Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 00:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe
- Size 1.7MB
- Sample260715-anz3vsgt2r
- SHA256 b4904c4fbfdd71e213e3c98c432104c23f92fce855f068a79925e9685f811bc1
- MD5 b67d1820f537ae27d0d78ab6ea449fd9
- SHA1 c6a53820e4bfb38218cad7fe402b36bcf0403f72
- SHA512 8352dcc37bcd52cadad797e2146d31b58fee12cad75bdb660c9cd2552ecdab3354ab7eab022ae9697b703fdd3103cb8f56e7e4053d6d5fee1bc11bf897a200bf
- SSDEEP 24576:NjudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:1BYH2afPAgkMcxNU
- TLSH T152854B15B29E73F1CEC5A87028AEB3FE6E749F850B165BC3A318DE2855623D2943711C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 2764 Logo1_.exe 2736 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\RCXD96F.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXE9CB.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\RCXD981.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE7B8.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe File created C:\Windows\Logo1_.exe 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe 2764 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1136 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 87 PID 1136 wrote to memory of 2828 1136 net.exe 89 PID 5052 wrote to memory of 1416 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 90 PID 5052 wrote to memory of 2764 5052 2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe 92 PID 2764 wrote to memory of 4444 2764 Logo1_.exe 93 PID 4444 wrote to memory of 4552 4444 net.exe 95 PID 2764 wrote to memory of 2656 2764 Logo1_.exe 98 PID 2656 wrote to memory of 4592 2656 net.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BF3.bat2⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4552
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4592
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXE6D5.tmp
- Size 94KB
- SHA256 ef815e5c2515ca3fae17ff993ba01d4669742f4ee90af18be6ecf4da351233d9
- MD5 c2427e823d0eaafed12eb06b77911954
- SHA1 7d2e14ba9e59fde63562f09c147b6ac1e587eed9
- SHA512 f657fbc674e65dfde721e46f2426bf4836776add03dec5eda68f2ef559940fd47e8ceb20c1aa0209b42ae6332e0e38db6ba9ea99b12f6b6268d10df229d34b03
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxDZ2HQuhtjRQXfND:ACSjGoLpWM6VbBVjxDZ2wuhttQvp
- TLSH T1B4933A56B18CB376D0E299BC8E0FF2E1BD257E300E1D089BB5993F0DEE761C15918296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXE947.tmp
- Size 103KB
- SHA256 6812d50aec3850193af270464f2b79950d3960037e5375b134df9c8655d6c766
- MD5 f555195b883241005b0c504ed0ef65ca
- SHA1 4d69738c3fc3b31435cd28f2b4fe3a74eba35ede
- SHA512 52a05a0b9dfb079cc6ac363bb654bc38c3670202f1eea542db4a1c74f58dd41958799e7bd6e3aa5b6a08c286285f1c23c3faafb5c1aab3f861f9011144f4799d
- SSDEEP 3072:YCSjGoLpWM6VbBVjx+Z2wuhttQcdtPlLqcu:uXq1Vt9RLs
- TLSH T187A36C5AB28DF372D0E29ABC8E0DF2D17D397D301E19185BB69E2F0DDAB61C1090C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE7F8.tmp
- Size 118KB
- SHA256 76385d8ac03603e12af1c7e9d0df3eed8bf9a0b6cd9eaac2c71481f61bd293d4
- MD5 20c1b2dcf3b31223bd1c8a37fff06507
- SHA1 071ee6092e1002db26225267f67bc284bafb7ec8
- SHA512 72f60ed81dd23492cd8fbe59d5d5c359b80944bff5588feb1df0f5a4d7eba61f927090249a6d18cb9f9e876221a33ff9645db0ae4a493149e9f6df46a66395bc
- SSDEEP 3072:FCSjGoLpWM6VbBVjxEZ2wuhttQPe5BV0PH:vXq1VX9ae5v0v
- TLSH T1BBC39D6AB68DF377D0E299B88E0CF2E57D257E301E19085BB5993F0DCE7B1C15908292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXEAE1.tmp
- Size 100KB
- SHA256 5d833741eefd0cbf607b9d48af9fed37dff86c9dedb80472ec0d80f6c7b2ef44
- MD5 c4daa4431eca1ddfd3ea2dabb5211196
- SHA1 3efd6cd6723bcfa3ade28d04ee6f37ee5f259018
- SHA512 33efe834b0b289cb00e6447e81b7d74d5ff76bd09a8e2f025cd1163a005aa2b8212e164d206f2d06964025bceb116f8dec425ce482814ec097d0c2866df0d3c5
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxdZ2HQuhtjRQXeqkSZZZ3oNj:4CSjGoLpWM6VbBVjxdZ2wuhttQgUoJ
- TLSH T150A36B56B68DB3B2D0E18AB88E0CF3E1BD357E300E59185BB29D3B1D9E771C2191C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXD970.tmp
- Size 91KB
- SHA256 eddb405e5bf9b4013a91b699fd3c577dbbd790d589974fc122680c3da131ed59
- MD5 eccdbb0028855a364ca6574aee4c4802
- SHA1 72325848afb26751a97116297571df970babc137
- SHA512 6d015c5ecdb609558c68f06b54a08164350d0a970d89c77cc4fb592ac67b5be03a00799e3867390ff7bed3dfdf870a570fa43962b1e2eaebd05301dfca7ee359
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxrZ2HQuhtjRQXkNb:oCSjGoLpWM6VbBVjxrZ2wuhttQ0B
- TLSH T1A7934B5AB68DB376D0E299B88E0CF2E5BD397E301E19185FB69D3F0DDA761C1090C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe
- Size 377KB
- SHA256 700c69d634cabc1d9ef3bec9178c1c1d150ea159147556dc43785f1867bddf2d
- MD5 c9c8108a6cc3bed70164e9373e5e03df
- SHA1 8e51bae0f69a2b71a1d37e4321fcb464310091db
- SHA512 a825eb4ef0e301809e91ae37d11be70bd01249c6f84c39fab2fe98e2f4a2802ffcb1bf3707f36ea6f04b8d4acb22649486f19de390d701ff716601058e39371d
- SSDEEP 6144:GXq1Vm9AAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:SACd9/WYoaLHF3z0z04PDvhI
- TLSH T104848C95B29C3BF4D8E281398D1DB546EEB27C250B20C65F23A8371A5F333911C2DB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 9ef1c298bfc5faa680abff8301aa313bf059bc6e3759fe73b6dbf862257cf19b
- MD5 65780eea5b00124ea82f39d2a2a7e344
- SHA1 db451fa18b84523407e3341e6ed7ec9b82b70336
- SHA512 c1ca809f7949347525e735f316dad7c50681ada34156bc6d233b8e5d261f7d1b407da1b8438c92c9c8fb3bf53a385f5d491bd697ad6199e0166daa1c48ff3ccb
- SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:hQvGAdlCEL8c/bRNw5CO
- TLSH T159263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXDE4E.tmp
- Size 91KB
- SHA256 dcb25691069045854e8cfa1478c2b86b14db7628faeb53350ca524e78f8a9be5
- MD5 6d4a2056f1fbdb2a36b585dce5c0b9d5
- SHA1 86157e6fdecc1687af7ba8e54d7b1c47a5721454
- SHA512 f8de2d23ea5205f367a58309f9894f71170a4e7263003e580a2c8c19846e261296a582bdb0f4f197403c7e034cc9ddb505742cf02c2424af7f4a3cf6f68f55c7
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxLZ2HQuhtjRQX2NL:wCSjGoLpWM6VbBVjxLZ2wuhttQGx
- TLSH T141935B5AB28CB376D0E2A9B88E0CF2E5BD257E300E19085BB5DD3F1DDA771C15A1C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
- Size 545KB
- SHA256 43387f29be812cdcd617761790b37f5e2d82955de4c91494f6b552e74151db12
- MD5 229f70a4b9ca4427cd1f47b30d863de0
- SHA1 29ef74de91ef772ce90bec07c2112c21e21fc94c
- SHA512 6eabcf56e1ce07c0ee4e389211845e23c2fae986aafbe2ba0b57b10251dd725312e92813a08fd7b945823135a371c5ede3bce287849f29c15fc3db517b1387f9
- SSDEEP 6144:uXq1Vw9r78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:4f85bM3npxYfj63hgD1ZiL
- TLSH T1D5C4D502B7EDB335F2F31B31AE7DB2515E7ABC619D35860E23841A0D49B0580EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXF061.tmp
- Size 92KB
- SHA256 bec1eeac7f6b8fee890de7c7c735281ab7c863380fef39247ddffe709dc0a38b
- MD5 7e6347fe7b9b7b671803dbf61f493067
- SHA1 563a1c024aad9fd5da337c7db1a5b4655015994f
- SHA512 56ec3c69620ce32c862cddf031465e2292d5b2f19c73b1f6bbcc903ff8b5ff60ce94a783a64a95c38a1735df0430fe25ef012b8cdee10c9cfaea78eb36447afb
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxDZ2HQuhtjRQXCBND:4CSjGoLpWM6VbBVjxDZ2wuhttQSBp
- TLSH T17C934966F28CB776D0E299B88E0DF2E1BC297E304E29185B759D3F0DDE771C14908286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a4BF3.bat
- Size 680B
- SHA256 390fd6ed609da80c79e6c19d146c6f51045f561740db445d0599d354370c49d5
- MD5 4bf8acd9ffc4f1881cda1c8720bc89b8
- SHA1 6913714ed2c31edc3f79a71435a7133ef719c3b2
- SHA512 4a5eb5b5dc869d2a1c92c6cd68d79b78d6ac6665cc3028e1bdd914e28dff9e9cce8190db72406763e341d2ec7700b1b8452584632e3072191b1aeea4581ea711
- TLSH T11501D683C47EC56F2440D81B9AF1794FDA73FE477A47375DA324C6466AC190DB487290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-14_b67d1820f537ae27d0d78ab6ea449fd9_elex_wannacry.exe.exe
- Size 1.7MB
- SHA256 1d814ff9d14a918e9ad884cc10c9ae13d43de8425ec2f7e16ac354565e370cc3
- MD5 a949341ecf2c417d4f0eb4d37073ae99
- SHA1 a1a72adc552a946710417db6563355dcd2e57dff
- SHA512 c30e815f7d8f0f1851db23c9c1f45cfc91cc2b84f292035b1878a1ef920576107c851447a9c6ba588d9a64e840702a4eda4078182e591afc4f377856c14542b1
- SSDEEP 24576:gudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:gBYH2afPAgkMcxNU
- TLSH T186855C15B29A41F1CE45A87028EEF7FE66749B890B1A9FC3A318DE3C55723D2A43711C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 759d305d812fb2b50cc120ae8582d767caf9071f4a018192418bf1faf5a603e0
- MD5 29670728652eb55eeeb38050b78c8fdd
- SHA1 462bbc159d9f737b32f097d3b8166ccdbc5350fd
- SHA512 68c89799575466d39efb66cf38031f5c6ac5cff9e6816edb6cf28b58eaefaa4806cd97e20af6d11147359739997215c59cd57beb2a5f312872403708286d80be
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxEZ2HQuhtjRQXRN:ACSjGoLpWM6VbBVjxEZ2wuhttQh
- TLSH T1FD934B5AB28DB776D0E299B88E0CF2E1BD397E301E19185BB69D3F0DDA771C1490C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH