wannacry | 936bb1d52fa66079c0d798ff539ea585fae4a9de47ce5ef5877c40e62ca372cd

Resubmissions

14/08/2026, 04:24

260814-e1nmtavthx10

14/08/2026, 04:22

13/08/2026, 20:46

13/08/2026, 20:45

13/08/2026, 20:26

Analysis

user interaction
yes
max time kernel
208s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Size 2.2MB
Sample260814-e1nmtavthx
SHA256 936bb1d52fa66079c0d798ff539ea585fae4a9de47ce5ef5877c40e62ca372cd
MD5 84e717a61b75e86d0dd359e12a1652c2
SHA1 e021122e683b4c0fe0e2d6c3c9db4f7bfe8cb35e
SHA512 e5cce57fca144f78f18063370c2d57b38088983bce66fd275b2b2c19ec02d89e24fef3cf8cfdd3bd909a0452ec3f49dbce58e000985d5d3648121e52913348e2
SSDEEP 49152:QnsQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA9n:Q/qPoBhz1aRxcSUDk36SAon
TLSH
T13FB5F115A1E86B64E6F25FF2217B8710437A3E45899B925E1760A04F0C33F5CDEE2F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (4422) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002467255ca52bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000461f655da52bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb0b885ba52bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c49645ba52bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b167065ca52bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001563825ca52bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db89895ca52bdd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1536	WINWORD.EXE
1536	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	5964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5964	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1536	WINWORD.EXE
1536	WINWORD.EXE
1536	WINWORD.EXE
1536	WINWORD.EXE
1536	WINWORD.EXE
1536	WINWORD.EXE
1536	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 452	5964	SearchIndexer.exe	112
PID 5964 wrote to memory of 4740	5964	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1968

C:\Users\Admin\AppData\Local\Temp\2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-13_84e717a61b75e86d0dd359e12a1652c2_coinminer_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3772

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SendOut.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:452
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD7A04.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 262B
SHA256 aff509b2d9f70e32030452d0f9a0f5b680ae68abf4b5b682c4c1f06f1d00052c
MD5 bf9bb0bf69c402ccdc10ecd363885bc5
SHA1 ecdbd3664c1aaee26a5757b16ca88d3fd41e7695
SHA512 79948823457ee62610ab97e14fc4daa4f0e3d48b66eb9f485e1c83d6c818c6906c3ae557bf89f00fa5a849a0ed5c4e2b5ed120d902dab26d3b0fda815fa50978
TLSH
T106D0676B2326D7F2837CC2E5BB365CD847F25858D264202110DD0D824EA0553649F959
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 2f5c2c7605a16762af3de2667dd90c586dfc3fae466b83446579ec2cbf2dc352
MD5 0c67be47a44c3ccb892e396ccaa6be3c
SHA1 8aa5a9df14de74fc37892c50d980e20649ddd600
SHA512 28e59c708d22a7c252aa7d89c89045fa02a398231bbca8fc6f3fc9c6aca8333b60947c9c0080687b4c9035def08ddf41db18698404618a07eccc2d52e07aa772
TLSH
T1FE210D1162EF1F5BD050C37282BA5729DB307C03D646274E9584111FAC70E009F6D7BA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1536-4-0x00007FFCD798D000-0x00007FFCD798E000-memory.dmp

Download

memory/1536-3-0x00007FFC97970000-0x00007FFC97980000-memory.dmp

Download

memory/1536-5-0x00007FFC97970000-0x00007FFC97980000-memory.dmp

Download

memory/1536-1-0x00007FFC97970000-0x00007FFC97980000-memory.dmp

Download

memory/1536-2-0x00007FFC97970000-0x00007FFC97980000-memory.dmp

Download

memory/1536-12-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-11-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-14-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-15-0x00007FFC957B0000-0x00007FFC957C0000-memory.dmp

Download

memory/1536-13-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-10-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-9-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-16-0x00007FFC957B0000-0x00007FFC957C0000-memory.dmp

Download

memory/1536-8-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-7-0x00007FFC97970000-0x00007FFC97980000-memory.dmp

Download

memory/1536-6-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/1536-52-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp

Download

memory/4740-537-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-541-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-545-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-544-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-522-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-523-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-524-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-525-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-526-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-527-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-528-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-532-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-534-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-535-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-548-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-536-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-533-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-531-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-530-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-529-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-538-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-539-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-540-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-543-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-542-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-549-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-546-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-547-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-553-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-552-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-551-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-558-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-559-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-557-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-562-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-569-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-568-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-567-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-566-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-565-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-564-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-563-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-561-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-560-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-556-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-555-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-554-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/4740-550-0x0000020A06A90000-0x0000020A06AA0000-memory.dmp

Download

memory/5964-496-0x000001EB5F8C0000-0x000001EB5F8D0000-memory.dmp

Download

memory/5964-481-0x000001EB5F6A0000-0x000001EB5F6B0000-memory.dmp

Download

memory/5964-518-0x000001EB69310000-0x000001EB69318000-memory.dmp

Download

memory/5964-512-0x000001EB67C80000-0x000001EB67C88000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads