44c51eb0cce745ebad74f3f1c1f6fe45d83a915206d92d5d1ad5e15052f752dd

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
Size 106KB
Sample260415-symvdsb15n
SHA256 44c51eb0cce745ebad74f3f1c1f6fe45d83a915206d92d5d1ad5e15052f752dd
MD5 3a617f4c058ec79ce6a189c329a22da5
SHA1 154302a67db9ef8b3ce905de4801022e33e73f11
SHA512 699a64398fa08917d4875f6ebc50827c2af436261427ea4acee7198e3bf28d6b9169cfe40806d93fcbd6ddfd1d4b94ccc0176f07bdbecd32cdc9328a7adbf740
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CvN9m3i1:YCSjGoLpWM6VsBEjx+ZdDvzmy1
TLSH
T174B35A16F69CB3B6E0F249789E1DF2E1BC397E304E19185B75A93F0D9E361C1990C282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (254) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
3556	Logo1_.exe
3440	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXD49F.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXD3EC.tmp	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXE64C.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCXD32D.tmp	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\RCXCFAF.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXD4D1.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\RCXE336.tmp	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe
3556	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2728	2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe	80
PID 2728 wrote to memory of 4192	2728	net.exe	82
PID 2620 wrote to memory of 4304	2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe	83
PID 2620 wrote to memory of 3556	2620	2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe	84
PID 3556 wrote to memory of 1760	3556	Logo1_.exe	86
PID 1760 wrote to memory of 2988	1760	net.exe	88
PID 3556 wrote to memory of 1880	3556	Logo1_.exe	91
PID 1880 wrote to memory of 1224	1880	net.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4215.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4304
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1224

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXDEC8.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXDEC8.tmp
Size 156KB
SHA256 05f17cda236c772d7cd3511f46e102ec4c6799c2ae57ea1ad59b2ec1be6312e8
MD5 64296af93a2141cec558ef96597783a6
SHA1 72aaa9996bb8fa3c9f2c8088fce11bf382cd4ed2
SHA512 cdd979aad2ba2210d327082971d4c5ae5d93d55e5c3a00a26640cd02cc90e32a0ae21aa9b24320bc6305c47762199be06498b26e3e00507c1cd0e0ddabc52ecb
SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6GNz:hCSjGoLpWM6VsBEjx5ZdnZ
TLSH
T1C8F3B36EB18FB3F6D3E1597C8D1CF2E5ED28FE20CE19285A75993B0E9A760C34508191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE265.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXE265.tmp
Size 94KB
SHA256 434a70f0044c8ad7235ada4e8649cc85d9e18e9ce44773ddc92d2451aa98d00c
MD5 5487a567bf245f83beda457de2240e1f
SHA1 74b1ad1eeac1652de38da5fa293ae5465238b852
SHA512 6493605e03dacd8ad0a122f5038531d6fd38c58424513ea25628e2bdb22bc0ff5ee6c7b9d1b6ae6b4ceca33db481ff7845783dd684d28518a08c303da266c1f1
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6dND:gCSjGoLpWM6VsBEjx+Zdop
TLSH
T1B7933A5AB28CB3B6D0E159BC8D0FF2E5BD297E201E1D189F75A92F0DDE760C1590C286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE564.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXE564.tmp
Size 103KB
SHA256 8b8eaad4b545f4188f106425dae3776edfe73f16251e403da50f2881ca4c73a8
MD5 722b17608a116f1c36453564dc68c504
SHA1 ba1ce1337063b578621dc5f280b39b88a480b296
SHA512 d7585cc8cd90c05a17d004af91ff8fb3b6bf7bb0800e888c4aebcfe53c62256a9284069a46ac36061d75c98fce1ceea028e41b4874d5b266a1e44368c8fe871a
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHifNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqSu
TLSH
T102A37C1AB68DB372D0E159BC8E0DF2E57D387E300F1A185FB69E2F0D9A765C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE5B5.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXE5B5.tmp
Size 91KB
SHA256 42df20af8596d7002995ce47a5401a9cbf30d7f50e8800d3f6618ec9463952ef
MD5 61466f11328c70acf8f7ac5b66ed505e
SHA1 86b72262857c5e245f31bce8890fcd2fefa5febb
SHA512 982c5466990f47b8cab842b9b6f8b3b19cf4d0e292bc155f120ba4c456f96e9be81992efd76a7ce4f912c68533b469aca4a2f8d27c67cec64ad2f076f67b880a
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6mNT:YCSjGoLpWM6VsBEjxZZdn5
TLSH
T1B9935C6AB68DB372D0E159B88E0DF2E5BD387E301F19185FB5AE2F0DDA761C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE405.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE405.tmp
Size 118KB
SHA256 3d8664750bcc58e811c6303d00156e819052007e6b897e899754621c7f2e362e
MD5 625870c8118fc020abd03cfc4c6281cf
SHA1 adaa466d3ad886ae1af0972589588cff2d873a62
SHA512 47e09636f868ae3f5da71ad6a4adc985fd1f4be4388a655412f293b56ecc2a465e4e90fbcdec2ec05b1549a1f9ade66b8837d68e8a932963d8643c470950a3da
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnp:JCSjGoLpWM6VsBEjxZZdQe5BV0NH
TLSH
T1BAC3AE6AB6CCB376D0E159B84E0DF2E57D697E300F19085FB59A2F0DCA7B5C1190C292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE70D.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXE70D.tmp
Size 100KB
SHA256 22214e44cdefbc5dee61840b3a83e3e140ba7f085d10d24c1440c7868418b939
MD5 c28a8a394b61073a7c42638e3d19e8a2
SHA1 660198de492e6b89237e00401d5f45fedd9bbee3
SHA512 48feb9de262b9267c4931703b4e04421431a9587cf51e2c056dccc20c437601f4b5d7da23eb382172e9525c4c12094678f2671702d391a6279efcba253366150
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3eNj:oCSjGoLpWM6VsBEjxQZdJUeJ
TLSH
T14CA35B1AB69CB3B2D0E189B89D0DF3E5BD397E300E59185FB2AD3B1D9A770C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 642KB
SHA256 dc661910cc5b3ede36824e656501086cbb36eba5cbc17408700df2362e2bd44f
MD5 2a37a7e029bd18d14d02eec77777e37a
SHA1 c7d8372677fd335fa143b7884b92005067e67210
SHA512 2e81fe2c922dc47fe31a3ad249e7b4e0194133d914f7ecabc94181fddd5f756fe6aa9743d30ce66886b08d070efd6ddf75eff40b52297a0399fb3441f18b6b3c
SSDEEP 12288:eUXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:T0Le5ji0hmxNrM
TLSH
T1D0E4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286976C6E276E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCFC1.tmp

Path C:\Program Files\7-Zip\RCXCFC1.tmp
Size 91KB
SHA256 b6c9bc9c9ce4a932fcd3b2e9794b46257cc2ac42bfe1e767ebe9e8410fa430f3
MD5 8e3040953010ff7533f5b82a39356c31
SHA1 0fba09694b8c2305d495b36ae86b6b07527cddac
SHA512 a6934db7a9cca4df5f14a02e42cd06675b4134ac89018f532d76783169e108bb80d22862578189d798c2622d24987a906fd2104e69ca43cd60848d8922d85bc1
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6aNb:QCSjGoLpWM6VsBEjxGZdLB
TLSH
T1B5935B6AB68DB3B2D0E159B88E0DF1E5BD387E301F19185FB5AE2F0DDA761C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD12F.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXD12F.tmp
Size 92KB
SHA256 c6ec7e77b5267907b103791507122327d30728c72085e343d1f76dc30757bb84
MD5 3e803da29f9b3e157b86ea7a2c3cf6c0
SHA1 e6d7813cd1f858157f473add526ebbe585450ac6
SHA512 f6f3f829ad6b34d6393cc27dcc86777e49dbcc6f271f22e0611868351549e109de0488cafa76d778e6d38a9ac9ff096c151f7d94b01fcbf514f7360fc34ab536
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6/NL:gCSjGoLpWM6VsBEjxeZdex
TLSH
T169935C5AB29CB372D0E559B88E0DF2E5BD297E300F19185F71AE3F1DDA761C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD48F.tmp

Path C:\Program Files\Mozilla Firefox\RCXD48F.tmp
Size 91KB
SHA256 f4b6a162c5e244b4904afa420b3d0c575745e846f28f946c9f4c4e806561b769
MD5 686f84cbee2198183c62079116aa803a
SHA1 0bcf951622a50c94b22081fce35fb597e5f91676
SHA512 e095a213c3c1361d28827d72a843f1ba292a624f4e42a5b89472da24b0efad96c903d081cd5eb34dccd5f5445b260df1640385a63c0ad7f14e425df673c86b7e
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6ENL:YCSjGoLpWM6VsBEjxmZdBx
TLSH
T11A934C5AB28CB376D0F159B88E0DF2E5BD297E300F19185BB5EE2F1DDA7A1C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXEB54.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXEB54.tmp
Size 92KB
SHA256 0fb28f0106d9793539c94cb238fc63fece3db7693fe5b8bec55afd13da5f7bf2
MD5 cf86e2246be9460ecb040ddba7e079fc
SHA1 382f89917505e5fdc2833ad8b4f39dfdd55d3e0d
SHA512 33bf585766c46e17abd1e109d26d8356f094334d2e621319e14fa31be1bbd9c129b77ec666484757fd143f8762337e39a06de93713ca04edcbad2343a799768c
SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6XNr:ICSjGoLpWM6VsBEjxQZdSR
TLSH
T1D6935C6AB69CB376D0E199B88E0DF1E5BD387E300E19185FB5AE2F0DDA770C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4215.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4215.bat
Size 722B
SHA256 e753960b87b66e46c74bb4799cb0954f29aaad5f2e5177a7291c6113d9c499b2
MD5 2719b5ff5808fc395319d7d02c9d6eee
SHA1 3d0d42e4243a93989bd20de6dc4df81fc357b430
SHA512 cc73da9e3d0b28652b5045d5afe27b20eced2c6e9e25f7bf578ae78e99b351b965fd07d4a092dc1fdfb6dcf59ac4d1e607a5aa2f4c5b008ba6af78f0f1879d7f
TLSH
T10701A550D27D9DFB1474D0178BF1654FC111BC4B69C623A6B77095C575E0A4DB89F240
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_3a617f4c058ec79ce6a189c329a22da5_amadey_elex_wannacry.exe.exe
Size 13KB
SHA256 32225d979e6708ae66e026e42e48ee05434ba7ab48f3267cce82485a22328c9c
MD5 d561610ef664fa15a7492e7b447c3a61
SHA1 a31ccf6a4545235f045f00caa99f377f4def31dd
SHA512 889e518cef30152f26a87c6f7655afdfae76cf6b95ae5c8a893d388c276f04c8c0e09ed7a6688aabed3af0af0ed4370705983314c5c3da2883be9f7809e17e75
SSDEEP 192:3lwNVaAKdNi9l6Nskfq+NpC/DL6HOO78c/JNpWP1oynJ+y7ihX6r28d/o:V+VtK7gYKkfqn6HppA13+y7+X61
TLSH
T10652D502DBA400A6FBFB1A3079FA6D5355B6BE210894EE4E46707BD91D30640EA93367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 211b272605ba89e02001f74f42d7097f6c10aa0125641a8cc9340e57f7cc36da
MD5 0c6b3e06e51559a232ce5c34b2b974b1
SHA1 6acd3cd00701deac2cb7d013b94ccb496eeaedb3
SHA512 6802d6157e7206d66b6100d4bba9fb922be6fb590b7f972c1e71993e52ba0fbee0262dfc37f7e4cebed57014ccec6d81f08e9b9f4a3143fbb3069db861ddb75a
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CvNa:YCSjGoLpWM6VsBEjx+ZdDvM
TLSH
T13A935C66F29CB3B6D0F199B88E0DF1E5BC297E304E19185B75AE2F0DDA770C1590C286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2620-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2620-13-0x00000000009A0000-0x0000000000A04000-memory.dmp

Download

memory/2620-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3440-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3440-19-0x00000000009F0000-0x0000000000A54000-memory.dmp

Download

memory/3556-718-0x0000000000860000-0x00000000008C4000-memory.dmp

Download

memory/3556-717-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3556-24-0x0000000000860000-0x00000000008C4000-memory.dmp

Download

memory/3556-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3556-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3556-1257-0x0000000000400000-0x0000000000429000-memory.dmp

Download