3c4b5f3665d9ce4c7d45307ec0b9d684e7a8a45a467a766228d86f428324cbde

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
Size 43KB
Sample260425-ppa8fsct2q
SHA256 3c4b5f3665d9ce4c7d45307ec0b9d684e7a8a45a467a766228d86f428324cbde
MD5 47a4ef09a26f3aca4266393f56087d88
SHA1 32b0862a66618fbb8b03476b695de392d66388b0
SHA512 92dafb5d83d26881a0de90eb3deab8fb9dee04e5201e2b2bac56f9d2e76ae272151d1ce865579e442207af321b8409a203a0d339b0dad6dec741f33ef701aebd
SSDEEP 768:pL16GVRu1yK9fMnJG2V9dHS8/WQ3655Kv1X/qY1MSd:ph3SHuJV9NDHqaNrFd
TLSH
T1F113AE529BE864A2F7FB0AB078FB2F974972FD108C84DA1E4A707B9D0C34640E566317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1764	Logo1_.exe
3212	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe
1764	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3436	448	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe	84
PID 448 wrote to memory of 1764	448	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe	85
PID 1764 wrote to memory of 4640	1764	Logo1_.exe	86
PID 4640 wrote to memory of 1160	4640	net.exe	89
PID 3436 wrote to memory of 3212	3436	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41E6.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3212
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 07c5e2f38197e6880a308b62bf6b1c557ca83514fe8aa2b5b438f25dcd1869d6
MD5 99125fb70b38b9d09764092a3a12b816
SHA1 ad655df45043eb01d0bd2c0b1afd98b93378773c
SHA512 0933235d17bccf183a02c9a12ca2cf2e2374a0a750bdfd35420f3db4ae4a1d64fcfb6ca425404ffff91d319875d6c607c57dfb96d5818be73a839cedfd5c99df
SSDEEP 3072:ptkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:0uJtYCk3ET+Tu3fC0zB+JHv
TLSH
T18CD39D1376D08472E5B2593108A1EEB1493EFD625D50CE6B37D42B3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 6e666e54000c945c096709c7972496c39c9486e7f023daae5048b9f515a1871d
MD5 a32953eab166b6e0b737c391590f227c
SHA1 08cf2399131df0cfc0cb591a7a821f0c0efb2ac1
SHA512 24d945415b1c4f8b2d463b105f4d2da7b1f1096554a7808f78c0cff3e7156de56043b035ad08218dac67d593f53e6480ad3ba7014ea627dcb39421f95a202035
SSDEEP 6144:0uJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:uXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T138C40916F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 33eed0776e70128759b6b69204542fef0b324599c45336a55a715d33021b77c1
MD5 1a5ab22b970a87e526b0d20b596882a5
SHA1 e8b374a387685516a02904eab9fdc400e8e6f3f0
SHA512 76d36d5f395a376b6c06483e25464575038c0fd2bb949a9d01b6dc49aa7a3fdf0635ce6eef11721ecb9fcae3caa58824b951abc20f900ab42faf33bac183fe61
SSDEEP 6144:weuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:woqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T144B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a41E6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a41E6.bat
Size 722B
SHA256 846675b945ec6da19d68ef5dedb1bbc2c62a34be9751b7c5d2c7f1530ade193c
MD5 c6a7586e78ee85e146747484bac7705c
SHA1 1aabc8509ff653a1ee40473180e3af24cd1891f3
SHA512 cc95ce21b2d7f1b266112040059a4aa3813c00a4b93bc64605e53e76904560763292f288f4cbeb22cea31e27e1d649ff493ac5df68aa9bfc2206f1b56c1175ca
TLSH
T16801921183BD657E3848900B0FA0698FC521F8493A86177763A5CA4956E280DFBE6383
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe.exe
Size 14KB
SHA256 1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
MD5 ad782ffac62e14e2269bf1379bccbaae
SHA1 9539773b550e902a35764574a2be2d05bc0d8afc
SHA512 a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
SSDEEP 192:aplw/Q3AjmqdD5KOEBrXGWRVkdQ2l+8275N5y+NXNUoynP+yJihMrKbbP28d/o:MlgQ3655Kv1XtRV2QicXax+yJ+MObd
TLSH
T11A62D502CBA454E1FBFB0631B9FA2A875AB6BD104894DE1E47B07FDD0C34680E566367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 5ebf30aa9e1d1ce8586f9201aef58ffda47afd0c730459a804848318513127eb
MD5 f5e9a746c4a271414e99a836930ded93
SHA1 70de4bfdcc7390b9c0e03baa1c5fddf19fa9f990
SHA512 1c1e91306a7dd895f765672cc8c7a83f1c9d4ffb3eeda612b94f46d6054b227f68c4a07493792705e7a8a1248a9a03e1d510e3f98787ee282c05f56bf7544e5d
SSDEEP 384:Nbb+yp91Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pL16GVRu1yK9fMnJG2V9dHS8
TLSH
T12CD2E174BBDC7663F7AA1FF068A35FA74422FE20ECC5921F2D34BA5A0C706405966613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2714754311-527593155-1440850301-1000\_desktop.ini
Size 9B
SHA256 49ae628b21eceb52cfae7af66d488c736e334e8e5a05bacaac62b3ddd791251b
MD5 acdb534d0253a176a2a0e1fd11e837b9
SHA1 a527b792940d294bca3c2fcec3cc01f48de60689
SHA512 ae6fee904c215193b2a84e2af6e46875b5c4ede55ec8a53eb88fc6204a207329b7b4e140e16c0630b3df64395b8533c4773e1a2157b654962d7c1390dc8097fe
MD5 SHA1 SHA512

Submit Download

memory/448-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/448-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-30-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-40-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-345-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-1249-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-5038-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-5545-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3212-23-0x0000000004030000-0x00000000040AE000-memory.dmp

Download

memory/3212-22-0x0000000004030000-0x00000000040AE000-memory.dmp

Download