Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
- Size 106KB
- Sample260415-symvdsb15n
- SHA256 44c51eb0cce745ebad74f3f1c1f6fe45d83a915206d92d5d1ad5e15052f752dd
- MD5 3a617f4c058ec79ce6a189c329a22da5
- SHA1 154302a67db9ef8b3ce905de4801022e33e73f11
- SHA512 699a64398fa08917d4875f6ebc50827c2af436261427ea4acee7198e3bf28d6b9169cfe40806d93fcbd6ddfd1d4b94ccc0176f07bdbecd32cdc9328a7adbf740
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CvN9m3i1:YCSjGoLpWM6VsBEjx+ZdDvzmy1
- TLSH T174B35A16F69CB3B6E0F249789E1DF2E1BC397E304E19185B75A93F0D9E361C1990C282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 4440 Logo1_.exe 5832 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCXA470.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX9AC6.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File created C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe File created C:\Windows\Logo1_.exe 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe 4440 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4460 wrote to memory of 4264 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 85 PID 4264 wrote to memory of 1548 4264 net.exe 87 PID 4460 wrote to memory of 4392 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 88 PID 4460 wrote to memory of 4440 4460 2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe 89 PID 4440 wrote to memory of 4640 4440 Logo1_.exe 91 PID 4640 wrote to memory of 3352 4640 net.exe 93 PID 4440 wrote to memory of 3536 4440 Logo1_.exe 96 PID 3536 wrote to memory of 2104 3536 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0D.bat2⤵
- System Location Discovery: System Language Discovery
PID:4392
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3352
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2104
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5832
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXA666.tmp
- Size 94KB
- SHA256 434a70f0044c8ad7235ada4e8649cc85d9e18e9ce44773ddc92d2451aa98d00c
- MD5 5487a567bf245f83beda457de2240e1f
- SHA1 74b1ad1eeac1652de38da5fa293ae5465238b852
- SHA512 6493605e03dacd8ad0a122f5038531d6fd38c58424513ea25628e2bdb22bc0ff5ee6c7b9d1b6ae6b4ceca33db481ff7845783dd684d28518a08c303da266c1f1
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6dND:gCSjGoLpWM6VsBEjx+Zdop
- TLSH T1B7933A5AB28CB3B6D0E159BC8D0FF2E5BD297E201E1D189F75A92F0DDE760C1590C286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\RCXA717.tmp
- Size 91KB
- SHA256 42df20af8596d7002995ce47a5401a9cbf30d7f50e8800d3f6618ec9463952ef
- MD5 61466f11328c70acf8f7ac5b66ed505e
- SHA1 86b72262857c5e245f31bce8890fcd2fefa5febb
- SHA512 982c5466990f47b8cab842b9b6f8b3b19cf4d0e292bc155f120ba4c456f96e9be81992efd76a7ce4f912c68533b469aca4a2f8d27c67cec64ad2f076f67b880a
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6mNT:YCSjGoLpWM6VsBEjxZZdn5
- TLSH T1B9935C6AB68DB372D0E159B88E0DF2E5BD387E301F19185FB5AE2F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
- Size 3.3MB
- SHA256 9fcb81784de8e2b543d3f03e169f5660551fa497dee5cf107e826c35fac44cf2
- MD5 ac898330515c96bed46826f6597901ab
