Analysis
-
max time kernel
199s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 12:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Ransomware.WannaCry/Ransomware.WannaCry.zip
Resource
win10v2004-20231127-en
General
-
Target
https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Ransomware.WannaCry/Ransomware.WannaCry.zip
Malware Config
Extracted
C:\Users\Admin\Desktop\WannaCry\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD591A.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5930.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Executes dropped EXE 19 IoCs
Processes:
taskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe@[email protected]taskse.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exepid process 1568 taskdl.exe 4412 @[email protected] 3832 @[email protected] 960 taskhsvc.exe 4336 taskdl.exe 3180 taskse.exe 4324 @[email protected] 2732 taskdl.exe 2292 taskse.exe 2492 @[email protected] 2448 taskdl.exe 3788 @[email protected] 3080 taskse.exe 2456 taskse.exe 2244 @[email protected] 2964 taskdl.exe 868 taskse.exe 4952 @[email protected] 3408 taskdl.exe -
Loads dropped DLL 8 IoCs
Processes:
taskhsvc.exepid process 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiuocvyzvzhojii822 = "\"C:\\Users\\Admin\\Desktop\\WannaCry\\tasksche.exe\"" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe@[email protected]description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings chrome.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
chrome.exetaskhsvc.exechrome.exepid process 784 chrome.exe 784 chrome.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 960 taskhsvc.exe 3912 chrome.exe 3912 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
Processes:
chrome.exepid process 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe Token: SeShutdownPrivilege 784 chrome.exe Token: SeCreatePagefilePrivilege 784 chrome.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
Processes:
chrome.exepid process 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
chrome.exepid process 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
pid process 4412 @[email protected] 3832 @[email protected] 4412 @[email protected] 3832 @[email protected] 4324 @[email protected] 4324 @[email protected] 2492 @[email protected] 3788 @[email protected] 2244 @[email protected] 4952 @[email protected] -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 784 wrote to memory of 3768 784 chrome.exe chrome.exe PID 784 wrote to memory of 3768 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 2428 784 chrome.exe chrome.exe PID 784 wrote to memory of 5092 784 chrome.exe chrome.exe PID 784 wrote to memory of 5092 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe PID 784 wrote to memory of 4140 784 chrome.exe chrome.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3596 attrib.exe 4252 attrib.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Ransomware.WannaCry/Ransomware.WannaCry.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe20c09758,0x7ffe20c09768,0x7ffe20c097782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4504 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4612 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5000 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5824 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2372 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6096 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6164 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4804 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6300 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6080 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6476 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6336 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=892 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6108 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4700 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5076 --field-trial-handle=1876,i,1134150889598825382,2063367542336618453,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 236221701176341.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]
-
C:\Users\Admin\Desktop\WannaCry\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kiuocvyzvzhojii822" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry\tasksche.exe\"" /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kiuocvyzvzhojii822" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\Desktop\WannaCry\taskse.exe
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\WannaCry\taskse.exe
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]
-
C:\Users\Admin\Desktop\WannaCry\taskse.exe
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]
-
C:\Users\Admin\Desktop\WannaCry\taskse.exe
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\WannaCry\taskse.exe
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]Filesize
682B
MD59ae3b7e78d300b3c18411abb96ee5891
SHA1e4fa0710cc169ec15b9360c43582f6238ab9db56
SHA25622d30529de7112df0348a3c78d57dda89b7df2d49ece658a549208feb0cbedf3
SHA512cfc5e9017d94c94b49d6fad26ebb37913ff5431a0ea25de567539f7acdae75096258920edc93c47d06169bf0d84cf426040d0b830145c0756a89049f28f31ba7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001dFilesize
83KB
MD54ae16447c56dff594c781cee13ed5ff3
SHA18e5bc09718735aafc48817c81582f01060f1f37b
SHA256c875f8a9973beb3ea123cb13107d63fe49ecfb5eb77d7d3c2337eeff3ee511c0
SHA51252c21138be819b288260cc2b96a3ecf58533d1087853a1ab11fb811797ec8755385dce82ad3dfc0d8566eda70286f208258fa1948c0e54e11375076cbec4293d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001eFilesize
51KB
MD52cd7d394147c07c85f985c6dc48d5fd2
SHA10387c0b69bbec67973bcbd3656093c4992c9fbec
SHA2562391b9c59036f1a48f4a91643fbcfabfcd6aaddee0503030112db869eda46cbc
SHA5124ae0a3e6db4f17951236efb392403812ed5d34094d4cf0f64930ced2c444e938d4b2fabdd0023d48d762233a998a15b7fc75c0a4a8d4b34fa14aef5bfe755e17
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021Filesize
55KB
MD56ba29c9468d00fe802faa4ff7de24876
SHA1a860c3865b9be3ef234cb1d131d59dd7b91ed376
SHA256178709fc52bd60720465fb535be644f856313108606dc4ea002ae01fc23deced
SHA5124ef36c69ac8dfedc75f350ae7719a5b1fe14928340a65833cad254a1d4075c4600afc8320aac4dcdfa12b7cf35f43864d66a9f6cc1184f454907ebda7f0106dc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024Filesize
16KB
MD55f65521f6c6223e1e18cb161832bea2a
SHA1f03800023e7bbe2579cd24e122cdf8c6ecf8b4c6
SHA256787b69b93681cf41784dfa8655cbdafe8a56ecc62f0112a6ea2241a284a0e3c9
SHA5124aa87e0f16d2be6398849314b375b865a8a3b2287dce712192f234ea8ba2222720555540cb8f20b9df36e6a9dd6b84849450ebe611a772ef488f89082802fd79
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025Filesize
19KB
MD50b1d379ad8dae5d9e5b98ef0b492e27c
SHA146675d1c57cd97c6980670a39b22f3221de73181
SHA2566076b14e4ab35c37208174d59446d49ca75527948b416d3ea426720a70c02958
SHA512e2474d5f740fe252ebcf390a6e2064861711e836e6f7b1ce6bed29230c1c3606c20837a718d56cce96877c8df97aac2b182d90b1f3e9b93c8248669efd7e52ce
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027Filesize
133KB
MD5f2edadecea964a12395aaca985d39cd8
SHA16922feddb54b0ee8efd6c3e8cd7db233e018990c
SHA25679085d7c5c119ad8ac691c5864a16d6e7495392a15fa82180cbc1f358433a5f0
SHA5121003f02faaa6c18fd058b81fec7e7ac5accdda0024124cb5536b96fbd35ffbf944de1d902ccbef86c6cbeb2e5a23fa673c02a80fd28b71d7bb8eff69255de8db
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002aFilesize
195KB
MD5d67056038eb0188c3d0dcdfa041b3dc2
SHA1d6cd24d1ace7a65627b1dd0c31a9c78276550398
SHA2564e78e681fb45707f0db0d06527bbc6a8f2acb3027d15d1762ea3b016ce505c57
SHA512d18c4c31d7874a4157a3a319d4a3e98664f9f06bba0f9704177a826023e5dbe2e71287c21742bba04bd71106f27b5a21894d0f3ed952b40456d9e98884c5f9aa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5ff69dda5b9ede06db312f08a05c8fabf
SHA1ccd16aca01180bab220c8fd1539bd6ce85ce95a1
SHA2568a17b4c98ee371c7cca8a620506357c4299eaa67706ba922f8c4b5fd79c9596b
SHA5128cb1a4fbfba3bf252151e87f46a6df5fe75e31697f46f841e4e927ed56d6a16f2b11910f77eb0d1af6d9b75a202b28d259d878bdfcec1592e3cc1a33526acb1f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD50c38de4aa5b46d5ef4332025bdf7209a
SHA1cddb57bb09d49a336b0c135a7053607d521103d5
SHA2560ea8ddf9830ec73bd89622df0daa5cbb287fcc7070b854526ca60bccbaaa3f25
SHA5128b0efd201c9759c65f0734a30ea3478bf711be9f403f18401c00dc187f4766c81330205b4ddecc49a6dc3ba25b1dc0a2d52241ec0d2b222eabf9b8ad0a2d6fc3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5010230ab27d459193b427e5b39eddcd9
SHA175baa805e4ee8e45e49f6b6b9d8913476e573345
SHA25686d96520ee0208ceeeda88fd8088922a6814a21bed91d3edaa3c052a88811bcc
SHA5121e382a4d6e844d4eacd56723904c5b4815d79a52e8b379dd15eb75843428937c6f2bd184420dafc8eb730af95448632486f54542f4abe01a633b60e97a8af6e7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
6KB
MD562132005c929396f8150652637d6a473
SHA113579492fa1d3f0d6bbcd7213589ea5395d8b3cf
SHA2564f68094ea459dd6316d25e6bec5cc1193702bf71bb07e9413474e73b47056509
SHA512e9f7ffb6f878ec98ef5010d1c59554b037cd9906e7047b0401c887808f45db43555b610e9d47c0644baeac8f15fe0167e7b4550a309facad5b55d9035820e993
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
3KB
MD5278d6497a98824e3a8e7e0b5389ede04
SHA186cd759b7548e120cd38814a77f725873e594f69
SHA256eeec459297b540b8aac1a8a7b627dec667824e15eeee0f22a6e455ad269c2554
SHA512a7c8fc28d80200266ef3d25162c8858907168caf27c3c0bf58e565f0d7b8b7c5d8ca9ec59bfd3863aa4ee48b4fe46b75a960640b8f7fff702c307e56e00cea07
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD531ad618ddb54ff20c642f72f583e1cbb
SHA155e8bc7f11e5e69929df52966f24462e835f641c
SHA2561dd5711e86e71959e1d5e38fe45859fa5af044e3adf7d8fd116ad5deb081c503
SHA512bbb9ca9fc0b77e73a44c92e50a664335bd07b2889ec83dbe0b764afb538e06b70e47c54a30f93c0c68f8ef74449db378a4b4954b106084ed0d098e7d3473581f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD55b3e48bbc7b4a22d491fc8a72dde1c70
SHA1e352fd13eb57753c1e9cfd0b8976d20a9731b1c7
SHA25649c3d2fd268ed258efa8f749fc069fac7059dff7dd21e66e6c0579c38582ae7d
SHA512a6f91a6f226e3d21097d2a30c499705e2a72b29faed8816936ee9654d8d0bac39094518ada3e017c74c7fd5613cfefc361f3673672be4127c939d521e0ac3a76
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD55ec2aef5ebecee04ac6c263d1e706d6f
SHA19d83db22f53b71c8832de5e2ce5413df98c4a440
SHA256cbe1d8bad00f15a8d2a49e158ca7c8d039927cd9ffbf24efa1cd9790a91c35cb
SHA512578b26cef3d5b7217a9a75b25032a3bafa7c86883e563cd707049d53b94e84c36d34789e5a73ac2947aa3785c5bbd726932895e53ccbe737888dbae67613872b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD56e000aeb9d2c6ed874ffc419d2d6e5e7
SHA1dcae7c870f632efe8c036db2b0d26b35049de3f9
SHA256eee58c917c6a33fd0ed690f7b2a131b4d1ff6c44f8af27702d9707181ff2062b
SHA512c1cdf5e7350c6d8afd0159d48b64af8965cbcc89fc22c3ed3b8411fd79ba9da39cb962644af9aa7e1d9cf236190ba5a0d0f241f0e325d2a1c09e5782a036cd53
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5e1b4cbd20c12268975fb0f9acdc0a358
SHA1415e62036955e301261347cb114615d4dab34bc6
SHA2567b59ce9c3ad85f05a10d5e79c66482a666c42305345046d651458e7f68782437
SHA512e3e5ede198383e8d7e32aba724caf52bf875b102ee1dec574fed54c198779354053e3164aa138834eb59386980f85583d6a5d27892bb951a6b3cd193c185fdc1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5a9e20dec29154941ed39271b5b1f9607
SHA1549aeee635c26dd2d9016afa877374977e8f3997
SHA2569f085f49ecb8a1d9e1d2f314f2f28bb0cd9e2c8f33b9cc48ec1200642f079351
SHA512cfb666f730c333b3f7939d9276c4ec850ca25ef8038b72519f82ad7efe0c35f39f356061a2eb18769bd6811cde8ffcb0b5434004d8b6fd4be0cc45241218732f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD507314a4eb9d4b9bf52053fb314ca356a
SHA1fecf21554af408dd3e3c9235c78ae64142fb511e
SHA25685ec0c71646c9fed121acf34a04dc4c903cab7a4c69ca007eeef115c99d564ba
SHA51242683f57298112c8d215972869be6d788bbe47817464d4ac878ae30f96a6e55bce1f77be4aaa7d67356474aaba931698618d1fd1d154dfedda0d7c62ea9df5b3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5a0067d355cc9085452bd6627a082c615
SHA16682d93d04898077850f5175698b1c2ecfaa4e87
SHA256cd0e166a46e25e58c304dd0860e481a498e85e6f98310263d95a02e4afdef4ce
SHA5123b02dee7136008f894ae119fafb037318c51ac545fbcb17f595ca9e7d7c91903d5037d15f8857ad70e8ff729fa5faddc6196bdde472eea81c52c225becfdd92f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD523997ad069ee38da65003b730b4f91cb
SHA15962c724534d5a50168d696983d2f925010f7371
SHA256daa91e522f895350d1cca1a9cbccfdf2f25389ed30c1cc03081f4024fb39fcbf
SHA51206586a780704522d938e8dcde9c12b680409360adf2de3affb78951dc2be642d6c287bbae4235a1830420ab74b90cc28626683b5ab655eba35ebc5abf3a7b686
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD50758e2fee4f13662be1632ee67b89666
SHA14f8ceb210d43158bb0ed5fd3b446ba837ab9cc9b
SHA256e6b0201f6923e842631431d9892b9a472f356df6eee17f8f6862eb2669a71546
SHA512deec2ea2678e1dcd21c1a33af5cc45d26d2f5cd970fd788eef312428fa6a578565c97df2026f107cb14d8f832db3f189cfec542b59e7df7953b0c1b1fa1410c7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5aec191552e2bfc7dc92bd883c4edfce9
SHA1dd63a9280517e602d2dbbca66d81ea2ec1da3cfd
SHA256b97bed1529ff816317ab448ba557c9af21fa296bedbf915afe956f81f5fdd7d2
SHA512d8b9e4cbe0f3cb00676eab9d0fb9f820c5564528ff5c2b1eb5398cf6d27fd85e525b5c6b63111c6f8cac7c34008a5652e3ce95e2493cb9a5d3fa39557f035e05
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5aad529404ae2cd3d0252aafb5e3d7fb7
SHA1277c55c3d609b342dce32da7faa377f2f88c0b02
SHA25698d24de6b86f1b5290b45b63360140125d59ffc39d51fa360be0ce4c5513d38e
SHA512b340369fcf2dd77bafc245f808661132ee0ddffbc7c76f2803af43637a8afab5aaa15f67d0ef43bc3f817c8a02a65e56664eaeb956a6ba19ea929d205eaac7b1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD51dd5c07fd4f15937eace8d1bc92a91b9
SHA10645e148f70eb2cbb8e7e3edbc3c0eb153cebe4c
SHA256731e1b0936c889e7fc0cf4616db8bd77f881e4d2208033c293107cbe960ceaf8
SHA512bfff32057b32c2d41fc611fb5b738762a77d1ad938eb8946a490e3585acd8f805e3117dfb7e0566b010073c3beaf898be1d04d880025490e7dbdb3107a6aa112
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fa5d5449-17a7-4aa5-a870-cfafb8272c0d.tmpFilesize
7KB
MD593de308f29807bcd4cfb9461225d1814
SHA19d74e4b8ef3ba076314d0533ed975166ed3c2630
SHA256cf74280129210dc3015f1226b443af75ca5dc6b06922c6c662dcbc666a4e3955
SHA512d5048fd5b872efbe4c7b02f483d11fbdc76225e9b97b9e6932e1f9ad110bbd10f993af29fa759ab8bed78c41ade495638ce2951a2f02381d2c8d10bc68452cfa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
115KB
MD5273fdda8e9eee830da4fbad695431448
SHA160c23d92cce32ab47ec36f7427af091f7554be72
SHA25652c7404337ac351c9a609a61f0918335ca4ee7b806edbbd808a74ba7b8f5745e
SHA5120ce046ae3b04d5662e9ff8b5193acaa6c9357a154fa251d0751a6ccd4bcc2297bd6cc51d8b16cc92f091c587b427b90777b7bdd5cdd372e56a44dd7e060cf2a5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
115KB
MD5ecdc89c96b08c633bc346034626207a4
SHA12e3e8d7d3b419b51f719f2fa9dad1fbf771a96fd
SHA256f960774289491ee96b44456d390051b2b2065e0048d672684c15e0ecdfeb578c
SHA512ece1bb1e79cb818d71f363d2d58a3c1f15c0a62483a17de9505f7bc11b75eced22a7b447e8114e3f70f63f63956d4609f23b4fa1dcd11070122ad15666b157bd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
114KB
MD5e364249411864a406c9e1094991231c1
SHA1cf54f640647df9a6a7314f56da081c0d884a1122
SHA256857ac9102512a4f27be45c750d6152afb59c9244ffb9be91ff62a9bcd4efed52
SHA512f8e344833a96f2a8da4546402ccda6fd8d2208e6f109a8dcae0b630dbb6649025cc4e07384b88aff939b83a095fa27f1547ff8eb62f66d3b00eaba3cf7d6342d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
114KB
MD576763917be0446d279ebadc35c994808
SHA12e0f88858a61ff2b3c5153820ac3a64d503bed25
SHA256b53cb192f681828d5956cb99c58907bea66689f762faecbfa03908773e01dea3
SHA512739e087dd4d747a02599b686299e88ed0ada0ec66d0db9a5c57fe7f460fc711966a393a047cb3f1f7aeafbc47451f9c8241ffa4ea9fa22826b8bf479efa4e55d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
110KB
MD53cdbae5f84e3e970ccc745d5aef16e37
SHA1dfee06f3ecffb8d578a171f12cd7f9406a5cdf8f
SHA2569130b33dfe4f23646fdb60e70f137667f773254e41af8be30de51981ab423c8a
SHA5128fccf3f5752fe00d95108e1df34a94016a281959227bc17c5b28413c30900db6929f49827f11cbd470d48213b6da865c67f3db5a856933ae244a6cf66061dd2e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5899ba.TMPFilesize
106KB
MD5dc867b80254561c4fb6cc5f24519fc1b
SHA17f8f0feb760c704245c0d80fb370b0db2d20e7f6
SHA256d3918f48f5154a83e4d266316b411618414c1e81e83d94206506d33aaa504e74
SHA512ad9315b35a8e83be53a543388a10f5426e6c38d97139356178a8b830eb0f73f4346403633863d0809c7187c9c76f7d01e788d50c20b6c2743abdc4e64cff08d2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.newFilesize
18.7MB
MD5df5ed20a983524d970833cf70bc2342e
SHA1df46c0882fc100dd2754aa36aab63b49fb56f567
SHA256cd35e86e76b27ee8bd04669696473cc74eea762d09e822adfe412758a46c16ce
SHA51229c379e43fb3dd357765c0c08c1abd22a7d93c7474fe00f44f06331ae9c987b80407147fdd33de23d95d1eab97d11f979df962ee9fc4e434667f4ded5ceec030
-
C:\Users\Admin\Desktop\WannaCry\00000000.resFilesize
136B
MD5b000b68169c1f014d33ad4b36b7da39a
SHA1e0db4a622c61e86065627cf5d42ad1534390d013
SHA2569db45b48c3754f42d5dadd843876eadfbbce50820ea45ee3a08e192947930da5
SHA51290b4cf4a0dfc3fd9dffeb27e1362386ce6fab15236db10f7ea3719f3d9dd45c935cc493fde0aa046f4b5d300d90db09c9af00ddcd9efadd537a5e85e4005fc68
-
C:\Users\Admin\Desktop\WannaCry\236221701176341.batFilesize
336B
MD50cc9f636da76aba09e25221274fdb611
SHA15ea7b3fac9378d5f9b8bb93932b40d223a8e84d1
SHA256a38191bcfa6b97f6b924d99b8d350439fbed0f0084370206a492c5342216ae70
SHA5125788536305289a8795849321de182f21be5088326f1ad390317f27403547416d7886ef06f15f136026601fa26fc745594547d391301b163a412001dd78f17357
-
C:\Users\Admin\Desktop\WannaCry\236221701176341.batFilesize
336B
MD5e2546bd50eab0b3889994799f1bdfa77
SHA1a3e879864ab626764dc6c414e4fc928af38de7f9
SHA256f4328b8bfc9da01098cfac3cf80a014fdc068bb3e8a99cc9b1d5c17b9550b952
SHA51279246f2fd7cd1d0dff6e96be5e158148dbddc569394f902088ee05a5f7379db79080dac1791ca8728220b2ca905f888278529bfd55f8ce54a3d652e98d47617d
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]Filesize
933B
MD57a2726bb6e6a79fb1d092b7f2b688af0
SHA1b3effadce8b76aee8cd6ce2eccbb8701797468a2
SHA256840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
SHA5124e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]Filesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]Filesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]Filesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]Filesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Desktop\WannaCry\@[email protected]Filesize
682B
MD59ae3b7e78d300b3c18411abb96ee5891
SHA1e4fa0710cc169ec15b9360c43582f6238ab9db56
SHA25622d30529de7112df0348a3c78d57dda89b7df2d49ece658a549208feb0cbedf3
SHA512cfc5e9017d94c94b49d6fad26ebb37913ff5431a0ea25de567539f7acdae75096258920edc93c47d06169bf0d84cf426040d0b830145c0756a89049f28f31ba7
-
C:\Users\Admin\Desktop\WannaCry\TaskData\Tor\libevent-2-0-5.dllFilesize
702KB
MD590f50a285efa5dd9c7fddce786bdef25
SHA154213da21542e11d656bb65db724105afe8be688
SHA25677a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
SHA512746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae
-
C:\Users\Admin\Desktop\WannaCry\TaskData\Tor\libssp-0.dllFilesize
90KB
MD578581e243e2b41b17452da8d0b5b2a48
SHA1eaefb59c31cf07e60a98af48c5348759586a61bb
SHA256f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
SHA512332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a
-
C:\Users\Admin\Desktop\WannaCry\TaskData\Tor\taskhsvc.exeFilesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\Desktop\WannaCry\TaskData\Tor\taskhsvc.exeFilesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\Desktop\WannaCry\TaskData\Tor\tor.exeFilesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\Desktop\WannaCry\b.wnryFilesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
C:\Users\Admin\Desktop\WannaCry\c.wnryFilesize
780B
MD58124a611153cd3aceb85a7ac58eaa25d
SHA1c1d5cd8774261d810dca9b6a8e478d01cd4995d6
SHA2560ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e
SHA512b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17
-
C:\Users\Admin\Desktop\WannaCry\m.vbsFilesize
215B
MD5fd78e3aea83e804c1b503585ebd6344d
SHA1e051cb58ba1340db02384957788a4e616dacc24b
SHA256f0fa5620f2445b247fc19d9bf38b0d4373c2cdf4793e22846e8a5a3edd7b68df
SHA512e012c775e67c8a938f4f2e9944ee3e0dffa719dc187589dd00ee53264fab7c4e6a0a6a47f531d181e576be6d1914768c77ab71a7c2118c79b32fe207d4932f56
-
C:\Users\Admin\Desktop\WannaCry\msg\m_bulgarian.wnryFilesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
C:\Users\Admin\Desktop\WannaCry\msg\m_chinese (simplified).wnryFilesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
C:\Users\Admin\Desktop\WannaCry\msg\m_chinese (traditional).wnryFilesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
C:\Users\Admin\Desktop\WannaCry\msg\m_croatian.wnryFilesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
C:\Users\Admin\Desktop\WannaCry\msg\m_czech.wnryFilesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
C:\Users\Admin\Desktop\WannaCry\msg\m_danish.wnryFilesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
C:\Users\Admin\Desktop\WannaCry\msg\m_dutch.wnryFilesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
C:\Users\Admin\Desktop\WannaCry\msg\m_english.wnryFilesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
C:\Users\Admin\Desktop\WannaCry\msg\m_filipino.wnryFilesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
C:\Users\Admin\Desktop\WannaCry\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\Desktop\WannaCry\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\Desktop\WannaCry\msg\m_french.wnryFilesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
C:\Users\Admin\Desktop\WannaCry\msg\m_german.wnryFilesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
C:\Users\Admin\Desktop\WannaCry\msg\m_greek.wnryFilesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
C:\Users\Admin\Desktop\WannaCry\msg\m_indonesian.wnryFilesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
C:\Users\Admin\Desktop\WannaCry\msg\m_italian.wnryFilesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
C:\Users\Admin\Desktop\WannaCry\msg\m_japanese.wnryFilesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
C:\Users\Admin\Desktop\WannaCry\msg\m_korean.wnryFilesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
C:\Users\Admin\Desktop\WannaCry\msg\m_latvian.wnryFilesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
C:\Users\Admin\Desktop\WannaCry\msg\m_norwegian.wnryFilesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
C:\Users\Admin\Desktop\WannaCry\msg\m_polish.wnryFilesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
C:\Users\Admin\Desktop\WannaCry\msg\m_portuguese.wnryFilesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
C:\Users\Admin\Desktop\WannaCry\msg\m_romanian.wnryFilesize
50KB
MD5313e0ececd24f4fa1504118a11bc7986
SHA1e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA25670c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
-
C:\Users\Admin\Desktop\WannaCry\msg\m_russian.wnryFilesize
46KB
MD5452615db2336d60af7e2057481e4cab5
SHA1442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA25602932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA5127613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
-
C:\Users\Admin\Desktop\WannaCry\msg\m_slovak.wnryFilesize
40KB
MD5c911aba4ab1da6c28cf86338ab2ab6cc
SHA1fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA5123491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
-
C:\Users\Admin\Desktop\WannaCry\msg\m_spanish.wnryFilesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
C:\Users\Admin\Desktop\WannaCry\msg\m_swedish.wnryFilesize
37KB
MD5c7a19984eb9f37198652eaf2fd1ee25c
SHA106eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA51243dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
-
C:\Users\Admin\Desktop\WannaCry\msg\m_turkish.wnryFilesize
41KB
MD5531ba6b1a5460fc9446946f91cc8c94b
SHA1cc56978681bd546fd82d87926b5d9905c92a5803
SHA2566db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
SHA512ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9
-
C:\Users\Admin\Desktop\WannaCry\msg\m_vietnamese.wnryFilesize
91KB
MD58419be28a0dcec3f55823620922b00fa
SHA12e4791f9cdfca8abf345d606f313d22b36c46b92
SHA2561f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
SHA5128fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386
-
C:\Users\Admin\Desktop\WannaCry\r.wnryFilesize
864B
MD53e0020fc529b1c2a061016dd2469ba96
SHA1c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade
SHA256402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
SHA5125ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf
-
C:\Users\Admin\Desktop\WannaCry\s.wnryFilesize
2.9MB
MD5ad4c9de7c8c40813f200ba1c2fa33083
SHA1d1af27518d455d432b62d73c6a1497d032f6120e
SHA256e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
SHA512115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617
-
C:\Users\Admin\Desktop\WannaCry\t.wnryFilesize
64KB
MD55dcaac857e695a65f5c3ef1441a73a8f
SHA17b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA25697ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
SHA51206eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exeFilesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
C:\Users\Admin\Desktop\WannaCry\taskdl.exeFilesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
C:\Users\Admin\Desktop\WannaCry\taskse.exeFilesize
20KB
MD58495400f199ac77853c53b5a3f278f3e
SHA1be5d6279874da315e3080b06083757aad9b32c23
SHA2562ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
SHA5120669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4
-
C:\Users\Admin\Desktop\WannaCry\u.wnryFilesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Downloads\Ransomware.WannaCry.zipFilesize
3.3MB
MD5efe76bf09daba2c594d2bc173d9b5cf0
SHA1ba5de52939cb809eae10fdbb7fac47095a9599a7
SHA256707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
SHA5124a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
-
C:\Users\Admin\Downloads\Ransomware.WannaCry.zipFilesize
3.3MB
MD5efe76bf09daba2c594d2bc173d9b5cf0
SHA1ba5de52939cb809eae10fdbb7fac47095a9599a7
SHA256707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
SHA5124a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
-
C:\Users\Public\Desktop\@[email protected]Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
\??\pipe\crashpad_784_COEWXHYEVPMMLBDYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/960-1877-0x00000000746F0000-0x000000007470C000-memory.dmpFilesize
112KB
-
memory/960-2158-0x0000000074300000-0x000000007451C000-memory.dmpFilesize
2.1MB
-
memory/960-1971-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1955-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1908-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1907-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-2099-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1899-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1882-0x0000000074300000-0x000000007451C000-memory.dmpFilesize
2.1MB
-
memory/960-1881-0x0000000074520000-0x0000000074597000-memory.dmpFilesize
476KB
-
memory/960-2152-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1961-0x0000000074300000-0x000000007451C000-memory.dmpFilesize
2.1MB
-
memory/960-1880-0x00000000745A0000-0x0000000074622000-memory.dmpFilesize
520KB
-
memory/960-1879-0x0000000074630000-0x00000000746B2000-memory.dmpFilesize
520KB
-
memory/960-2178-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1878-0x00000000746C0000-0x00000000746E2000-memory.dmpFilesize
136KB
-
memory/960-1825-0x0000000074630000-0x00000000746B2000-memory.dmpFilesize
520KB
-
memory/960-1876-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1826-0x0000000074300000-0x000000007451C000-memory.dmpFilesize
2.1MB
-
memory/960-1832-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1831-0x0000000000070000-0x000000000036E000-memory.dmpFilesize
3.0MB
-
memory/960-1828-0x00000000745A0000-0x0000000074622000-memory.dmpFilesize
520KB
-
memory/960-1830-0x00000000746C0000-0x00000000746E2000-memory.dmpFilesize
136KB
-
memory/1960-225-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB