Analysis
- max time kernel
108s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 16:00
Behavioral task
behavioral1
Sample
2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.0MB
- Sample260602-tf47dsaz8q
- SHA256 7c0134700e194a05c11be48f85b7ff0546e1c759ccf43486d719b6331c97f9e6
- MD5 a1b6ee9ebead97821a282217ae5ccdd8
- SHA1 96e48cfee137cbf6e9db7d8987771fc4c008357f
- SHA512 f75f7531537bf232dbe0d65c89e7320d5cdfa5754b65d3e8ef78746647a7be69c9148c587504b2fbd7a386681dbd6b4828da56df43dda7ca32776d77fe82453d
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0Aj:A3k03kHR4fkZcBr+Zjo
- TLSH T138E52A16F6788762D077C0B9C5D2A69AFA3238425F308ACB0345D7283F277D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1892-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4d7-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3336-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1892-64-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3336-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e21-1252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a5f9-1525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000010420-1919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000026124-2084.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4d7-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028e21-1252.dat aspack_v212_v242 behavioral2/files/0x001f00000001a5f9-1525.dat aspack_v212_v242 behavioral2/files/0x000e000000010420-1919.dat aspack_v212_v242 behavioral2/files/0x0004000000026124-2084.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3336 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1892 2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3336 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a1b6ee9ebead97821a282217ae5ccdd8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1892
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 7c0134700e194a05c11be48f85b7ff0546e1c759ccf43486d719b6331c97f9e6
- MD5 a1b6ee9ebead97821a282217ae5ccdd8
- SHA1 96e48cfee137cbf6e9db7d8987771fc4c008357f
- SHA512 f75f7531537bf232dbe0d65c89e7320d5cdfa5754b65d3e8ef78746647a7be69c9148c587504b2fbd7a386681dbd6b4828da56df43dda7ca32776d77fe82453d
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0Aj:A3k03kHR4fkZcBr+Zjo
- TLSH T138E52A16F6788762D077C0B9C5D2A69AFA3238425F308ACB0345D7283F277D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.5MB
- SHA256 97dd51c98f0c0091931af68cc89958d5f1f1f2ca8c8509bdf8981341ca1115aa
- MD5 4c0097245f718673120719fe7f6a6b50
- SHA1 6cf9da07deda0ec956732335f054e0cae7f06f7b
- SHA512 31fe218e19f1a950f795670cad3c770205b32b273e875e1bbea5b61a1b381930208cb1ce739b157632d95823b8e77bf42f4a840f21a579a42b4c34e9042eb46e
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0AjoTd9CHKyao:A3k03kHR4fkZcBr+ZjoKCqo
- TLSH T18AF53A16F6B84762D077C079C5D2AA5AFA3238465F308ACB0345972C3F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$
- Size 3.1MB
- SHA256 e2d0a936a4ccd695e3d31ec03ebdca4edef1fe77abc174a7e9d71d674fbeb062
- MD5 49f49b59e36f0eb4bdcf76d46ee9ce84
- SHA1 dfca315dd7edad0d051cebb19fa41ad5e73f48bc
- SHA512 face1a4693beffc149f8cf5569b9faee3f0bb188dc4348881a3285ccb6a039463821439c1a562e8b9d529156802941f43af8bc22425f01ad6a64f6b3e054384b
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0AjMI:A3k03kHR4fkZcBr+ZjogI
- TLSH T174E52A16F6788762D077C0B9C5D2A69AFA3238415F308ACB0345D7283F277D59A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 d4cad5b365da5ec49ef6617f8f0b19cd8252f2809c4bc132b4ef06d74fdcb63a
- MD5 df2f63116b4b94a0058b91ca61e5c8be
- SHA1 d65d516cbcdcdf631cb32d8b40e8df37c6b86214
- SHA512 94abb13e3c7551c7f07c291300f594bd1861ff57c7022e280d3898358b8b8ceff72a16c5e9d063855a8b88a312bc9c024dc629883f4d03490b3b338b9df9f03f
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0AjKPji0Aj:A3k03kHR4fkZcBr+Zjo0jo
- TLSH T16C061916F6788762D077C0B9C5D2A69AFA3238465F308ACB0345D72C3E277D5963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.1MB
- SHA256 23feaf1f50cc87440086c1fc258ee33bffa045f5f5c8030351ac506d8cee9825
- MD5 fa3e180287d5c62524912e3a5fb7f52d
- SHA1 74f15faf37357a26e8826ff437360f92f9dc2d1a
- SHA512 22799f979097ccc4eeb690da616cd0bb38d6c4231b9e5d7cb7861aea2ed8f231fa33fd03d4709398b5543733fd07cf76393c5d1cbaaf98abe278b775ffb9f552
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0Ajq:A3k03kHR4fkZcBr+Zjo2
- TLSH T122E51A16F6788762D077C079C5D2AA9AFA323C415F308ACB0345EB282E377D59636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 3.2MB
- SHA256 d5fbf55fdf85e30b938d1c67bd66b6d66c35d3b1de06bd18bdfe1f1e6f75c5a0
- MD5 aaf8b3808c406d1636350737c1ceefbd
- SHA1 b4155120bd4f5e6cb7b64787cc4d05476f097b2f
- SHA512 c03d9dd341d02e2a92d8abaaba8bd851e8180ca7cb066054b94b5063c11424b3402a691f46394e0e85f002e2700601a5bec67e1d0b2241321f7e0d728c899c4b
- SSDEEP 49152:A3k03kHRJueW4SkZP4sz9MbE56r+qJtb2IQPji0AjYi2WH3:A3k03kHR4fkZcBr+ZjoMuX
- TLSH T16DF52A16F6B88772D077C079C5D6A69AFA3238425F308ACB0345D72C2E277D59A36732
- MD5 SHA1 SHA512 SSDEEP TLSH