- SHA1 3b26316df2dd4467c64cba9edfabb459317b1e1e
- SHA512 f55c1a5ca9b4b0dc60d12a719791c5dd1f81a289820137cba077d7ece8620447dbedbb2d3325fc016a901cb658378dd6994ec45310ae22be427cc0c6c55d85f2
- SSDEEP 49152:PglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:zs6Gwxul1EE4wsH
- TLSH T166F53803E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA7B8.tmp
- Size 118KB
- SHA256 3d8664750bcc58e811c6303d00156e819052007e6b897e899754621c7f2e362e
- MD5 625870c8118fc020abd03cfc4c6281cf
- SHA1 adaa466d3ad886ae1af0972589588cff2d873a62
- SHA512 47e09636f868ae3f5da71ad6a4adc985fd1f4be4388a655412f293b56ecc2a465e4e90fbcdec2ec05b1549a1f9ade66b8837d68e8a932963d8643c470950a3da
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnp:JCSjGoLpWM6VsBEjxZZdQe5BV0NH
- TLSH T1BAC3AE6AB6CCB376D0E159B84E0DF2E57D697E300F19085FB59A2F0DCA7B5C1190C292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 dc661910cc5b3ede36824e656501086cbb36eba5cbc17408700df2362e2bd44f
- MD5 2a37a7e029bd18d14d02eec77777e37a
- SHA1 c7d8372677fd335fa143b7884b92005067e67210
- SHA512 2e81fe2c922dc47fe31a3ad249e7b4e0194133d914f7ecabc94181fddd5f756fe6aa9743d30ce66886b08d070efd6ddf75eff40b52297a0399fb3441f18b6b3c
- SSDEEP 12288:eUXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:T0Le5ji0hmxNrM
- TLSH T1D0E4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286976C6E276E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX97A8.tmp
- Size 91KB
- SHA256 0bfb73490cabe811a42bb8aa8bf0e4a8b1fe9dcc5602ad3258aae9413668562f
- MD5 6195e3861e668425a8bd39cc41d238b2
- SHA1 ef7659d7ee5eb0b9e7067705c751ed392a6bfcc1
- SHA512 c3f4beac2e4074e5b400d8d18b805935176b44c65f9fb687b1090e27c0a187013ce19c1f9bad840b5c28d81699fb08da1cc2fdc772a2cff0930f3ffc85a30717
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6hNb:QCSjGoLpWM6VsBEjxGZdAB
- TLSH T163935B6AB68DB376D0E259B88E0DF1E5BD387E301E19185FB5AE3F0DDA761C1090C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX98E9.tmp
- Size 92KB
- SHA256 c6ec7e77b5267907b103791507122327d30728c72085e343d1f76dc30757bb84
- MD5 3e803da29f9b3e157b86ea7a2c3cf6c0
- SHA1 e6d7813cd1f858157f473add526ebbe585450ac6
- SHA512 f6f3f829ad6b34d6393cc27dcc86777e49dbcc6f271f22e0611868351549e109de0488cafa76d778e6d38a9ac9ff096c151f7d94b01fcbf514f7360fc34ab536
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6/NL:gCSjGoLpWM6VsBEjxeZdex
- TLSH T169935C5AB29CB372D0E559B88E0DF2E5BD297E300F19185F71AE3F1DDA761C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCX9BB9.tmp
- Size 156KB
- SHA256 addef74a7cb8b7faab79089c06c0004287819da75b3f6ab09513b58015a6db05
- MD5 16f457bdbc44c752438a9bba605564ad
- SHA1 a2cd0d557b31c46257c8ecf61ce32efc214aa762
- SHA512 8ac622848c3d8dc68e4f92d826edcc6d04cc47e65dd2e1f77e85560af33d0fc0ea8867b02190b6c94c12f881477d18a4fa5ad791cf3d4b37aab1dfd33f86f6f7
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6PnxNz:hCSjGoLpWM6VsBEjx5ZdsxZ
- TLSH T15BF3D576B25CB776E0E599B84E0CF1E1AC6D7E201E1BCC6A715A3F0DBB761C11A0818D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX9BEB.tmp
- Size 91KB
