a31938834b6a3eef5d2789e2bab406ee5091d849ee1e6b7c5e8845afd6cc1dda

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
Size 1.7MB
Sample260506-zqcssaex3n
SHA256 a31938834b6a3eef5d2789e2bab406ee5091d849ee1e6b7c5e8845afd6cc1dda
MD5 6f9e91108a0f6716bc45522838732cad
SHA1 33303cc7dd55463b6be02f6d6fd1a170aa042812
SHA512 c7465a1d4310f30233736719e06ee5841d5bc6a96c9a2dd161c6133b91c5d28223c5ec29215714cef67351ad6211b7bcfd27297a3cab4421183c774492346b29
SSDEEP 24576:4udsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:4BYH2afPAgkMcxNU
TLSH
T134854A15B29E73F1CEC5A87028AEB3FE6E749F850B165BC3A318DE2855223D2943715C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
1896	Logo1_.exe
5072	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXBF0F.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXBF22.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXBF73.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXCE52.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXC0D4.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe
1896	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1844	4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe	85
PID 1844 wrote to memory of 4764	1844	net.exe	87
PID 4716 wrote to memory of 5300	4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe	88
PID 4716 wrote to memory of 1896	4716	2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe	89
PID 1896 wrote to memory of 452	1896	Logo1_.exe	91
PID 452 wrote to memory of 4608	452	net.exe	93
PID 1896 wrote to memory of 5160	1896	Logo1_.exe	96
PID 5160 wrote to memory of 372	5160	net.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3004.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5300
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:372

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXC95C.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXC95C.tmp
Size 156KB
SHA256 20df0a9ce97c311c4881fd6a27e9fb3d4759d94861acbc680179f06de893fd1d
MD5 257eea7c86ab7768972537c5b1d6c217
SHA1 403d6bacb1adb0e208be0cefe0991ed1191bc85f
SHA512 2cce44ac7b2473174af4427cf7e1153d89b48ed3b5967c29873a0238fa289619bbdd24b2f23f777fd1df6fa885e542a01019142039bb8737367d4079496232e6
SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6QNz:hCSjGoLpWM6VsBEjx5Zd5Z
TLSH
T126F3A36EB14EB3F6D3E1597C8D1CF295ED28FE20CE19285B75993B0EDA760C34508291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCAE4.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXCAE4.tmp
Size 94KB
SHA256 4b0d1c60b387559eea88d77dc98803aa3b32d6a8e5485e4720b0011ecc0712d4
MD5 28041a258773976372466312a873bc98
SHA1 a1eb5e1d85cb4bf0fe021a5094cd3063a8ded835
SHA512 40390d992435bf93ec8200b67397f265f8b0e87b2601ce7ba2eb0795c8923aba594c40fb160b80e7a3c65108f685e04e646d22906923c6a5c0fa01a8872e2ce1
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6fND:gCSjGoLpWM6VsBEjx+Zdqp
TLSH
T1C393295AB19CB3B2D0E199BD8E0FF2E5BD297E200E1D189F71993F0DEE76181590C285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCBC6.tmp

Path C:\Program Files (x86)\Google\Update\RCXCBC6.tmp
Size 91KB
SHA256 e94597c853343c9eace980ab893fca946167457ac4031b95611df74fe879a84d
MD5 e20f61117bf42210a228b75b46f46be5
SHA1 e8012f1c6712f66e4c46c3ad5b786fcb464d884c
SHA512 57e86653f9954138f23ff7a6ad15034ffd9d29782f27c3afe6ea32517c1f04fa3083d5f120029b4130a84c524298c5416744a6d655fe9139d9d6f68170561a53
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6wNT:YCSjGoLpWM6VsBEjxZZd55
TLSH
T19D935C5AB28DB372D0E299B88E0DF2E5BD387E300E1A185FB59E3F0DDA761C1190C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 3.3MB
SHA256 363b03b163269337f50a988542c58285ac4f5fb6e273176041a525c554c89736
MD5 9725a51bdc3a84279e0c02fcbd88b490
SHA1 393943de186e8bbb1373e0a0ce5f1b00e1de1612
SHA512 e293b8a031d96e72ec233bc6fea2ab77392d8d7ad72befe7cb5194cb21382afa0427c468684e975081e38fdb9ca506be111bd20c9d1e1dc8b0614381ec7c2a62
SSDEEP 49152:BglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:hs6Gwxul1EE4wsH
TLSH
T1BAF53803E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe.Exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
Size 4.0MB
SHA256 4fd202524530bea11feb233636be26c84af70af8a3e34a68d11cbe0598dc7cee
MD5 b5f2ff87a8d703991e1a867c5e067581
SHA1 735ff4c3bf8c478ca53f69d3b62497ff68278e9f
SHA512 a4387f45e94b4693a534e345d17459cd144476e0ab7a5097d2070d9561bbf9de776d75b04c5c02f5fb0fb05599c976954b1006061fd80276fc9cd45000305241
SSDEEP 49152:RudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:DijnUdYd+RaAj
TLSH
T16C164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD02A.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXD02A.tmp
Size 100KB
SHA256 4d87571b2c3b3815c445c5331b0ea349d89408d36f92d725e8e05af23b6516ef
MD5 721249ad3cf45f01d7f905d1c1697951
SHA1 1313006a62ffbcb279032ac49a270693dc2a2fc3
SHA512 ecff6cee97f3597e87ec4995773ddc8521cb05516e87b5252557a9a776792dbe27616bf7865d068671b82a4d92aed5080bf798bde16d532cd02052e255e7742a
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3oNj:oCSjGoLpWM6VsBEjxQZdJUoJ
TLSH
T149A36C1AB69CB3B2D0F18AB89D0DF3E5BD397E300E5A185FB29D3B0D9A77181190C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBD80.tmp

Path C:\Program Files\7-Zip\RCXBD80.tmp
Size 91KB
SHA256 7fb8a4501b399986d3474c7a299b24cb17fbcdc1e19ce0252ba7ce8bb40da6e8
MD5 6e25aecd2edfba203c6ed77960de9056
SHA1 cdb15aaaeb5b50fb0ad07743e766ea849a76b431
SHA512 e112a21484135763e4cb825db14bc7b605ccef7ad7511e1ef3ba8a74b7549117c21c0a1f0e81cd3d0e2e83dd11f33027763b9e9e2c231759e7a287cc608c44bb
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6DNb:QCSjGoLpWM6VsBEjxGZdCB
TLSH
T17B936C5AB69DB376D0E299B88E0DF2E5BD387E300E1A185FB59E3F0DDA761C1090C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetClose.exe.Exe

Path C:\Program Files\GetClose.exe.Exe
Size 345KB
SHA256 018305b48cb4aef8747acb2d3ef69f3fa70c8627465b6520f43869dacc486937
MD5 f30ef4aa3b50a52bf3e3dbd35b5c1c7a
SHA1 0269b92754902ec07f180ea4c4467e07ab7d1139
SHA512 be366f7bd6dfd0c7de1dd16ccb6043c044c40228b17a47dbe434941b3dcf8f2222eba6956b69dd2ed3478577d27376e53a79fc645d89517c346146de7e9c4cd1
SSDEEP 6144:+XqoEwt/A3H/SMs6b+tQsmIWmrc6UIXdBJGrt/iFb0jN81z0TDAeV1d:R3H/SMs++ismIWmr3UINT08QVv
TLSH
T1B2740216B64CBB77D0E18AB88E4DF6E5BC297D200F150D5B71EC3B1EDA764D21A0C2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBEA1.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXBEA1.tmp
Size 92KB
SHA256 54369bc6aaf79e38be82abfd3669369859a86de6ae712517f8ffa757d504effc
MD5 116a38ad9986fcbd171c381e57875fbc
SHA1 c10436167652b6a474cfb651c917f1b6237d42c5
SHA512 5cc38b604d8a757a95936f4b1a366239975b67b99df98bdd8e8106be979ce9f2e80ab2f2cde60fc0d7a1548795607d9f2b05b437ef172199dd38ffff3dc9e462
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6RNL:gCSjGoLpWM6VsBEjxeZdox
TLSH
T1E4935B6AB29CB376D0E159B88E0DF2E5BD297E300E19185BB1AE3F0DDA771C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC136.tmp

Path C:\Program Files\Mozilla Firefox\RCXC136.tmp
Size 91KB
SHA256 785b6362283f80412ed302555cf860c5431c86e6f379fdec2808994a5e81f1ff
MD5 e091392a3f5d59e07ed8f971146bcd6b
SHA1 a1b6ec6eb3b9dd474a9725846370222a77a67640
SHA512 8e869f518de943dc08e1aced7362fe0f37409cbcd117157f10c980bbf244ea7dd0e73df78db7d8518b41ccf191b2ee4b0a2fa9b7db24270fb51da8a083726afb
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t62NL:YCSjGoLpWM6VsBEjxmZdjx
TLSH
T1B2934C59B29CB376D0F1A9B88E0DF2E5BD297E300E1A185BB5DE3F0DDA7A1C1190C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC179.tmp

Path C:\Program Files\VideoLAN\VLC\RCXC179.tmp
Size 92KB
SHA256 a5d79e5d6583e248ebf69895244cc5cd281bd5a92af52f0c7dcb5fc22217a72a
MD5 46474e174ae2790fa5d500c83b25d3de
SHA1 c8cfe589ab53e83807e28715fe44a54d079a385d
SHA512 5c738fffa2d348fa1847a8343cef5723c1ca06a8c931e8e9820cf1bed888b6af3431d77dea6740f7a73712db54fe77a81a44577fab64c0d5e1af78a1f5b42eac
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6WND:YCSjGoLpWM6VsBEjx+ZdPp
TLSH
T14B933A65B29CB376D0EE59BC8E0DF2E5BD297E300E19085B719E3B0DDA7A1C1190C29D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3004.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3004.bat
Size 680B
SHA256 35b5d6db91db8e55b5288aa9a57b19511cfbb657d702fabed55f3fb427348fea
MD5 9fa1c52c7ede8fdbc8d16083986573c5
SHA1 f6fb1bc9d6d7a00805b7b3ea64d0e8ef9a301b61
SHA512 98f3eb58099ee29e789f7436bfed9eaa1b7dd1702affae4efcc4ada243a9cdee3c9417d4d33372ce9f6f36ae0cc67dac6bf8ff7167c0f7e03e7cd0a8cfa7afc0
TLSH
T1F1016755C1BA8A3B19C6E12767E05F8FC0317D14FF191F483721858D60D095CB799B81
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe.exe
Size 1.7MB
SHA256 c4ef48cd0666ce447131d436fa62977a84420036eafa8187267c9b8a47a944f7
MD5 cbd225bdf23bbe9cd10c521d734dc837
SHA1 be0aea31f1358b13aed0c641e779aaa898b8d0d8
SHA512 9425d731bd1c55b04344b5e24b6ab95e03c7f78e9391ed7aa267b2ae3d6b2a76792be8cea8b3b1fe8f2395611c6a4616974d986342c065726dac54fa32b958a5
SSDEEP 24576:gudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:gBYH2afPAgkMcxNU
TLSH
T140855C15B29A41F1CE45A87028EEF7FE66749B890B1A9FC3A318DE3C55723D2A43711C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 5f97c528054fcbef8a09843af93b5cf5a9615952ec5d710339240b892f58ca74
MD5 392061a0663b2f3b79ee9fc5767d5b6b
SHA1 941c618bf0267ba597e603dac267ff9fcf56a52f
SHA512 47de79d370caedc036e63fd37c6b78ab58273e550789e7f9b27c73a9bc004de5c743684fb59d10f96e403cef004328fab9e4652135dfdcc5014488a433145e8f
SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6pN:ICSjGoLpWM6VsBEjxQZdc
TLSH
T142935B6AB29CB776D0E199B88E0DF2E5BD287E300E1A185FB59E3F0DDA771C1490C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1896-1271-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1896-910-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1896-26-0x0000000000760000-0x0000000000785000-memory.dmp

Download

memory/1896-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4716-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4716-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4716-11-0x00000000009D0000-0x00000000009F5000-memory.dmp

Download

memory/5072-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5072-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5072-21-0x0000000000540000-0x0000000000565000-memory.dmp

Download