2c028cbf2d5aba3bc903516e276d834159b
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0AjoTd9CHKyao:A3k03kCrQR5jocT1ZjoKCqo
- TLSH T1DDF53916F6A447B5D077C079C5D2965AEA7238421F308BCB0385DB293F277E19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 67d99808dfcf709b0126de18d1bc9ebef0ba2e88d37a6bdcee5f256342dba62e
- MD5 f46ca87b3d71390d5d4c04f2dd3c133d
- SHA1 384cd743714bbac4d73ec8448089b013059e3753
- SHA512 7bc949899d8aeab2969dbee7ef1c09dede83e1621510f6c0e48678aa3ab1f4826c8264b396f3783f9e84f03423ac84b39382cd4ae53eee771d2383ebf8af9ad8
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0AjKPji0Aj:A3k03kCrQR5jocT1Zjo0jo
- TLSH T1E5F53A16F6644771D077C0B9C5D2969AEA7238411F308ACB0385DB6C3F277E69A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 2.8MB
- SHA256 00d5944b1b7cdd94a5e4fbde0b045a02bd828516b13e06b5034e6ce03206c654
- MD5 a34b43dd298f3a3c6b0164674bbaeede
- SHA1 2da1231023c309182c04b7d4e3340345e765d2a8
- SHA512 5ebc6873bf90584c07f751329590b3f7f552063e6771a4ef91b92cdec903f64304572c18a223f04c971350e177176a758bc547ff0166af8ffb6a39462d33ffe7
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0AjX:A3k03kCrQR5jocT1ZjoD
- TLSH T1BED53A16F6A44775D077C0B9C5D2969AEA7238421F308BCB0385DB283F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$
- Size 2.9MB
- SHA256 cab86a2f002e437c851fd21885913429badfb7c81b75e02f55611c656878927b
- MD5 1faeef672a89b46bc1326aa20cdb792c
- SHA1 d79150840812f20255d9a4d0fe7a69bec87c4c1b
- SHA512 446c5d50569eb1edb34a47698ac2f23b032305f788024b28df65f606dd37ffa615c83f0d4b6d94d6d188a24de40e3385173e2b9877da4a962cc1d7ec460eb173
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0AjM5:A3k03kCrQR5jocT1Zjo4
- TLSH T154D53A16F6A44775D077C079C5D2969AEA7238421F308BCB0385DB283F277E59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.0MB
- SHA256 71d83ff16d0df9129ead973e52e79813f07e7e67c2e9224ca9bc391ae79a0a1b
- MD5 2c5e6ae1d916c40734b64bb26d38d461
- SHA1 e563a53e658f24742390b6519cd8d5b3644bcc48
- SHA512 aee46460e377d8dcf5f4aebc321fa7fb7252e9ba5ada360b1dcb40f04af0babeaafd51347c2bc77fe09237ac6f5173b00e63a420197c38e5effb222742cb2461
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0AjYi2WH3:A3k03kCrQR5jocT1ZjoMuX
- TLSH T1B9E53A26F6A44775D077C079C5D296AAEA3238421F3087CB0345DB2D3F677E19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe$
- Size 2.9MB
- SHA256 0a7ce8cf9d789225b158f1095ff05858247bb17acb10b1ebd00c57ec7985eef0
- MD5 26d6104f9ac9c9471189b8f52c3f65c7
- SHA1 62e2f9317db6a003e2e489aa410ba751d747d023
- SHA512 d2f0f0da4684c0ba9defa997eccde6955f23637788681cb05f16489191387a373cb47ec97c97d05c6f8a3534f47ba9a44e274c35a677b1113872881ddd50ae69
- SSDEEP 49152:A3k03kB56rQRJHPji0AjoTe+qJtb2IQPji0Ajzccow:A3k03kCrQR5jocT1Zjo/c
- TLSH T11FD53A16F6A44775D077C0B9C5D2969AEA7238421F308BCB0385DB683F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH