Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe
- Size 110KB
- Sample260417-ecafaahw61
- SHA256 1257bae4562cd514089d7baece80ebfb4825c40ef54b205577e75edf1f5e588f
- MD5 88ecaed88b0a173de26c33d37599f1cd
- SHA1 cbcd3ac1a401ac9fd9a59a5033e033415304166e
- SHA512 44ad22f27a1930dc5434ca6b9478e64e12f492e4cf9da8b3af3be5398ac22ca9453e3510e83f49f058596ba2ff8e373b3f708a27e78cdf502171ea0065a6d090
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxMHsHqaNrFgVtsmfg7UqD3U:3CSjGoLpWM6bblmjxMlaNpgVtsOgS
- TLSH T148B35B56B69CB7B2E0F28974AE1DF2E6BC357E201E15485F726D2F0C8F762C1650C286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 1276 Logo1_.exe 4076 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3128 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXFAC8.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\RCXEA10.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXED87.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXFAFB.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXFB0B.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXFB0C.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXF9D2.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXED03.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe Logo1_.exe File opened for modification C:\Program Files\JoinUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXF9F3.tmp Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe.Exe Logo1_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe File created C:\Windows\Logo1_.exe 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe 1276 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3936 wrote to memory of 2136 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 80 PID 2136 wrote to memory of 4708 2136 net.exe 82 PID 3936 wrote to memory of 1760 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 83 PID 3936 wrote to memory of 1276 3936 2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe 84 PID 1276 wrote to memory of 3000 1276 Logo1_.exe 86 PID 3000 wrote to memory of 3808 3000 net.exe 89 PID 1760 wrote to memory of 4076 1760 cmd.exe 88 PID 1276 wrote to memory of 2860 1276 Logo1_.exe 92 PID 2860 wrote to memory of 2568 2860 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C92.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe"3⤵
- Executes dropped EXE
PID:4076
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3808
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXF800.tmp
- Size 79KB
- SHA256 cbe2e6631b44e298d6577360781ad7acc070c9bbc62dc7b2029508c37ee553ab
- MD5 d422d515ea35a30b0540239248db07ad
- SHA1 3ec88110a9b78a76a603c8a72b9a0790793f7fda
- SHA512 847ae54db8b806fd0b050937bea0024e5dc4d985f0114288e356f437c1e1aab6e0225c8e22b9d3e9bdb8447aa284ee54221c6c7b0a12d7f12370d7728702f85a
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx3Hv:DCSjGoLpWM6bblmjx3P
- TLSH T12683E756B18DB3B6D0E299BC8E0FF2E5BC253E201E2D589FB59E2F0DDA7A0C1550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXF9D2.tmp
- Size 89KB
- SHA256 638d37b85ef0f171a8777164fb066c1b37aa14067dbe0c18cf27b1590e56265a
- MD5 388ca9e2fbb616235901095f613a0ece
- SHA1 eacfde89467b24947a265b094ce764f28960e4e2
- SHA512 29bd42f02b49f7b5bdee94f275aedf8286fe1385dc625ff2d52695cd9ace63568bf56beb03c0b6621da79d7dc9fbdcd9b977bf9e3995452671903a627293c28d
- SSDEEP 1536:+7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxg1XkSPsULMHieHW:vCSjGoLpWM6bblmjxgdtPlLqX2
- TLSH T166934A69B28EF376D0E299BC9E0DF2E5BC287D301E19185FB69E1F0D9A764C2150C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXFAA4.tmp
- Size 76KB
- SHA256 1d323afb9bd54c6be88162f24ce210186db28794595e1823f6e4915d8cf22ef4
- MD5 4773c3d01d2e7b00bdd9e4db0474066c
- SHA1 6a8dcda0ec9c9241dcd075d20104864b235c8cbb
- SHA512 b3da7c86802938858327803824c3e74400410bd345883245aa093e7c06f535042bc2b3a86ebf7ef01d92c81ad3c273cc745468a87e8458be9828626a4d53114b
- SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxpH/:TCSjGoLpWM6bblmjxpf
- TLSH T12C732A69B28DB376D0F299B89E0DF2E5BC687E301E29185FB69E2F0DDA770C1150C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF943.tmp
- Size 104KB
- SHA256 51afb2080b2e0148efb18ec5d6f660909d93eb0aaab1d50f700b9912ccba06e7
- MD5 493aa0f040a4cb06b1ef4d85d9e8f508
- SHA1 68769c357261ec0b9b0dd92013d7d4a86a17d4d7
- SHA512 98baccb8271de28f3f57c8606c131f0065926c5935e81802a4a4e13935ae66bebe0728328146448de66302f5418c99f1a8664f3fc012b7b9b53e91036f8192c1
- SSDEEP 1536:e7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxT4GZjzQwK5WW7VCn6KydHc:PCSjGoLpWM6bblmjx9e5BV0o8
- TLSH T122A38C69B68DF377C0E298B84E0CF2E5BC697E301E29185FB59A2F0DCA7B5C1150C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXFB9F.tmp
- Size 85KB
- SHA256 1f63aa44ef51e1e1c8641ed0bbedcb8af440ba54716608afa8418ab804d08c06
- MD5 c884101337f24bed2fde698cb2911c4b
- SHA1 09627df871ef68d332eecf348840b763dd60d513
- SHA512 24499204d63371bed429d350faa7496c84652d1558d389a8b6db150eb5261eb87a838b7945c44029000e7000e7a0d673f8139950b1c6939b45ae6110fb427f86
- SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxTqkSZZZ3bHP:zCSjGoLpWM6bblmjxJUbv
- TLSH T191833855B68DB3B6D0F289B89E0CF3E5BD247E301E69185FB69E3F0D9A77082150C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXEAE0.tmp
- Size 77KB
- SHA256 0e0d58f4567c5f2da3754bc43a7a059f6196976cedc8507dffb06f372741a135
- MD5 780933d4857ef3a4b78870010eec7689
- SHA1 88456dcbcebb0b0d7a2ff07d6ea280278441ea3b
- SHA512 b9d556d08ba5475de3ec97adf009ac78d9ee7af769878fb597c62efe0f6397c2e84e56183d2b330914f0a967147ff88fc625b1302691a055d6a41c543f349c1b
- SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxgH3:TCSjGoLpWM6bblmjxgX
- TLSH T136730965B28DB376C0F299B89E0DF2E5BC257E301E19186BB5AE3F0DDA7B1C1150C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\JoinUpdate.exe.Exe
- Size 472KB
- SHA256 f7f4e384cd13e7dfd7e0f202f8ab4b443ba925b1c22ee4963df0c7a332030022
- MD5 0388fc8953c65412c708cf8bf6c8beca
- SHA1 85c0d65cb6a5fd5e63b7917860484a0479d1bdfc
- SHA512 acf2051b305a4dfad66a2360b2c082836511df3f42699e818b8e39e4376a989c52a57195124bdf6ff98288cf96151da810d04067fa8b556c14cf4e8a46b2fd74
- SSDEEP 6144:tXmRmua0uYUjkAKK6G+jGrXZblG1ILbqhAwLHhQed73FPrSNFzYdUCwZYX6gRgCD:svSe2Ej2EILbq9LHFd5nUCnOCD
- TLSH T18BA4125A731DB3B6E6D689348D2EF2E1ACB03D203D255D4F76AA2F1EC53B1C1941D182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.2MB
- SHA256 998a67a3844506cfc8c81b17c27960cce73d729e9156e5e8feb35d1a28bf9401
- MD5 a165b196d036b59c5a4b48a24ee5bb6b
- SHA1 747320a4bb6aa50d5634d1b61d7bad829a6fbc1e
- SHA512 6e35fc90408da1df38a7c153f0666c38441d04bec2af54fe9d9854c5e8cabcdfe0a718dd799fef0e2ac2c9cb54d69d960bc99e9f6c20a4acdf7d537a49c3f921
- SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:RQvGAdlCEL8c/bRNw5CO
- TLSH T12E263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXED76.tmp
- Size 77KB
- SHA256 fe97474d45b781c4e5405ac2a4ddeffde05f638d252120915b1b6d4028db26b8
- MD5 ae6f81077919d02631b7e3f3e74777a8
- SHA1 f752fd736d20e9945e3e0a60c9630c43d26a5f51
- SHA512 87ef55590006d7ceb7d9aa475f4af446cb2230080fe4eb9550ce96a63913c7a4766431b19cd3bde9d68ea510fc9b2b034f2d291944f17b1892f4be497d902ea0
- SSDEEP 1536:e7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxPH3:PCSjGoLpWM6bblmjxPX
- TLSH T1FF731A65B28DB376C0F2A9B89E0DF2E5BC257E301E29185BB5DE2F0DDA7B0C2150C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX83.tmp
- Size 78KB
- SHA256 8087942b71b13a708b29f55a85a82eb79197065f740720cbaddcf5584906942e
- MD5 846f96101a3410254cef2c6a7f3330d9
- SHA1 97bb9823aa6b00454d9fb0a8390c7b10c0a6da8d
- SHA512 a573de4166f993a96fe07fb33c647fc356952b1f2c3f4982d9f3a658929812a39f7d71c6a241c64017edda8c9e2f082894e8f9c2108fad5f3e08946a04b1194e
- SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxZuHv:nCSjGoLpWM6bblmjxZuP
- TLSH T18D732A65F28DB776C0F299B88E0DF2E5BC287E305E29185BB59E2F0DDA7B0C2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5C92.bat
- Size 680B
- SHA256 0edab0505681e44f6285078e09813975ab3d180de58779309c869ea21ae1f5dd
- MD5 53e2c4c91ad52777f95792bfd75500d5
- SHA1 54c49b466e9b2e4806882a25ba3c7b04bd213595
- SHA512 62cb4a8185ba3dea3832361dec25b589de99aa101ad52fdb0bdea1107e0e9dcc2c1b09fbb214c205d0dc4b5042b8ef6fb9b6306eccd1bf18c685a787ac952767
- TLSH T132012482B379EDA74A0540176FA2094FC156FE96BF5993634702848436D3C2CFFCB905
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_88ecaed88b0a173de26c33d37599f1cd_elex_wannacry.exe.exe
- Size 20KB
- SHA256 1957c76d58b2e76d04b682a7a6cfd264114a3b79a6951790b598838c1b213b2d
- MD5 9556baf000d1a1040cf810857ee2ab27
- SHA1 b94acdd76f2765d0712d815e62f62b45b98bc37d
- SHA512 e21a0eda42f5763a570a1ac95e2c16453977a83189a6564d21a9eabf814de89a3b879a8822f6f2f919e8319d3bacb51e95bcb6d3647c47bf288629ebe49f2c86
- SSDEEP 384:Tjk+VCgP6UMDvByxhBbFzKfXeffIYieTFhO00mhs3U:TnVtPCvkNFmmfgYiUF0mhs3U
- TLSH T109925C5ADAB10CA5F8164570B6E14A17EE387A93BA92D2DF731D80046F81742366E3FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 89KB
- SHA256 a810a0accd8059219f2172f2cd49b775dda664f41bb6b4c2a35931c42b93a57d
- MD5 0dd6d886113d094a5a423cfce11cba8d
- SHA1 00f7fc3262a3975020d192eb5df8af2eb73850f6
- SHA512 6892f5261d7b07086fe9234dbb85834f467e9bacaa71fedbdca82bf7a140796fc5c19f6bcb363092c0773d9da75bfd0042582d5afd839bb9ea814d60aab996c4
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxMHsHqaNrFC:3CSjGoLpWM6bblmjxMlaNpC
- TLSH T1F6935B66B38CB3B2D0F299B89E1DF2E5BC257D301E19185F76AD3F0D8A761C1950C286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH