Analysis
- max time kernel
139s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/05/2024, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
- Size 224KB
- Sample240513-xtncksac4x
- SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
- MD5 5c7fb0927db37372da25f270708103a2
- SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
- SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
- SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\!Please Read Me!.txt
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD137D.tmp be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe - Executes dropped EXE 4 IoCs
pid Process 2408 !WannaDecryptor!.exe 2036 !WannaDecryptor!.exe 2092 !WannaDecryptor!.exe 1120 !WannaDecryptor!.exe - Loads dropped DLL 9 IoCs
pid Process 2520 cscript.exe 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 2656 cmd.exe 2656 cmd.exe 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" /r" be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" !WannaDecryptor!.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2748 vssadmin.exe - Kills process with taskkill 4 IoCs
pid Process 2712 taskkill.exe 1904 taskkill.exe 1764 taskkill.exe 2364 taskkill.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1120 !WannaDecryptor!.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 2712 taskkill.exe Token: SeDebugPrivilege 1764 taskkill.exe Token: SeDebugPrivilege 1904 taskkill.exe Token: SeDebugPrivilege 2364 taskkill.exe Token: SeBackupPrivilege 1436 vssvc.exe Token: SeRestorePrivilege 1436 vssvc.exe Token: SeAuditPrivilege 1436 vssvc.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2408 !WannaDecryptor!.exe 2408 !WannaDecryptor!.exe 2036 !WannaDecryptor!.exe 2036 !WannaDecryptor!.exe 2092 !WannaDecryptor!.exe 2092 !WannaDecryptor!.exe 1120 !WannaDecryptor!.exe 1120 !WannaDecryptor!.exe - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2616 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 28 PID 2236 wrote to memory of 2616 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 28 PID 2236 wrote to memory of 2616 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 28 PID 2236 wrote to memory of 2616 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 28 PID 2616 wrote to memory of 2520 2616 cmd.exe 30 PID 2616 wrote to memory of 2520 2616 cmd.exe 30 PID 2616 wrote to memory of 2520 2616 cmd.exe 30 PID 2616 wrote to memory of 2520 2616 cmd.exe 30 PID 2236 wrote to memory of 2408 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 31 PID 2236 wrote to memory of 2408 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 31 PID 2236 wrote to memory of 2408 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 31 PID 2236 wrote to memory of 2408 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 31 PID 2236 wrote to memory of 2712 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 32 PID 2236 wrote to memory of 2712 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 32 PID 2236 wrote to memory of 2712 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 32 PID 2236 wrote to memory of 2712 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 32 PID 2236 wrote to memory of 1904 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 33 PID 2236 wrote to memory of 1904 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 33 PID 2236 wrote to memory of 1904 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 33 PID 2236 wrote to memory of 1904 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 33 PID 2236 wrote to memory of 1764 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 35 PID 2236 wrote to memory of 1764 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 35 PID 2236 wrote to memory of 1764 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 35 PID 2236 wrote to memory of 1764 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 35 PID 2236 wrote to memory of 2364 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 37 PID 2236 wrote to memory of 2364 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 37 PID 2236 wrote to memory of 2364 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 37 PID 2236 wrote to memory of 2364 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 37 PID 2236 wrote to memory of 2036 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 42 PID 2236 wrote to memory of 2036 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 42 PID 2236 wrote to memory of 2036 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 42 PID 2236 wrote to memory of 2036 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 42 PID 2236 wrote to memory of 2656 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 43 PID 2236 wrote to memory of 2656 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 43 PID 2236 wrote to memory of 2656 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 43 PID 2236 wrote to memory of 2656 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 43 PID 2656 wrote to memory of 2092 2656 cmd.exe 45 PID 2656 wrote to memory of 2092 2656 cmd.exe 45 PID 2656 wrote to memory of 2092 2656 cmd.exe 45 PID 2656 wrote to memory of 2092 2656 cmd.exe 45 PID 2236 wrote to memory of 1120 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 46 PID 2236 wrote to memory of 1120 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 46 PID 2236 wrote to memory of 1120 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 46 PID 2236 wrote to memory of 1120 2236 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 46 PID 2092 wrote to memory of 580 2092 !WannaDecryptor!.exe 47 PID 2092 wrote to memory of 580 2092 !WannaDecryptor!.exe 47 PID 2092 wrote to memory of 580 2092 !WannaDecryptor!.exe 47 PID 2092 wrote to memory of 580 2092 !WannaDecryptor!.exe 47 PID 580 wrote to memory of 2748 580 cmd.exe 49 PID 580 wrote to memory of 2748 580 cmd.exe 49 PID 580 wrote to memory of 2748 580 cmd.exe 49 PID 580 wrote to memory of 2748 580 cmd.exe 49 PID 580 wrote to memory of 2576 580 cmd.exe 51 PID 580 wrote to memory of 2576 580 cmd.exe 51 PID 580 wrote to memory of 2576 580 cmd.exe 51 PID 580 wrote to memory of 2576 580 cmd.exe 51 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.execmd /c 182361715627336.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- Loads dropped DLL
PID:2520
-
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe f2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2408
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2748
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
- Size 236KB
- SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
- MD5 cf1416074cd7791ab80a18f9e7e219d9
- SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
- SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
- SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
- Size 921B
- SHA256 99a8bab47e1cabb93412501bb7459864aa8875569dd6f808801d99e6a0f25494
- MD5 0cfe5a80ace7d92617929007d4239543
- SHA1 b552ad0258452d09706182967283faefc8d9414b
- SHA512 ef4d42bc22dbf98243060a6b9ab5891355a38607a4bdca67825944f6b405055fef0ab26bab0b74a5c2357f1345387195245dbfb5beb08ffa6a1fa503ff6448ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\00000000.res
- Size 136B
- SHA256 bf4eca9d08a057a83df9ca2767f6e7118679cd17aa44a4149886a433fc7c34de
- MD5 019abe08bb6ce4b737435d34fd8a2fbd
- SHA1 473eb08eb387a303b63bdbd202769ea6f2e136e9
- SHA512 8e8746c9d3665e00d216db15c652509f98f8f300d0e1c93a0286382624749e05643e4a71c2645bc2357471d7616d0fa9f235c9cbe348ab84e26210f4ced02da0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\00000000.res
- Size 136B
- SHA256 ce33a6ccc09d5be1a45133cb6e0157053ba6798e8a319ab5c11f6d5c5d456757
- MD5 c8653ba0dbd6ce2ff12790a25dd440e5
- SHA1 e3493057cad43fed5108fd6410ef10b72ea71cb5
- SHA512 f83943d500b8bb3c641fe3b4d524a8f48136f3a27f2afbe19324247399cb3311df33bee9454a03c1828613b4fa348a3a27235947548b508983aecf05f01b6af9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\00000000.res
- Size 136B
- SHA256 be11ce1bd57e9f5a3c22a934be92e29c0601f696c10bb09865757397fcd7ab47
- MD5 3a028cff8865a34d3818e431b97b99a2
- SHA1 5613c9cb3ed65803b2f4a5200bd21058f9205c9b
- SHA512 0eb29388963c1ecc272eabd85fcf0c7f1a9d1140470403b81312ffad0af99817bbb95df95870e0c41fe692c9d9342cf27de171748fb24efc2adae49c1bdf58a3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\182361715627336.bat
- Size 336B
- SHA256 73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
- MD5 3540e056349c6972905dc9706cd49418
- SHA1 492c20442d34d45a6d6790c720349b11ec591cde
- SHA512 c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\c.vbs
- Size 219B
- SHA256 0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
- MD5 5f6d40ca3c34b470113ed04d06a88ff4
- SHA1 50629e7211ae43e32060686d6be17ebd492fd7aa
- SHA512 4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\c.wry
- Size 628B
- SHA256 36cc3830fb57ec0cf2f6e806931f61c4eff6967bc2d655aa03a6623e8ee586df
- MD5 a527d8e7c2abdacba369df24d1100a32
- SHA1 ea2aa9ff27d8bc8f0a2792e05247972cef3481f0
- SHA512 cba68b07d393b5f420ddb430a06c881dc63a0c72021b09c04e41113e444d7a39ff529438e0c20739c5cea062a421b2250bbb3880bae3b8bdc5fbee724aad62f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\m.wry
- Size 42KB
- SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
- MD5 980b08bac152aff3f9b0136b616affa5
- SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
- SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
- SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\!Please Read Me!.txt
- Size 797B
- SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
- MD5 afa18cf4aa2660392111763fb93a8c3d
- SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
- SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
- MD5 SHA1 SHA512