a43315de03c2cb5fd313ad4e9f4d33d814737c87ae19c175f3a8f0c60ce7a016

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
Size 1.7MB
Sample260422-rbb9pscs3x
SHA256 a43315de03c2cb5fd313ad4e9f4d33d814737c87ae19c175f3a8f0c60ce7a016
MD5 2a428999d05ff3cfdbe94fad3755e302
SHA1 a840e7def677bd720a897a31d7ce967b2d0daf09
SHA512 42524eec9a5628aa1a3f9451e3856f22f1998291c5e16eeecf9f1d4b238a6b06b887fea0f0dc32b2e8095614341094fd62f15e066a01f8406cc3db0c83244a6e
SSDEEP 24576:eiudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:eiBYH2afPAgkMcxNU
TLSH
T107854A15B29E73F1CEC5A87028AEB3FE6E749F850B165BC3A318DE2855223D2943715C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
4788	Logo1_.exe
4064	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\RCXDE9D.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXE257.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\javaw.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\RCXD129.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3632	1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe	84
PID 3632 wrote to memory of 3520	3632	net.exe	86
PID 1064 wrote to memory of 2880	1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe	87
PID 1064 wrote to memory of 4788	1064	2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe	88
PID 4788 wrote to memory of 4812	4788	Logo1_.exe	90
PID 4812 wrote to memory of 888	4812	net.exe	92
PID 4788 wrote to memory of 2536	4788	Logo1_.exe	95
PID 2536 wrote to memory of 4384	2536	net.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43BB.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:888
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4384

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXDE8C.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXDE8C.tmp
Size 94KB
SHA256 11d48d8272bff88c3f10f32244fa4fa274571a304beca4129fac2a646297441f
MD5 2e37d152ce22933bac7edc40bf7418e3
SHA1 ba89fefaf0bd38ffc33071ace382f53e75597c84
SHA512 39e2d2a7b545929212b127142803f0542e063bb730dbcaa2cd433bf0973ac3b39681abaedd13345974055cbd492254728e3a72aea198d744f0c6324e33726b72
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLfND:ACSjGoLpWM6VbBgjxwxi3MTp
TLSH
T1AB933A56B28CB3B6D0E195BD8E0FF2E5BD257E201E2D089FB1993F0DDE76181590C285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE13D.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXE13D.tmp
Size 103KB
SHA256 6e8732e0a804368bd1a93b61cf65fc0dd9391b1cae1355232d9afc776e112003
MD5 81843d24c648c96e3fba064a81420fe2
SHA1 6576ada2f1038a4ef4a1ea01f4602a390fc4dffa
SHA512 6485e3674e6b04ed5f7a37c31549c6c16f312b86c7e124560fc98128e649ff270bc63b98349c70624139f86c82af9746d143564ec73be20ca16877a73669fdd4
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHixNQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqcu
TLSH
T1BEA37B1AB28DB3B6D0E199BC8E0DF2E4BD397D301F19186BB19D2F0D9A775C2490C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE18F.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXE18F.tmp
Size 91KB
SHA256 e0b7901b78582eb816978f1f8d66a1c348f0c46f0e8adaa749e99e60c350e9a0
MD5 9d04a25e1ccc714346300bba0dde8a60
SHA1 2d07b887c8588e65046f32dbc02c954a915f07d7
SHA512 a8cbeb833b3f2ef717cc874bb8dffc9b8d8f0925582045dde4188a972b82d5e553b90eb1314904fe14e5058ed3c49538c4e4a55f3cd2d32964b8251d87852b76
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLwNT:ACSjGoLpWM6VbBgjxzxi3Mk5
TLSH
T15A934A5AB28DB3B6D0E199B88E0DF2E5BD797E301E29086FB19D3F0D9A771C1490C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDFDF.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDFDF.tmp
Size 118KB
SHA256 370a9c5de01ac88ce7b46f7c960d9d0275d769c5d38b8f9d2613227538c53b68
MD5 0c6e986da2aa4c2216411f45841ec4e3
SHA1 0a9f38f26426c53d1b50e68d835296313a0210bc
SHA512 4e561144d484cac5cb9efb734f2f1b9c9291970efb4e724207d7f42246270c9ec7712326adcee214a68311d312d6d84e89e6bd4c1d9922f1c8aabdd95ceb00bb
SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VCv:FCSjGoLpWM6VbBgjxzxi3Mje5BV0PH
TLSH
T15FC3AE59B68CB3B7C0E199B88E0CF2E5BD697E301E29085FB5993F0DC97B5C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD128.tmp

Path C:\Program Files\7-Zip\RCXD128.tmp
Size 91KB
SHA256 ee15eeeae4170757d6f8ad1ee2749ee1502f683074f193d74ad9b92d130a4ef4
MD5 61d9c5572b9a4ecc53923e56c101c894
SHA1 4289a9feeaa1e81b9b9f04d8c6ef055379cc57a7
SHA512 ed74e78f6f5b8f827c50f843b03cc4430a0230a339ffced9efe054fa4d4245fcccb4827b0454163309d0d16e62b47ae5a04b7996abdac6a6c97698abce4f9c17
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPMLkNb:oCSjGoLpWM6VbBgjxoxi3MYB
TLSH
T10D934B59B28DB3B6D0E199B88E0DF2E5BD797E301F19086FB19D3F0D9A761C1490C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockConvertFrom.exe.Exe

Path C:\Program Files\BlockConvertFrom.exe.Exe
Size 1000KB
SHA256 70732d550f48a52b74236c47addf1368f61e50b53f4394eb5c51fb7fa2eecd89
MD5 7271837886756a921075397b5a01ff14
SHA1 5ca0f2d64f8836e436347e31b41a706640d2c269
SHA512 150f4af28dd96add320d02b5e70b20688c997f7ae63d30b035e3483c92bf869d77a59dd046d423036f4668e67c9c3c6793b755d2091dea7304fbc8c925715be9
SSDEEP 24576:eXfO/qJCS3b/aAAbKzAUOMzkvRwQIuD1Y46aCSQ4QJl:eXfnCyxsKzAS457+bVFJl
TLSH
T17C252342B28DB3BBD0D1E9748D2DF6A9FD71BD704F285C5BF690371CC2B62850A06299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD247.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXD247.tmp
Size 92KB
SHA256 11fc75379d314c660910d63cd3b7531140956f89575932050033afd6361f07a6
MD5 f707130090fb2d9208e18eb0a871ffa4
SHA1 f779339bb440e4b15d74415f729a1bd08d332933
SHA512 8526bc47d560c8ea05f7ed4cb89fc858202c3de0a7a5ee5d4d5ae7e3be04a490cf059e70d25bbde0e259a9971f60df22e2ff44f2d563b2fa0cd86c0aaf998a23
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPMLRNL:wCSjGoLpWM6VbBgjxQxi3Mdx
TLSH
T135934C56B29CB376C0E199B88E0DF2E5BD757E301E19086BB1AE3F0DD97B1C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe.Exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
Size 4.3MB
SHA256 671129dc881c30ceeecfc1ee730a98b72cd842c1fdd5ee9f5fe8128677f146db
MD5 33a449e5bc91280e75d0177cc8448662
SHA1 422da454bdd92dc781927dd2fe07a8a0c94f19c7
SHA512 dbb562b09b154ca0f03c8e5e9a3bfeae64d6423a2d373ba21d3bb4af730a829c90e4a35930a45a37b21ae548bd5bb842d87634e3a5fee9d8b120b83250ea9c57
SSDEEP 49152:IoQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:RQvGAdlCEL8c/bRNw5CO
TLSH
T144263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD56B.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCXD56B.tmp
Size 100KB
SHA256 f94c062933a7da9a2756dd4191db997e1dbaf1c3ed7bf89280c44d8b55b33747
MD5 bf3a4d7a98710458b02f3a1dc035b658
SHA1 53207bcf7dd146275ddd40b19e19224f8297874f
SHA512 305f2cb72d46e9206d56cfaee511d902f6bb02221053a342bb4e88dd3edc33559b80e7b7f2b2cd34f37911b40f1fe93affa2d07e5d089d448790dadc6e01596c
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3oNj:4CSjGoLpWM6VbBgjxOxi3M0UoJ
TLSH
T17FA36B16B69CB3B6D0F189788E0DF3E5BD357D300F69086BB2AD3B0D9A77182190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD59D.tmp

Path C:\Program Files\VideoLAN\VLC\RCXD59D.tmp
Size 92KB
SHA256 d25775a48a61f4153665da747ee3b4e3c511211e2b83cdcea3b6eb51ed280542
MD5 f017dfb28626c12d5a0ba87216f42932
SHA1 283c62ca2161c50e8ce98def1842e4e5159be752
SHA512 c3da6f41155b9bc852c8339ffb023b1838abe83779f6ac5c88931ba687b4e25ed36d72874653ae992b5d7e51a054fb7cc4250e1ca1ff55c737c1e04c804fe8c0
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLWND:4CSjGoLpWM6VbBgjxwxi3Mqp
TLSH
T1DE934B55B29CB3B6D0ED99BC8E0DF2E4BD657E300E29086BB19D3F0D9A7A1C1590C18D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a43BB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a43BB.bat
Size 680B
SHA256 2adcc8e7f62dbfca8a6b1b44a8a8b9d67e058f42473f5697a1d0b01cf314f14d
MD5 fc62feb39902cbf939d84df3bdef4cef
SHA1 55767c930669c245ffeda63807e768072545b513
SHA512 65a96d426c26a98e065d385941105c1b3db51b0039f2d8d3ee0c35d3d467e657a02b4851a52752656f0a17a2eee0704f8c5ccace7b966daed6a715729a30b95f
TLSH
T13901F700C4B94D6A388C911797E0248FE069BC547E9677B9C352C9B592D260FB6CB280
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe.exe
Size 1.7MB
SHA256 8b8aef9469be48599c4b38ac88d778b4fb694fc3f5cba8d9153b7df4aefae438
MD5 59619d40a0fd2f15f0b6a4b64a3fb8ed
SHA1 353d131ff92946500f368fd3eb11098a13ac16d1
SHA512 80ff49de3324a3fc3e5cfe449b4efe2d9e841159ee8fbf2198e7af86baafc7fa192c7a6f1e53e92aec40b3305394492556c3917014adbbb8616b1693d431102e
SSDEEP 24576:gudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:gBYH2afPAgkMcxNU
TLSH
T128855C15B29A41F1CE45A87028EEF7FE66749B890B1A9FC3A318DE3C55723D2A43711C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 b758a5d245fbca1721d150ae2cd539d99b2116d4b79cfcacc3c9e6a64d9c5518
MD5 af4362d0035d522c8ff7719ba839b2fd
SHA1 b47cf08f9307abc277e8f25eee5d4c1a364025d4
SHA512 50d3f3f5ced98a61d4a4e4ef131c0a722efdb99289c320abae27265557e5f3246d8e8d36976d1ef589419f2f65a3c6fce74edb3a26a2d06b0e0b2a80546fde88
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPML2N:wCSjGoLpWM6VbBgjxIxi3Mq
TLSH
T15A934C56B29CB376D0E299B8CE0DF2E5BD257D700E2908ABB1AD3F1DDA771C1590C281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4064-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4788-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4788-889-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4788-1260-0x0000000000400000-0x0000000000429000-memory.dmp

Download