Analysis

  • max time kernel
    1196s
  • max time network
    1176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 20:20

General

  • Target

    VencordInstaller.exe

  • Size

    9.9MB

  • MD5

    1b8ee61ddcfd1d425821d76ea54ca829

  • SHA1

    f8daf2bea3d4a6bfc99455d69c3754054de3baa5

  • SHA256

    dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

  • SHA512

    75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a

  • SSDEEP

    98304:jmPUf5A91QP5oToUsbeRwcyHekFeSpc12EKw+KVktWHBLmpTN5huJd3kMerGpNTt:SqqQP5oKswpLi3gOW

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3612
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff98166ab58,0x7ff98166ab68,0x7ff98166ab78
      2⤵
        PID:3384
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:2
        2⤵
          PID:1580
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
          2⤵
            PID:1172
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
            2⤵
              PID:996
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:1
              2⤵
                PID:3916
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:1
                2⤵
                  PID:3636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4264 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:1
                  2⤵
                    PID:2556
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4300 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                    2⤵
                      PID:4484
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4424 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                      2⤵
                        PID:1900
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                        2⤵
                          PID:4572
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                          2⤵
                            PID:3772
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
                            2⤵
                              PID:4968
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff60937ae48,0x7ff60937ae58,0x7ff60937ae68
                                3⤵
                                  PID:3640
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                                2⤵
                                  PID:1096
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3960 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:1
                                  2⤵
                                    PID:4040
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4748 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:1
                                    2⤵
                                      PID:1820
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3148 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                                      2⤵
                                        PID:4140
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1984,i,8099973471814962747,6673804501225602193,131072 /prefetch:8
                                        2⤵
                                          PID:1716
                                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                        1⤵
                                          PID:4088
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:1428
                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                            1⤵
                                            • Drops startup file
                                            • Sets desktop wallpaper using registry
                                            PID:1096
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib +h .
                                              2⤵
                                              • Views/modifies file attributes
                                              PID:536
                                            • C:\Windows\SysWOW64\icacls.exe
                                              icacls . /grant Everyone:F /T /C /Q
                                              2⤵
                                              • Modifies file permissions
                                              PID:2724
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                              taskdl.exe
                                              2⤵
                                              • Executes dropped EXE
                                              PID:116
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c 309841716150692.bat
                                              2⤵
                                                PID:4748
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript.exe //nologo m.vbs
                                                  3⤵
                                                    PID:4836
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib +h +s F:\$RECYCLE
                                                  2⤵
                                                  • Views/modifies file attributes
                                                  PID:4584
                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2692
                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe
                                                    TaskData\Tor\taskhsvc.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3880
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd.exe /c start /b @[email protected] vs
                                                  2⤵
                                                    PID:2120
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2624
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                        4⤵
                                                          PID:2704
                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                            wmic shadowcopy delete
                                                            5⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1208
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                      taskdl.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1500
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1916
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "napztglphjtx944" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
                                                      2⤵
                                                        PID:2020
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "napztglphjtx944" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
                                                          3⤵
                                                          • Adds Run key to start application
                                                          • Modifies registry key
                                                          PID:5032
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1432
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3680
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1444
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1160
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:756
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:180
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4868
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3432
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4380
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:976
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1592
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3256
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4476
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1872
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4848
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4840
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4600
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1048
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2588
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:656
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:440
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1228
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2424
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:180
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3172
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4404
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2868
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3944
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4892
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3600
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:5072
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:400
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3300
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:632
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2076
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2324
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4116
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                          PID:2744
                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                          2⤵
                                                            PID:2300
                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                            taskdl.exe
                                                            2⤵
                                                              PID:1388
                                                          • C:\Users\Admin\Desktop\@[email protected]
                                                            "C:\Users\Admin\Desktop\@[email protected]"
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Sets desktop wallpaper using registry
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1812
                                                          • C:\Windows\system32\vssvc.exe
                                                            C:\Windows\system32\vssvc.exe
                                                            1⤵
                                                              PID:4912
                                                            • C:\Windows\system32\mspaint.exe
                                                              "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\@[email protected]"
                                                              1⤵
                                                              • Drops file in Windows directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:804
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                              1⤵
                                                                PID:3216
                                                              • C:\Windows\system32\mspaint.exe
                                                                "C:\Windows\system32\mspaint.exe" "C:\Users\Public\Desktop\@[email protected]"
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:468

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                615ade7280092630f4ab54616acb53e1

                                                                SHA1

                                                                0e80600a8eaba6c7cdcaea4a59bad3a78f4bb00b

                                                                SHA256

                                                                e3e04f8977da13aa393e6d54558bfec31c362d815fec14bec7abbe6200ec06c9

                                                                SHA512

                                                                6b99f22c6445f5f8b800aaef9a2362a3d62267672362c3e7b5b9e124f06d7bc8f4969082b275e6d986ec6ab4302390417a0feebc470b851818cf5cb9b4515fc3

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                69f71e37091426b9a9dcbba8d1de0240

                                                                SHA1

                                                                27ba9aae7f2fc61f07309075b050f87ea0ce3b1e

                                                                SHA256

                                                                6c868308395afc1bffdc3b9354d503b58a777b22b3dbc92e03f0c420fb987147

                                                                SHA512

                                                                9e3220f7ea2d85308af09e1a5870a0a29dd5ad804c1caa115eaef4ff264f003ec9ff4ff542c532ae7ca4105317a354656743e918c1919dda770f3192ea54eae4

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                Filesize

                                                                264KB

                                                                MD5

                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                SHA1

                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                SHA256

                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                SHA512

                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                8f173301ce82836d6193da28a148e2cc

                                                                SHA1

                                                                0f45181560f47e853e7ce3f8b5a9b91c622ab2e0

                                                                SHA256

                                                                c9cb274f03a8f2666732edec574fff1d8864fa2ec16a8a49a87a583626f83363

                                                                SHA512

                                                                3dfe9b37d0334f448af2fa3cf423ff469d196c9118927b3040f770421833be6c84dbac82909dd2a3f3d7dd773dcbc5b3332f3093aad6efc998d86ba7e7fac823

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                f99ef9297ce7c36fe7ee6c219bb20ea5

                                                                SHA1

                                                                5b45feddad74cd4c980b5620a6220ddd9adde9ed

                                                                SHA256

                                                                714ddf7c48e302b192dd7fde03da0f183ae62dca43604ce63561d3173d6c96cb

                                                                SHA512

                                                                19e32407afd85c5f14fff61ea3f397c82bb8b88e28874d73d20f9ce85a159077e785cda5b20c875009a7f430d111b4ee75a96035c1f92d8a00a44cb5ac0c08f4

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                356B

                                                                MD5

                                                                91d625450657879c8c541b3fa59fcc25

                                                                SHA1

                                                                adb482287d63b798fb52ea5882f3bc08d11454a0

                                                                SHA256

                                                                dc7df7e4b9900964748f9870cacfa718563bf57203901bdf775ae745421bdd11

                                                                SHA512

                                                                f3f7074a4f711e7b0a4cb6969e08e05a55d96b90561abf561ebab0c9bfe385d6252c413703e646d1d8919a993f32cd9d4c9f3b58e90f5f014feec644cdf0085b

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                91da69ca0c281d55a8fb2cd03abbc37e

                                                                SHA1

                                                                ed5b8966f411ad8f3538af1287c0b819ccc159e7

                                                                SHA256

                                                                1876f3bd1a7253dcdbceffd7c0f7520f0dd20c136e3ee5870f6e609f198a6cff

                                                                SHA512

                                                                003e927f1ad138d00fc2674c662d2c38e11cd5cf4e783fc73ceeebb9355a6c04eba22404e438a9d07fcdebd110f9cc5da6d26fe34dfda5c0f5152651933da472

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                0ec277238d079753fa4605f8f68326b4

                                                                SHA1

                                                                abd2d8b4f2d135b833c04d8fdf2022d4d36c611b

                                                                SHA256

                                                                cbe99a09b34a822babb8ed0abba39745ccaba973fc62415e9e3dcf04636a4d07

                                                                SHA512

                                                                18adfd7d7a6fd2b910b63c0041f2963118d7472088b9aeacb01fb1345117ea6c3a83e4fe29fd8daaa8a964201b6fd2d5ebe196de09f2d308ab00a3ddcaf7e195

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                deea86f4f32957b9366ed96865349e85

                                                                SHA1

                                                                e22399559fd40d1b38cac9f7248776f426160ded

                                                                SHA256

                                                                10c4670178c13fae8a4492c4ac40570fb126664554a0f2dca689f2486a427943

                                                                SHA512

                                                                a2a7a0c4ab4428b258d3c09adc913f3482ae06946ba3fdd7983ca0a0404cb6781bba5bc1db66f875ab33f3f5b7e182453166dbd049570379afdfb6b0f39ce625

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                436a7b032f7edc7b8c4ba22bbbd77ebb

                                                                SHA1

                                                                a77cccf3014778a860950353fb52a4880e63a6f3

                                                                SHA256

                                                                e16bded12348d02e07b66e7c7a61bfc1f4acb464c5b4e90aba3386798dc6603a

                                                                SHA512

                                                                87b5e690d6ccd25442268c739c9077f2da4baf03ca3fa2418cc1d130e55dc2dfbbff3eafe0565c8485dcccfbe41709abab9eb3d01f501d65940cc7c016b00cb0

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                Filesize

                                                                16KB

                                                                MD5

                                                                dcaa52df949c04345eef8cdfd0b631cf

                                                                SHA1

                                                                974fbef57763348e459c82855696e106435bbe9b

                                                                SHA256

                                                                91754a93ba4b2bb4653385c8e95a7d4bde96fd2fc1344721482d8412b7382371

                                                                SHA512

                                                                3c16e03ce273f157f3af518df31e280d7225cb74d3a6e8fbde693c6135e55cd8e8533b5bbe32151315d7ef55189e6f368f655b241855080b092fc20a472106ab

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                261KB

                                                                MD5

                                                                c08bab7fb0b3c6ddb15ada0fca05f2de

                                                                SHA1

                                                                01fbac680b638bdd733c952fe1dd1bd9d0f6b118

                                                                SHA256

                                                                61db96f3f9fd6ba479557e24863a904d4b1e13aa4cf3b7542a9a405440a93cfb

                                                                SHA512

                                                                ab36c5238068da932e6850f11bceb19cd640fd85ba1d60cdee11f6cbedffbaaf3e3ff7ac35978f90e176174713f5e13ee7942ad37af91f8dc1f27b0fa537f125

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                257KB

                                                                MD5

                                                                e9ffa4bb3d52edfea4458a786f68802e

                                                                SHA1

                                                                be9e7e5d6e1670ec554a0023f9b254597bce4ffd

                                                                SHA256

                                                                73a341e7691c31a90817de577dc11f25eb92602b66bcac052906399efe06930a

                                                                SHA512

                                                                69190372f8f11ff8d74bd2a8ec646b083797dbe1ea3bc47e9a9e9a67ead760db284c82008c50d6602ff4ddbda4ab6876e448e3d73dfb23379a952c8d90e9c750

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                261KB

                                                                MD5

                                                                405558676893027c0c4ac58573775f89

                                                                SHA1

                                                                520cbbfb33efa6fa83826b6b7b03ca79b65de46a

                                                                SHA256

                                                                b3818b46104f9176e9e2945600064cb1c5697d0ca931c369cbb3549ed40c95ab

                                                                SHA512

                                                                ae0975d19ceb1171ec1e67b934468db0e20addf122835346819c42227216a1cc0a43f7e780a7f58dbe5c82398e18168a866f8549470e1da3b78c8c070606b77b

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

                                                                Filesize

                                                                933B

                                                                MD5

                                                                7e6b6da7c61fcb66f3f30166871def5b

                                                                SHA1

                                                                00f699cf9bbc0308f6e101283eca15a7c566d4f9

                                                                SHA256

                                                                4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

                                                                SHA512

                                                                e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

                                                                Filesize

                                                                240KB

                                                                MD5

                                                                7bf2b57f2a205768755c07f238fb32cc

                                                                SHA1

                                                                45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                SHA256

                                                                b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                SHA512

                                                                91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\tor.exe

                                                                Filesize

                                                                3.0MB

                                                                MD5

                                                                fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                SHA1

                                                                53912d33bec3375153b7e4e68b78d66dab62671a

                                                                SHA256

                                                                e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                SHA512

                                                                8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\b.wnry

                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                c17170262312f3be7027bc2ca825bf0c

                                                                SHA1

                                                                f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                SHA256

                                                                d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                SHA512

                                                                c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\c.wnry

                                                                Filesize

                                                                780B

                                                                MD5

                                                                93f33b83f1f263e2419006d6026e7bc1

                                                                SHA1

                                                                1a4b36c56430a56af2e0ecabd754bf00067ce488

                                                                SHA256

                                                                ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

                                                                SHA512

                                                                45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_bulgarian.wnry

                                                                Filesize

                                                                46KB

                                                                MD5

                                                                95673b0f968c0f55b32204361940d184

                                                                SHA1

                                                                81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                SHA256

                                                                40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                SHA512

                                                                7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_chinese (simplified).wnry

                                                                Filesize

                                                                53KB

                                                                MD5

                                                                0252d45ca21c8e43c9742285c48e91ad

                                                                SHA1

                                                                5c14551d2736eef3a1c1970cc492206e531703c1

                                                                SHA256

                                                                845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                SHA512

                                                                1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_chinese (traditional).wnry

                                                                Filesize

                                                                77KB

                                                                MD5

                                                                2efc3690d67cd073a9406a25005f7cea

                                                                SHA1

                                                                52c07f98870eabace6ec370b7eb562751e8067e9

                                                                SHA256

                                                                5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                SHA512

                                                                0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_croatian.wnry

                                                                Filesize

                                                                38KB

                                                                MD5

                                                                17194003fa70ce477326ce2f6deeb270

                                                                SHA1

                                                                e325988f68d327743926ea317abb9882f347fa73

                                                                SHA256

                                                                3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                SHA512

                                                                dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_czech.wnry

                                                                Filesize

                                                                39KB

                                                                MD5

                                                                537efeecdfa94cc421e58fd82a58ba9e

                                                                SHA1

                                                                3609456e16bc16ba447979f3aa69221290ec17d0

                                                                SHA256

                                                                5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                SHA512

                                                                e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_danish.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                2c5a3b81d5c4715b7bea01033367fcb5

                                                                SHA1

                                                                b548b45da8463e17199daafd34c23591f94e82cd

                                                                SHA256

                                                                a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                SHA512

                                                                490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_dutch.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                7a8d499407c6a647c03c4471a67eaad7

                                                                SHA1

                                                                d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                SHA256

                                                                2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                SHA512

                                                                608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_english.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                fe68c2dc0d2419b38f44d83f2fcf232e

                                                                SHA1

                                                                6c6e49949957215aa2f3dfb72207d249adf36283

                                                                SHA256

                                                                26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                SHA512

                                                                941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_filipino.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                08b9e69b57e4c9b966664f8e1c27ab09

                                                                SHA1

                                                                2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                SHA256

                                                                d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                SHA512

                                                                966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_finnish.wnry

                                                                Filesize

                                                                37KB

                                                                MD5

                                                                35c2f97eea8819b1caebd23fee732d8f

                                                                SHA1

                                                                e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                SHA256

                                                                1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                SHA512

                                                                908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_french.wnry

                                                                Filesize

                                                                37KB

                                                                MD5

                                                                4e57113a6bf6b88fdd32782a4a381274

                                                                SHA1

                                                                0fccbc91f0f94453d91670c6794f71348711061d

                                                                SHA256

                                                                9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                SHA512

                                                                4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_german.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                3d59bbb5553fe03a89f817819540f469

                                                                SHA1

                                                                26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                SHA256

                                                                2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                SHA512

                                                                95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_greek.wnry

                                                                Filesize

                                                                47KB

                                                                MD5

                                                                fb4e8718fea95bb7479727fde80cb424

                                                                SHA1

                                                                1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                SHA256

                                                                e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                SHA512

                                                                24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_indonesian.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                3788f91c694dfc48e12417ce93356b0f

                                                                SHA1

                                                                eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

                                                                SHA256

                                                                23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

                                                                SHA512

                                                                b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_italian.wnry

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                30a200f78498990095b36f574b6e8690

                                                                SHA1

                                                                c4b1b3c087bd12b063e98bca464cd05f3f7b7882

                                                                SHA256

                                                                49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

                                                                SHA512

                                                                c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

                                                              • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

                                                                Filesize

                                                                7.7MB

                                                                MD5

                                                                0de76f51a90c02337a98534634567771

                                                                SHA1

                                                                f789001d96d8996cd336c277d8371caa29a44ce5

                                                                SHA256

                                                                6079dbf70b50d2fd1038abd8a2b9fa8dc1146782daa56374c235681050be79be

                                                                SHA512

                                                                430b297c1f1962d41345906248fd65e5c84474135a92603238c4e3e9fa5b40c31826ac62299f714eafa6d2803628eae5763e28ee7fcc30e5e510de930b954c6c

                                                              • C:\Users\Admin\Desktop\AddShow.tif

                                                                Filesize

                                                                378KB

                                                                MD5

                                                                6c1b61afb352df9496c3d9b1be5deda6

                                                                SHA1

                                                                943d0546b5cd75779ed6acb9de8669b67662bbf3

                                                                SHA256

                                                                bacbecbe509f980b369697e31958600ff45ddc4f236d50931134e8b0222850bd

                                                                SHA512

                                                                d5bb9e7d410d20b5ae5e3e0c79751235553e52d18bc9feab10d4b27c3bee17e65ebefac94ed26e2f3a2dbad5be8c58f27e2cd1a98f15577b09174f68845ba37a

                                                              • C:\Users\Admin\Desktop\BlockInvoke.bat

                                                                Filesize

                                                                132KB

                                                                MD5

                                                                e6091be9bc1829d225c3c4c040d80f88

                                                                SHA1

                                                                31ba64ad38a19fecda1075bff876f73b57f3d736

                                                                SHA256

                                                                a9437167f7bb6d25c800f5bdf841325a1f576de45bb2dfd69d1e0e28efa4d306

                                                                SHA512

                                                                6288df80eefa2f497f9f991042561151e335d425975e19ab2093628816c0fb122a4148cb2efb0224f5d4ab99805d790cec4722033d185949fe3434cc3a0e048a

                                                              • C:\Users\Admin\Desktop\BlockSend.wmf

                                                                Filesize

                                                                520KB

                                                                MD5

                                                                33c7b3a218b5ccb68accd1c46a769ba0

                                                                SHA1

                                                                082513a2ab0f2871a79ae2ae6de01c67bbc464c8

                                                                SHA256

                                                                fd06eba59610d21498e7988b0aa21a956e7ca15b72313317a06a7bd4e3bff2cb

                                                                SHA512

                                                                f24eaa736fea8e1afabbfefe566e0b175ce267c05c73b952fa7db5ef72842190122cc081cd09bc2bb1aceb3466443776fb984a85e55977b0ae7b619c06e702f1

                                                              • C:\Users\Admin\Desktop\ConnectRestart.mpg

                                                                Filesize

                                                                181KB

                                                                MD5

                                                                a1080e5fac4e5a963e2cc5e3a54bd954

                                                                SHA1

                                                                b8122f6ae89b1cd2a9ac6d426a4381a3fd058dc0

                                                                SHA256

                                                                1b057afd39ba531f212636c65521dffa5e24f64959b61bed2fc1d1967457f03f

                                                                SHA512

                                                                ad1f48f2fde66d35de8e7e87105a6a714d7e5691d275125f3f11101b3441ccf19ae356a5a21ac8e14f14312347c6be45db67e78049d208557c0cefd996e6ddc5

                                                              • C:\Users\Admin\Desktop\DisconnectResolve.txt

                                                                Filesize

                                                                211KB

                                                                MD5

                                                                a1a8bcec5d4d03ae98a092547a227e42

                                                                SHA1

                                                                ce7d9144290d66487d97e835974473f7adc16c3d

                                                                SHA256

                                                                d2d3aef4fdb44221b2a7aa7dab2e9a2821f1d0997f8394aca162e971f47fa185

                                                                SHA512

                                                                44ac6fc364bdcbe66655d74bdb3df15ec97da0c9371165f2c4f662e2f23d6955a8926468e0d6f330a37a23ba9f75aa2b1d89f604f06ff2313bbd0a2c4998af70

                                                              • C:\Users\Admin\Desktop\EnableInstall.vsdx

                                                                Filesize

                                                                240KB

                                                                MD5

                                                                2c7b29d697158e560612b0a6fa2e12b4

                                                                SHA1

                                                                df8e819d3e98b73e4c1566d2fbef2d7747ed9da6

                                                                SHA256

                                                                f22281d47f69d10662e1753a4b37b99878c13a1fca5eff3575b3f57d0c9aee7b

                                                                SHA512

                                                                d3d5d429383614d9087298c4ee3a1e7f938ec99c01170cb7ae1bcfbcf95b5d0e954c29a3944f0750e54baabaf958ba23ecb43a2ed59a469538f7ba36e64c05f4

                                                              • C:\Users\Admin\Desktop\ExitRevoke.m4v

                                                                Filesize

                                                                319KB

                                                                MD5

                                                                4cbd42576938a02cdaf6d174650d1406

                                                                SHA1

                                                                dc464758e921e5063ad37b02391a4e441011754f

                                                                SHA256

                                                                2d197ccc946a465e89b52b2d67f296ec4023491b24f47de69c1da884f9861220

                                                                SHA512

                                                                5ef1d20b2c14762cc56db825c8abf6826f12eb66de42a59554cdd892fcc80aeb6c3b5cd2af701fef2664cdeecd65e5b2b5f50a6907e5b3ef6928e1bba7fbbe47

                                                              • C:\Users\Admin\Desktop\ExpandConfirm.xht

                                                                Filesize

                                                                290KB

                                                                MD5

                                                                6a7c5669d2139dd93c4ba29f3e1409de

                                                                SHA1

                                                                c346a43eb234834349c2f72885fac209ae51139a

                                                                SHA256

                                                                41cbb282339da0735008820a196c42b7225577727dc48d11c149da79b0fadb9d

                                                                SHA512

                                                                69b083af78fef2f08ea2742fc7f392273a9bca6feee47f106431c8fb211b0a3872cf31b4867a522ba0672ecaf577e3e59cd8e08aed0cef56daae6aa1b33ac109

                                                              • C:\Users\Admin\Desktop\MergeReset.cfg

                                                                Filesize

                                                                358KB

                                                                MD5

                                                                9d6f09360ef86d6093a0350d44246441

                                                                SHA1

                                                                0afa606c2ebe68620c7194ed28307dbd206b9985

                                                                SHA256

                                                                60402acb7ef3b72b9cb0962468d8a85abcac7f0445bb29acfcd7bbbe9f9df948

                                                                SHA512

                                                                7f1f3a1262db18006a6a2a61eb644025ea8f3f7339671c4d381f051308ae15de4e67fa0b6e5e91c394bab0133d93883b28836b7be10df2dff6e16051c27c5ac2

                                                              • C:\Users\Admin\Desktop\MergeRestart.dotx

                                                                Filesize

                                                                172KB

                                                                MD5

                                                                1da1087f604a70eddb7398749d50088b

                                                                SHA1

                                                                3e04de1739524f3191b9f1d53456e0e415bb7d4b

                                                                SHA256

                                                                86a04d02127eeb549868eac87a3a1e736c6345c250e07adb3a43fa53ab3d748c

                                                                SHA512

                                                                dba7f57a6845f1c07e56d6b130f4d765d3ff03b8f0eb7c6f418b9a2ffe685fcea244380d5c50633079c27cb6d49d128a78c6943c57fcad92bc7e02bffd88f419

                                                              • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                6457f1c557069026111b2bb46d936271

                                                                SHA1

                                                                f191805065766f814c90e43b563e0e06e86916c0

                                                                SHA256

                                                                34ec3210bd6992f95932016636d3d0a71036c976cf55b44b2a4d6fcc994b9267

                                                                SHA512

                                                                b083a8f84ebd2bee4f55eed1f5bea8ed7c0eb325a18351b25d4d0453b2a7bf0fabd0a123dd8de009a55707fdbd262aa63282ee07ba6f4b9334931049d5e1bf0d

                                                              • C:\Users\Admin\Desktop\MoveTrace.otf

                                                                Filesize

                                                                221KB

                                                                MD5

                                                                0d8899a960d7637be97008f8d60cd7d0

                                                                SHA1

                                                                b06a1211a266325692ff1347679f68b98709532a

                                                                SHA256

                                                                a7b5fc399d8e131263276adbd885353b0d8074bf85b2fcdda682e1bbbc3e0804

                                                                SHA512

                                                                eed6dc81905a84c067813bb578e3e4a019dc2d59c2babe39256871c28f4c13c3fa2934c79749b59e28c87b7642caffb1db13f4dd04602f08e52f4a1ec93766a3

                                                              • C:\Users\Admin\Desktop\OutUnpublish.mp4

                                                                Filesize

                                                                201KB

                                                                MD5

                                                                838c8a4f10d2d71d7ff6cf1d43ad43db

                                                                SHA1

                                                                73449aa4ddf6dde3d3abb2bf86f6089d08006180

                                                                SHA256

                                                                6567958d2615dc4cb9515e8d4493dfd8c5d7a11114d5ced193b7fa54d97469ff

                                                                SHA512

                                                                0a9d8cd9e2050f5fe9620513504b0469545bc74264b035d3666ae9460809749d4f0dacf0a072a39877520c84181fe7d2dc9b56695fd3b3b8c465705563f96c93

                                                              • C:\Users\Admin\Desktop\PopRedo.ttc

                                                                Filesize

                                                                339KB

                                                                MD5

                                                                b12d56fea4e369474fb3ffb5fd83ef9e

                                                                SHA1

                                                                8cb84df92e853bbf2663e2c0b19aad4c1344cd3f

                                                                SHA256

                                                                9479df5581c90f7bd0e3a73e5a5a04b7a34ec00ecb506db2abb55c9678d06691

                                                                SHA512

                                                                0a402124a62a3152c6a78986f2bdf4d26af1f62b7abec8f3fd821dc7dc10172e2cdc9c518aacc94a956c05d8c72a206c5d28ea6bcd7e151cf9d3868d3c33906a

                                                              • C:\Users\Admin\Desktop\RegisterGroup.mp3

                                                                Filesize

                                                                250KB

                                                                MD5

                                                                19106181de7206c5c08d3a826749e17d

                                                                SHA1

                                                                d2fbe432f999ff0936a1486562b23ea90b4d9b8a

                                                                SHA256

                                                                1edd2abe3db21e00b096cbb88864044a4226deaeb625d661da10680fe01908f8

                                                                SHA512

                                                                13dbfc70870b0dbde7aba3d0ec9da4386f97a8f4c6b5f3f81ad1afdaa8021a6eb456b3d654ba8ef51bdc52a4bc840c9443bb2e2c417164b8a18a74245804602f

                                                              • C:\Users\Admin\Desktop\ResumeEnter.wmv

                                                                Filesize

                                                                162KB

                                                                MD5

                                                                6af16c09e3cee6156f38c22fb75d4d05

                                                                SHA1

                                                                dbfa653593035cad40500023711ed2c04544a24e

                                                                SHA256

                                                                f969470f7da0cf73d0c6c99795c5da822d522a67a310a3538496b3bef309b935

                                                                SHA512

                                                                d4c67919b5753054871c9382dc9f9131791a34d9a129a43792fbbf1e2db3fdec28f14c5221c08467f8f1595fded06ffd12ef11431d6da46518b48e914fdc2545

                                                              • C:\Users\Admin\Desktop\SearchSelect.TS

                                                                Filesize

                                                                280KB

                                                                MD5

                                                                732b463bd79629d23ad5a63307cda892

                                                                SHA1

                                                                f1c5d3a328daec20beffc281a4bb92a98fb29557

                                                                SHA256

                                                                ef21361499d4d014c8ec0c56fae2a551f36b0a8e4c86bf1fc0aa42e5600efbf0

                                                                SHA512

                                                                dc835b732d66ec0f43007b021265a6db4ed528daf3ec7ce5833f20ae60f66d20ecf651c6f05462b3aa7cc913e40944e849d76981626ce3fe86e68fcd21d0fd37

                                                              • C:\Users\Admin\Desktop\ShowConfirm.ogg

                                                                Filesize

                                                                299KB

                                                                MD5

                                                                39c395ebeb5b3cac553b195ffbd8ed65

                                                                SHA1

                                                                446620fbbcd1d25dca118fc8c7c268f3903038f0

                                                                SHA256

                                                                ad599fdfea41998a00572d5e209161f3a4c5df666a58acac4277bec67000113e

                                                                SHA512

                                                                4301e4c2c2fc8187eb5c956edb3853426c64785e63efdf82a031e319448425f30923370d1640b67398d2e0d2ca15c030bfcf2ba4098f0e055757d5067cf3e3ab

                                                              • C:\Users\Admin\Desktop\ShowExit.vbs

                                                                Filesize

                                                                309KB

                                                                MD5

                                                                c810abffa334bafd99ce9014b3f11a96

                                                                SHA1

                                                                2d2fb12f1852f50595fb3fe7faed7eefafbdc1a2

                                                                SHA256

                                                                ee26165dcdaa9a5268709e2ae5c8e826200e057378f9bba7cc8f23a4e2acbfa5

                                                                SHA512

                                                                5e807e95cbe33003bbc036bf193a4482553134681b183e950575865b3bc3d449cabb2529757cd647239d355c8b63cd86e39cfacd4f4f160c9aebfae686ee1cee

                                                              • C:\Users\Admin\Desktop\SyncEnter.docx

                                                                Filesize

                                                                349KB

                                                                MD5

                                                                1917b69127ed28c9e0c672b1b264532b

                                                                SHA1

                                                                d74166051e637d9710a4282c6beeb06114009a5d

                                                                SHA256

                                                                4f4ac2cacc96bd2c3bc89f585239edc19eb51c3f77d72b6f44ce413476fcf971

                                                                SHA512

                                                                e69332448b418ef907c61c257cc78b0b9dd71f39881f1f2928c1c1ff71eb41470ea9083034e288d5ed1481369321a16d4e8240a3b9190c1a765462263f7c1180

                                                              • C:\Users\Admin\Desktop\UnblockRestore.odp

                                                                Filesize

                                                                329KB

                                                                MD5

                                                                7762ebb40606381047f135db05b5d9c9

                                                                SHA1

                                                                47f3d3f304f5f716faad33f6e7f6a4f4d20b4c3b

                                                                SHA256

                                                                b143a1de2dbe6c0ad8f8307b971fd3e10859ee170067d34c476f6a998b0906c7

                                                                SHA512

                                                                2c13940df8402755a3be94448079ceee2a2eefb1bf8559b4ef98fd24d4f583b31d904e9f1c703d8f9d1dea603aadb296688826ef6fa6f7f241e83c741dcd16fb

                                                              • C:\Users\Admin\Desktop\UnlockDisconnect.mpe

                                                                Filesize

                                                                142KB

                                                                MD5

                                                                14a091d4ccb49ce9d8fbb6a97af976a2

                                                                SHA1

                                                                39e9d40ebf996a1c3030f07228abf32a1ddfb12c

                                                                SHA256

                                                                bb6235d6631098f8c7ad4c76ba6aaeccb017a7029776a87a4fe0c3b93fea03e9

                                                                SHA512

                                                                e9270be4905c559c264a7353cf000d4289238520af203a79d4c44b36dac1efd5f58a33f4d133370cd32d21ba7431e7717fae7835df0a0e72d8506e8b52b04522

                                                              • C:\Users\Admin\Desktop\UnpublishGet.mov

                                                                Filesize

                                                                191KB

                                                                MD5

                                                                08877a798fbaf33dc48909a40438d77f

                                                                SHA1

                                                                0936b8f5ecd62288e1056a84800c54325b2d6c1d

                                                                SHA256

                                                                2f4a990be5c7f0ef57b22c1058b10a806b8db0e1ece654b54c969221922979ae

                                                                SHA512

                                                                9cac8ea8b0edc0d7ad62323789c8a01b4654f849c0254318efa9f351e91096ad6dc802c22f786702a883d09f3343b9f58468030f3d95043a49f40a3b76544f3d

                                                              • C:\Users\Admin\Desktop\UnpublishUpdate.au

                                                                Filesize

                                                                152KB

                                                                MD5

                                                                554e33c29a0c3423fca0feb15be8fd50

                                                                SHA1

                                                                45ae34d1cd2bc51d03393e426c05221aa8689c15

                                                                SHA256

                                                                e650017250ea5c3c55d48f5de556724000de08a7e519fd398de6942cee95873e

                                                                SHA512

                                                                d24ab8f6b50517afcba57045825097924722244b5bdf65f001f92f65e80656aa7f738caf5e0dc915b0020a79e209269abcca69db414c93f85babc41e9a99b15b

                                                              • C:\Users\Admin\Desktop\UnregisterRepair.svg

                                                                Filesize

                                                                231KB

                                                                MD5

                                                                fa4448447377244a7d86b216707d7f11

                                                                SHA1

                                                                7f697a1b971b4b23180e3d95d32c25daab614760

                                                                SHA256

                                                                db988db95e668f143b22ef98721fa3916b16c1f6f35d271efc5eda06a5b6dbb3

                                                                SHA512

                                                                9c1b6990df86de7d09d2b9715d603d6e6f90e6c75e23c576f03587dcbc9c293cab9e3f03d4915b018e5066dcc38474cf5adcd71ed86b9258040d6a029f9889b7

                                                              • C:\Users\Admin\Desktop\WaitStart.tiff

                                                                Filesize

                                                                260KB

                                                                MD5

                                                                92f0ae6929dec527af7ecac2785e94ed

                                                                SHA1

                                                                ecb3294adf558300d95fea1bbf87c60c3b8e1045

                                                                SHA256

                                                                99076ef29414044d3a2a1e197202b652633173d12f5bb521ff0c193ad6e6771e

                                                                SHA512

                                                                558c5270270cbd417b92a7175aed20cfe204cb9c25e4039fd4dbaad1d56b82406f77bf4ce34714911b4d502706a4a78304b06cfbaa5b2c0137fedcd7214ea8cb

                                                              • C:\Users\Admin\Desktop\WritePing.zip

                                                                Filesize

                                                                368KB

                                                                MD5

                                                                beda28711e9662d2288f20c9770e328c

                                                                SHA1

                                                                87e1247e7a8482ac3571e71c3099d4aedec0a47d

                                                                SHA256

                                                                85ffdfc0b29929551ba0703231460d8ae1f635df04b7122ae017983dda0e51a8

                                                                SHA512

                                                                3768ee3f5e705c7c38027ba442c8474381753f8674522bfee509d65e8193fa42e08204dbe3ae4352d83bba849c14b40e97626ffd476dae260d2933599b8ded54

                                                              • C:\Users\Admin\Desktop\WriteRedo.ADT

                                                                Filesize

                                                                270KB

                                                                MD5

                                                                3b1077d2893706a132abb78c10c906b3

                                                                SHA1

                                                                74745ab4a54d2e32c4ac4c900eaf85f701f4d4ad

                                                                SHA256

                                                                aa1b1c097ab78ca04e395f3126e852080ab5a4542772936c270bef798ee81789

                                                                SHA512

                                                                e98b5cd89cacdeaa3bb3bbdfa15be0deb11fe5519f05314d38db00ebbd237f2229d6a02d67d31d94371da9eabd51799ad36a3b0aa908aed4d27322c3562e5e3b

                                                              • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip.crdownload

                                                                Filesize

                                                                3.3MB

                                                                MD5

                                                                017f199a7a5f1e090e10bbd3e9c885ca

                                                                SHA1

                                                                4e545b77d1be2445b2f0163ab2d6f2f01ec4ca05

                                                                SHA256

                                                                761e037ee186880d5f7d1f112b839818056f160a9ba60c7fb8d23d926ac0621f

                                                                SHA512

                                                                76215a26588204247027dcfdab4ea583443b2b2873ff92ad7dd5e9a9037c77d20ab4e471b8dd83e642d8481f53dbc0f83f993548dc7d151dead48dc29c1fdc22

                                                              • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                45b344f6e87f77f19431c1cd63294bb3

                                                                SHA1

                                                                5ce5b76bdbd7b1d0ea361c330e1c69078afcd385

                                                                SHA256

                                                                909a9f81c890ea0aae20fc98e8e2574b6332a3cf72bf692c54879836e052a134

                                                                SHA512

                                                                5f39a058da4bd0152ee4f60809d524738a0ad1afa1be41ccbe225d5c99ef69496a8d5ca6b11cce7c739ebeae7d5ca00e2676ccf903e6e96a0a7fd9759fb40ff3

                                                              • C:\Users\Public\Desktop\Firefox.lnk

                                                                Filesize

                                                                1000B

                                                                MD5

                                                                baac45a88c46f44ec092d4aa0ef92436

                                                                SHA1

                                                                0662390a1458f2b79ef5436c6f8521ace42ab936

                                                                SHA256

                                                                d527e66804325d1e80a63d503102a1ba3325dc76524d3f97710cb7dfcefbb8c2

                                                                SHA512

                                                                28d1badf47c986a5fc58f85b4b68fbd9bb7aafe31bdbb4b3e027275e8de9f8606b0c233823c7d0f9f4426a91a72ff79b1b7dff2b350a123b4cea7e515dd212a6

                                                              • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                b586e652d49f6d0077ccb6a042679742

                                                                SHA1

                                                                0f0db52806c3c04348c42dc6ffb938d019829a33

                                                                SHA256

                                                                06d3aa6136fba7f2475779c0f6efa7f7f320aed7944b3992adbfb5438002efb9

                                                                SHA512

                                                                f81cc9fe5e1289d65ec4171886fa78a9dbf5f081259fa96f83604c32372a2890603f2579054c48eeca713463870e7ecb8b808524937292e9e57dc8e5013602c6

                                                              • C:\Users\Public\Desktop\VLC media player.lnk

                                                                Filesize

                                                                923B

                                                                MD5

                                                                10c11d4d9404b7013a859543715137ce

                                                                SHA1

                                                                01b1fdf41a86f91a237f3490cbbe4c10936a0d7c

                                                                SHA256

                                                                8d136d5424d196a57507fe1a0899cd2d6b3ec758a86bad34a1cf9c45a436153d

                                                                SHA512

                                                                a2056faa5a7cda1673948f95c36002e7b217e124f16f1745e491c845057188599f7047220a20ac3bab480600bb830b67831d5ad471861f3dc72ae7dc0fe8cc30

                                                              • \??\pipe\crashpad_4956_DZJNXHGRAUONOJKM

                                                                MD5

                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                SHA1

                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                SHA256

                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                SHA512

                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                              • memory/1096-499-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3612-0-0x00007FF7810B0000-0x00007FF782329000-memory.dmp

                                                                Filesize

                                                                18.5MB

                                                              • memory/3880-1944-0x0000000073690000-0x00000000738AC000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                              • memory/3880-1922-0x00000000738B0000-0x0000000073932000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3880-1923-0x0000000073940000-0x0000000073962000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/3880-1920-0x0000000073970000-0x00000000739F2000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3880-1941-0x0000000073970000-0x00000000739F2000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3880-1943-0x00000000738B0000-0x0000000073932000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3880-1945-0x0000000073610000-0x0000000073687000-memory.dmp

                                                                Filesize

                                                                476KB

                                                              • memory/3880-1924-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-1942-0x0000000073940000-0x0000000073962000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/3880-1939-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-1940-0x0000000073A00000-0x0000000073A1C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                              • memory/3880-1921-0x0000000073690000-0x00000000738AC000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                              • memory/3880-1962-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-1969-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-1980-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-1985-0x0000000073690000-0x00000000738AC000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                              • memory/3880-1998-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-2011-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-2019-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3880-2024-0x0000000073690000-0x00000000738AC000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                              • memory/3880-2026-0x0000000000500000-0x00000000007FE000-memory.dmp

                                                                Filesize

                                                                3.0MB