Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe
- Size 1.7MB
- Sample260422-rbb9pscs3x
- SHA256 a43315de03c2cb5fd313ad4e9f4d33d814737c87ae19c175f3a8f0c60ce7a016
- MD5 2a428999d05ff3cfdbe94fad3755e302
- SHA1 a840e7def677bd720a897a31d7ce967b2d0daf09
- SHA512 42524eec9a5628aa1a3f9451e3856f22f1998291c5e16eeecf9f1d4b238a6b06b887fea0f0dc32b2e8095614341094fd62f15e066a01f8406cc3db0c83244a6e
- SSDEEP 24576:eiudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:eiBYH2afPAgkMcxNU
- TLSH T107854A15B29E73F1CEC5A87028AEB3FE6E749F850B165BC3A318DE2855223D2943715C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 4916 Logo1_.exe 1620 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXA7EF.tmp Logo1_.exe File created C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX95EB.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA048.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX96CC.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA42B.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXA588.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe File created C:\Windows\Logo1_.exe 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe 4916 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3636 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 78 PID 3636 wrote to memory of 3356 3636 net.exe 80 PID 4912 wrote to memory of 1692 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 81 PID 4912 wrote to memory of 4916 4912 2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe 82 PID 4916 wrote to memory of 1600 4916 Logo1_.exe 84 PID 1600 wrote to memory of 4020 1600 net.exe 86 PID 4916 wrote to memory of 4600 4916 Logo1_.exe 89 PID 4600 wrote to memory of 848 4600 net.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76D.bat2⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4020
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:848
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA048.tmp
- Size 156KB
- SHA256 a51ac545bbc82174f0c1fcd13920f093262d2ac71ff211aa32837deb859651c6
- MD5 c171d29905fb5433d5162ff9ecd04c67
- SHA1 f47a93a7d33b3e6e0c4689f6254e62c12a2f632f
- SHA512 48de813654b36b958c6f48b178f5c36418844a0fe5769b020a3dbca00165c0d6401f96e19ee8dd7e5f88f356738ddaa6e62ab5f2a580f18f2deab36931daf347
- SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxT8m3G5QGPMLQNz:dCSjGoLpWM6VbBgjxTxi3M8Z
- TLSH T1E4F3B32EB14FB3F6C3E1997C8D1CF295ED29FE20CE19285B75993B0E9A7A1C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXA2FB.tmp
- Size 94KB
- SHA256 11d48d8272bff88c3f10f32244fa4fa274571a304beca4129fac2a646297441f
- MD5 2e37d152ce22933bac7edc40bf7418e3
- SHA1 ba89fefaf0bd38ffc33071ace382f53e75597c84
- SHA512 39e2d2a7b545929212b127142803f0542e063bb730dbcaa2cd433bf0973ac3b39681abaedd13345974055cbd492254728e3a72aea198d744f0c6324e33726b72
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLfND:ACSjGoLpWM6VbBgjxwxi3MTp
- TLSH T1AB933A56B28CB3B6D0E195BD8E0FF2E5BD257E201E2D089FB1993F0DDE76181590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXA638.tmp
- Size 103KB
- SHA256 6e8732e0a804368bd1a93b61cf65fc0dd9391b1cae1355232d9afc776e112003
- MD5 81843d24c648c96e3fba064a81420fe2
- SHA1 6576ada2f1038a4ef4a1ea01f4602a390fc4dffa
- SHA512 6485e3674e6b04ed5f7a37c31549c6c16f312b86c7e124560fc98128e649ff270bc63b98349c70624139f86c82af9746d143564ec73be20ca16877a73669fdd4
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHixNQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqcu
- TLSH T1BEA37B1AB28DB3B6D0E199BC8E0DF2E4BD397D301F19186BB19D2F0D9A775C2490C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXA6C8.tmp
- Size 91KB
- SHA256 e0b7901b78582eb816978f1f8d66a1c348f0c46f0e8adaa749e99e60c350e9a0
- MD5 9d04a25e1ccc714346300bba0dde8a60
- SHA1 2d07b887c8588e65046f32dbc02c954a915f07d7
- SHA512 a8cbeb833b3f2ef717cc874bb8dffc9b8d8f0925582045dde4188a972b82d5e553b90eb1314904fe14e5058ed3c49538c4e4a55f3cd2d32964b8251d87852b76
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLwNT:ACSjGoLpWM6VbBgjxzxi3Mk5
- TLSH T15A934A5AB28DB3B6D0E199B88E0DF2E5BD797E301E29086FB19D3F0D9A771C1490C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 5bee4b776d7ce0097aea9728458b80ca2ec469cd3a6267458474b438f537ab2f
- MD5 af15e63f7550e9737a7bdb8ac21b320f
- SHA1 1635cd952df3b0985cbd22eb475e00bb108c5ef7
- SHA512 c622a53f0107245e526dfbe97b5f68461f73934e48e419e97a8217cd7ea7310895e258f0cdaf4761ca9a76a07b13f1c9ea3d30906e58549cf470d55f69cd33ae
- SSDEEP 49152:A4udQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:/ijnUdYd+RaAj
- TLSH T13B164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXA83F.tmp
- Size 100KB
- SHA256 f94c062933a7da9a2756dd4191db997e1dbaf1c3ed7bf89280c44d8b55b33747
- MD5 bf3a4d7a98710458b02f3a1dc035b658
- SHA1 53207bcf7dd146275ddd40b19e19224f8297874f
- SHA512 305f2cb72d46e9206d56cfaee511d902f6bb02221053a342bb4e88dd3edc33559b80e7b7f2b2cd34f37911b40f1fe93affa2d07e5d089d448790dadc6e01596c
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3oNj:4CSjGoLpWM6VbBgjxOxi3M0UoJ
- TLSH T17FA36B16B69CB3B6D0F189788E0DF3E5BD357D300F69086BB2AD3B0D9A77182190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 0370778c84bfea3b958b052b9f4bf159234ec14f68f48d0f8ae0ad6a50a3e0cd
- MD5 5187004c099be17bf83af4b5bdd3e3b4
- SHA1 65144b2cf9299aed3b5014fd558e6e8e1355beb7
- SHA512 a0bf7b0b2a496186aae8eebbd33855b30cdaf692fcf8365a2de6b05dc29e60642288d39f5c51ba0840ce0e942f9724970ea8b97a20fb4ac72015e56ad63711ea
- SSDEEP 12288:bCxXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:e30Le5ji0hmxNrM
- TLSH T11CE40815F56CB331D0F2C0B9C9DEB68AED713C811B3089CB5286976C6E276E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX94EA.tmp
- Size 91KB
- SHA256 ee15eeeae4170757d6f8ad1ee2749ee1502f683074f193d74ad9b92d130a4ef4
- MD5 61d9c5572b9a4ecc53923e56c101c894
- SHA1 4289a9feeaa1e81b9b9f04d8c6ef055379cc57a7
- SHA512 ed74e78f6f5b8f827c50f843b03cc4430a0230a339ffced9efe054fa4d4245fcccb4827b0454163309d0d16e62b47ae5a04b7996abdac6a6c97698abce4f9c17
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPMLkNb:oCSjGoLpWM6VbBgjxoxi3MYB
- TLSH T10D934B59B28DB3B6D0E199B88E0DF2E5BD797E301F19086FB19D3F0D9A761C1490C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX95EB.tmp
- Size 92KB
- SHA256 11fc75379d314c660910d63cd3b7531140956f89575932050033afd6361f07a6
- MD5 f707130090fb2d9208e18eb0a871ffa4
- SHA1 f779339bb440e4b15d74415f729a1bd08d332933
- SHA512 8526bc47d560c8ea05f7ed4cb89fc858202c3de0a7a5ee5d4d5ae7e3be04a490cf059e70d25bbde0e259a9971f60df22e2ff44f2d563b2fa0cd86c0aaf998a23
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPMLRNL:wCSjGoLpWM6VbBgjxQxi3Mdx
- TLSH T135934C56B29CB376C0E199B88E0DF2E5BD757E301E19086BB1AE3F0DD97B1C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXAC76.tmp
- Size 92KB
- SHA256 b5bfa52b4807ed165a03e87ba3f4983772079d904a1ecc69c5210252930d033b
- MD5 b5bea9f0d332e844b06a6a15668ea215
- SHA1 a992089617d3267985e81ec18d569006e81b85a6
- SHA512 84b8a1d882c51e1d86eaf329207a179cce7e5f45d510115b34a6dcbf78612e9f187766d8bf258ad4394c5c447aa49355a3f7aa72eda877ac38ae017b2d5e2cf5
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLpNr:YCSjGoLpWM6VbBgjxOxi3MVR
- TLSH T17F935B6AB29CB3B6D0E199B88E0DF2E4BD797D300E29186BB19D3F0D9E771C1490C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXACE5.tmp
- Size 92KB
- SHA256 867fa8fb19bb5c5847fce0bcdcd2727687cc4203ee6959f94fcb2945ecf0afef
- MD5 a5aa32c219419d31e73f349c65f1386a
- SHA1 6e7a0ed19cbee0ef85ce9f5cb304c621482d69a4
- SHA512 679e093e6acdf6a4478f0da5e673b973bea259359a45bd38930ca560df4169c9b81f89eba4b93a1d2508574efd54b52339f1fa64bc354294269f67b5bfc29d88
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLCBND:4CSjGoLpWM6VbBgjxwxi3MWBp
- TLSH T1F2935B26F29CB7B6C0E199B88E0DF2E5BD297E304E29186B719D3F0D9E771C2590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a76D.bat
- Size 679B
- SHA256 9ebaf45025e6059d9aa29310ef881eed1a8f0857fa86d9196ea204469a143aa4
- MD5 6fec6b9d02d92973998b5343ce1b4137
- SHA1 87adc19819227d276bbb13ac1336b5c83eb34fcd
- SHA512 a57d7dcd63dce55597956268a4200f8f22e058c5012c8f09dcbd1d7bddfc28f731ffb426c7b301d568006e1db0c985ab160e4095142aa36f86415e8ecf48dc80
- TLSH T16801F700C4BA4D6A288C911797E0148FE069BC547E9677B9C352C9B592E260FB6CB280
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-22_2a428999d05ff3cfdbe94fad3755e302_elex_wannacry.exe.exe
- Size 1.7MB
- SHA256 8b8aef9469be48599c4b38ac88d778b4fb694fc3f5cba8d9153b7df4aefae438
- MD5 59619d40a0fd2f15f0b6a4b64a3fb8ed
- SHA1 353d131ff92946500f368fd3eb11098a13ac16d1
- SHA512 80ff49de3324a3fc3e5cfe449b4efe2d9e841159ee8fbf2198e7af86baafc7fa192c7a6f1e53e92aec40b3305394492556c3917014adbbb8616b1693d431102e
- SSDEEP 24576:gudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:gBYH2afPAgkMcxNU
- TLSH T128855C15B29A41F1CE45A87028EEF7FE66749B890B1A9FC3A318DE3C55723D2A43711C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 b758a5d245fbca1721d150ae2cd539d99b2116d4b79cfcacc3c9e6a64d9c5518
- MD5 af4362d0035d522c8ff7719ba839b2fd
- SHA1 b47cf08f9307abc277e8f25eee5d4c1a364025d4
- SHA512 50d3f3f5ced98a61d4a4e4ef131c0a722efdb99289c320abae27265557e5f3246d8e8d36976d1ef589419f2f65a3c6fce74edb3a26a2d06b0e0b2a80546fde88
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPML2N:wCSjGoLpWM6VbBgjxIxi3Mq
- TLSH T15A934C56B29CB376D0E299B8CE0DF2E5BD257D700E2908ABB1AD3F1DDA771C1590C281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH