Analysis
- max time kernel
99s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 03:39
Behavioral task
behavioral1
Sample
2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.9MB
- Sample260602-d7lalaev3j
- SHA256 ecf87e32cda1c9e64914613b9e927e0105f266c5c88109b25e86a3edf6a3440f
- MD5 ecc0be7fe2f5dde32f96f91d1ee986cd
- SHA1 c70c9cf12f3f6af2a0804c4dd0d48060cbb9a1e7
- SHA512 6fb07e010922710c6c79be452edd2c2fc0794cbb93b213a18c1990ad12215a628af96ed98f6d0dfc1d78be3380da658d31a4a468ee3392c4f35e4778a815890a
- SSDEEP 49152:A3k03kHRJySqJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHRYSFfkZcRjo
- TLSH T171D52A16F6788362D073C0B9C5D6AA9AFE3234465B308ACB0349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4604-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b5ec-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3308-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a34c-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4604-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3308-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d000000028eac-1246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000026128-2083.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b5ec-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a34c-12.dat aspack_v212_v242 behavioral2/files/0x000d000000028eac-1246.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1965.dat aspack_v212_v242 behavioral2/files/0x0004000000026128-2083.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3308 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4604 2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3308 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_ecc0be7fe2f5dde32f96f91d1ee986cd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4604
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 ecf87e32cda1c9e64914613b9e927e0105f266c5c88109b25e86a3edf6a3440f
- MD5 ecc0be7fe2f5dde32f96f91d1ee986cd
- SHA1 c70c9cf12f3f6af2a0804c4dd0d48060cbb9a1e7
- SHA512 6fb07e010922710c6c79be452edd2c2fc0794cbb93b213a18c1990ad12215a628af96ed98f6d0dfc1d78be3380da658d31a4a468ee3392c4f35e4778a815890a
- SSDEEP 49152:A3k03kHRJySqJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHRYSFfkZcRjo
- TLSH T171D52A16F6788362D073C0B9C5D6AA9AFE3234465B308ACB0349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 3a207223606cf5874651e1b7ad90228d831e74e0003d5e9f26240150866cc383
- MD5 2fc56d74ed3ff2c0650c72d8ba5a5fcf
- SHA1 c92e9a1c5bfe95f6eeb807c58f9eee7c7d24d2fb
- SHA512 5ca5a0b06d211f973b598b04f7fd4a318284df522225dc5979a82a2b7341775646f63418c5f23e162bf3cfd7427d0f4f739a4c7f9f278ee81abd9a9378faab5e
- SSDEEP 49152:A3k03kHRJySqJtb2IEeW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHRYSFfkZcRjo0jo
- TLSH T1ADF52916F6788332D073C0B9C5D2AA9AFA7234465B308ACB0345D76C2F277D6963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.9MB
- SHA256 22ab86f6dc1a01a8a015ad7fd126747e10d86fb96006e4b3762dfbb72904fd41
- MD5 f45b271f696417c791bd06313b233a01
- SHA1 f7b7c28f32f93f15163bcdb96cbf8d67161f4371
- SHA512 150b0f1ac572676712f7a83b05a6d7b077023b619f86adc8deb3fea0872d233b7d8fe098d962491ae9f533f94169b28fdf7d6fd90a7027600b9b12a2e5f68ed0
- SSDEEP 49152:A3k03kHRJySqJtb2IEeW4SkZP4sz9MbBPji0Ajq:A3k03kHRYSFfkZcRjo2
- TLSH T137E52A16F6B88322D073C0B9C5D6AA9AFA3138465B308ACB1345E72C2F377D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.3MB
- SHA256 3cf7324de4c3d931a4c4fcb9cd4b8d7431bcc3a58bf5c69581fb488576a1eda9
- MD5 48a97c155651827295eb8cb8fe39fcaf
- SHA1 24fddcca471cea413e7bdf6a4815b2e547cc6a9a
- SHA512 3cd042c2944f806456179a6d5cb4206ffcc72768cb3d1e7081293f513af0d08073bef3f7d042a104197dcc6b1e13af2d7bc51fac87ec7e4b54ab01b011f39a7a
- SSDEEP 49152:A3k03kHRJySqJtb2IEeW4SkZP4sz9MbBPji0AjRXpiMh:A3k03kHRYSFfkZcRjolpig
- TLSH T15AF53B16F6B88332E0B3C175C5E6A65AFE7238425B3086CB1345972C2E677D1DA36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe
- Size 3.1MB
- SHA256 280bd29466f89f9b20f5ac9fc29e8a9b27ffdcef09c5ddfe8acc9216eab8fc83
- MD5 b5863eec07bd854a37ba5b925c3d8e99
- SHA1 c163e4cb993424d93b97faabc0ad5d1037eb55cd
- SHA512 8b3cba5e31ab86493fc045f613a979012c7f82ee3d3e6f69de18e7420b527012972534d044123365aec604a14861321b550ae848102efbba49b8081d0e7d92bc
- SSDEEP 49152:A3k03kHRJySqJtb2IEeW4SkZP4sz9MbBPji0AjYi2WH3:A3k03kHRYSFfkZcRjoMuX
- TLSH T175E53B26F6B88332D073C0B9C5D6A69AFA3134465B308ACB1345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH