Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 14:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe
- Size 301KB
- Sample260525-sb9ewaby4m
- SHA256 75019d68012ae83641c52b82e2b18927c1b28f19ef76a511fa19edab76f3b620
- MD5 a11ade136d4b59401f026e08f8f5a618
- SHA1 779285584d438dfbc576a1963d815b9c04b7e7ca
- SHA512 5f976f9e6903d97962e39623fa3b753c32ca1e55676bcd811be027c6d3e187e751d45ed4d03ae4fc3b81e7885b032bed29182c9edb1c89f5a45a34c112c24188
- SSDEEP 6144:y2ja0pShfK4x0j7L6Ed5+IZiZhLlG4AimmCb:yZfKo0H+I5+IZUhLlG4AvP
- TLSH T19C640816ADC3913DF2DB25BC8405C77CB8A77E2059261B3BB784F9DC18767E08A2910E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\sppoolsv.exe 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe File created C:\Windows\SysWOW64\drivers\sppoolsv.exe 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe - Executes dropped EXE 1 IoCs
pid Process 2696 sppoolsv.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcshare = "C:\\Windows\\system32\\drivers\\sppoolsv.exe" sppoolsv.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: sppoolsv.exe File opened (read-only) \??\V: sppoolsv.exe File opened (read-only) \??\A: sppoolsv.exe File opened (read-only) \??\E: sppoolsv.exe File opened (read-only) \??\I: sppoolsv.exe File opened (read-only) \??\M: sppoolsv.exe File opened (read-only) \??\O: sppoolsv.exe File opened (read-only) \??\X: sppoolsv.exe File opened (read-only) \??\Y: sppoolsv.exe File opened (read-only) \??\B: sppoolsv.exe File opened (read-only) \??\Z: sppoolsv.exe File opened (read-only) \??\K: sppoolsv.exe File opened (read-only) \??\P: sppoolsv.exe File opened (read-only) \??\Q: sppoolsv.exe File opened (read-only) \??\S: sppoolsv.exe File opened (read-only) \??\T: sppoolsv.exe File opened (read-only) \??\U: sppoolsv.exe File opened (read-only) \??\W: sppoolsv.exe File opened (read-only) \??\G: sppoolsv.exe File opened (read-only) \??\H: sppoolsv.exe File opened (read-only) \??\J: sppoolsv.exe File opened (read-only) \??\L: sppoolsv.exe File opened (read-only) \??\N: sppoolsv.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\autorun.inf sppoolsv.exe File opened for modification F:\autorun.inf sppoolsv.exe File created C:\autorun.inf sppoolsv.exe File opened for modification C:\autorun.inf sppoolsv.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe sppoolsv.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe sppoolsv.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\Desktop_.ini sppoolsv.exe File created C:\Program Files\Java\jre-1.8\lib\security\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\Desktop_.ini sppoolsv.exe File created C:\Program Files\Microsoft Office\root\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe sppoolsv.exe File created C:\Program Files\Java\jre-1.8\lib\ext\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\dotnet\swidtag\Desktop_.ini sppoolsv.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe sppoolsv.exe File created C:\Program Files\Microsoft Office\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe sppoolsv.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\swidtag\Desktop_.ini sppoolsv.exe File created C:\Program Files\Microsoft Office\root\Integration\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\Desktop_.ini sppoolsv.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\Desktop_.ini sppoolsv.exe File created C:\Program Files\7-Zip\Lang\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Desktop_.ini sppoolsv.exe File created C:\Program Files\Java\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe sppoolsv.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\Desktop_.ini sppoolsv.exe File created C:\Program Files\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Desktop_.ini sppoolsv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Desktop_.ini sppoolsv.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\Desktop_.ini sppoolsv.exe File created C:\Program Files\Java\jdk-1.8\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe sppoolsv.exe File created C:\Program Files\dotnet\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\Desktop_.ini sppoolsv.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\applet\Desktop_.ini sppoolsv.exe File created C:\Program Files\Java\jdk-1.8\lib\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe sppoolsv.exe File created C:\Program Files\Crashpad\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\dotnet\dotnet.exe sppoolsv.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Desktop_.ini sppoolsv.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\Desktop_.ini sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe sppoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe sppoolsv.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\Desktop_.ini sppoolsv.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sppoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe 2004 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe 2696 sppoolsv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe Token: SeDebugPrivilege 2696 sppoolsv.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2004 wrote to memory of 844 2004 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe 87 PID 2004 wrote to memory of 2696 2004 2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe 89 PID 2696 wrote to memory of 2864 2696 sppoolsv.exe 110 PID 2696 wrote to memory of 4456 2696 sppoolsv.exe 111 PID 2696 wrote to memory of 872 2696 sppoolsv.exe 112 PID 2864 wrote to memory of 3048 2864 cmd.exe 116 PID 872 wrote to memory of 2824 872 cmd.exe 117 PID 4456 wrote to memory of 3792 4456 cmd.exe 118 PID 3792 wrote to memory of 4952 3792 net.exe 120 PID 2824 wrote to memory of 4068 2824 net.exe 119 PID 3048 wrote to memory of 2808 3048 net.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_a11ade136d4b59401f026e08f8f5a618_coinminer_elex_wannacry_wannacryptor.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2$$.bat2⤵
- System Location Discovery: System Language Discovery
PID:844
-
-
C:\Windows\SysWOW64\drivers\sppoolsv.exeC:\Windows\system32\drivers\sppoolsv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net share F$ /del /y3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\net.exenet share F$ /del /y4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share F$ /del /y5⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net share C$ /del /y3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\net.exenet share C$ /del /y4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share C$ /del /y5⤵
- System Location Discovery: System Language Discovery
PID:4952
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net share admin$ /del /y3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\net.exenet share admin$ /del /y4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share admin$ /del /y5⤵
- System Location Discovery: System Language Discovery
PID:4068
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\Desktop_.ini
- Size 9B
- SHA256 2ca3346a9d7d86252bc565527f3230b91132c147a03d0cd5d7b0d9d3c4b64a37
- MD5 3af6e271eb1be84793edbc8ea742e917
- SHA1 44f63a83a182805e5a1dd01dc91e836cec086051
- SHA512 b2007af635001bc702b37f4c5192833a05746455689dd95db12af9bacd7c42f68f0f9b8dac7c3e798d1340c554db7ead0cf8892e89b3600db23e3933fe38d654
- MD5 SHA1 SHA512
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 90KB
- SHA256 ee9a5b738c238f148a85192ee06cfba62ac9bb4ea6f3c33842f2e1259ee494eb
- MD5 8b9438dd89c5e1265c1ac46a7f1b5760
- SHA1 89d952a30ad2b2b105bf4053defb26c1a56ae635
- SHA512 5b229be067cfca149e13390605e91198aec2611ce2c37c2f9a4c5bea71025d4bc06bc03615f707d6ecbc132efe37123259ad34f419065510025ed3275a64ebd5
- SSDEEP 1536:8vqepQ1rna0pt073wYToVExK4FrywY6wN+5uINqLEz+QlokYWowCej+itxMRK:ypAja0pSLwYfK4xywY62t7LEzukYclxl
- TLSH T127936D5ABB90C272D03155FCCD4AC299FA2A32742F254487FBD64F1D9AB63E2163C253
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2$$.bat
- Size 773B
- SHA256 9298fc11e380266c22ebdf2ec891262325a3c10c75726bff8b93c1ef0a02f058
- MD5 ae59867bfeb90f85a465ba5d2e9a884a
- SHA1 a426bcdb8459dc5f0b2f00cdec2130de902587a6
- SHA512 4d3d539539a8fb840153d65a331c1cd34a2c39c71535cb767bb43f92b8ea66c594981d122b17abcd929d6926b3805dbcfa58e89dd53375f802169207b63b47e7
- TLSH T18501F11414B9DFB6699BC1124BB0D49FC2C479E36A3E239BC734CBC2CAD1184F289311
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\drivers\sppoolsv.exe
- Size 61KB
- SHA256 5918db9f0ea49a2bfbdf7b268ba47761f4ab46f608f4bd45d71eb51ce00c3f8d
- MD5 febeb62a6e056cacfa506f4c9a9a4452
- SHA1 a380b1706286a01c3a5c2777880b8e33d57112bc
- SHA512 01395ae45792f0cc5e777e2b78dc120aec655992f22b54a9a1f42a6e6f6595c93f2acbc269ede55dc835b8beb6baaa471f5502c8b32b166276282c49137f5562
- SSDEEP 1536:8vqepQ1rna0pt073wYToVExK4FrywY6wN+5uINqLEf:ypAja0pSLwYfK4xywY62t7LEf
- TLSH T1F0534A5ABE40D672D03409FC5D0EC3E9B92E77342E291453BBEA4F5C99F92D26A1C183
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 81B
- SHA256 223ba22fec52565c543884278b7346de05119093e664f8aa18e86a6c95eab2fb
- MD5 101598ec88b8d4c4b9949b00e36abbe9
- SHA1 f93d2b502d51ed9997136c7bfaeb2df897e9c1ee
- SHA512 420378c61370b376f1f021e0303be1ce680e94b56a8171267dbae112a9be63251899c336c2a6502643c770dfad6a99422d7bd93e1390501c9e9cbb3d882e3851
- TLSH T167A01102EC23028E3B0A20808BBE00A22C0380C00088C2EAC2CCB8C008802080F022C0
- MD5 SHA1 SHA512 TLSH