- SHA256 f4b6a162c5e244b4904afa420b3d0c575745e846f28f946c9f4c4e806561b769
- MD5 686f84cbee2198183c62079116aa803a
- SHA1 0bcf951622a50c94b22081fce35fb597e5f91676
- SHA512 e095a213c3c1361d28827d72a843f1ba292a624f4e42a5b89472da24b0efad96c903d081cd5eb34dccd5f5445b260df1640385a63c0ad7f14e425df673c86b7e
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6ENL:YCSjGoLpWM6VsBEjxmZdBx
- TLSH T11A934C5AB28CB376D0F159B88E0DF2E5BD297E300F19185BB5EE2F1DDA7A1C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe
- Size 1.4MB
- SHA256 3f074bc0449a9ee7a54049a848d0f0ec35843ef567af33d8d27afafc4288cedd
- MD5 139dda2b96177847942e95759df0cf1c
- SHA1 e4fc92e5435baf2c6ac05865101368de219a57eb
- SHA512 7a156b75e434294ce8090032d6483dfb07da3067aeb73feb055d65fcd9be7d3a6d310d6160785cbe4ea0c7c4879ef41b68a36495c353a33d1f51a3c742fa3f3b
- SSDEEP 12288:qU8TyUjD5xN9euP+bnEPKSjlSoRUJDJ095+B7a2SooEP2WKtsm45c:cTTHhmbEPKSjIov0BW1oZP21tT45c
- TLSH T145655B01A79CFB32D4EA493078BCF7262F35BD916F51C6B7331AB25C4E71391996820A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXAF16.tmp
- Size 92KB
- SHA256 0fb28f0106d9793539c94cb238fc63fece3db7693fe5b8bec55afd13da5f7bf2
- MD5 cf86e2246be9460ecb040ddba7e079fc
- SHA1 382f89917505e5fdc2833ad8b4f39dfdd55d3e0d
- SHA512 33bf585766c46e17abd1e109d26d8356f094334d2e621319e14fa31be1bbd9c129b77ec666484757fd143f8762337e39a06de93713ca04edcbad2343a799768c
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6XNr:ICSjGoLpWM6VsBEjxQZdSR
- TLSH T1D6935C6AB69CB376D0E199B88E0DF1E5BD387E300E19185FB5AE2F0DDA770C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aA0D.bat
- Size 721B
- SHA256 0c15474336e3c1c5630c38013cb51ad4c83e91fe4e9fccaee865f8cb4c601652
- MD5 889283185673cdb52dff9047417c1e28
- SHA1 088dd9c85a4cf63f8fdf2e0140df558082a656cd
- SHA512 e2bc95b96cf1bd2da3cbcccbc1f593380a73e9540f3d9094e112a05e9a584e5fc83ec867e1088f7ff4133f3c9894ceaf54b6497423d85ae578e1ed02a0f235c9
- TLSH T17501F510D27D5DFB1874D0174FF1654FC111BC4769C623A6B77099C576E0A4DB89F240
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe.exe
- Size 13KB
- SHA256 32225d979e6708ae66e026e42e48ee05434ba7ab48f3267cce82485a22328c9c
- MD5 d561610ef664fa15a7492e7b447c3a61
- SHA1 a31ccf6a4545235f045f00caa99f377f4def31dd
- SHA512 889e518cef30152f26a87c6f7655afdfae76cf6b95ae5c8a893d388c276f04c8c0e09ed7a6688aabed3af0af0ed4370705983314c5c3da2883be9f7809e17e75
- SSDEEP 192:3lwNVaAKdNi9l6Nskfq+NpC/DL6HOO78c/JNpWP1oynJ+y7ihX6r28d/o:V+VtK7gYKkfqn6HppA13+y7+X61
- TLSH T10652D502DBA400A6FBFB1A3079FA6D5355B6BE210894EE4E46707BD91D30640EA93367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 211b272605ba89e02001f74f42d7097f6c10aa0125641a8cc9340e57f7cc36da
- MD5 0c6b3e06e51559a232ce5c34b2b974b1
- SHA1 6acd3cd00701deac2cb7d013b94ccb496eeaedb3
- SHA512 6802d6157e7206d66b6100d4bba9fb922be6fb590b7f972c1e71993e52ba0fbee0262dfc37f7e4cebed57014ccec6d81f08e9b9f4a3143fbb3069db861ddb75a
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CvNa:YCSjGoLpWM6VsBEjx+ZdDvM
- TLSH T13A935C66F29CB3B6D0F199B88E0DF1E5BC297E304E19185B75AE2F0DDA770C1590C286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH