02bb901a0dea0ac4aad45b4ebfddb97b6a3eb744433bf320c31d2e21ae0a609a

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
Size 105KB
Sample260603-vmr13sct2x
SHA256 02bb901a0dea0ac4aad45b4ebfddb97b6a3eb744433bf320c31d2e21ae0a609a
MD5 ea41c012b4d918f64c9a556bdc79198a
SHA1 1bb2b7b15b7e09db4f3b4fe07f9b38b6a65fcb64
SHA512 10c65012ca2c8f5308587b2e6b7ae4f686dd0f31affa0cd77310b751052f3a2595c3761b1f49b53388e2ddd6d7cf9eabe7f9b39d494707b83e75e48a017c6145
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t67NNm3i1:YCSjGoLpWM6VsBEjxZZd2Dmy1
TLSH
T1ABB36C16B69CB3B2E0F249789E1DF1E1BD397E300E19185FB5AD3F0D9A761C1990C292
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
3084	Logo1_.exe
3804	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXCD04.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXC8D5.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXC8E6.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXCCF2.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXBBD1.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXBB41.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXBC22.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCA23.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCXCBA0.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXC552.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe
3084	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3200	1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe	80
PID 3200 wrote to memory of 1040	3200	net.exe	82
PID 1936 wrote to memory of 1068	1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe	83
PID 1936 wrote to memory of 3084	1936	2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe	84
PID 3084 wrote to memory of 4512	3084	Logo1_.exe	86
PID 4512 wrote to memory of 3380	4512	net.exe	88
PID 3084 wrote to memory of 1152	3084	Logo1_.exe	91
PID 1152 wrote to memory of 4448	1152	net.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AA5.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1068
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4448

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXC894.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC894.tmp
Size 94KB
SHA256 434a70f0044c8ad7235ada4e8649cc85d9e18e9ce44773ddc92d2451aa98d00c
MD5 5487a567bf245f83beda457de2240e1f
SHA1 74b1ad1eeac1652de38da5fa293ae5465238b852
SHA512 6493605e03dacd8ad0a122f5038531d6fd38c58424513ea25628e2bdb22bc0ff5ee6c7b9d1b6ae6b4ceca33db481ff7845783dd684d28518a08c303da266c1f1
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6dND:gCSjGoLpWM6VsBEjx+Zdop
TLSH
T1B7933A5AB28CB3B6D0E159BC8D0FF2E5BD297E201E1D189F75A92F0DDE760C1590C286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCC7D.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXCC7D.tmp
Size 103KB
SHA256 8b8eaad4b545f4188f106425dae3776edfe73f16251e403da50f2881ca4c73a8
MD5 722b17608a116f1c36453564dc68c504
SHA1 ba1ce1337063b578621dc5f280b39b88a480b296
SHA512 d7585cc8cd90c05a17d004af91ff8fb3b6bf7bb0800e888c4aebcfe53c62256a9284069a46ac36061d75c98fce1ceea028e41b4874d5b266a1e44368c8fe871a
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHifNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqSu
TLSH
T102A37C1AB68DB372D0E159BC8E0DF2E57D387E300F1A185FB69E2F0D9A765C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCA34.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCA34.tmp
Size 118KB
SHA256 3d8664750bcc58e811c6303d00156e819052007e6b897e899754621c7f2e362e
MD5 625870c8118fc020abd03cfc4c6281cf
SHA1 adaa466d3ad886ae1af0972589588cff2d873a62
SHA512 47e09636f868ae3f5da71ad6a4adc985fd1f4be4388a655412f293b56ecc2a465e4e90fbcdec2ec05b1549a1f9ade66b8837d68e8a932963d8643c470950a3da
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnp:JCSjGoLpWM6VsBEjxZZdQe5BV0NH
TLSH
T1BAC3AE6AB6CCB376D0E159B84E0DF2E57D697E300F19085FB59A2F0DCA7B5C1190C292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCDC8.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXCDC8.tmp
Size 100KB
SHA256 22214e44cdefbc5dee61840b3a83e3e140ba7f085d10d24c1440c7868418b939
MD5 c28a8a394b61073a7c42638e3d19e8a2
SHA1 660198de492e6b89237e00401d5f45fedd9bbee3
SHA512 48feb9de262b9267c4931703b4e04421431a9587cf51e2c056dccc20c437601f4b5d7da23eb382172e9525c4c12094678f2671702d391a6279efcba253366150
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3eNj:oCSjGoLpWM6VsBEjxQZdJUeJ
TLSH
T14CA35B1AB69CB3B2D0E189B89D0DF3E5BD397E300E59185FB2AD3B1D9A770C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 642KB
SHA256 72b882b61809c3efb43a5c383d76f9f75b6345709f9ce712d92e6cb0707e4fdf
MD5 cff22b90975688c7ffe8031e65a8e806
SHA1 8661aca1833ea61d6d5daff73984bdd72af2fea1
SHA512 41050589e82d3696701106e1879c5e0941480ee846a6934ec7d961adb2152c6a30ff1f9768630d508855d0895f803a875a811056d4a13ca42572aff253043e2f
SSDEEP 6144:uXqoEzMXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:sXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T150E40716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB7F3.tmp

Path C:\Program Files\7-Zip\RCXB7F3.tmp
Size 91KB
SHA256 b6c9bc9c9ce4a932fcd3b2e9794b46257cc2ac42bfe1e767ebe9e8410fa430f3
MD5 8e3040953010ff7533f5b82a39356c31
SHA1 0fba09694b8c2305d495b36ae86b6b07527cddac
SHA512 a6934db7a9cca4df5f14a02e42cd06675b4134ac89018f532d76783169e108bb80d22862578189d798c2622d24987a906fd2104e69ca43cd60848d8922d85bc1
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6aNb:QCSjGoLpWM6VsBEjxGZdLB
TLSH
T1B5935B6AB68DB3B2D0E159B88E0DF1E5BD387E301F19185FB5AE2F0DDA761C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB961.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXB961.tmp
Size 92KB
SHA256 c6ec7e77b5267907b103791507122327d30728c72085e343d1f76dc30757bb84
MD5 3e803da29f9b3e157b86ea7a2c3cf6c0
SHA1 e6d7813cd1f858157f473add526ebbe585450ac6
SHA512 f6f3f829ad6b34d6393cc27dcc86777e49dbcc6f271f22e0611868351549e109de0488cafa76d778e6d38a9ac9ff096c151f7d94b01fcbf514f7360fc34ab536
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6/NL:gCSjGoLpWM6VsBEjxeZdex
TLSH
T169935C5AB29CB372D0E559B88E0DF2E5BD297E300F19185F71AE3F1DDA761C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe.Exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
Size 4.3MB
SHA256 6c1230bee71620c274dd5918b7d3e08f2eb4b28c3315d951d6d5bb67e2d72566
MD5 343f35654dd04c8d62cfa222a98c9469
SHA1 8b6fd61c1c4f2b9e1c2ca89f9a03ea7bb3378c9c
SHA512 8edb1ecac29ff38db00f0c23ce2a616d6d1ba1daa0fb40f6e3374b570c09a7936d420fa83ac0c3c09ae9d73cdd2ee0de60ba0ad639bb19f7405619c8483c82f2
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:rQvGAdlCEL8c/bRNw5CO
TLSH
T1B6263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBC44.tmp

Path C:\Program Files\Mozilla Firefox\RCXBC44.tmp
Size 91KB
SHA256 f4b6a162c5e244b4904afa420b3d0c575745e846f28f946c9f4c4e806561b769
MD5 686f84cbee2198183c62079116aa803a
SHA1 0bcf951622a50c94b22081fce35fb597e5f91676
SHA512 e095a213c3c1361d28827d72a843f1ba292a624f4e42a5b89472da24b0efad96c903d081cd5eb34dccd5f5445b260df1640385a63c0ad7f14e425df673c86b7e
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6ENL:YCSjGoLpWM6VsBEjxmZdBx
TLSH
T11A934C5AB28CB376D0F159B88E0DF2E5BD297E300F19185BB5EE2F1DDA7A1C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD23F.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXD23F.tmp
Size 92KB
SHA256 7d19ba0494c9fe8ed6e2b1aac4e58453564950a27682bebb7ec51c9495fbd38f
MD5 1b11f48becb7c3abf11126e5e2dce65a
SHA1 18523b7b985a0aaf28535bffa3a13325c5a8031a
SHA512 6a19f7d2fb36ab37a12f2bedf1020357f394aec30f96ad42793263b39ada815283281ecd461a45c66b5f2267f8d5b89ca0298dfa89ebcf5afe87b1aab18123f7
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CvND:YCSjGoLpWM6VsBEjx+ZdDvp
TLSH
T1B3935C66F29CB376D0F199B88E0DF2E5BC297E304E19185B75AE2F0DDA770C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2AA5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2AA5.bat
Size 722B
SHA256 091cabc5d60e778cd92fdc3de800d13e0cebbb122b41bd4efc5d17078e36e474
MD5 5f02deafdaa266c621ab31e810324e3c
SHA1 f1ec5a68040be2deaa575c6a729b954a7d8dfe1e
SHA512 7f9e0b5b986dd38f6d029e2f114dd689fd8f271c6256d4c7091cd0f3b90cfbe35f2414512a0f43463f69d058579cb18c288e52334f750dad4a1d356fe2121346
TLSH
T199018480C1ADE7372CC6791B56E0544FC021BC053D2B230C2B24E69DB3D396EB6C6984
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-03_ea41c012b4d918f64c9a556bdc79198a_amadey_elex_wannacry.exe.exe
Size 12KB
SHA256 87e7d2e3a456d4b5ef4842ad2174012e6d08a245d35a7dc14061bc440fb90a73
MD5 b95fdf5ea178565e31811ba33ea56e31
SHA1 1fec9de4420ba669a5f501fb82747bec6e555f06
SHA512 9bea1de3409ff409b47f8db391ef201703c214d6f750bd44dbaf80c107b6b78f4f6b92b1f8ba2741175445e377ba9b47db358ce1aba2c00bd12cedb48bd76bc1
SSDEEP 192:ZaAKdNi9l6Nskfq+NpC/DL6HOO78c/JNpWP1oynJ+y7ihX6r28d/o:ZtK7gYKkfqn6HppA13+y7+X61
TLSH
T14242E5028BA400A6FBFB1A307EF96E4755B6BE210855EE5D06707BDD1D30640EAA3363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 a3bb2b5d2fe9b1fb57342e27de060ae42ec69f5f65ee8b050f7faf62b4973f05
MD5 8e8d16e2a8c2774c473b5e7211624d26
SHA1 59030f4b5a05979333292bb901c18fae41e330df
SHA512 3120de6a22c4350bdfc502b25388b93f97b4436037c100376308d92bfbc04e8bd4afd8d28d845f923ee0b4ef71db96d41c62e19086a3903e3c7d045575127ae7
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t67ND:YCSjGoLpWM6VsBEjxZZd2l
TLSH
T1F9936C6AB68CB372D0E159B88E0DF1E5BD397E301F19185FB5AE2F0DDA761C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1936-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1936-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3084-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3084-712-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3084-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3084-1254-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3804-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download