wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry[.]exe

Resubmissions

08-04-2024 03:16

240408-dsz57sfc87 10

Analysis

max time kernel
922s
max time network
847s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
17-05-2024 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe

Score

10^/10

wannacry defense_evasion execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (55) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Drops startup file 2 IoCs

Processes:

WannaCry.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBC1C.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDBC23.tmp	WannaCry.exe

Executes dropped EXE 5 IoCs

Processes:

WannaCry.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe

pid process

2404 WannaCry.exe
1308 !WannaDecryptor!.exe
2420 !WannaDecryptor!.exe
4572 !WannaDecryptor!.exe
2820 !WannaDecryptor!.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2404	WannaCry.exe
1308	!WannaDecryptor!.exe
2420	!WannaDecryptor!.exe
4572	!WannaDecryptor!.exe
2820	!WannaDecryptor!.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WannaCry.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

30 raw.githubusercontent.com
1 raw.githubusercontent.com
3 raw.githubusercontent.com

flow	ioc
30	raw.githubusercontent.com
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

!WannaDecryptor!.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

1956 taskkill.exe
716 taskkill.exe
340 taskkill.exe
2320 taskkill.exe

pid	process
1956	taskkill.exe
716	taskkill.exe
340	taskkill.exe
2320	taskkill.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 965678.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
796	msedge.exe
796	msedge.exe
3772	msedge.exe
3772	msedge.exe
3344	identity_helper.exe
3344	identity_helper.exe
4384	msedge.exe
4384	msedge.exe
1828	msedge.exe
1828	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3772 msedge.exe
3772 msedge.exe
3772 msedge.exe
3772 msedge.exe
3772 msedge.exe
3772 msedge.exe
3772 msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	716	taskkill.exe
Token: SeDebugPrivilege	340	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeIncreaseQuotaPrivilege	472	WMIC.exe
Token: SeSecurityPrivilege	472	WMIC.exe
Token: SeTakeOwnershipPrivilege	472	WMIC.exe
Token: SeLoadDriverPrivilege	472	WMIC.exe
Token: SeSystemProfilePrivilege	472	WMIC.exe
Token: SeSystemtimePrivilege	472	WMIC.exe
Token: SeProfSingleProcessPrivilege	472	WMIC.exe
Token: SeIncBasePriorityPrivilege	472	WMIC.exe
Token: SeCreatePagefilePrivilege	472	WMIC.exe
Token: SeBackupPrivilege	472	WMIC.exe
Token: SeRestorePrivilege	472	WMIC.exe
Token: SeShutdownPrivilege	472	WMIC.exe
Token: SeDebugPrivilege	472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	472	WMIC.exe
Token: SeRemoteShutdownPrivilege	472	WMIC.exe
Token: SeUndockPrivilege	472	WMIC.exe
Token: SeManageVolumePrivilege	472	WMIC.exe
Token: 33	472	WMIC.exe
Token: 34	472	WMIC.exe
Token: 35	472	WMIC.exe
Token: 36	472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	472	WMIC.exe
Token: SeSecurityPrivilege	472	WMIC.exe
Token: SeTakeOwnershipPrivilege	472	WMIC.exe
Token: SeLoadDriverPrivilege	472	WMIC.exe
Token: SeSystemProfilePrivilege	472	WMIC.exe
Token: SeSystemtimePrivilege	472	WMIC.exe
Token: SeProfSingleProcessPrivilege	472	WMIC.exe
Token: SeIncBasePriorityPrivilege	472	WMIC.exe
Token: SeCreatePagefilePrivilege	472	WMIC.exe
Token: SeBackupPrivilege	472	WMIC.exe
Token: SeRestorePrivilege	472	WMIC.exe
Token: SeShutdownPrivilege	472	WMIC.exe
Token: SeDebugPrivilege	472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	472	WMIC.exe
Token: SeRemoteShutdownPrivilege	472	WMIC.exe
Token: SeUndockPrivilege	472	WMIC.exe
Token: SeManageVolumePrivilege	472	WMIC.exe
Token: 33	472	WMIC.exe
Token: 34	472	WMIC.exe
Token: 35	472	WMIC.exe
Token: 36	472	WMIC.exe
Token: SeBackupPrivilege	4476	vssvc.exe
Token: SeRestorePrivilege	4476	vssvc.exe
Token: SeAuditPrivilege	4476	vssvc.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe

pid	process
1308	!WannaDecryptor!.exe
1308	!WannaDecryptor!.exe
2420	!WannaDecryptor!.exe
2420	!WannaDecryptor!.exe
4572	!WannaDecryptor!.exe
4572	!WannaDecryptor!.exe
2820	!WannaDecryptor!.exe
2820	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3772 wrote to memory of 3996	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 3996	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 1500	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 796	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 796	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe
PID 3772 wrote to memory of 4940	3772	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa976c3cb8,0x7ffa976c3cc8,0x7ffa976c3cd8
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
2⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
2⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
2⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 /prefetch:8
2⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,11588228133910610342,2362372865993016913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4736 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2112

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:2404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 92881715925372.bat
2⤵
PID:1892

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
3⤵
PID:236

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
2⤵
PID:4212

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:948

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:2820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8e1dd984856ef51f4512d3bf2c7aef54

SHA1
81cb28f2153ec7ae0cbf79c04c1a445efedd125f

SHA256
34afac298a256d796d20598df006222ed6900a0dafe0f8507ed3b29bfd2027d7

SHA512
d1f8dfc7fdc5d0f185de88a420f2e5b364e77904cab99d2ace154407c4936c510f3c49e27eed4e74dd2fbd850ad129eb585a64127105661d5f8066448e9f201d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ffa07b9a59daf025c30d00d26391d66f

SHA1
382cb374cf0dda03fa67bd55288eeb588b9353da

SHA256
7052a8294dd24294974bb11e6f53b7bf36feeb62ce8b5be0c93fbee6bc034afb

SHA512
25a29d2a3ba4af0709455a9905a619c9d9375eb4042e959562af8faa087c91afafdb2476599280bbb70960af67d5bd477330f17f7345a7df729aaee997627b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a263ccfcc7f3043898252dbda1de1e6e

SHA1
bae33ecb1ca86d78ce54343f3fba6e231947be9e

SHA256
c556265ae49be2da51d185af7940d6145a137002770f6381599e5bbdd26de9ab

SHA512
bf373c69baff4b1cf220f4ddcca103df0ce97b0a671ebe24b346a33da408df81ae9a66f8eb40f10554fc5c67730394bd5827d1c20ec9acc19afdf3876f0e1e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
2ebbd61422b78463e73114c90d111185

SHA1
96a2a4824b034c487ccfcc08f3d7defa75601565

SHA256
164f96175f640e1c88954414f0d6bd4b866e8bc4004221585211df95aaeacaab

SHA512
a707e87fa44ddc0f804778e849698b4b9b1a110342a9eb8abcc1a9178019d6424077d6293940adf1b3db80872e42fb70347fb927e7a6cadb2490381fb2f1b926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f23a1b027247db440680a432dc785480

SHA1
632eb26ea3d2cdecfa49f57cb6326182528e96b7

SHA256
2af9e2ed69f8969a5fe2f6ae465b8d4bd98fcf7f7c5469e5bbe64b88962371e4

SHA512
4baceb67d79fab3792b023cc3ab508799c797a254c15747626ff550e98d8272ff3406b26d14a0da9838aad448e18e95326cacce2bba1b37a2fd6e6a371d8637c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8718db0f402d72bf0ecfa8a41841bbc

SHA1
f079b53dd76add91b1d9e68aa325d2028eb57bcb

SHA256
485488cbb18fa441a75fcd9786170dc0dc41365438af4ac51270028fe41f2e23

SHA512
d67f148a07af5023f42d88c3a50e94e85daa3bdf4fa8666ac6c83241607d30e927f69de5ff401e11a57f4258da6d96ba4e969d979158fe36aa7ef628c1eeb2d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d973cccfdc3198cfe39523b45922d7cf

SHA1
384190ee8b3a4a5533db7796020e6a9d766a6308

SHA256
d941b939e30bb3a717b498e6f85366d1ec54f61f66bdefbb5535e43ef324e2a6

SHA512
f7b300b945eefcb5f61c4011e06081c618719c120c61c758dad359752b202df6608ef3920f1c2ad77df027f9e67438dc490735f82bae14ff524242ee0d38dcad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
7dec80a80c95290f94d1b9c02530385b

SHA1
caf71a977fa403a898fd223a4a882ab703537ab6

SHA256
8e87f492ab9cb8ededa33ec95e7adfb1f3d3ecd83d8e6dd3dc3f1445f4afdc15

SHA512
1574b01bdf15ebfcf8a286091c9229c14d996aaf655211fe290571cdf45a3ed929bb649a54620581bea96f6addcf928a1db0ed1faa05a12942c1a7911c70c8d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ba71370b93ee9d5b72b4276d7583c20

SHA1
9313026455115341acfcd9e4ab8c4f942e4f2b7a

SHA256
9e1ff698aea4c25889fb5773a5548e2ea13a2368341d78bfaca4131962df3573

SHA512
dadd2b7a68743aba6d32561d2aa56f95405a51c67fca59c451e756605c0096139a3935379242d790f963e0e50b99e8cd843d2eb0d6b7da6d953e91b1a27cd4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2ef9e4c911f481d93682c37a905e2c6c

SHA1
fd01ef96f2d81c8f5eb3d8bfda7cafb85c5b71f8

SHA256
d15a2ab08bde0c5d7472cf98f6d858588b7e9a99507457775e8107ceec597ab6

SHA512
a386f091f6f8aad4a2ac5eca4ed80b65f407eb9595d7256681f5852450001440c30ae25a21c3a6fe28fa2cadadcbe5a176f7a396628c5d9ea5e7bb7097088529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e05d.TMP

Filesize
874B

MD5
217252411c9f6fb8196709fbf7d42a63

SHA1
2509cb53372c21c97508ad5f0c2faa3ba3248d19

SHA256
925b5db8173fa3df4952aa026859761084fb1c9c27f352a9f0262f15db99d3a2

SHA512
48da3dcf441b3009b28326a60dc77cef4c719bb18574f802806fbb2b882d250b7786f1f907fd44333c2e8ecf94943ff8efc91aed79913b7c349ddb30a7e4609b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db

Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
989ddb0c8c255efbbd9d82082efeeb77

SHA1
7225c502968a51d3d49257a6e4028b9d3e8e8f88

SHA256
6c5df9a45810d575cae10e8c600e97d4dbdb4725363d5d6aebf1fb7955284bec

SHA512
61358dcd884a4ac142079ad93626cf0750d179e9b26cb11ef69f519bceef45199f1893c206471dccd5ba90e30c5a9e2f0854188981ba65926b838dbf81550a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dc78dd68a4b66f9b9e2c7f4a3ef3c7b1

SHA1
339920bd18ac4adc2e5fae1792b53157fea4bf56

SHA256
ab1ea00db778cdd6f4042d2fc6fb566d6d9a15deac22c82e7277a4e115d7839c

SHA512
7799f42de003209b613c743d8fc2ea5bfcd6f946a1a24b24840df9642deab7a6a5afd4108c6481b1c1eaeb01e2e0210255c76350129396c1f4466d90180e4afc

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
0c48284318e1d1dd67fdd2a6b57c40fd

SHA1
52923c96ee34faf3cf8f83cdbd1ca186c7555346

SHA256
319bfbeece2b4bd447800ae4d2740a05c0e92e671921298e0320ab62b04c3771

SHA512
5ee64fdec88b78e41e2d8b7f28b37a26be80cf88e54af42b557946fe73bbb262fb405ea69cf20c981798b7da058c2961bcf8c7a6c3bccc9039d9ddb3d3d49284

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
6ada626ec777675aa69ecccd737f4270

SHA1
b72b6f73466c9fc5d39cd8bf7e4996373a4d7a5c

SHA256
585b567ef93a5ceade19a59c93fb8dd5eb1612f9dde256782103fea05c80260b

SHA512
6952ea5e634bad8a92da9a5cbb58e1d3a87eb02934a04918b7ea83792fac32ba932ad12a2f3bc55086a4f4267fc2cdf613bfc4a8491f24b643e3ae14f2ef9792

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
8a0b85ea2edf85410e89ce2eaee5ad59

SHA1
7d6c53be2a9ab91a0b75b76bea7363aed44bf9f6

SHA256
b467180b0e6b1b6eb4fc497116e9741f79850c8bd76d6fafa0410f0be19e2aa1

SHA512
2a7601fe5322a962f5ebad14ff0b553fd688d0e31d1e7df576b140c32a158404bc9dea9913d46742c0fcc4484db9c563803219392c70cd2064f53241bb7a2afa

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
3896c27fa1edf094f5410d65bc5a5c7f

SHA1
9e48d7a1bd3a13d4dce3126e29eb69c4f7ee7c94

SHA256
465af92baac44e45a6fed9f62f83173df3bf147f11c502df31dee5c0d9b8fffc

SHA512
df18ba1d15d92ef096e0f7817530b23c0ed2d2449bc9bf0fb71c5cffbc7ccccae13e639adff19b89ec4608de35d28ec7e08a72413a8f63532fa6a646f2769022

Download Submit
C:\Users\Admin\Downloads\92881715925372.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 965678.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
1aae7376a4d5c6c25787ef0ff6b48f20

SHA1
7b06f8e56fd61c596188b3d052f1d7e3a1515526

SHA256
2c89fb8a92bde457622ec01152f862357bf9d3631d296ca05630418aaf329acd

SHA512
27d6f2c1ae17af1dc0be3b7f0e446553eb0b857d06ea3700e677f045e30fe8494813ae4314f668bdadab03eec40db104ff314de30adc63375e213761c65715fb

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
\??\pipe\LOCAL\crashpad_3772_ZKAPVSZSYMHUJRZV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2404-325-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download