Analysis
- max time kernel
107s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:13
Behavioral task
behavioral1
Sample
2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.1MB
- Sample260604-pdqtrse14m
- SHA256 b10331c95e41e0b36a9b67797a29ccaebb3958002b924f2826fdae47a6e869fc
- MD5 d6d55fab1957fd1eec5743b99791d26c
- SHA1 7cdb3a9e81afe99b2822971ad7541bc7e69c6c2d
- SHA512 311c9d674741cdeeb3796a112bcbb3af7f7c66330a776ee9f1547f1064f22999d8581d30e72a7067f322158756fbc36cd8004630292dbc73f69c9009dc72caf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+CSSYTqMi8CtBd2QHCHmTBW5DB0C:A3k03kHRJYqJtb2I4Pji0Aj
- TLSH T158A55B16F6A44375D073C0B9C9D2969AEE313C821B308ADB1349E7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1548-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4c3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1416-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a34c-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1548-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1416-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ac5-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b4cd-1578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000000673-2081.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4c3-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a34c-12.dat aspack_v212_v242 behavioral2/files/0x0008000000027ac5-1370.dat aspack_v212_v242 behavioral2/files/0x001900000002b4cd-1578.dat aspack_v212_v242 behavioral2/files/0x0014000000000673-2081.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1416 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1548 2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1416 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_d6d55fab1957fd1eec5743b99791d26c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1548
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1416
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 b10331c95e41e0b36a9b67797a29ccaebb3958002b924f2826fdae47a6e869fc
- MD5 d6d55fab1957fd1eec5743b99791d26c
- SHA1 7cdb3a9e81afe99b2822971ad7541bc7e69c6c2d
- SHA512 311c9d674741cdeeb3796a112bcbb3af7f7c66330a776ee9f1547f1064f22999d8581d30e72a7067f322158756fbc36cd8004630292dbc73f69c9009dc72caf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+CSSYTqMi8CtBd2QHCHmTBW5DB0C:A3k03kHRJYqJtb2I4Pji0Aj
- TLSH T158A55B16F6A44375D073C0B9C9D2969AEE313C821B308ADB1349E7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.8MB
- SHA256 dcde48fec98f7a81e6f67abefbfc813203fe8c293752421565765d1ed9c295fc
- MD5 087fc4afc5df5eef6b0ed0136b245e51
- SHA1 01a774a27de25ad1ca45bdeb5a4ea065b68c4d3f
- SHA512 8dd3cd8319d4d7b91e8aebf4d3ab457c879d2ebf371fcb31461680db71c2ae1648f2fbf247757d900d5706117993850eccd4ba1b5295379823fe14ff584a51bf
- SSDEEP 49152:A3k03kHRJYqJtb2I4Pji0AjPVk0QGTvntQb:A3k03kHR6fjoCHaib
- TLSH T1E0D56C26F6A843A5D077C179C9D39656FA313C4217308ACB0395E7292F77BE19A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 2.2MB
- SHA256 406c06baccaaac5603558b3282ae9d0972faa63ebc6cedddd87132e7935604f0
- MD5 37e98e78fddad21a29ceb843b56885c2
- SHA1 bd2b8bde3416d9ab56e102a25f6286f657571d1e
- SHA512 28712cb22e5d14fd795451c5ef3d1735bdbb3ca7d5866f087a2e5e5b72bffe9af4253737d47f4e1f4c12d625054e3eb9234efd4f67048182bacf701e0a83bb5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+CSSYTqMi8CtBd2QHCHmTBW5DB03:A3k03kHRJYqJtb2I4Pji0Ajow
- TLSH T144B55B16F6A44375D073C079C9D29A9AEE313C821B308ADB1349E7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 239c3136b7aa5440d2e7265fd07ef081175ec1405244ffd82dd720b4a8270ead
- MD5 6a123a033c417dbec6c158bbc8209f82
- SHA1 0b7c71ae277b16245957dcfc31709560c1a98bd5
- SHA512 74b4278c8f64b2b79021803d311f0ea17bf08a11458ee76c28f35bda1c229ce448b2c170f2436f0754d8fc90f485a8aa881976deb96889e47e6364a56de6d1e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+CSSYTqMi8CtBd2QHCHmTBW5DB04:A3k03kHRJYqJtb2I4Pji0AjKPji0Aj
- TLSH T1B3D54B16F6B44375D073C0B9C9D2A69AEE7138821B308ACB1345E7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 2.3MB
- SHA256 e92d24a39b06f8692831ac43d3e792a4a60e527fa0675cc74653cd704c9f83f6
- MD5 c7c6db73d90b6d085d21bf04f26575b6
- SHA1 d86bfbd24a46c41f1b9d0c365f83db2250fc13a0
- SHA512 a0018a55248cff058adacaeeb0c3e643dc01344d2f60d68a69bbdef834082d4d4f7e5350a1b838cd0461c89721ac8014d76d9da3e94be744d4dc953a178d3aab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+CSSYTqMi8CtBd2QHCHmTBW5DB0J:A3k03kHRJYqJtb2I4Pji0AjYi2WH3
- TLSH T1C6B55B22F6A44375D073C075C9D6A69AEA313C825B308ACB1349E72D2F777D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH