8c4e87a1f2252e53c674e9a7e0e896a08359df0e264f9e4effd3447f8f2476ef

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
Size 450KB
Sample260602-vk6rfscv2p
SHA256 8c4e87a1f2252e53c674e9a7e0e896a08359df0e264f9e4effd3447f8f2476ef
MD5 4b27fccb57e96b3709f03adc7865780d
SHA1 d90bcb53a6d9270b32442f5f05579e890bf648da
SHA512 853f974f9dce2ffae7cb24fda61294376c41e15b5939aceef24e5880d747904e4b00d83187d12c76dd14549abdd455ff07dab485e67c5a58decdd5cb95e742c6
SSDEEP 6144:uXqoEODli4es4TCLXauMi9T0Pynk33QGc+A0uDtmFJ2zu6ZpzFgOekPdP3ERblt:es4XmexGyWQh+sISRjjdIJ
TLSH
T11AA45A117BEDF336D1E206318F5EBBE5ACF9BE248D21484733C41A1D5A35885D239B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
4976	Logo1_.exe
2944	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXAD8A.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXB0E9.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXB142.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXA3CD.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\RCXB0C9.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXB12F.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXB173.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA155.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe
4976	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1892	5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe	80
PID 1892 wrote to memory of 716	1892	net.exe	82
PID 5592 wrote to memory of 5648	5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe	83
PID 5592 wrote to memory of 4976	5592	2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe	84
PID 4976 wrote to memory of 1360	4976	Logo1_.exe	86
PID 1360 wrote to memory of 4064	1360	net.exe	88
PID 4976 wrote to memory of 4672	4976	Logo1_.exe	91
PID 4672 wrote to memory of 1856	4672	net.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1316.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5648
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4064
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1856

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXAD8A.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXAD8A.tmp
Size 94KB
SHA256 dda945d9eee98c1b046f27e22725b56809ffa8dab1232d874181f0a4a18df3c9
MD5 0b97e01b56a6f76ec6a97913bd28683b
SHA1 9811e4ff99890ab2287c1c87e94c032d5ede3dcf
SHA512 4e538d3ce64d21b9cfae6ca7619082167677878b4bbecb676ed7981c4658a78f8e192a07b92b564af30eddd706f0318a27447b448b2994222f5241d6fec36cfd
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t62ND:gCSjGoLpWM6VsBEjx+ZdTp
TLSH
T12D932A5AB18CB376D0E159BC8E0FF2E5BD297E200E1D589F75992F0EEE760C1590C285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 3.3MB
SHA256 98cb142bd92781df68344bcb8cbfd5f95b738e76680f75c40ae1517e54476601
MD5 c44a1b6fd181c426bd9b7ef0af76649b
SHA1 fb3aa321884164fb065cf5ac5306ee49c85e7a70
SHA512 cd432c71a16c138341dc1df09d3ca33146794883b3f0156d0dacf02890390f9a8f99532c4ea656e7bf6da671adba6592ccdb47dff926a5f3f2493b6cabe4b3cb
SSDEEP 49152:QglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:gs6Gwxul1EE4wsH
TLSH
T1E7F53803E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB0E9.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXB0E9.tmp
Size 91KB
SHA256 50e8837e809954307bad2d969fba414775c29441f7841d385429e7ebbb9a7255
MD5 364065a7ee8bd74e8a018691bec07982
SHA1 449a58c873839a19bccc2f96ddcfa0f2696f9c82
SHA512 dea89c927e163f897c841d341d7706d77e85b08ee5296ff72fa29e4097bf3187568923e81425586f789eb3bceba83d1591085fc23e2e351a9daefbac9d4c2559
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6pNT:YCSjGoLpWM6VsBEjxZZd45
TLSH
T100935B6AB28DB376D0F299B88E0DF2E5BD397E300E19185FB59E2F0DDA761C1190C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAEFB.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAEFB.tmp
Size 118KB
SHA256 012a812689140fe26e2a9d38d858c01ef95dfe0d0a25d88fb6c073c9a440224d
MD5 b1e7e239177173873b37339e2e8b6dad
SHA1 a063607f9876b7231d5c2760edf6c397e8a4dbca
SHA512 dffa7679ead353184654beb273b19d67e2c4e10c96a61cd913afb0690f5610b330b2cc7f7233f81d54e4dff7010b1da716643754bd6e5791ee12c614aee8c5ca
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnu:JCSjGoLpWM6VsBEjxZZdQe5BV0GH
TLSH
T149C39D69B68CF377D0E259B88E0DF2E57D697E300E19085FB59A2F0DCA7B5C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB1C5.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXB1C5.tmp
Size 100KB
SHA256 98b914476043a60a133695230c7a58a8b98e998782fc3e05359feffdf1b0aa1a
MD5 273def70360dc316efd2aaa618cdfff9
SHA1 e024f868033905998de49bd1a80a0b88cf348799
SHA512 2d3d84858c2748b91159a0cf417fc5c95352b4d0280785cad8e24f8e97d83d80387c6469ecba6729bb4b979a599c584975210664fd34af015d1cd61182fc39cb
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3xNj:oCSjGoLpWM6VsBEjxQZdJUxJ
TLSH
T110A35B1AB69CB3B6D0F189B89D0DF3E5BD397E300E59185BB2AD3B1E9A77081190C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA073.tmp

Path C:\Program Files\7-Zip\RCXA073.tmp
Size 91KB
SHA256 8e1d0351717a214cb777ca055b2d7655bb31f3f82512296abc165525e19aac0a
MD5 800bf3708a3fb44b6593102d1c6b031c
SHA1 c1010bf2df15ede79ff7ffe51af0a56307b3025f
SHA512 0152d3933ff0c5c477080dc85446d2591e171388286a80f9f3852f81a9b73152ad4df61d1e7e043711edd579b979ec09d27e8285a665fca5ccce77ebca36566a
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6tNb:QCSjGoLpWM6VsBEjxGZdsB
TLSH
T12B935B6AB68DB376D0E259B88E0DF1E5BD387E301E19185FB5AE3F0DDA761C1090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA155.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXA155.tmp
Size 92KB
SHA256 5bcd863b4f8c623579ac1e4c0f928f2ed0073292b2ac873b5bbeb191caf1d833
MD5 47c5509353520a1352407ad9fb6b110c
SHA1 f8d6fd70a7f15ceadbc9514ae54715028736fcfd
SHA512 65351f0e1acf48949ac0d5a1a8f2e81e7a599b62a400b0dedd9e05e55e6496225866cc610df706c55ab7f89a61da15bdb51874c623c8a938dee887cddcd86e6c
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6gNL:gCSjGoLpWM6VsBEjxeZdxx
TLSH
T141935C6AB29CB376D0E159B88E0DF2E5BD397E300E19185BB1AE3F1DDA771C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA34A.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCXA34A.tmp
Size 156KB
SHA256 5df4f1a944dfe56d5a468f8bf83a64cff68e395714ca02861ad4b7bc34ebf4f8
MD5 529c7c1ef78ea4300d7576a619cc839c
SHA1 4cb362aaf9d3f92d195566b50067b5c6419af451
SHA512 dd6bcbf54f881b34eed001662a2ff178240a07c0843c3ee49bc094c4c450a5accf52aae9c98a471d50df65cd0d4cc31c93b58ea072fa913b0dea48893d4c8a5b
SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6PnqNz:hCSjGoLpWM6VsBEjx5ZdsqZ
TLSH
T126F3D576B25CB776E0E199B84E0DF1E4AC6D7E201E1BCC6A715A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA3AB.tmp

Path C:\Program Files\Mozilla Firefox\RCXA3AB.tmp
Size 91KB
SHA256 152c274b6bf8e385309d052253a5695168c6bb4adda5c940e4ea983cc994b803
MD5 541dbaf9b11535748926bdf60306df49
SHA1 ba7ffdde613287629bd1b969eaf1f5836d4849b1
SHA512 cdad550ed7b1eee527feb10de01dd8ed8f5c8d01424293e2c1092ad3b3c52bfb2495bdbb5fbabf73db673a31bd79a453fe4f7e3b2a6de872d843ba1641738010
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6PNL:YCSjGoLpWM6VsBEjxmZdax
TLSH
T15A935C59B29CB376D0F259B88E0DF2E5BD297E300F1A185BB5EE2F0DDA7A1C1190C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopConvertTo.exe.Exe

Path C:\Program Files\StopConvertTo.exe.Exe
Size 212KB
SHA256 d9c901bfdd1ccee05bfffd43afa1881557c9605b45a37e52cd3442902ed40848
MD5 60bdd378f39c5a129ad990e3a41eddf1
SHA1 f6a01711c340eb48383ba9b6171895720c4374e7
SHA512 2138e4109bc62a7f92b8ac5b349d0ccae93c1658a4f46a15736dd2ae7fe066c7525de2793e6a7385e1b2c8091388c376de0082ef0f4a345d97f7a7c2ab288aaa
SSDEEP 3072:YCSjGoLpWM6VsBEjx+ZdDwpknQ2OoY0eUfsbgp7lWGec8ADaQszWIYcecJJ7b:uXqoEOD0kQDoYOsbgx2czpeYkb
TLSH
T11124E166F59CB772C0E28AB88D0CF2F0BC297D304F1D195B759E3B1EDAB65D10A08196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1316.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1316.bat
Size 722B
SHA256 941cfbf46dd0de621ea75b75b7e0397814e8536467f20d384946cb5538ad28b1
MD5 a3d7aea7c16e33fac61b476fc708563c
SHA1 74a37a9a5fe31171cdae1a38d26debe52eee7e86
SHA512 06ed8668e327cd03314507bcd48c3230c9d26ec7d02b8dd2fb081226731d9f5a7e593212c92a7fc5675e76df98ccee3cd66c4c1484ed8119e9fb450c5043fff7
TLSH
T119014721817D97F71C85A807A7ACA4DFD4107D14396B530967A288CCE6F187EB585281
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-02_4b27fccb57e96b3709f03adc7865780d_amadey_elex_wannacry.exe.exe
Size 357KB
SHA256 9bad5064112b4a879354c74243a31f375ea41339cfed25535757435785d1c98a
MD5 4fd2a36838ee7d759215894199e3dd41
SHA1 96461e8d813c0764f490d89bb3f44f6a25bad03f
SHA512 15e1de32477cd6f80093459a62d73952a5c9b343339cb110a51cf8f665a7ef7757b77949d206f407d320f167f5bbe0af767cb3198b0af0ac8ea7efefeb3003dc
SSDEEP 6144:xi4es4TCLXauMi9T0Pynk33QGc+A0uDtmFJ2zu6ZpzFgOekPdP3ERblt:A4XmexGyWQh+sISRjjdIJ
TLSH
T152746B113BF9D03AD6620631CF5A9BE5A4F9FB588D704C4723C01A2D5A75C89E239F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 5d11a68f2c637c76abe53ffad21e7b8c4b53b48974f6f652752ab7e32e77750b
MD5 286ceef951b310bcf9debbd4f8883744
SHA1 2deabe8b1bcfa52ba30638c594e4efbc151fb588
SHA512 11f6b4ffcd4b7d8fa20487b7f5dcb7dcbb00cc48336ec82f1e732084b298f3e50f95de4b1168e903dcb3e85a84f5e23b34e5185d6bcaa1369fb19cc849db5cf3
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CwN:YCSjGoLpWM6VsBEjx+ZdDw
TLSH
T163935B6AF29CB776D0E199B88E0DF2E5BC297E304E19185B759E3F0EDA770C1590C281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2944-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2944-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4976-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4976-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4976-931-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4976-1262-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5592-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5592-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download