bfdefbf3c7190746817ad925142d34e68b30aeff60d13fc23cae676b6f6fe2f3

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
Size 116KB
Sample260528-vd8bpsfw9m
SHA256 bfdefbf3c7190746817ad925142d34e68b30aeff60d13fc23cae676b6f6fe2f3
MD5 261c94bf2865c2f21afea0c3a3ed9d28
SHA1 9b8795390648e892074b041e6f8f6bb3caf983cb
SHA512 d9924fa9c0a13ff1ae6b7fe967fe45759a9b77cc61356fc7ba0a74ba898762898328756311acf3cbaa1fd94a91c1b90876adbc470950f0e708e4f95e7eeb5feb
SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxB2uC+ysafR2NNVs6dcBGmxxBx:9CSjGoLpWM6slmjxku4JJ2XVteBDbBx
TLSH
T1B5C36B16F28CF3B6C0F1A9788E1EF2F5BC357D204F29495B7299AF0D997B4C14908259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
1344	Logo1_.exe
3056	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXDAB9.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXCC46.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7zG.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXC9D4.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXD3CC.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXCB70.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXC882.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXCC03.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7zFM.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4356	3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe	89
PID 4356 wrote to memory of 4348	4356	net.exe	91
PID 3000 wrote to memory of 596	3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe	93
PID 3000 wrote to memory of 1344	3000	2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe	94
PID 1344 wrote to memory of 2696	1344	Logo1_.exe	96
PID 2696 wrote to memory of 1988	2696	net.exe	98
PID 1344 wrote to memory of 4488	1344	Logo1_.exe	101
PID 4488 wrote to memory of 792	4488	net.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a390C.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:596
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1988
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:792

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXD3CC.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXD3CC.tmp
Size 156KB
SHA256 431191d3a03afafcb8063f1816c74ff453ee543ab025e525403053e88881e036
MD5 786ba1c63eeaaeed4b5647d7c6350b2a
SHA1 c7cfb58533c8d3e04e62f728c82235193a7b62d8
SHA512 4e28dbd1f52c28dec3539a499eb17202c7f03bfc02461dddc3521e9ddb017971a4fb8d7304e94345f96dc2cb016f172d9ef5f6bbbf0c6739c68aaeb38df6306c
SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxQ2uC+ysafoNF:ICSjGoLpWM6slmjxnu4Jgj
TLSH
T145F3B26EA18FB3F6C3E1697C8D1CF295ED28FE20DE19285B75C93B0E9A7A0C34508155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD63F.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD63F.tmp
Size 94KB
SHA256 10318034b0bdc823dfd70ca6a9521e4ce5d0a365ff5e364d071687077aab67ed
MD5 512fd3a2eb5d9425596f9a37f5fd7c63
SHA1 6d0af112a51d2f353d7b8bd653ed63b4d67475e8
SHA512 86b5921ac3d98aba3c07b1ad2a29bcc8f37161fb4f313cd8e7d8ab1da024861a6d8ee9bd3045f3a9857a8c0f8a39893fb2021e2de2405b02fbed895f247c5c8b
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxJ2uC+ysafLN1:JCSjGoLpWM6slmjxMu4JTT
TLSH
T10D932956B18CB376C0E169BC8E0FF2E5BD257E201E1D489FB59D2F0EEE7A0C15918189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD79D.tmp

Path C:\Program Files (x86)\Google\Update\RCXD79D.tmp
Size 91KB
SHA256 aaa907532b4823deae5cf12b8ba866b30049dceb90aefc96ef0ef498b5a6207f
MD5 bfbd2fb06ce1bf1360450cdaddcea655
SHA1 1383cad8105a73cf8a1703730ae6a573250ec265
SHA512 29f917da7922ac2972551414c32490a4cb8c36bd5b423190c051f1d67b1d812ea99128b598cfdac29df7edf3efd422219e970ab114b7a584d8a20f4cb5ec2eae
SSDEEP 1536:Q7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxA2uC+ysafQNl:BCSjGoLpWM6slmjxXu4JoD
TLSH
T13A934B55B28DB376C0F259B88E0DF2E5BD297E301E19085FB69E2F0DDABB1C2490C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 3.3MB
SHA256 98f325d4a499d755b4d23166aad124b1e3309a103370604b64f6370ba2c9ffca
MD5 ec78f33a69ad3f131cb7d64319c2c33f
SHA1 52f516ee6853083933b16bdbbf881ecec0d77cb7
SHA512 bd260d37d22f5279e2527fec5868d15ebd6f3ac24a08c2b86e6914c3c190cd77a7e5115908c844139b8ce407cc36d5edfeb231c0f3d4486f2e93f48e9aa92e29
SSDEEP 49152:bglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:3s6Gwxul1EE4wsH
TLSH
T18FF53803E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD83E.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD83E.tmp
Size 118KB
SHA256 c7cde2ee9ebc0ea67c0d277b8ec372d76531662fab4c9c811d968fd4af254c68
MD5 fbe6372ec4c3c1c9e96bea06b0841535
SHA1 f258639be731411ebf43739803572958b70d6315
SHA512 17be94455aacd7a123719ce3967e07a05af05d6d34e550dbacae11e7089269294d7d7bd77039d58ac380becb81d1bc1b481fb2898506cc0c34833f135a51bcf5
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxK2uC+ysafs4GZjzQwK5WW7VCn6Kl:QCSjGoLpWM6slmjxVu4Jye5BV0w2
TLSH
T101C39E55B68CF376C0E169B88E0CF2E5BD297E301E19085FB59E2F0DCABB5C2590C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDC01.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXDC01.tmp
Size 100KB
SHA256 6e92d21f20e9bdee4275abb779e287b1bd5bc00407602cf1196041697a734fd7
MD5 53295c794315c09b98bc9d9b2ca994ab
SHA1 fc9e5afecf572fce1f62a67980b881b320a72f13
SHA512 c8d480c976e72cff81e0bfde89d7d968ab9d5277751e55616c30b06ee8e620364b9a6fcfecf846fa2723e27ac03fa2b559480f000b925bd2813e4e16f6dba28a
SSDEEP 1536:g7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxn2uC+ysafFqkSZZZ3PNV:xCSjGoLpWM6slmjx2u4JHUPz
TLSH
T1CDA36A56B68CB3B2D0F199B89E1CF3E5BD297D301E59085FB29D3F0E9A77082191C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC6C8.tmp

Path C:\Program Files\7-Zip\RCXC6C8.tmp
Size 91KB
SHA256 096f8962e11e660216bdb4ab4464a09d8d81bb6313fa234aa34954cf7e64f3b7
MD5 481efb1f09fb52e2bd7ed96c67373fd4
SHA1 a5a5345ea40f1ee4dcffae3f1b20d70e4c94441f
SHA512 dc15a36fbd9f34377370d4bcfbbfa41bc4888acd7b6d865df091dc325d1cdc1536994ce24d69cbd287f49028f1ab0f950328e768ed8674d6d74ec2b5c64ec68f
SSDEEP 1536:U7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxB2uC+ysafkN9:NCSjGoLpWM6slmjxku4Jsb
TLSH
T1AC934B55B28DB376C0F559B88E0DF2E5BD297E301E19085FB69E2F0DDABB1C2090C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC8A3.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXC8A3.tmp
Size 92KB
SHA256 382281fb3951695427812f7535283d42d0727d1b0e00b197545f5f6bc480363e
MD5 ebd5d280baa2618c803b7284d63f82b5
SHA1 9be76ecdc917202aa02a7b65ed7c6e0f6c6f6b86
SHA512 68453e0bff4c4ca4bdbc61355efa482746dccd90d4ba1f0d8294d55908042733a66d1d02da9a7b04a6789ab94513837b9cbaf3b2dcebe9a14bd963fef718b156
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxdv2uC+ysafNNN:JCSjGoLpWM6slmjxsu4J1r
TLSH
T1BB934B56B28CB376C0F559B88E0DF2E5BD297E301E19485BB59E3F1DDABB1C2090C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCC03.tmp

Path C:\Program Files\Mozilla Firefox\RCXCC03.tmp
Size 91KB
SHA256 32965660bf44ffc1835326df14da2cd26658e32803fc68f72f51f77be72ab74d
MD5 839605c83bf529012d2e54aa421c8111
SHA1 1404a0d36e2317766f1219add13528dea716c827
SHA512 76b14fa1f18b0733c3c44266e59584dcde8d4097c6c2666edf98fe90986ce42c71e5003b90ef5f4b226ca1c64629f2c7350167a35d5e6170e20af6fe8c229285
SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxp2uC+ysafaNN:FCSjGoLpWM6slmjxsu4Jyr
TLSH
T135935B55B28CB376C0F269B88E0DF2D5BD297E301E19089BB5DE2F0DDA7B1C25A0C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE048.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXE048.tmp
Size 92KB
SHA256 adfaa8976b762acf566cba48ba46f32f5a14a6d955d4b91916d6efe7793f7991
MD5 744e18f78b2b61190056720cb82d0f69
SHA1 ba43e68f30c8e7fb04abf589ea9bcf836817b93a
SHA512 8f298404f254cc884722317b26188b960723226aacdf7099fc9502c61c55dbf98f7df7467568b39f9c19468721a6771745f43b58b1f89adf801521b4cabe9580
SSDEEP 1536:A7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxn2uC+ysafxNt:RCSjGoLpWM6slmjx2u4JpL
TLSH
T1C9934B56B28DB776C0F199B88E0DF2E5BD287D301E19185FB69E2F0DDA7B0C2490C199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a390C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a390C.bat
Size 680B
SHA256 69abeca4ef233e569bdcc8cfee62e22e928bbd7e17b7d2df3251936d67dc9649
MD5 165b7c36ad03ba4607e414863b3a428a
SHA1 b567c4c13379b9e4bcd85099bd929b3fb8d38826
SHA512 caf2eb3f34ea6bfddf7418c4545796175d57d951dd1912c12d0dbb1a0e34731a1764786c1c43265b2af4f56e7ad4739b43abdebbe504a82e5866e28aa1b61fe7
TLSH
T1C801DBA181FE4E7B1844D04BCBB64C8EC89E7816BA7A37947729C85A1FD085DF8DD280
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe.exe
Size 23KB
SHA256 f953d7869a18de299f40756e92e30ae31e65dbfbc716add7b42e7a00916c677a
MD5 f92e3ba6b46972febe38845dc3611c77
SHA1 e1ca98edcd4201144aed37fbd5e00b9b96e5a2b6
SHA512 5cea8fd481aeef2633d7cab4eaf6b2a96120be7f0653c1f4778e65255991f97214b4c9878f6404d27ee5f27dec2612e3aaeb1b20c62f438386b2205224c0f97e
SSDEEP 384:1xBJApjs8od7ABGmxs8Y1qN/zm4W2yWu:1xzUjs8odcBGmxs8CqBx
TLSH
T181B2A416AEEAC06BD565EE300AFB113A5931BD018F348B4B7361FB8D6477E101812F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 21a91ca15f7914e1308146165387299bbdafe12f4f48ed919b374f3d0612c939
MD5 727f9c146d9d455b205db9d331f5febe
SHA1 1d63c281c5bc34264905bb039255af3798a74718
SHA512 66fe36fed06e4a97bf4391af7463bb8aa01d518ea8820ebaae96f524312e8fef904401e6f4a388f5d4f1ae6faf67ba1430181bf1353e4caecde59b1a47333279
SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxB2uC+ysafR2N:9CSjGoLpWM6slmjxku4JJ2
TLSH
T1D2934B56F28CB776C0F199B88E0DF2E5BD297D304E19085B769E2F0EDA7B1D2490C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1344-877-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1344-1260-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3000-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3056-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download