wannacry | hxxp://a[.]co

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18-07-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://a.co

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

Processes:

[email protected]

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCBEC.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCBF3.tmp	[email protected]

Executes dropped EXE 7 IoCs

Processes:

taskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]

pid process

3996 taskdl.exe
1932 @[email protected]
688 @[email protected]
4188 taskhsvc.exe
4760 taskdl.exe
2212 taskse.exe
1116 @[email protected]
Loads dropped DLL 7 IoCs

Processes:

taskhsvc.exe

pid process

4188 taskhsvc.exe
4188 taskhsvc.exe
4188 taskhsvc.exe
4188 taskhsvc.exe
4188 taskhsvc.exe
4188 taskhsvc.exe
4188 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2860 icacls.exe

pid	process
3996	taskdl.exe
1932	@[email protected]
688	@[email protected]
4188	taskhsvc.exe
4760	taskdl.exe
2212	taskse.exe
1116	@[email protected]

pid	process
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe

pid	process
2860	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\puoawzavxa263 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_WannaCrypt0r.zip\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

16 camo.githubusercontent.com
16 raw.githubusercontent.com
57 raw.githubusercontent.com

flow	ioc
16	camo.githubusercontent.com
16	raw.githubusercontent.com
57	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

[email protected]@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEWINWORD.EXEWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeWINWORD.EXEWINWORD.EXEWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1376880307-1734125928-2892936080-1000\{8B509C37-48CF-43D1-866D-96FEDAE4EEAA}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

972 reg.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier msedge.exe
Suspicious behavior: AddClipboardFormatListener 6 IoCs

Processes:

WINWORD.EXEWINWORD.EXEWINWORD.EXE

pid process

1744 WINWORD.EXE
1744 WINWORD.EXE
4048 WINWORD.EXE
4048 WINWORD.EXE
2208 WINWORD.EXE
2208 WINWORD.EXE

pid	process
972	reg.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exetaskhsvc.exe

pid	process
4700	msedge.exe
4700	msedge.exe
2276	msedge.exe
2276	msedge.exe
1256	identity_helper.exe
1256	identity_helper.exe
3392	msedge.exe
3392	msedge.exe
3684	msedge.exe
3684	msedge.exe
4828	msedge.exe
4828	msedge.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe
4188	taskhsvc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

WMIC.exevssvc.exetaskse.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3524	WMIC.exe
Token: SeSecurityPrivilege	3524	WMIC.exe
Token: SeTakeOwnershipPrivilege	3524	WMIC.exe
Token: SeLoadDriverPrivilege	3524	WMIC.exe
Token: SeSystemProfilePrivilege	3524	WMIC.exe
Token: SeSystemtimePrivilege	3524	WMIC.exe
Token: SeProfSingleProcessPrivilege	3524	WMIC.exe
Token: SeIncBasePriorityPrivilege	3524	WMIC.exe
Token: SeCreatePagefilePrivilege	3524	WMIC.exe
Token: SeBackupPrivilege	3524	WMIC.exe
Token: SeRestorePrivilege	3524	WMIC.exe
Token: SeShutdownPrivilege	3524	WMIC.exe
Token: SeDebugPrivilege	3524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3524	WMIC.exe
Token: SeRemoteShutdownPrivilege	3524	WMIC.exe
Token: SeUndockPrivilege	3524	WMIC.exe
Token: SeManageVolumePrivilege	3524	WMIC.exe
Token: 33	3524	WMIC.exe
Token: 34	3524	WMIC.exe
Token: 35	3524	WMIC.exe
Token: 36	3524	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3524	WMIC.exe
Token: SeSecurityPrivilege	3524	WMIC.exe
Token: SeTakeOwnershipPrivilege	3524	WMIC.exe
Token: SeLoadDriverPrivilege	3524	WMIC.exe
Token: SeSystemProfilePrivilege	3524	WMIC.exe
Token: SeSystemtimePrivilege	3524	WMIC.exe
Token: SeProfSingleProcessPrivilege	3524	WMIC.exe
Token: SeIncBasePriorityPrivilege	3524	WMIC.exe
Token: SeCreatePagefilePrivilege	3524	WMIC.exe
Token: SeBackupPrivilege	3524	WMIC.exe
Token: SeRestorePrivilege	3524	WMIC.exe
Token: SeShutdownPrivilege	3524	WMIC.exe
Token: SeDebugPrivilege	3524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3524	WMIC.exe
Token: SeRemoteShutdownPrivilege	3524	WMIC.exe
Token: SeUndockPrivilege	3524	WMIC.exe
Token: SeManageVolumePrivilege	3524	WMIC.exe
Token: 33	3524	WMIC.exe
Token: 34	3524	WMIC.exe
Token: 35	3524	WMIC.exe
Token: 36	3524	WMIC.exe
Token: SeBackupPrivilege	2916	vssvc.exe
Token: SeRestorePrivilege	2916	vssvc.exe
Token: SeAuditPrivilege	2916	vssvc.exe
Token: SeTcbPrivilege	2212	taskse.exe
Token: SeTcbPrivilege	2212	taskse.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

msedge.exe

pid	process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Processes:

WINWORD.EXEWINWORD.EXE@[email protected]@[email protected]WINWORD.EXE@[email protected]

pid	process
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
1932	@[email protected]
1932	@[email protected]
688	@[email protected]
688	@[email protected]
2208	WINWORD.EXE
2208	WINWORD.EXE
2208	WINWORD.EXE
2208	WINWORD.EXE
2208	WINWORD.EXE
2208	WINWORD.EXE
2208	WINWORD.EXE
1116	@[email protected]
1116	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2276 wrote to memory of 1132	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 1132	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 3300	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 4700	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 4700	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe
PID 2276 wrote to memory of 5068	2276	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2864 attrib.exe
1140 attrib.exe

pid	process
2864	attrib.exe
1140	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://a.co
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd41bb3cb8,0x7ffd41bb3cc8,0x7ffd41bb3cd8
2⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
2⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
2⤵
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
2⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
2⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4712 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,11939738136646584157,3304158756780084801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0
1⤵
PID:4540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1648

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CompressFind.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CompressFind.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:2128

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:1140

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2860

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 263801721331040.bat
2⤵
PID:1800

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:2448

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:2864

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:4944

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:3672

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4760

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "puoawzavxa263" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
2⤵
PID:2348

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "puoawzavxa263" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CompressFind.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
1KB

MD5
19609940e2b2cdda9dce16d8870c197f

SHA1
e5336909c71a80d9b698a15a6e5a8e5e8f827f35

SHA256
d161e767a1537a6d8d442b82a17aa71359a49cf9172408addd6de3ac80f8a6fd

SHA512
307b9451490d1c9acd28fb8ac58d51b5cfb777d00059548ad3a98c02754d71e231a0a9d77fc4a01bca8f79b289e59abef18692d935984bba2cd4377f92e1e36f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
8925188261f81a3d7e78678c7042d282

SHA1
6c68dc9ee87c0f9e55a6b2a7505f8eee94c24dd6

SHA256
af3203ddde5ea800d4bd98f895bc0e5b33fbbdb23b6ed93b1a93192eb752c1e4

SHA512
8f1e3f21980a7d8446941f13f7b1ee7b4650e53e079efc69557ef724ffbe68dfe1fb448b8b541dc6bcccc0da212efab7441b3f7c52c9fb60d32a061b7b0c61d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
a278cb2efdde1cf21264b290822ef1b0

SHA1
0a2ed7b4cc1786dcd0b486905aa64cf56c5e3b75

SHA256
3c2034b11a56ff35eefb2d33cc6d0d627d4e2a04221b0e5c3a7975941058d10d

SHA512
0de15050ee9a2543e2e93f79135cb4fe726d397abf0cd7b6793318c2bd00cc4881abb1ea0263c72607979912774371c039669feedd6f77b37603330fa153ca5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0499f1feacbab5a863b23b1440161a5

SHA1
37a982ece8255b9e0baadb9c596112395caf9c12

SHA256
41799b5bbdb95da6a57ae553b90de65b80264ca65406f11eea46bcb87a5882a7

SHA512
4cf9a8547a1527b1df13905c2a206a6e24e706e0bc174550caeefabfc8c1c8a40030e8958680cd7d34e815873a7a173abe40c03780b1c4c2564382f1ceed9260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53eb880cad5acef8c91684b1a94eed6

SHA1
afab2b1015fecbc986c1f4a8a6d27adff6f6fde9

SHA256
5cb8554e763313f3d46766ab868f9d481e3644bfc037f7b8fe43d75d87405a27

SHA512
d53f3965428f73c0dfed1d941a9ff06eb70b254732410b815bc759b8c7904e11292ad7e9624c12cccaed6763e7bea68208bc0b67fc70b7616d25bda143833794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
832KB

MD5
8652522f3ba4b3d8db891a258f316e10

SHA1
a2ad5d53dff34e6daf5920e6987002159847492e

SHA256
49e717f68a574006f3ff05823db2e597294300cc4838c192ee69e52e08119d22

SHA512
81416be98bce387530161847cbdcecc638e550f04579407a96860e590a85920cca32cef5e8846ccff5b8e85330c0c6b0e5bf24c71504fde4ca662915e2044edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
23c3517347b69e3c4848847979c635fd

SHA1
beb0e38ae71913d94c052e94bc874d09879e9598

SHA256
d404ac081b7584ee022e4f94c2a950dd7f8a60eeaa9e7e731358a10ae05ad2e2

SHA512
313e7ec7cbf6dc7c6caf1f289ab52aa37d902f8ee5122055b663592f0f2891a1113720065c2622dfcd361acce916c48b57fedb94581077cdf3ab0fdb326cc37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
59553c608197188e0f7d198aa7ce04fe

SHA1
586b285789d0de2a842a510c43c222be49e81dca

SHA256
f18f1245b72a0d006d2d8cfa33ae8dc8431124568283673e16f7a20b9be58aab

SHA512
94916e107384f440ff4ba2f3de5b4cdacfaf3d01c561359103c4f54ed95df8b61de06cf9dce943fa5bb97ef3e7a23dc71e5b6d73291a057f76f82f3d7da07cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f686bf50f0979dacfc13fba458cb67d3

SHA1
19a3cd7b7aed1ce9afdb62e4ea57b1744c58eba6

SHA256
be65fc5eb01df9c9aaf76c37b85b410dd7593691e8fa3562881e4600e8e4be7f

SHA512
a6962126f0584ce5d913770fd09721b50e4ec94135ed955313015eb741996d2f58db14404c06e33b947d09c3b865d3a55bc842110a6721411cfa4e5d0d6f37d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
613fc017e42a1304b04afc352c04d109

SHA1
09081efb061458beff9412db150937474b953c22

SHA256
eceace99dab98ef30a5975e18c2cb7caac61b715d9f50379eafa0a7101ac3486

SHA512
f19d4a44e4ec6d760fd6f94f0f333f2670b49619445f0d31b2d24082286f27532218a81c842e8811d97d4de245a77339102b9c74ad9f4c100ac91155c3004b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73d6a39315492d2c9dd599c07b6bf0ad

SHA1
f515c6cc7510efab15372243a8bc5dd8b6bf846b

SHA256
a78f16701ac6494061f9c5eda20e01d2eaa85dbbc705fa9eb7b6b399b348aef3

SHA512
e542f1bb64ecfcb3e44586fcca62455cef7642d12c05134d550dafb1bb6c31bfd78f3217facf77860e68eacbbb77965ea2c249480c1e5fda9d1b0e169610a958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb00a8d0f06d44750a06b13239bad6aa

SHA1
8070e65873dd5c60d3d239a0fd60a4c9161b4d9d

SHA256
358a719a1b689a92a3a770cbf64412976baefaf177f4f5d62de281c6590e07d6

SHA512
f636b61e484d2e5df1095c1000608db8c62818d6b2cbf9f7d8bfe05df4f63aa12771f94046e98eff98c297b9b560e732c8a623827195f3d2f0868e8d3383c382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85ad1bf4d2e3105eb319b6215735c2cf

SHA1
aad5a1c7c572bfcead5ef4119507a47bc61f5d65

SHA256
b12f6ab51e863ed8ab16924d3e1b845f09e2ef33e8f3fe5603b43349960c16e7

SHA512
1b3fcab8b4e5c5f941e91d4e91d214ebde368ca3a5753e4b2ae0d5a9b656ea38347d4c1dbdfac1074d098e279a31c9e2c57158ac44f65ea915a274cdf34c4342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
38dce23b9646e192a370a763363a2a50

SHA1
7a6b2c9f9a2ee48beb4d93a9c34b4b26a6c502da

SHA256
e5856bcf660d23ebb2195175bfedf0c73f2daae941d23747b004be4a268d6ec6

SHA512
c1aef18921601273e786c42af2ce6e424aaf88121ecd5279f241c5421433d174750f2de96958b2a4394434688ef4af26cd263226071c8b45dccbbc2a038d7358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c85a91e0b07a82841ce45b0c4ebaf049

SHA1
de225eac99e320eac0fdc94734c1f1b06fd4031a

SHA256
af7f8a69308fb530a78fa182a8f1df2202551a69295ae198e7e2613cd4680848

SHA512
624728240bf2cd54c7ba8f68b9cff5148b4b35da0c546f64c2f1b2d709c2663f2411c105dfe2c95418494148a412388a75a47386caf659b41f41f58a625e5489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fd0490d753edfe6ee68a1c3549ee4534

SHA1
a51c11155a4c9f8b6493daba262b55867bbdd432

SHA256
6739accbd6d008f57cad586b2ecce7176952764140fc590c5555fc5281b48b2b

SHA512
d026440bb3802a7f0eb9551d0a97dcb028452a55f16e1ee8e1dc4c80a117d607e94c340c16d0d4734d29a599a4127c1cd250ea1c7a401a8e52b91ff23a70c919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
156f316f3a6d44c38fc575a57d807555

SHA1
06fc39183a39a9fd8b64436f546a1b6e7050cef8

SHA256
d17b2d1e4368e293f12d0ecff46d47f4955f07590e5a4c78c445539532caf37a

SHA512
20f5b9bdee3c224912c1351e55979b33d5fdfca9ee8cc9a3c06b4cf97908d2d29186a3d0283ded1379b7b3da95241091fa4ab2179f73c3146f53186a24769626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588c5d.TMP

Filesize
698B

MD5
29243bf08c87a799f0d60a3d50cdeb45

SHA1
6a8b0b29beb01004e2aab0d51027c22d8a271067

SHA256
0577a17c19884f3999c6f1bad5790b86c2da2b6b334fab5c2b57c8107546eba2

SHA512
f632fc8ca8e47a088e22c8771efbf174e6dd05ff64671d287f56f0a5ef4dcb2daf83660f260e5b88447b5d77e554c5cc4d3615698d2a45aec6d05b3466f5e0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
942bb88e1e308783e342ca5eec00b983

SHA1
3d20d238adff9673ed9822093ee604ac29961467

SHA256
636e16d0ea8a651b610eaba20ced415adaa2625d36bb0f2f966d9d41e07428c8

SHA512
26737b6f6326efe39504c15118ea976e481d17ede202ac5e20dbec8aa67a49d96cd8fbba9ad29031b39155fcac80024472acb1771fcaf65a1402bfb5922c8391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14b20e21d3402bcad0d346629de2d336

SHA1
834f0fa83a3dbf96024da81db9c34a81085b9b39

SHA256
8bcab2660aab79a1e2a0c296171698abf1d101e1a52d3176a583a214a522b9ca

SHA512
643bbd72843c407ac9d52e0af557f8a949f29513d805095917065de633a48d487cd59dd603d6b8053f71cae07513da0490ce5fa53289f8df3f1ad43fe3881bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A2C71B2B-9B06-4EF4-B350-190C58E1AFD0

Filesize
168KB

MD5
21245b29af0a67c6cecec7f6556ea33b

SHA1
25515d3d1d6d6b1682e4ef9400f0e195b885a374

SHA256
535b0bfca5aaf3838eb2b1313077d90029271a814110efdc11a39e5c2867a2d7

SHA512
ca62ebf9fab2ed97d4a429d36eec2effb89dac5bd72985bc5e9745bdf5490044a0ca7f21424333895091a6ab30054f8124fab8689c370297567bb0b0de838579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
12KB

MD5
f3c76f6ade391377f5cf8a2fb22dd8fb

SHA1
252811ca66603351825c9e09d4fa78b206d991f8

SHA256
921907f0fde41034d8b0ac9d76b74b7c6fc849b13e553b5cccf38891e962877b

SHA512
a8cd4dbf37d13c6fefa608187c3afa10616693d649a91432c1ce9da92a6ce3eb55381e132102b12232b1d98f5c8ac7c7b57e0310673dd7e5fc4e4c21c1af89e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
8665de22b67e46648a5a147c1ed296ca

SHA1
b289a96fee9fa77dd8e045ae8fd161debd376f48

SHA256
b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

SHA512
bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\CompressFind.docx.LNK

Filesize
537B

MD5
d178c62e3c3f29482c4628d371f2c35a

SHA1
e04069e0388c45a744fd068b7118e960ee10dd42

SHA256
5880cadab40f2a91b2e3d2d0402a28323dad95920cc7ee19568660317bfc2aa8

SHA512
7384eb899754ddd8693e0d76b7ec54c5d57355da84db582a37eff9e0468bab456a86ee354bda1cde08a2f476c692a1bdbf8b3c8655f6725583c6bf169055c58e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
336B

MD5
c09ea4cb75ced5bb1ef55f060c50ba55

SHA1
1c34172c07b7f9721e805679256d57097867b8ce

SHA256
37f086f954beaf839d4775e112c71cde1361241e86ccea8bc860bf2a88609879

SHA512
11fcf7ea8641ef52a490743e4ed3fe70d6f9096be1a3b5026bd505a404342d773602fe68ad15517eda67cc115286048004279e6a896bc3100054a176a9679d3f

Download Submit
C:\Users\Admin\Desktop\~WRD0000.tmp

Filesize
11KB

MD5
4639aa59d83d48002b3ad676d0356d8a

SHA1
1f4cd65020317b9ca6913474888a5de732ae1267

SHA256
c887cf72cdecae526ec680ef8fa430cebc30eafd59d6110c48c9a919f9ea373f

SHA512
75f451d9f5abc1eb9879786491c58a4d2d68337bb9af9ed4ab5d838ee10e868450554987a347999c8dfefe3f8bd0109d2e6d61bee4a2985fe51ee3889a119aae

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
\??\pipe\LOCAL\crashpad_2276_YRCCEGAPUVVLHHNP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1744-622-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-627-0x00007FFD0EEC0000-0x00007FFD0EED0000-memory.dmp

Filesize
64KB

Download
memory/1744-626-0x00007FFD0EEC0000-0x00007FFD0EED0000-memory.dmp

Filesize
64KB

Download
memory/1744-698-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-625-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-624-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-623-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-621-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-699-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-701-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/1744-700-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/2128-793-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4188-2191-0x0000000073A80000-0x0000000073B02000-memory.dmp

Filesize
520KB

Download
memory/4188-2217-0x0000000073B40000-0x0000000073BB7000-memory.dmp

Filesize
476KB

Download
memory/4188-2192-0x0000000073B10000-0x0000000073B32000-memory.dmp

Filesize
136KB

Download
memory/4188-2193-0x0000000000440000-0x000000000073E000-memory.dmp

Filesize
3.0MB

Download
memory/4188-2189-0x0000000073BE0000-0x0000000073C62000-memory.dmp

Filesize
520KB

Download
memory/4188-2212-0x0000000000440000-0x000000000073E000-memory.dmp

Filesize
3.0MB

Download
memory/4188-2218-0x0000000073860000-0x0000000073A7C000-memory.dmp

Filesize
2.1MB

Download
memory/4188-2190-0x0000000073860000-0x0000000073A7C000-memory.dmp

Filesize
2.1MB

Download
memory/4188-2216-0x0000000073A80000-0x0000000073B02000-memory.dmp

Filesize
520KB

Download
memory/4188-2215-0x0000000073B10000-0x0000000073B32000-memory.dmp

Filesize
136KB

Download
memory/4188-2214-0x0000000073BC0000-0x0000000073BDC000-memory.dmp

Filesize
112KB

Download
memory/4188-2213-0x0000000073BE0000-0x0000000073C62000-memory.dmp

Filesize
520KB

Download
memory/4188-2242-0x0000000000440000-0x000000000073E000-memory.dmp

Filesize
3.0MB

Download
memory/4188-2249-0x0000000000440000-0x000000000073E000-memory.dmp

Filesize
3.0MB

Download