Analysis
- max time kernel
123s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 16:11
Behavioral task
behavioral1
Sample
2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260603-tm3bdacw2j
- SHA256 f20d6dce350611064d07df69e1700dbd88965b55476fe9e590be1670b443415e
- MD5 bb5a1fb24219517c6092f3a75e8a379c
- SHA1 78c727e709bc22615caf394cce94ed935ec39ab0
- SHA512 8d9bf454043d22c6dd53d1055212214afa42d754cc8d7a11bafb84af4b08b3576031c4af06126394b640eec0925f10e14a912b04245ccf06c0016ed3e519db4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsqi/WWBaalAFGMD5TvinrmgF:A3k03kHRJS56r9
- TLSH T108555A02E6950FA5D64F8130DD964622E6377D920F209BEF1368BF253F327C0BA39656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2412-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b5ca-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5020-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2412-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5020-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028da1-1276.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a7b-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001a5f9-1536.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000025df9-2089.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b5ca-7.dat aspack_v212_v242 behavioral2/files/0x0002000000028da1-1276.dat aspack_v212_v242 behavioral2/files/0x0008000000027a7b-1381.dat aspack_v212_v242 behavioral2/files/0x002000000001a5f9-1536.dat aspack_v212_v242 behavioral2/files/0x0006000000025df9-2089.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5020 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2412 2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5020 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_bb5a1fb24219517c6092f3a75e8a379c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2412
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1.3MB
- SHA256 f20d6dce350611064d07df69e1700dbd88965b55476fe9e590be1670b443415e
- MD5 bb5a1fb24219517c6092f3a75e8a379c
- SHA1 78c727e709bc22615caf394cce94ed935ec39ab0
- SHA512 8d9bf454043d22c6dd53d1055212214afa42d754cc8d7a11bafb84af4b08b3576031c4af06126394b640eec0925f10e14a912b04245ccf06c0016ed3e519db4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsqi/WWBaalAFGMD5TvinrmgF:A3k03kHRJS56r9
- TLSH T108555A02E6950FA5D64F8130DD964622E6377D920F209BEF1368BF253F327C0BA39656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.0MB
- SHA256 a0055c79fe8615451830370f56b296367d32ed248b36ef99715642e828e6f1c1
- MD5 41809060dddea1daa36c4e96daf90387
- SHA1 eaca02663e4d6464c65c4f66cc0c03cd88545c5b
- SHA512 cf3f368d1a0745cef88934aa9440ccfe1d56cbf8cd819d586886186d26c141e59914f6fcce468d78c66ed4a5616755e9f7fe9bc36f6876e52de42fba303f58d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsqi/WWBaalAFGMD5TvinrmgMVkGDvQGs94U:A3k03kHRJS56r0Vk0QGTvntQb
- TLSH T1B3A55B1292D80BD5D5AFC134CA568512FA727C460F219BEF0364BB2A3F736D0AA3D716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.8MB
- SHA256 734f6e4ffe84e6128068b05880b6104d031062cd860aed2f91bb2c1c77f591a3
- MD5 fb8d8de966715e2b728e9e1b4389178d
- SHA1 9851ada5cb88daebc32f79de15a11d749eea6d37
- SHA512 296ec378b61bef05e2dd142c6f2ccc5f599a26ef16b318f441a2ae8c52150ec9a92eea9fee5d1c4f10871dade88c91bfc49e7dde971759d90286bf4fe9e2c298
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsqi/WWBaalAFGMD5Tvinrmg13Td9CHKy7Go:A3k03kHRJS56rtTd9CHKyao
- TLSH T10C857D02E6D40AE5E66F8130DD954612EA777D950F208BEF1354BF253F327C0AA39B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.4MB
- SHA256 c64d9a8ec9721f4d9376a115c681ba9e3aa5b1969481c00331a33b4520abf104
- MD5 b066ba705ff2f26a24ae0bfebbcb7bb3
- SHA1 2e0828c3349ace0876a0a470f832a78ddbe9a7ae
- SHA512 429aa9754b0e7cce89929ad4d737856d4fac43aa65743611eaa88b08b7ffd7a4e55b6326101d6f7e23815a509a6fc98ceed4f44a5de215d2f008f46349536392
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsqi/WWBaalAFGMD5TvinrmgRF:A3k03kHRJS56r7
- TLSH T15F654A02E6D50B95D68F8030DD9A4662E637BE910F104BFF1368BF257E327C0BA39656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 1.6MB
- SHA256 f015e78af22620ae141b0a296305d4de35e1f336668831800995b0d3f7171321
- MD5 ab3ba6246b5c20638a55a5090b905008
- SHA1 59d9c70aa8e4950afac67c237502024b17565b99
- SHA512 7edc2fb3603d5dd99b9be9266107454a4c066b6d2729c5dc0e83bd640ea76cd43c3f82d937237c03c03cfeb5a4e3681d8250520ba0df32351f1334660146e2fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsqi/WWBaalAFGMD5TvinrmgxV+PAk2hMH3:A3k03kHRJS56rZi2WH3
- TLSH T121757C12E6D40EA5D65F81309D998626E6377D820F2087EF1354BF2A3F327D0AA39357
- MD5 SHA1 SHA512 SSDEEP TLSH