wannacry | 4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1

Resubmissions

19-04-2024 11:45

240419-nw88dsag38 10

19-04-2024 11:43

240419-nv23pabf2x 3

19-04-2024 10:25

240419-mf6a5agh7t 10

Analysis

max time kernel
68s
max time network
147s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19-04-2024 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!All malware.zip
Size

6.4MB
MD5

cdf646d5bfa6e006d61d9b2720e96341
SHA1

48a6f50b17b242f3abfeff00968960eeaa6e5ff9
SHA256

4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1
SHA512

bdb8168b5160f255655b82b19c0cec9952a8714cdb6c09ad5b30cc47f23bd64091403621ac5ec6d00d0861e19144f17474108270cb8de8e1fe31c7ce6859cc30
SSDEEP

196608:Pjlmaezq3Z3rgRBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiG:PYaImgRKt2O9/rH6T6yigHRHGxG

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
6972	WannaCrypt0r.exe
7596	taskdl.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7004	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
6892	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3998431567-3716957556-781226098-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
9592	reg.exe

Opens file in notepad (likely ransom note) 64 IoCs

ransomware

pid	Process
6396	NOTEPAD.EXE
6740	NOTEPAD.EXE
7588	NOTEPAD.EXE
8820	NOTEPAD.EXE
2480	NOTEPAD.EXE
5092	NOTEPAD.EXE
1536	NOTEPAD.EXE
528	NOTEPAD.EXE
7336	NOTEPAD.EXE
9068	NOTEPAD.EXE
9292	NOTEPAD.EXE
3164	NOTEPAD.EXE
7420	NOTEPAD.EXE
8340	NOTEPAD.EXE
10180	NOTEPAD.EXE
5060	NOTEPAD.EXE
5068	NOTEPAD.EXE
2412	NOTEPAD.EXE
6204	NOTEPAD.EXE
7368	NOTEPAD.EXE
6008	NOTEPAD.EXE
4324	NOTEPAD.EXE
7896	NOTEPAD.EXE
8624	NOTEPAD.EXE
2652	NOTEPAD.EXE
6708	NOTEPAD.EXE
8164	NOTEPAD.EXE
9024	NOTEPAD.EXE
3588	NOTEPAD.EXE
6800	NOTEPAD.EXE
9364	NOTEPAD.EXE
9388	NOTEPAD.EXE
4516	NOTEPAD.EXE
2844	NOTEPAD.EXE
7552	NOTEPAD.EXE
7072	NOTEPAD.EXE
7800	NOTEPAD.EXE
5756	NOTEPAD.EXE
7212	NOTEPAD.EXE
7352	NOTEPAD.EXE
4328	NOTEPAD.EXE
9756	NOTEPAD.EXE
3212	NOTEPAD.EXE
6628	NOTEPAD.EXE
6256	NOTEPAD.EXE
9336	NOTEPAD.EXE
9932	NOTEPAD.EXE
3800	NOTEPAD.EXE
5584	NOTEPAD.EXE
9000	NOTEPAD.EXE
1128	NOTEPAD.EXE
1764	NOTEPAD.EXE
5256	NOTEPAD.EXE
6608	NOTEPAD.EXE
7784	NOTEPAD.EXE
1448	NOTEPAD.EXE
5676	NOTEPAD.EXE
8644	NOTEPAD.EXE
2772	NOTEPAD.EXE
8460	NOTEPAD.EXE
9504	NOTEPAD.EXE
7984	NOTEPAD.EXE
5340	NOTEPAD.EXE
7460	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4596	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2832	7zG.exe
Token: 35	2832	7zG.exe
Token: SeSecurityPrivilege	2832	7zG.exe
Token: SeSecurityPrivilege	2832	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	7zG.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4852	4596	cmd.exe	84
PID 4596 wrote to memory of 4852	4596	cmd.exe	84
PID 4596 wrote to memory of 4328	4596	cmd.exe	85
PID 4596 wrote to memory of 4328	4596	cmd.exe	85
PID 4596 wrote to memory of 2456	4596	cmd.exe	86
PID 4596 wrote to memory of 2456	4596	cmd.exe	86
PID 4596 wrote to memory of 3880	4596	cmd.exe	87
PID 4596 wrote to memory of 3880	4596	cmd.exe	87
PID 4596 wrote to memory of 4304	4596	cmd.exe	88
PID 4596 wrote to memory of 4304	4596	cmd.exe	88
PID 4596 wrote to memory of 3916	4596	cmd.exe	89
PID 4596 wrote to memory of 3916	4596	cmd.exe	89
PID 4596 wrote to memory of 2620	4596	cmd.exe	90
PID 4596 wrote to memory of 2620	4596	cmd.exe	90
PID 4596 wrote to memory of 1128	4596	cmd.exe	91
PID 4596 wrote to memory of 1128	4596	cmd.exe	91
PID 4596 wrote to memory of 4516	4596	cmd.exe	92
PID 4596 wrote to memory of 4516	4596	cmd.exe	92
PID 4596 wrote to memory of 5092	4596	cmd.exe	93
PID 4596 wrote to memory of 5092	4596	cmd.exe	93
PID 4596 wrote to memory of 1356	4596	cmd.exe	94
PID 4596 wrote to memory of 1356	4596	cmd.exe	94
PID 4596 wrote to memory of 3800	4596	cmd.exe	95
PID 4596 wrote to memory of 3800	4596	cmd.exe	95
PID 4596 wrote to memory of 1492	4596	cmd.exe	96
PID 4596 wrote to memory of 1492	4596	cmd.exe	96
PID 4596 wrote to memory of 1448	4596	cmd.exe	97
PID 4596 wrote to memory of 1448	4596	cmd.exe	97
PID 4596 wrote to memory of 1324	4596	cmd.exe	98
PID 4596 wrote to memory of 1324	4596	cmd.exe	98
PID 4596 wrote to memory of 4240	4596	cmd.exe	99
PID 4596 wrote to memory of 4240	4596	cmd.exe	99
PID 4596 wrote to memory of 3212	4596	cmd.exe	100
PID 4596 wrote to memory of 3212	4596	cmd.exe	100
PID 4596 wrote to memory of 2652	4596	cmd.exe	102
PID 4596 wrote to memory of 2652	4596	cmd.exe	102
PID 4596 wrote to memory of 2772	4596	cmd.exe	103
PID 4596 wrote to memory of 2772	4596	cmd.exe	103
PID 4596 wrote to memory of 1764	4596	cmd.exe	104
PID 4596 wrote to memory of 1764	4596	cmd.exe	104
PID 4596 wrote to memory of 4152	4596	cmd.exe	105
PID 4596 wrote to memory of 4152	4596	cmd.exe	105
PID 4596 wrote to memory of 5048	4596	cmd.exe	106
PID 4596 wrote to memory of 5048	4596	cmd.exe	106
PID 4596 wrote to memory of 5116	4596	cmd.exe	107
PID 4596 wrote to memory of 5116	4596	cmd.exe	107
PID 4596 wrote to memory of 4324	4596	cmd.exe	108
PID 4596 wrote to memory of 4324	4596	cmd.exe	108
PID 4596 wrote to memory of 1536	4596	cmd.exe	109
PID 4596 wrote to memory of 1536	4596	cmd.exe	109
PID 4596 wrote to memory of 5060	4596	cmd.exe	110
PID 4596 wrote to memory of 5060	4596	cmd.exe	110
PID 4596 wrote to memory of 4036	4596	cmd.exe	111
PID 4596 wrote to memory of 4036	4596	cmd.exe	111
PID 4596 wrote to memory of 5068	4596	cmd.exe	112
PID 4596 wrote to memory of 5068	4596	cmd.exe	112
PID 4596 wrote to memory of 2412	4596	cmd.exe	113
PID 4596 wrote to memory of 2412	4596	cmd.exe	113
PID 4596 wrote to memory of 5104	4596	cmd.exe	114
PID 4596 wrote to memory of 5104	4596	cmd.exe	114
PID 4596 wrote to memory of 4448	4596	cmd.exe	115
PID 4596 wrote to memory of 4448	4596	cmd.exe	115
PID 4596 wrote to memory of 3628	4596	cmd.exe	116
PID 4596 wrote to memory of 3628	4596	cmd.exe	116

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6916	attrib.exe
9980	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\!All malware.zip"
1⤵
PID:2024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4192

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap22165:82:7zEvent26951
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2832

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Phantom Crypter.bat
1⤵
PID:4820

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DDOS.bat
1⤵
PID:2960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\DDOS.bat" "
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4852
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4328
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:2456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:2620
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4516
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5092
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:1356
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3800
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:1492
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:1324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3212
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2772
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4152
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5048
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5116
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5060
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5068
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5104
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2844
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4360
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4928
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2480
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3344
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4784
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3588
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3164
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:528
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3844
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3368
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:2784
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:4032
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5040
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5156
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5188
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5224
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5256
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5296
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5380
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5432
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5488
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5540
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5584
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5636
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5680
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5700
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5732
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5796
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5820
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5840
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5888
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5936
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5956
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6020
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6044
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6072
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6104
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5676
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:5804
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6008
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6160
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6228
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6256
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6280
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6312
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6396
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6420
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6492
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6544
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6588
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6684
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6708
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6740
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6780
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6800
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6844
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6864
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6900
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6932
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7016
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7048
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7108
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7136
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6584
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7336
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7368
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7420
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7552
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7588
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7648
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7724
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7748
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7792
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7812
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7836
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7896
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7944
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7984
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8008
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8040
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8072
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8104
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8136
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8164
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:6528
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7160
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7212
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:3412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7072
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7244
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7272
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7352
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7528
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7544
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7800
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7996
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7784
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7116
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:7788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8208
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8248
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8344
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8376
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8396
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8424
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8496
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8524
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8552
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8644
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8696
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8724
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8776
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8820
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8892
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9044
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9068
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9112
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9152
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8784
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:8844
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9248
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9292
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9336
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9364
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9388
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9420
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9504
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9636
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9660
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9692
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9732
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9780
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9836
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9892
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9932
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:10028
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:10084
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:10136
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:10180
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:10236
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txt.txt
  2⤵
  PID:9404

C:\Users\Admin\Desktop\WannaCrypt0r.exe
"C:\Users\Admin\Desktop\WannaCrypt0r.exe"
1⤵
- Executes dropped EXE
PID:6972
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:6916
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:7004
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:7596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 258991713527275.bat
  2⤵
  PID:8876
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:9980
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:9980
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected] co
  2⤵
  PID:7964
- - C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    PID:10212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:2024
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected] vs
    3⤵
    PID:7632
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:9812
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:6892
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:9172
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  PID:5872
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  PID:5836
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:5796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "gqilupcchjsj012" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
  2⤵
  PID:9288
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "gqilupcchjsj012" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
    3⤵
    - Modifies registry key
    PID:9592
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  PID:7784
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  PID:7252
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:6856

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:8812

C:\Users\Admin\Desktop\Memz.exe
"C:\Users\Admin\Desktop\Memz.exe"
1⤵
PID:7436
- C:\Users\Admin\Desktop\Memz.exe
  "C:\Users\Admin\Desktop\Memz.exe" /watchdog
  2⤵
  PID:5768
- C:\Users\Admin\Desktop\Memz.exe
  "C:\Users\Admin\Desktop\Memz.exe" /watchdog
  2⤵
  PID:8236
- C:\Users\Admin\Desktop\Memz.exe
  "C:\Users\Admin\Desktop\Memz.exe" /watchdog
  2⤵
  PID:9104
- C:\Users\Admin\Desktop\Memz.exe
  "C:\Users\Admin\Desktop\Memz.exe" /watchdog
  2⤵
  PID:8584
- C:\Users\Admin\Desktop\Memz.exe
  "C:\Users\Admin\Desktop\Memz.exe" /watchdog
  2⤵
  PID:7100
- C:\Users\Admin\Desktop\Memz.exe
  "C:\Users\Admin\Desktop\Memz.exe" /main
  2⤵
  PID:9976
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:7520
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:9276

C:\Users\Admin\Desktop\Desktop Puzzle.exe
"C:\Users\Admin\Desktop\Desktop Puzzle.exe"
1⤵
PID:9580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6636

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact