2026-10-02_37bcc4313b0efd275cc45977bcf244cb_elex_wannacry
Wannacry ransomware with credential theft
Protected Storage passwords sent by URL-encoded HTTP POSTIE Protected Storage credential theft
SHA-2562d219cb99b8786093d16451d0149e6f396d4e7d00119ab56894a9a75ae9649c7
Evidence
⋯3 more rows
0x1d800000000000000000000000000000000................
0x1e8555058300000000000a0020000100000UPX0............
0x1f800a00200001000000000000000000000................
⋯7 more rows
⋯5 more rows
0xff0c22469f6a9fcfb944e904dde9c73c753.$i.....N.M..s.S
0x100000000000000000000000000000000000................
0x101000000000000000000000000000000000................
0x102000000000000000000000000000000000................
0x103000000000000000000000000000000000................
0x104000000000000000000000000000000000................
0x105000000000000000000000000000000000................
0x106000000000000000000000000000000000................
0x107000000000000000000000000000000000................
0x108000000000000000000000000000000000................
0x109000000000000000000000000000000000................
0x10a000000000000000000000000000000000................
0x10b000000000000000000000000000000000................
0x10c000000000000000000000000000000000................
0x10d000000000000000000000000000000000................
0x10e000000000000000000000000000000000................
0x10f000000000000000000000000000000000................
0x110000000000000000000000000000000000................
0x111000000000000000000000000000000000................
0x112000000000000000000000000000000000................
0x113000000000000000000000000000000000................
0x114000000000000000000000000000000000................
0x115000000000000000000000000000000000................
0x116000000000000000000000000000000000................
0x117000000000000000000000000000000000................
0x118000000000000000000000000000000000................
0x119000000000000000000000000000000000................
0x11a000000000000000000000000000000000................
0x11b000000000000000000000000000000000................
0x11c000000000000000000000000000000000................
0x11d000000000000000000000000000000000................
0x11e000000000000000000000000000000000................
0x11f000000000000000000000000000000000................
0x120000000000000000000000000000000000................
0x121000000000000000000000000000000000................
0x122000000000000000000000000000000000................
0x123000000000000000000000000000000000................
0x124000000000000000000000000000000000................
0x125000000000000000000000000000000000................
0x126000000000000000000000000000000000................
0x127000000000000000000000000000000000................
0x274580505050505050505bfa51505cda51505................
0x27468dda5150505050505eda5150505050505................
0x27478eba51505050505050a05058505050505................
0x274884e40574b404936372b41494905485653N@WK@I67+AII.HVS
0x274984657512b616969055056405736372b61FWQ+aii.PV@W67+a
0x274a86969055256375a36372b616969050505ii.RV7Z67+aii...
0x274b8496a6461496c677764777c4405054260IjdaIlgwdw|D..B`
0x274c87155776a66446161776076760505536cqUwjfDaaw`vv..Sl
0x274d8777170646955776a7160667105056377wqpdiUwjq`fq..cw
0x274e860600505466469694b607d714d6a6a6e``..FdiiK`}qMjjn
0x274f8407d05050595150509050505983e0505@}...........>..
0x2750805050505050505050505050505050505................
0x2751805050505050505050505050505050505................
0x2752805050505050505050505050505050505................
0x2753805050505050505050505050505050505................
0x2754805050505050505050505050505050505................
0x2755805050505050505050505050505050505................
0x2756805050505050505050505050505050505................
0x2757805050505050505050505050505050505................
0x2758805050505050505050505050505050505................
0x27598050505050505050505050505 ............
0x275f40505050505050505507742009c774200........PwB..wB.
0x27604a4774200ac774200b4774200bc774200.wB..wB..wB..wB.
0x2761461647661706933322e646c6c00000000advapi32.dll....
0x276246b65726e656c33322e646c6c00000000kernel32.dll....
0x2763447657450726f63416464726573730000GetProcAddress..
0x27644476574456e7669726f6e6d656e745661GetEnvironmentVa
0x27654726961626c65410057696e4578656300riableA.WinExec.
0x27664436f707946696c654100000053657446CopyFileA...SetF
0x27674696c6541747472696275746573410000ileAttributesA..
0x2768452656753657456616c75654578410000RegSetValueExA..
0x276945265674f70656e4b6579410052656743RegOpenKeyA.RegC
0x276a46c6f73654b657900687474703a2f2f62loseKey.http://b
0x276b475626c696b6961646d696e6973747261ublikiadministra
0x276c4746f722e636f6d2f0000000068747470tor.com/....http
0x276d43a2f2f6275626c696b696d616e616765://bublikimanage
0x276e4722e636f6d2f00006f6c645f6c6f6164r.com/..old_load
0x276f4000000005f5f5f5f5f5f5f5f005f5f5f....________.___
0x277045f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f________________
0x277145f5f5f5f5f5f5f5f5f5f5f5f5f000000_____________...
0x277246366746d6f6e2e657865000073706f6fcftmon.exe..spoo
0x277346c732e657865000066747033332e646cls.exe..ftp33.dl
0x277446c000000633a5c73746f7000666c6962l...c:\stop.flib
0x277540000000077696e696e65742e646c6c00....wininet.dll.
0x27764496e7465726e65744f70656e41000000InternetOpenA...
0x27774496e7465726e65744f70656e55726c41InternetOpenUrlA
0x2778400000000496e7465726e657452656164....InternetRead
0x2779446696c6500000000706b696c6c000000File....pkill...
0x277a466736f636b73000066666c6173680000fsocks..fflash..
0x277b4666d696e69617600667073746f726167fminiav.fpstorag
0x277c465000000256400007200000072000000e...%d..r...r...
0x277d44142434445464748494a4b4c4d4e4f50ABCDEFGHIJKLMNOP
0x277e45152535455565758595a616263646566QRSTUVWXYZabcdef
0x277f46768696a6b6c6d6e6f70717273747576ghijklmnopqrstuv
0x278047778797a303132333435363738392b2fwxyz0123456789+/
0x2781400000000252525303258000077000000....%%%02X..w...
0x278246e747573657200006175746f6c6f6164ntuser..autoload
0x278340000000055696072716774635a4b6f65....Ui`rqgtcZKoe
0x278447469756960725a516f68626971755a45tiui`rZQohbiquZE
0x27854737474636872506374756f69685a5473sttchrPctuoihZTs
0x27864685a0000496d61676550617468000000hZ..ImagePath...
0x27874515b5156474f5e41777070676c76416dQ[QVGO^AwppglvAm
0x278846c76706d6e5167765e516770746b6167lvpmnQgv^Qgptkag
0x27894715e51616a6766776e67000022253122q^Qajgfwng.."%1"
0x278a420252a00202225312220252a00000000 %*. "%1" %*....
0x278b45a637e63606f6a635a756e636a6a5a69Zc~c`ojcZuncjjZi
0x278c47663685a65696b6b6768625a00000000vchZeikkghbZ....
0x278d4577d7770616940766d7261005c000000W}wpai@vmra.\...
0x278e46d616e64612e70687000000064617461manda.php...data
0x27a4026733d005f000000416d6c76676c762f&s=._...Amlvglv/
0x27a50567b726738226372726e6b6163766b6dV{rg8"crrnkacvkm
0x27a606c2d7a2f7575752f646d706f2f77706el-z/uuu/dmpo/wpn
0x27a70676c616d666766002f0000002f000000glamfgf./.../...
0x27a80504f535420257320485454502f312e31POST %s HTTP/1.1
0x27a900d0a486f73743a2025730d0a436f6e74..Host: %s..Cont
0x27aa0656e742d547970653a206170706c6963ent-Type: applic
0x27ab06174696f6e2f782d7777772d666f726dation/x-www-form
0x27ac02d75726c656e636f6465640d0a436f6e-urlencoded..Con
0x27ad074656e742d6c656e6774683a2025640dtent-length: %d.
0x27ae00a0d0a25730000000a000000233a5c00...%s.......#:\.
0x27af06377766d70776c2c677a67006377766dcwvmpwl,gzg.cwvm
0x27b0070776c2c6b6c64007700000059637776pwl,kld.w...Ycwv
0x27b106d70776c5f0000000d0a0000516a676empwl_.......Qjgn
0x27b206e477a67617776673f6377766d70776cnGzgawvg?cwvmpwl
0x27b302c677a67000000007067652266676e67,gzg....pge"fgng
0x27b40766722204a494e4f5e514d4456554350vg" JINO^QMDVUCP
0x27b50475e4f6b61706d716d64765e556b6c66G^Okapmqmdv^Uklf
0x27b606d75715e41777070676c76546770716bmuq^AwppglvTgpqk
0x27b706d6c5e477a726e6d7067705e40706d75ml^Gzrnmpgp^@pmu
0x27b80716770224a676e726770224d60686761qgp"Jgnrgp"M`hga
0x27b90767120222d6400004578706c6f726572vq "-d..Explorer
0x27ba02e657865000000005368656c6c000000.exe....Shell...
0x27bb0514d4456554350475e4f6b61706d716dQMDVUCPG^Okapmqm
0x27bc064765e556b6c666d7571224c565e4177dv^Uklfmuq"LV^Aw
0x27bd07070676c76546770716b6d6c5e556b6cppglvTgpqkml^Ukl
0x27be06e6d656d6c5e00006c6f676f6e75692enmeml^..logonui.
0x27bf0657865005549486f73740000514d4456exe.UIHost..QMDV
0x27c00554350475e4f6b61706d716d64765e55UCPG^Okapmqmdv^U
0x27c106b6c666d7571224c565e41777070676cklfmuq"LV^Awppgl
0x27c2076546770716b6d6c5e556b6c6e6d656dvTgpqkml^Uklnmem
0x27c306c5e00005c75736572696e69742e6578l^..\userinit.ex
0x27c40652c000055736572496e697400000000e,..UserInit....
0x27c50514d4456554350475e4f6b61706d716dQMDVUCPG^Okapmqm
0x27c6064765e556b6c666d7571224c565e4177dv^Uklfmuq"LV^Aw
0x27c707070676c76546770716b6d6c5e556b6cppglvTgpqkml^Ukl
0x27c806e6d656d6c5e00007067652266676e67nmeml^..pge"fgng
0x27c90766722204a494e4f5e514d4456554350vg" JINO^QMDVUCP
0x27ca0475e4f6b61706d716d64765e556b6c66G^Okapmqmdv^Uklf
0x27cb06d75715e41777070676c76546770716bmuq^AwppglvTgpqk
0x27cc06d6c5e50776c20222d64000070676522ml^Pwl "-d..pge"
0x27cd066676e67766722204a4941575e514d44fgngvg" JIAW^QMD
0x27ce056554350475e4f6b61706d716d64765eVUCPG^Okapmqmdv^
0x27cf0556b6c666d75715e41777070676c7654Uklfmuq^AwppglvT
0x27d006770716b6d6c5e50776c20222d640000gpqkml^Pwl "-d..
0x27d107067652266676e67766722204a494e4fpge"fgngvg" JINO
0x27d205e514d4456554350475e4f6b61706d71^QMDVUCPG^Okapmq
0x27d306d64765e556b6c666d75715e41777070mdv^Uklfmuq^Awpp