Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 18:00
Static task
static1
Behavioral task
behavioral1
Sample
IMG_20240310_184106.jpg
Resource
win10v2004-20231215-en
General
-
Target
IMG_20240310_184106.jpg
-
Size
57KB
-
MD5
506caf16009f6206c82f40be26c293ce
-
SHA1
f163b3c98326d94ade43bda3a54d3902f65894d3
-
SHA256
0935d0e03118df8da87c810cdc09277f7cf7da85817e555d4c5c6042102f5bb1
-
SHA512
06a59e49638c19e971356d84fa905bd72438c4ea547d6913d4318753c17c3742a7d1544d883eb8af388c4885daa9a2403eefcca8eb6efc722196239f2a991bc5
-
SSDEEP
1536:8orcpLSre645qWilo9ErSx7eLy4oo++wtZvjEI68d:8orE2re6Si8Er/W4ojPd
Malware Config
Extracted
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
Processes:
WannaCry.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDD313.tmp WannaCry.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDD31A.tmp WannaCry.EXE -
Executes dropped EXE 20 IoCs
Processes:
taskdl.exe@[email protected]@[email protected]taskhsvc.exetaskse.exetaskdl.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exe@[email protected]@[email protected]@[email protected]@[email protected]taskse.exe@[email protected]taskdl.exepid process 1940 taskdl.exe 212 @[email protected] 5356 @[email protected] 6132 taskhsvc.exe 5116 taskse.exe 1220 taskdl.exe 2352 @[email protected] 2204 taskdl.exe 2804 taskse.exe 3928 @[email protected] 4556 taskse.exe 5804 @[email protected] 3728 taskdl.exe 900 @[email protected] 4916 @[email protected] 6024 @[email protected] 2968 @[email protected] 884 taskse.exe 3616 @[email protected] 4036 taskdl.exe -
Loads dropped DLL 7 IoCs
Processes:
taskhsvc.exepid process 6132 taskhsvc.exe 6132 taskhsvc.exe 6132 taskhsvc.exe 6132 taskhsvc.exe 6132 taskhsvc.exe 6132 taskhsvc.exe 6132 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qcqurlzktrqmlqm219 = "\"C:\\Users\\Admin\\Downloads\\WannaCry-main\\WannaCry-main\\tasksche.exe\"" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ-Destructive.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ-Destructive.exe -
Sets desktop wallpaper using registry 2 TTPs 3 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCry.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1448 5356 WerFault.exe @[email protected] 5968 5356 WerFault.exe @[email protected] -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Taskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 2 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{4CA2E667-F701-4B8E-BBE3-5A5CAF19BB0B} msedge.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exepid process 4300 msedge.exe 4300 msedge.exe 1516 msedge.exe 1516 msedge.exe 1092 msedge.exe 1092 msedge.exe 1596 identity_helper.exe 1596 identity_helper.exe 1656 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2352 @[email protected] -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
Processes:
msedge.exepid process 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Taskmgr.exetaskmgr.exeAUDIODG.EXEWMIC.exevssvc.exetaskse.exetaskse.exetaskse.exetaskse.exedescription pid process Token: SeDebugPrivilege 5368 Taskmgr.exe Token: SeSystemProfilePrivilege 5368 Taskmgr.exe Token: SeCreateGlobalPrivilege 5368 Taskmgr.exe Token: 33 5368 Taskmgr.exe Token: SeIncBasePriorityPrivilege 5368 Taskmgr.exe Token: SeDebugPrivilege 5868 taskmgr.exe Token: SeSystemProfilePrivilege 5868 taskmgr.exe Token: SeCreateGlobalPrivilege 5868 taskmgr.exe Token: 33 5868 taskmgr.exe Token: SeIncBasePriorityPrivilege 5868 taskmgr.exe Token: 33 2920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2920 AUDIODG.EXE Token: SeIncreaseQuotaPrivilege 4264 WMIC.exe Token: SeSecurityPrivilege 4264 WMIC.exe Token: SeTakeOwnershipPrivilege 4264 WMIC.exe Token: SeLoadDriverPrivilege 4264 WMIC.exe Token: SeSystemProfilePrivilege 4264 WMIC.exe Token: SeSystemtimePrivilege 4264 WMIC.exe Token: SeProfSingleProcessPrivilege 4264 WMIC.exe Token: SeIncBasePriorityPrivilege 4264 WMIC.exe Token: SeCreatePagefilePrivilege 4264 WMIC.exe Token: SeBackupPrivilege 4264 WMIC.exe Token: SeRestorePrivilege 4264 WMIC.exe Token: SeShutdownPrivilege 4264 WMIC.exe Token: SeDebugPrivilege 4264 WMIC.exe Token: SeSystemEnvironmentPrivilege 4264 WMIC.exe Token: SeRemoteShutdownPrivilege 4264 WMIC.exe Token: SeUndockPrivilege 4264 WMIC.exe Token: SeManageVolumePrivilege 4264 WMIC.exe Token: 33 4264 WMIC.exe Token: 34 4264 WMIC.exe Token: 35 4264 WMIC.exe Token: 36 4264 WMIC.exe Token: SeIncreaseQuotaPrivilege 4264 WMIC.exe Token: SeSecurityPrivilege 4264 WMIC.exe Token: SeTakeOwnershipPrivilege 4264 WMIC.exe Token: SeLoadDriverPrivilege 4264 WMIC.exe Token: SeSystemProfilePrivilege 4264 WMIC.exe Token: SeSystemtimePrivilege 4264 WMIC.exe Token: SeProfSingleProcessPrivilege 4264 WMIC.exe Token: SeIncBasePriorityPrivilege 4264 WMIC.exe Token: SeCreatePagefilePrivilege 4264 WMIC.exe Token: SeBackupPrivilege 4264 WMIC.exe Token: SeRestorePrivilege 4264 WMIC.exe Token: SeShutdownPrivilege 4264 WMIC.exe Token: SeDebugPrivilege 4264 WMIC.exe Token: SeSystemEnvironmentPrivilege 4264 WMIC.exe Token: SeRemoteShutdownPrivilege 4264 WMIC.exe Token: SeUndockPrivilege 4264 WMIC.exe Token: SeManageVolumePrivilege 4264 WMIC.exe Token: 33 4264 WMIC.exe Token: 34 4264 WMIC.exe Token: 35 4264 WMIC.exe Token: 36 4264 WMIC.exe Token: SeBackupPrivilege 4520 vssvc.exe Token: SeRestorePrivilege 4520 vssvc.exe Token: SeAuditPrivilege 4520 vssvc.exe Token: SeTcbPrivilege 5116 taskse.exe Token: SeTcbPrivilege 5116 taskse.exe Token: SeTcbPrivilege 2804 taskse.exe Token: SeTcbPrivilege 2804 taskse.exe Token: SeTcbPrivilege 4556 taskse.exe Token: SeTcbPrivilege 4556 taskse.exe Token: SeTcbPrivilege 884 taskse.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exeTaskmgr.exepid process 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exeTaskmgr.exetaskmgr.exepid process 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5368 Taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe 5868 taskmgr.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
Processes:
MEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exemspaint.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]pid process 456 MEMZ-Destructive.exe 1656 MEMZ-Destructive.exe 1800 MEMZ-Destructive.exe 3768 MEMZ-Destructive.exe 1548 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4836 MEMZ-Destructive.exe 1708 mspaint.exe 1708 mspaint.exe 1708 mspaint.exe 1708 mspaint.exe 212 @[email protected] 212 @[email protected] 5356 @[email protected] 5356 @[email protected] 2352 @[email protected] 2352 @[email protected] 4836 MEMZ-Destructive.exe 3928 @[email protected] 4836 MEMZ-Destructive.exe 5804 @[email protected] 900 @[email protected] 4916 @[email protected] 4916 @[email protected] 6024 @[email protected] 4836 MEMZ-Destructive.exe 2968 @[email protected] 3616 @[email protected] -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1516 wrote to memory of 3264 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3264 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 3472 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 4300 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 4300 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe PID 1516 wrote to memory of 948 1516 msedge.exe msedge.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 6136 attrib.exe 5984 attrib.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20240310_184106.jpg1⤵PID:1020
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff61fa46f8,0x7fff61fa4708,0x7fff61fa47182⤵PID:3264
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2088
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵PID:4420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:12⤵PID:4784
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:4564
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:4856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:4884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:82⤵PID:3648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:4156
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:82⤵PID:3848
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:2036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:12⤵PID:2596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:4476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:3780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:3008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:2792
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:12⤵PID:3468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6620 /prefetch:82⤵PID:612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6456 /prefetch:82⤵
- Modifies registry class
PID:4828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:1648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:12⤵PID:3032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:12⤵PID:4460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:5444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:12⤵PID:5712
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:12⤵PID:1160
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:12⤵PID:3860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7524 /prefetch:12⤵PID:5876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:12⤵PID:5992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7788 /prefetch:12⤵PID:1472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:12⤵PID:680
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5756 /prefetch:22⤵PID:5372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:12⤵PID:4264
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:12⤵PID:1796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7092 /prefetch:82⤵PID:3420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:12⤵PID:2052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:12⤵PID:4268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:2904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:82⤵PID:1628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:12⤵PID:4640
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:12⤵PID:5704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:12⤵PID:3860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8168 /prefetch:12⤵PID:1208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:12⤵PID:4628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:12⤵PID:3152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:12⤵PID:1940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:12⤵PID:1208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:12⤵PID:5808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:12⤵PID:5900
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10585404652769924703,16879674425416859313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:12⤵PID:3120
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3032
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3720
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1548
-
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:456 -
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3768 -
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4060 -
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1548 -
C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:4836 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:1492
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵PID:5672
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\System32\mspaint.exe"3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1708 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5368 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵PID:2140
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:5308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection3⤵PID:5888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff61fa46f8,0x7fff61fa4708,0x7fff61fa47184⤵PID:2708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20163⤵PID:1832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff61fa46f8,0x7fff61fa4708,0x7fff61fa47184⤵PID:5104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed3⤵PID:1796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff61fa46f8,0x7fff61fa4708,0x7fff61fa47184⤵PID:2548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus3⤵PID:5824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff61fa46f8,0x7fff61fa4708,0x7fff61fa47184⤵PID:5540
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵PID:1836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend3⤵PID:428
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff61fa46f8,0x7fff61fa4708,0x7fff61fa47184⤵PID:680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4148
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5868
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:1104 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:6136 -
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2940 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 307161710612205.bat2⤵PID:5436
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:896
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5984 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:212
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6132 -
C:\Windows\SysWOW64\cmd.exePID:3284
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:5356
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵PID:2196
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 2644⤵
- Program crash
PID:1448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 2644⤵
- Program crash
PID:5968 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exetaskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qcqurlzktrqmlqm219" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f2⤵PID:2984
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qcqurlzktrqmlqm219" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:4104 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exetaskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:3928
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exetaskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:5804
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exetaskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:884 -
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:3616
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:4036
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x394 0x3841⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5356 -ip 53561⤵PID:3912
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5356 -ip 53561⤵PID:5468
-
C:\Users\Public\Desktop\@[email protected]"C:\Users\Public\Desktop\@[email protected]"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
C:\Users\Public\Desktop\@[email protected]"C:\Users\Public\Desktop\@[email protected]"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4916
-
C:\Users\Public\Desktop\@[email protected]"C:\Users\Public\Desktop\@[email protected]"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6024
-
C:\Users\Public\Desktop\@[email protected]"C:\Users\Public\Desktop\@[email protected]"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2968
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\AppV\Setup\@[email protected]
Filesize813B
MD5c502a558b534f99f4818b0402a84bc38
SHA187f356db707c492d3bf9e1f08a900c2e00a158c0
SHA2568d4a6faadada41dfe75f4982e721cb5e7779346ed995964fdf5052fa40c0bd81
SHA51216f18b05d3ab76fd7126f49fa640a5bd5f9d92a4a959c188de51e2275a611aa9a5123df3622475e6367a4deb2f72ed0ad22b7640ba00af757ee95dd2fd2abfd8
-
Filesize
11KB
MD57fb11d85d2669eea389fc6874f806c9d
SHA18a2b9881144197b810637dcba9dca594f8cd10cd
SHA25691090a78ea40ef6ffced164fc05f1a75708747d8cf33be23d56506b8520990d6
SHA51245caa0a3b37c593d06dbedd6fd8afa42831e5b35ce7463bf4813f60f085ac22ed3a02d80a6c77e05ed053bec0ac9078ae2792b54595049a54f9cddc2b5d4b93f
-
Filesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e7fb957-56b2-40f7-bdad-8200fdb6376b.tmp
Filesize3KB
MD593f7700339ca1a8f00288ccbe18da61c
SHA17fb49b253d5e9e9dc754c12f73f67e2556684dba
SHA256fa7f82709d0fe060d9407d4d8a9ecbc534ae2c142471b49cdffec54c6a86c4cf
SHA5127e6c5a84633d5f357186d293677b2a1c6df675d5e2ff606cf3ef875794673357ec8df8296d74006ef6835b855ac66e42263041122b9a8896132077268cee2cbc
-
Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
Filesize
67KB
MD588a552e6be1ac3978c49143983276b3a
SHA1dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423
SHA256927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5
SHA512125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a
-
Filesize
32KB
MD53baf7c2e036abf00bf52d8e4a918e970
SHA10eb5406e14050dc41227ba74b64a38da778fe5d6
SHA256d30dcb199ca26a9664a46c01b4eccb26f5b8682f04480d0a9d2beffab7d0a049
SHA512c12875c0e5085f534496ca9f1f43bc4d5097f6d4d969f70ad1651bf01bdd4e9f5e27c93413ef0589c06c647c0a22d8c4b7a2ffbda2fe61bdeb84657f53a6a429
-
Filesize
19KB
MD576a3f1e9a452564e0f8dce6c0ee111e8
SHA111c3d925cbc1a52d53584fd8606f8f713aa59114
SHA256381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
SHA512a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
-
Filesize
63KB
MD5710d7637cc7e21b62fd3efe6aba1fd27
SHA18645d6b137064c7b38e10c736724e17787db6cf3
SHA256c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA51219aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
-
Filesize
88KB
MD5b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1386ba241790252df01a6a028b3238de2f995a559
SHA256b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
SHA512546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
-
Filesize
1.1MB
MD524a16440d5b663d0d87263e812e3fd90
SHA10ffec5a540218892b440703dfbf04bf1252def68
SHA256c3af8b6de514fe12fef4987e8a1a9c6294ea0ebf46d0537bf02d18595abbe799
SHA5129845ca0adcbdf6e77a021073f5f01c6b0ecc0593d2c7e13d58b7717368d466d69f74c51934c77f21aaaf0704815fdefdf285748aa3e17441b700ba092a6df9cc
-
Filesize
33KB
MD53cd0f2f60ab620c7be0c2c3dbf2cda97
SHA147fad82bfa9a32d578c0c84aed2840c55bd27bfb
SHA25629a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b
SHA512ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb
-
Filesize
74KB
MD5bc9faa8bb6aae687766b2db2e055a494
SHA134b2395d1b6908afcd60f92cdd8e7153939191e4
SHA2564a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed
SHA512621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4
-
Filesize
198KB
MD506d38d9bf028710762491328778f9db6
SHA183e1b6cbaad5ca5f6dc63453da324f8df28de193
SHA25691558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad
SHA512b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5cb56fbebe20a507fe3454d1884138e43
SHA1c44f347bccdaca9e584906edaa41b6aaffb12f1d
SHA2564561320ddae4464fa8afd576d1e3889ad4923a75b595b369a5c60521a215b25a
SHA5122ee304b2b60b50f1855980616cd4f259e93b42acfddb1d319fe3866ee049901a1a10715d8ff8c6939b1738fe593caacf16462b7fd3e708c9e5147a4d95a201ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5007941b03fe89db13bfb4e8bb0fecb21
SHA1bb0a5785be03359c67fea183aaaf4d5c8137f133
SHA25677292575d438d1f9e04b8480d8bac4644090cf52f7b3d4d7c232cb0697a93d26
SHA512d48a433bfefe4570372335e1f732de68b7eba6dd02954991007d68d989c1ae4c576b6d22c391d2e291d32ac208598451a3c79983e2c259b6aae183d70eb9a500
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5028db4859c4f87cc76e4f94afa30bfc1
SHA1f3346af4c3054c00a98a97d93409725ff6cbaa8a
SHA256ee9cb462f979b61449d0c4d84b2f42bcbeb0ef9cfc9fce3ef069a90ccb44eee4
SHA512d07b5794ba83ebf7d0a4b74875dea6ada261d4e1714f7c0f0f8834e7fed680d63e33589b564ff2781b1205fa8b188867c6f8a310cbf0ce03f3ca054419285244
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD584b511362729af575af4a068001d307e
SHA197a77ddb9c4861c4e8b8c43232ad3cc78929729b
SHA25601d6ed6d9ace73ab72abbf72ac89511f8db49bf24e0def43ba19dcb52654df54
SHA5129ebdce53cc7daf5670f431f8bd558f89de3d2652ec824df5fc4b4514d133206ce8054c8956cbacbc9d13fe59109cbd9f54e19a1d8b76716585527b3d70eda270
-
Filesize
7KB
MD55ec2a937a2f9554cc549aeafd20c001f
SHA1166e25e5dee6ce615c9445d66256c6a36b93893b
SHA256f62cc305dd31bf4c81a26f6baaae1ec996cfabed92df0462254a14723b403629
SHA5120be9c2c52e5f589779ca5c657af50ce9053739959408836c28746f4b987c4699863d5276ca7b103783ea9d8ab210298e409f7bcb07163641b19836f33d2c4b38
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
7KB
MD546089d873fc67190f4c083274dbf54bd
SHA10baad3039cd3d29069c559cfa2e00f89326ade07
SHA2562af27e27f9ed6235b0d7816c9fbc259cc713d8615e9f5e7306b9a77a68b414eb
SHA5124034152a3c989e07bcac49fc79b23663ef722b14ee52c114c5862fb4c88134ead11a14254a7addf6373860b7831e890efadfd156ae9db6a3d7a3c2e01f783be0
-
Filesize
1KB
MD5b7db37f8161e10abe2a3019abd4b473c
SHA1fc8de1e266c1502f1935af2e2b7ad4d8abddea53
SHA256be6923529bc190f998739ef37f7c761240344f57c50d5c64ddbde4456912cc40
SHA512abe2ae32614753dd6344dec44bf47f105e945645efe502547d8824ed2da0756173523f3ef4665d2fb982cdd8b8cf43b74132fb2c9edb9d60d05d7ec1f4fd557a
-
Filesize
10KB
MD50b333c643b5ea6ee06d7a62ffb6812b5
SHA1f4e8babc7950944959d4c443fab7eaa1e74f3dde
SHA2569d45420969f0744a06d78e1387a62057ee06b06deec652edfa39a702033b85bd
SHA512df75bb3bb98c779f25bf05ee1ed196feee9c73e3f1d6858b4565800455d683ac22b8cdfffba5462382773a29d2de371fbc07d78bf9f227f960dd865625b60eb2
-
Filesize
6KB
MD582889287341f64f12f11a51a7da6a424
SHA106706ba1ad1d73905ee1b674f0532f7be25885f3
SHA2567d41155dbeba9b3beb4ef89bc34f84c2243be90f7750ebaf31f04303a1e87948
SHA512e9856d70b09027faa01260cb94c8a9127b8cf120744ae63dbe178810cfe3e36eda9520efe174d3c1fe90e661490babcaf26c97812b7c6e76f74a67d0d3fe06ea
-
Filesize
9KB
MD56f196abb02af951c51900c79500883f2
SHA1a6a6434844f76aec0e2968ad67f6e9ca8477e316
SHA256f6bb149537480e8d302a5ef057d9ff493a960353bedee122e8e6f7dbc7550628
SHA512cedeec7036620fe626ba58d647166be94d41749956d1ff81ff3f98bdfb259e85fd2bae5b9f11b55fe1486bd8578327fae6ad0fc263ef03c5041fe1f15addb26a
-
Filesize
5KB
MD523d7245c0b5b888685a20e0e04bf210b
SHA1370bbdf15ea02292182397af21a9eb5c1e4c37ba
SHA256a263cf2a9fadc099867299f00e46e8d9bed1de8357cb5108fdafbe3a2cbfc81d
SHA5126fcc9f57d9089e2b24a7aeb6b3f0df91cb86b77eadca25455cfd920cb91acc819dae9fc8798ced767c940e699797670204c22442c85a27524bb88e3687ce4d0a
-
Filesize
6KB
MD5ddc43872437d99e174b1bb1b679c862b
SHA15db766a5bbe3ee3e56dd2ae14315960ebb8f7b64
SHA2560e0c6305d09b9a6939c63b266cf3a140bbe832dc3202aa7d11c49cb8046820c9
SHA5127b353aa34d298cfff6a2d90ea0c1a3029c29f86542b2d86c3107883853630ecf9e13eedb3785d92234e479755d1a0f119001be2960980f3070de42900a50f648
-
Filesize
9KB
MD50bf2e05ff1d61452feeef32b38ecd3c1
SHA14d24a345689d0b165a8c17908bb99bbae0445a23
SHA2561a90813c89520aac89426ea3ac742067ae8aef945cd8f6016d21aa9d8263bc62
SHA5122f507ff298b445a085eccb2f3a6dbefcd7fea9479cc692824478a8e4c41470df650ad6d70bdbf98b3723001612fbe341b7b44b8b177ba0222f6deaad5b85f1e0
-
Filesize
9KB
MD5c19935db1151433fb6b1e7156e53ab85
SHA1229bb4177009e5cfff168e743d196655ff162a4c
SHA256b429ce92bd207ab354fbad41e04f760d707dff360ef0fc5ee8c6d9b48a3c3f72
SHA512941de61a58d7c71ae029f3cab1c875c657f38d5000396f6cf5243f75a4d76de36859d1cbe8e2ff557ea1ea553649a431be95d6742c4327797a9f67f7f41b1220
-
Filesize
9KB
MD5c8be8c3e829f3ecbacba0dec594c44b1
SHA129f11126a858122853313d83d9fd10e7ebda24f9
SHA2563af286df51da738fb1e62acd5fb290676f59503a9c5ea2d925f18837dcf1c370
SHA5129c8762ac0e5ce0e24137320aaee9807afbad9a73c5e942fde16da9db32cdcc9564aff52703677b625d2487fda3c8a83af9a2efea5c1aae58bfe294a3b38563dd
-
Filesize
9KB
MD51907b8a012c9ec8e8520882b336e6755
SHA1661b2f52150685e26bb28ad9e10fc8c4edd38733
SHA2562e58f3c4ad0117f0ba50c5261aecc2b83291071a4db2a1d53554a168eef2972a
SHA512af828aa51299395d5932bb7f4c9c9d097530d084f6f0870a329e2186e6cae0a12cf377dda2ab7f04100b6591c938782538487f2a6d87f17b090e54e9bb066177
-
Filesize
9KB
MD599d953b656b3ce0664dd515e10b9b8fb
SHA1956e4e84d6de7f85dde94a09a840113f1d126242
SHA256a42e72512aba5edbab266d76a463f432668d106b3cc87eb92958c28789b1aade
SHA512bc89e97b2db03e678748437ac5e5b3821f0c23bdcd7e8aa68a5e3e389a318f56fd21ca65441d98df81d7fc5eae307a2ce5dffc5468228e49dc56b85cc3817e9a
-
Filesize
9KB
MD5deed3022c90e31443372cb6e25b71b9b
SHA13493fb94b8784aa591161bc3d16f763ba63023a8
SHA2566ee8eb2da3918b2699e312df3cf9bc4b2bb4d916db18ea8d2ccb44865c3f16e8
SHA5122abdde8eda92d2db537f9e3a5047e410d38f7b22b4e64a7eb6d46cb6904c6cf82ecf33eaaeec770fa2849e7673c8f58d330b6f9ee4f4281de7838baa790260c0
-
Filesize
6KB
MD5ddbb6517483551f619e810a628865a28
SHA1ad9f610eef629b0ef5ffeacb859f500d3d35513e
SHA2566f1fb93ab61b4b71da13bcf39bbda0dd4c3c82209605d522d497623f89426069
SHA5128b44f22344786600b0440898e5606bcfb7ef30054319552b258f07429e33d981803dc7e5213bbadc30bdf3caf8ddd65e89eec7d6b64b9811ccfecb9fc949b955
-
Filesize
9KB
MD5b72068d6d959bf4453fbbeae4d60419e
SHA109909bec284861697528d091d282212e682c27a3
SHA25655a4054ee076086715ef506bda22c70186ffeaceaf3fd90a69265d4e9882e8ff
SHA512cbdb8002a35bc5d90c747aed9b889f2c92ede2e7365efe07105668c96c114ad9c8b1fd3f27733ca7a7d78dc67b4f287d7adb30236b1e91a5c326bbd56c0b1eef
-
Filesize
8KB
MD5bdce2cdbb82587029a0a18a6e56cf281
SHA1cca5445ad3ce172e8aebafde292b22b0f9b49fca
SHA25608592c3508adbd5889c8e81248fefd174f41db26e0900b6dd103fb9715c26ffe
SHA512f82f5b3f1b644aca4fa35be8852d958017873840409d2186a280529bd5d6620cf800184100823af7f69cccb56c2e6e0668f65531aa275b98bada652d633ea066
-
Filesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0e9570385f62e0d768437bb68f32a135ffc5fe22\index.txt
Filesize89B
MD55d0bb55602e24d5bbd160e602f32efb3
SHA133a65b95d10d08af05f84f1a4330d6c818f2b7fa
SHA2565f7fca1c97bd52935bbc111a74d6e613db8a6dbf2767d9628a889004ace76fce
SHA512d641e9386d30e94d5eab7ddc92dabf52a082b5173750f0da7c0ec1ad8e2a4631ed2e27af8789da0d97d597515f7e6cde8caeb0bf6fdb2b77c532974088e992ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0e9570385f62e0d768437bb68f32a135ffc5fe22\index.txt
Filesize82B
MD5ef903c47a1bf5d635ee4b18bb1b3d346
SHA124dfd7f11a78c7443da0416367b6d2fa3a01dc2d
SHA2565904f1be701d2aebc7cf9a8a3e0ee65fc5a44e9be76834446ac5e3c46c5dc436
SHA5129af4f66c28377562801116eca3bb0659ce5633bf06e927f038bd726ce25a5fd02a81a2ab988af9c3921fa4bd79e0de52c413840071b8c3e85e05a67279f51101
-
Filesize
3KB
MD500466b11a4f0184cc286c535df0d6bf3
SHA1b9daf3b86a847e2fdc3aa02514d851a0a6e60162
SHA2564e4e695e9e3ddcc5eff3d0178fa0808eb5a63ef05e6763ba00c6afe56e890b07
SHA512327923382bae54828c979b6d6670919560c51e7550995c84ab4b1cf96dbcfd1498bc575a3a5e9cbab9332767f2c8548448b0237329885fcd5cb477cb8a938ab7
-
Filesize
3KB
MD5dd8d2e45e6bfa8136b5a4e762b698d09
SHA154689b4603133bd78afaca3deba08d7ef1660656
SHA256381bda96da50e4ed449387e7dbc4b7ac90b464d09a968b62e0129a76a2528a84
SHA5127558c2c175136721252246f1805048b57843f3c93ec4cedaf6c317d0c457306ea8b04f429cfd9c9ac4653568fef574e6f4e06d233d72e1178d66cde01564d9fd
-
Filesize
2KB
MD57e3e3275041f71c0e9ad274959d042eb
SHA1dedf9b18f56f603094097a5fb18b77f630350bdd
SHA256f258cdf5a8dc046d6afa9fba378223ea05880aa71a31389b6ae858f7bd27189e
SHA5121ea1f131ebe0f16d42656bbc4b81153b635486cacb14bfe94344ae4f8498dadcd088b9ae54423b5c360c974484bbfdf8b46fb6e2d4c431849b3f2df43c51fb02
-
Filesize
3KB
MD5d52d95195ccbdf87489a01f02f9613ad
SHA19fdd9c4b7fd2ace8159befdc8f466e0b894d6858
SHA2562747209b9d4f365516f4342c65e6fe92f3327d7bfade7c2677b0d28034b5d68e
SHA5123f0b2f1f446cbb8d67f64037c0eb8fef7c8acb6dc2a3faa506ef9f044e86138a6739dada9f5f8ae672bd9af901040efb33f48951c1b4d1e0bbed669d1f0fa20e
-
Filesize
3KB
MD526b6b7c4ac27281bcfbd0cc0eb503110
SHA12bae92e9ebb3021f43f7d83164d1b959a7dbdba4
SHA256ae9c6fc4c25067402d4c412ee336313f25e827b030c9c8f0ad48d71b8d0510a6
SHA51232f10059ba7fb0512e35d4aa2d9e64f4ccb1423ccdbd96783eca9be89863f36b75c1d4a32e966eb8fbc13abab2e20efd7a89369c1390c81655d0c9592bd4f7cf
-
Filesize
2KB
MD5d9801e6521fe0a29a557a4a367529c27
SHA1a4b2957d90dfd3052b49c1ca5a820d7b64d15757
SHA256599dc7dcc2713d49a068f0ead2b5c639b18fc58a82ad8c0f7533a666d01f7891
SHA5124a8c5c46ee90de231365b0777b4d5f8aef795a3cace2427d5e0ffadfea3d81bacd3a51d7b13eba1b70224c7f75a8ca1501e0984c5367199d6326465155cc5f0f
-
Filesize
2KB
MD5d349e6854ecb38306d4433fda92f35d3
SHA18fb3fe38d7ef21a5a24024c326dcd532d114e338
SHA25626e39385dfae94e38066932c8bd526354b37b2bd78055bcefb2d10cace8f035f
SHA512496d3bb079bfb7bc053d9f1a532dea1825f751837317ac7528c9ed15a1506871a59c3c80068a7421cd1e823ecf16a4aab790ebfcb2d6694f2d923f945c78c508
-
Filesize
703B
MD5e2e67029064a2cab92e4b631651cd51e
SHA1322e20f33fa6e2a80fdb2aa3ad7f8eeca48d0c9a
SHA25629be1412d6e697963dc00bbd74f0343742cf30ebf94393242cc02bd1abc62f52
SHA5129a95e24407b902b4a2015dfa31a36aa19af41c6960e5c7cb420dc10d783b70ec0d8e8dbc05541fad62de0da6a7e90b815b2c34eeccdaf65f676e8ba970d35a0d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD51b2262e7763e3c65a37fbc1c47022f49
SHA104be2ee14dcd70f3b1ed28547a147f35c735e118
SHA2565913f0bccf48950c039407ef593aa59516c6fc2fb9bedddc00f21c95630a6fd0
SHA5121ef235ff5fe39ae39362a1026db32d480eabc3f2815543aaf59b95dfeb8a82e8c86b61c58154194073fda3ca90c4a419a8dd603fc92bd4f46aa43e86353dd617
-
Filesize
10KB
MD5966e0fd9d9864c6dd1121316290b6793
SHA12020ed5f21f7737f849a4c7dbeb6570a32192ae1
SHA256f5dc0d8b933db2dddbe0b44e51bb14c55797e37812657955472f54044c639371
SHA51246ababc16fc3725e2766380118143fd4919849b8a25ee253836b777cc4118eaf33d240d31ed646bb20a2be2bd278812eb95624b3804c1acc018df9c21209e3a1
-
Filesize
12KB
MD53f28bb679fe10aa42c8d88fb98929c85
SHA1d65a4cd50ff6f2998b3cf95d984a01ea3fe660d9
SHA2560a6a1d9152e910aebe1c1b3db8ce521d2214320bcfa11016196e14c54496412b
SHA51212464193ba7a4418da49fe2e97a07964db18c1810d54c7f8afa9d028522304ccfa2987161261821074190546f8b9423f9098125bae1a1c7773701406d64da9c7
-
Filesize
12KB
MD5a5506713e394c29e7687360bbf426d1d
SHA1fe1256c45151c1e792cd7a49242b611d025ad765
SHA256d6bb6728386745b3e3e100e58ed2de6d6c7fd112dda8dc001f906cadda0f2d4c
SHA512125da46acf596265c9a6e9eb6e1ab11f77127b9a68c1a856eaf1a706f01000872a887bb683c1df2ab213826d7d66f6a9f1f6680e200f956421f9d5e6c2fbbd5c
-
Filesize
12KB
MD5aefc858e3ea00c3a07f16d811f93fd84
SHA1463fe2fe207ef2b8cfb5497a47724fd5479882b1
SHA256c425e448e126c737e23cb6b41a1111433ffeaf69597c2b45085d932666595ffc
SHA5124bf69a9ff8e5a210c1216812f53fca909e2ef6d1970db5009513fe3453ca036324cc5f1c698329407129eefbc1eca41da3bfde21625b202c23243afbeac0b534
-
Filesize
12KB
MD5238af761b08f0485f85df0bdcd95e197
SHA152a8fd83f132b4959a3b2506036d0e59a99186c8
SHA256aa82c2e43ec69f67303c117763a81ab0e6384a4bf835043fc3a4e618103034d5
SHA5128aee4f17149815e06fa25fe5b10591d5a4cf2b8a95cd792c2fbd9c2983a311883f43b493aa938f0c0fdd8b5c1eb910609681fe91f560b69979bca388064fb05f
-
Filesize
10KB
MD561ef15d80043e24baaf63245f20834eb
SHA1d246a8e1830325cac292b853d84a8318c2a57dd3
SHA256644dcfa57bd79a05fe0ece5b0f11fd225df459eba6121553441e607ccea84b42
SHA51215d46932e65f0430eb4c7b285531c6a1a4061529c36d12fad8644136f99baef0ba8ca535b044996d319ced0a7288f43109edc7ca0e4372291305443b9252315f
-
Filesize
12KB
MD5d5862439ce7fa5e6131ed69d9d5244d3
SHA1439e5500b6fd8283ac4bfd2efd8269e408679ac0
SHA25612ff363c13b2dc493cae391add8cb222690d8c2a43e0f4c775ad9a37b10ab4ba
SHA51262919329f2cc74ef6dd2bbc4ef57b2e41ee9f3973e1f43d55c465a0600e9851b576aa322ae270bfba7253c63a00c33306cf65e4c945f5cacfebb22a174e46e72
-
Filesize
5.1MB
MD5ebb32f28efcf12ebc69314dfad32aa3d
SHA112d0b7cd59fa8f5e1e7cc92bb931666369f39afa
SHA2562f6d4f5e566e2f4f1278bafae36df0ca4cbd177ce6f5e3afef7633362ea7dd3c
SHA51292e050ac5cd4ba77728338da24f4c1cdc45072030eb16050df9b0d25d0b44f1fc8c24dcb118008376506ac22023d960cfd37df513a1844f6be4d74427e1f0ffe
-
Filesize
163KB
MD5c5ae00d4614210e60c593a999bc5a0fc
SHA16eb44314f434a5718cc27592ab0a6971bf079bc7
SHA256b47b403f4fc89ebdb92100a79a39e54fb091b7ea74cd1822328398202ae7bfac
SHA5123f7a87190d22b371dcf61bc7d7b4d9e6ee787e7a1e1b146881bd63bf0702ca9baad1664bcf7ecdae47b3bfbc8144f2fdbfa60d97084200073df98e468c154f3c
-
Filesize
3.3MB
MD53c7861d067e5409eae5c08fd28a5bea2
SHA144e4b61278544a6a7b8094a0615d3339a8e75259
SHA25607ecdced8cf2436c0bc886ee1e49ee4b8880a228aa173220103f35c535305635
SHA512c2968e30212707acf8a146b25bb29c9f5d779792df88582b03431a0034dc82599f58d61fc9494324cc06873e5943f8c29bffd0272ca682d13c0bb10482d79fc5
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
Filesize933B
MD57e6b6da7c61fcb66f3f30166871def5b
SHA100f699cf9bbc0308f6e101283eca15a7c566d4f9
SHA2564a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
SHA512e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
Filesize240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
Filesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
780B
MD593f33b83f1f263e2419006d6026e7bc1
SHA11a4b36c56430a56af2e0ecabd754bf00067ce488
SHA256ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
SHA51245bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac
-
Filesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
Filesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
Filesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
Filesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
Filesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
Filesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
Filesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
Filesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
Filesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
Filesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
Filesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
Filesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
Filesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
Filesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
Filesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
Filesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
Filesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
Filesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
Filesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
Filesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
Filesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
Filesize
17KB
MD54790677e05d72ef7429dddf35562bf4a
SHA14243d6ea53db7e8cc0c355e70d6cffb54787b90b
SHA256319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96
SHA512a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3
-
C:\Users\Default\Desktop\@[email protected]
Filesize1024KB
MD5dbbe82485c0402c219997634de6d71e1
SHA1277753d985fb1b7522ff6877d0a1562eb01b17cf
SHA256984e38937a8f00a081a060d3ea3215f5974e765f7bfc82cffca7e7bf7a908d6d
SHA51239914dace53ac15c13f2abd3eb9bd2548388eefa5d1a108203c261cba300bf74e8a01e38e56a98126807c3fd1ef792ec54b0af05efa00fce408f90c8bd9f058c
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e