Analysis
- max time kernel
123s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 16:39
Behavioral task
behavioral1
Sample
2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 4.2MB
- Sample260602-t53pvsax2v
- SHA256 5f193f25c40e6494b92c47923b2a7856d7ad19d971e246a371fa9f32d3f084e3
- MD5 6808d25a859778639521fba1ebcb611b
- SHA1 92fce9b7bee1da1f8c86254000dbd043257547b8
- SHA512 f404776dbcea5144ac08f15f14573a77b1e59ff00137d3f5783bcb14a172473cdc37b201d06a015b7c4a69c4f64ee69564fedf93c8ef1908a565f341f9bcc122
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrKV:A3k03kHRbr+cFfkZckzm
- TLSH T13D163B16F6788762D077C079C5D2A6AAFA7238425F308BCB0245D72D2F277D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5552-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b465-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2172-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5552-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2172-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a7b-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000027a22-1486.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b4ac-1952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025acf-2088.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b465-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-12.dat aspack_v212_v242 behavioral2/files/0x0008000000027a7b-1375.dat aspack_v212_v242 behavioral2/files/0x0007000000027a22-1486.dat aspack_v212_v242 behavioral2/files/0x001900000002b4ac-1952.dat aspack_v212_v242 behavioral2/files/0x0003000000025acf-2088.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2172 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe$ 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5552 2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 2172 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_6808d25a859778639521fba1ebcb611b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5552
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.2MB
- SHA256 5f193f25c40e6494b92c47923b2a7856d7ad19d971e246a371fa9f32d3f084e3
- MD5 6808d25a859778639521fba1ebcb611b
- SHA1 92fce9b7bee1da1f8c86254000dbd043257547b8
- SHA512 f404776dbcea5144ac08f15f14573a77b1e59ff00137d3f5783bcb14a172473cdc37b201d06a015b7c4a69c4f64ee69564fedf93c8ef1908a565f341f9bcc122
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrKV:A3k03kHRbr+cFfkZckzm
- TLSH T13D163B16F6788762D077C079C5D2A6AAFA7238425F308BCB0245D72D2F277D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 4.9MB
- SHA256 47cb616c905a710ac9920eb694c7754d51c2a37ccac58926e3c6a433f1e15309
- MD5 79fee12e4c708d9dc373d61e9f87ff95
- SHA1 84a4d52d9c102e257135004098b885e567bca508
- SHA512 cac34be6f9af7c787c2934b6e7dbcde5583d0c56e6246aabbbd269f3722cf6b2da36432d6a99261c9102539b14355dfc483641cbdc7613e4cb75450920b019ee
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrKcVk0QGTU:A3k03kHRbr+cFfkZckzaHaib
- TLSH T199364B16F6B887A1D077C179C5D39A6AFA7238421B308BCB0245D72D2F277D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 4.3MB
- SHA256 9ddd549141c9381b8bb655c805502e40c221ea51a12e0ed98f367be93cf6bc84
- MD5 e8a555dcc794017268f50b8a4f18c84e
- SHA1 71a1c03a3a390c66e0962079bacf1183d6a8d38b
- SHA512 78eb8fe408c89702be5fc47393b7ec6f380e0197b78ece75ebe8ea0a0c16acb7e0bb388cc42043d4a220592f9ddd73a0b3017be6be41180086f1b4f69bf6d3bd
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrKJW:A3k03kHRbr+cFfkZckzKW
- TLSH T177263B16F6788762D077C079C5D2A6AAFA7238425F308BCB0245D72D2F277D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe
- Size 4.3MB
- SHA256 d2e6ca283a1daedede2872162cd2b28dbd8a6d8bc3db60c6220145b89ac275e9
- MD5 288ef19bc2475dd3334e1ccfb347fdcd
- SHA1 2c09311fda0867d750b8167b12d0065788d1955f
- SHA512 cc9af94d11fdc7bde4c1536c6d5dd5992c55c009d4fd403ea5f09aab8b55078b57e0c9241d261150333212248fc673b3fd0c457797d881b27c3b12edb8eeb59c
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrK/I:A3k03kHRbr+cFfkZckzoI
- TLSH T14E263B16F6788762D077C079C5D2A6AAFA7238425F308BCB0245D72D2F277D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.7MB
- SHA256 bc6d4a02239bbb75df82a7538cdb3f020ede7c79c54094e0ceea418ecc348557
- MD5 80dc9896214f6af8a17e47ed8fa632c1
- SHA1 01b4dbe7b2c87c4743b1d19058755f36fdc13d20
- SHA512 0cbecd74c75c7f8a03fb73aa39701c4907e9546241f481190e804db487054d1aed43581988847ea0814e1e1dd6481cedb67c0c3821fa29ed99a9d909f09e4e31
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrKRPji0Aj:A3k03kHRbr+cFfkZckzcjo
- TLSH T14C363B16F6788772D077C079C5D2A6AAFA7238425F308ACB0245D72C2F277D5993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 4.4MB
- SHA256 29cf2a438324a905bf9ca1ebfbdfb485899c36277051bbf377a2ac3027e281af
- MD5 aa28de3b3fe4cddd1ba7014fe57c724e
- SHA1 44716ca768c1e28c65e029d91480d4e45ee65759
- SHA512 befe824b87e086f5d4104c18612774e4923940dfd3723367be7e426a133335178f9a0dc8c45cd3f5e07f97ebcecf30396bfeceb725891daa183d2fb8c27ce82a
- SSDEEP 49152:A3k03kHRJw56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbkqJtb2IQ8tDZqrKhi2WH3:A3k03kHRbr+cFfkZckzEuX
- TLSH T193263B26F6788772D077C079C5D2A6AAFA7238425F3086CB0345D72D2F276D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH