%PROGRAMDATA%\\wt.exe

Posts referencing this indicator

• Supply Chain Attack on Axios Pulls Malicious Dependency from npm

  Renamed copy of powershell.exe used on Windows to evade EDR detection.

  2026-05-13