Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe
- Size 116KB
- Sample260528-vd8bpsfw9m
- SHA256 bfdefbf3c7190746817ad925142d34e68b30aeff60d13fc23cae676b6f6fe2f3
- MD5 261c94bf2865c2f21afea0c3a3ed9d28
- SHA1 9b8795390648e892074b041e6f8f6bb3caf983cb
- SHA512 d9924fa9c0a13ff1ae6b7fe967fe45759a9b77cc61356fc7ba0a74ba898762898328756311acf3cbaa1fd94a91c1b90876adbc470950f0e708e4f95e7eeb5feb
- SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxB2uC+ysafR2NNVs6dcBGmxxBx:9CSjGoLpWM6slmjxku4JJ2XVteBDbBx
- TLSH T1B5C36B16F28CF3B6C0F1A9788E1EF2F5BC357D204F29495B7299AF0D997B4C14908259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 792 Logo1_.exe 5368 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXAE1B.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXBD8F.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXAD88.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Video.UI.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXBD1B.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXBDC2.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe 792 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4452 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 81 PID 4452 wrote to memory of 6124 4452 net.exe 83 PID 4792 wrote to memory of 5796 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 84 PID 4792 wrote to memory of 792 4792 2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe 85 PID 792 wrote to memory of 4944 792 Logo1_.exe 87 PID 4944 wrote to memory of 5792 4944 net.exe 89 PID 792 wrote to memory of 4272 792 Logo1_.exe 92 PID 4272 wrote to memory of 2112 4272 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:6124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F3B.bat2⤵
- System Location Discovery: System Language Discovery
PID:5796
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5792
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2112
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5368
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXB845.tmp
- Size 156KB
- SHA256 431191d3a03afafcb8063f1816c74ff453ee543ab025e525403053e88881e036
- MD5 786ba1c63eeaaeed4b5647d7c6350b2a
- SHA1 c7cfb58533c8d3e04e62f728c82235193a7b62d8
- SHA512 4e28dbd1f52c28dec3539a499eb17202c7f03bfc02461dddc3521e9ddb017971a4fb8d7304e94345f96dc2cb016f172d9ef5f6bbbf0c6739c68aaeb38df6306c
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxQ2uC+ysafoNF:ICSjGoLpWM6slmjxnu4Jgj
- TLSH T145F3B26EA18FB3F6C3E1697C8D1CF295ED28FE20DE19285B75C93B0E9A7A0C34508155
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXBA5A.tmp
- Size 94KB
- SHA256 10318034b0bdc823dfd70ca6a9521e4ce5d0a365ff5e364d071687077aab67ed
- MD5 512fd3a2eb5d9425596f9a37f5fd7c63
- SHA1 6d0af112a51d2f353d7b8bd653ed63b4d67475e8
- SHA512 86b5921ac3d98aba3c07b1ad2a29bcc8f37161fb4f313cd8e7d8ab1da024861a6d8ee9bd3045f3a9857a8c0f8a39893fb2021e2de2405b02fbed895f247c5c8b
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxJ2uC+ysafLN1:JCSjGoLpWM6slmjxMu4JTT
- TLSH T10D932956B18CB376C0E169BC8E0FF2E5BD257E201E1D489FB59D2F0EEE7A0C15918189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXBD1B.tmp
- Size 103KB
- SHA256 6f9b702481e3a4f15fd2419e1687e70ece4f7d63d1178ed0524b1e62e9209ed9
- MD5 cff27200ebde92d300f650e56808113f
- SHA1 9b9a4bfec5b79aba2a092230ab624a1640782938
- SHA512 09bc78215f97988f7e06ae5616c663c0dcd125e209ae2b958f092345843629c777efa46b2b31860ae9ac5fd68313111dffd2e823ba3fcfdea3e27d198871f7d6
- SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxf82uC+ysaf71XkSPsULMHiGNy:9CSjGoLpWM6slmjxzu4JjdtPlLq7Y
- TLSH T1E3A36B59B28DF372C0F159BC8E0DF2D5BD287D301E19585FB68E2F0E9AB75C2090819A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXBD6D.tmp
- Size 91KB
- SHA256 aaa907532b4823deae5cf12b8ba866b30049dceb90aefc96ef0ef498b5a6207f
- MD5 bfbd2fb06ce1bf1360450cdaddcea655
- SHA1 1383cad8105a73cf8a1703730ae6a573250ec265
- SHA512 29f917da7922ac2972551414c32490a4cb8c36bd5b423190c051f1d67b1d812ea99128b598cfdac29df7edf3efd422219e970ab114b7a584d8a20f4cb5ec2eae
- SSDEEP 1536:Q7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxA2uC+ysafQNl:BCSjGoLpWM6slmjxXu4JoD
- TLSH T13A934B55B28DB376C0F259B88E0DF2E5BD297E301E19085FB69E2F0DDABB1C2490C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 795af3d63fb35caf5f0fe65480c35924e86d900de1f9f0f5c1b8e2761602690e
- MD5 fc7068f702c7d81cb688310be7199415
- SHA1 a93112fd0e12296b57df8e8af5b302ed3ebc0440
- SHA512 28a84ad4923201cfa6357bd8d392c7c70d84cd6463c95e269d68c5b58554eb86dd0865f3cb750e03910f48690c09c9dfe2486ff45d70512cb58916fda09cb026
- SSDEEP 49152:kudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:sijnUdYd+RaAj
- TLSH T193164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXBE77.tmp
- Size 100KB
- SHA256 6e92d21f20e9bdee4275abb779e287b1bd5bc00407602cf1196041697a734fd7
- MD5 53295c794315c09b98bc9d9b2ca994ab
- SHA1 fc9e5afecf572fce1f62a67980b881b320a72f13
- SHA512 c8d480c976e72cff81e0bfde89d7d968ab9d5277751e55616c30b06ee8e620364b9a6fcfecf846fa2723e27ac03fa2b559480f000b925bd2813e4e16f6dba28a
- SSDEEP 1536:g7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxn2uC+ysafFqkSZZZ3PNV:xCSjGoLpWM6slmjx2u4JHUPz
- TLSH T1CDA36A56B68CB3B2D0F199B89E1CF3E5BD297D301E59085FB29D3F0E9A77082191C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 58254e0fb5cfd324fa7d05c65f9b538c5adeb2f7d841b161879b454869c0b8a4
- MD5 0a3e4ff5a050654dc5afd06be8a73952
- SHA1 3d7cdf7b7d9673c26d66d4f53a1b053236e6eebd
- SHA512 05baabcb775a1b679cea481257ee953227476b90819856d092841b9675965d6053533ac40d28dd7e4097d5885ddf6091279292be19630d59c88e0c4acc4a7889
- SSDEEP 12288:9u4JJUXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:FU0Le5ji0hmxNrM
- TLSH T1A1E40715F66CB331D0F2C0B9C5DEB68AED313C411B3089CB5286976C6E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXACA8.tmp
- Size 91KB
- SHA256 096f8962e11e660216bdb4ab4464a09d8d81bb6313fa234aa34954cf7e64f3b7
- MD5 481efb1f09fb52e2bd7ed96c67373fd4
- SHA1 a5a5345ea40f1ee4dcffae3f1b20d70e4c94441f
- SHA512 dc15a36fbd9f34377370d4bcfbbfa41bc4888acd7b6d865df091dc325d1cdc1536994ce24d69cbd287f49028f1ab0f950328e768ed8674d6d74ec2b5c64ec68f
- SSDEEP 1536:U7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxB2uC+ysafkN9:NCSjGoLpWM6slmjxku4Jsb
- TLSH T1AC934B55B28DB376C0F559B88E0DF2E5BD297E301E19085FB69E2F0DDABB1C2090C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXAD9A.tmp
- Size 92KB
- SHA256 382281fb3951695427812f7535283d42d0727d1b0e00b197545f5f6bc480363e
- MD5 ebd5d280baa2618c803b7284d63f82b5
- SHA1 9be76ecdc917202aa02a7b65ed7c6e0f6c6f6b86
- SHA512 68453e0bff4c4ca4bdbc61355efa482746dccd90d4ba1f0d8294d55908042733a66d1d02da9a7b04a6789ab94513837b9cbaf3b2dcebe9a14bd963fef718b156
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxdv2uC+ysafNNN:JCSjGoLpWM6slmjxsu4J1r
- TLSH T1BB934B56B28CB376C0F559B88E0DF2E5BD297E301E19485BB59E3F1DDABB1C2090C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe
- Size 554KB
- SHA256 c669a3f56e223ae8046be8226ddbee7d378539cb6b9e6fe861858575cdbc4dba
- MD5 4c71a21de19a197e6e373e5df7458eb0
- SHA1 a8aab5a0ac5d3e60606c04e46245ee3d941914cf
- SHA512 ad9716e92e076c20cb3a815a8a97a0417cce49cf42e15cfadfa3a7641942f91928e17289468269f83c920cc184e026ca1f680ec5d8d2042b5890f5e77d797116
- SSDEEP 12288:9u4JfDnVDcmd/6JAB/6N30xQ+hpvm7Mgj:FFTVomdaA230xQLMo
- TLSH T1D5C4292032EDB318C8FB1B70DC3DB6812E767EA56D81C6AE29543B6D4D723428711B97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXC2BD.tmp
- Size 92KB
- SHA256 adfaa8976b762acf566cba48ba46f32f5a14a6d955d4b91916d6efe7793f7991
- MD5 744e18f78b2b61190056720cb82d0f69
- SHA1 ba43e68f30c8e7fb04abf589ea9bcf836817b93a
- SHA512 8f298404f254cc884722317b26188b960723226aacdf7099fc9502c61c55dbf98f7df7467568b39f9c19468721a6771745f43b58b1f89adf801521b4cabe9580
- SSDEEP 1536:A7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxn2uC+ysafxNt:RCSjGoLpWM6slmjx2u4JpL
- TLSH T1C9934B56B28DB776C0F199B88E0DF2E5BD287D301E19185FB69E2F0DDA7B0C2490C199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a1F3B.bat
- Size 680B
- SHA256 3fb86a7956d91c14c677387f362399c605833a38ffa9cb83f41bb74f49b73c9d
- MD5 682558d5d48e1d43869c82794a2fa939
- SHA1 b11a724010b6e541fc120edcf1b71cd494c7710c
- SHA512 ddaca85008ccad8be3dbb024cc6edf43b7ee4b3508cc3d8f359adf9f8dfe63a6e1787474fe8429b934e25cae4b171a8c71157c3074089facb40001861dc9cdab
- TLSH T1FC01DBB181FE4E771844D047C7B64C8EC99A7816B97A37947729C85A1FD085DF8CD280
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-28_261c94bf2865c2f21afea0c3a3ed9d28_elex_wannacry.exe.exe
- Size 23KB
- SHA256 f953d7869a18de299f40756e92e30ae31e65dbfbc716add7b42e7a00916c677a
- MD5 f92e3ba6b46972febe38845dc3611c77
- SHA1 e1ca98edcd4201144aed37fbd5e00b9b96e5a2b6
- SHA512 5cea8fd481aeef2633d7cab4eaf6b2a96120be7f0653c1f4778e65255991f97214b4c9878f6404d27ee5f27dec2612e3aaeb1b20c62f438386b2205224c0f97e
- SSDEEP 384:1xBJApjs8od7ABGmxs8Y1qN/zm4W2yWu:1xzUjs8odcBGmxs8CqBx
- TLSH T181B2A416AEEAC06BD565EE300AFB113A5931BD018F348B4B7361FB8D6477E101812F2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 21a91ca15f7914e1308146165387299bbdafe12f4f48ed919b374f3d0612c939
- MD5 727f9c146d9d455b205db9d331f5febe
- SHA1 1d63c281c5bc34264905bb039255af3798a74718
- SHA512 66fe36fed06e4a97bf4391af7463bb8aa01d518ea8820ebaae96f524312e8fef904401e6f4a388f5d4f1ae6faf67ba1430181bf1353e4caecde59b1a47333279
- SSDEEP 1536:k7qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxB2uC+ysafR2N:9CSjGoLpWM6slmjxku4JJ2
- TLSH T1D2934B56F28CB776C0F199B88E0DF2E5BD297D304E19085B769E2F0EDA7B1D2490C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH