Overview

overview

10

Static

static

3

dl2.exe

windows7-x64

1

dl2.exe

windows10-2004-x64

10

Resubmissions

02-10-2024 11:53

241002-n2j6fsycqb 3

13-09-2024 04:59

240913-fmwxpswcpb 3

11-09-2024 15:54

240911-tcmg6sygmm 3

11-09-2024 15:53

240911-tbsmsszbnh 10

25-08-2024 22:53

240825-2t6als1gll 10

24-08-2024 21:25

240824-z93hjsscrp 9

24-08-2024 21:20

240824-z65thazfpa 10

21-08-2024 23:05

240821-23av3azamj 10

21-08-2024 16:22

240821-tvn4qayekh 3

21-08-2024 16:20

240821-ttkd5sydng 10

Analysis

  • max time kernel
    657s
  • max time network
    657s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 19:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dl2.exe

  • Size

    849KB

  • MD5

    c2055b7fbaa041d9f68b9d5df9b45edd

  • SHA1

    e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06

  • SHA256

    342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3

  • SHA512

    18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc

  • SSDEEP

    12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2

Score
10/10
bazarbackdoorwannacrybackdoordefense_evasiondiscoveryexecutionimpactpersistenceransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • BazarBackdoor 64 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\dl2.exe
    "C:\Users\Admin\AppData\Local\Temp\dl2.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3076
  • C:\Users\Admin\AppData\Local\Temp\dl2.exe
    C:\Users\Admin\AppData\Local\Temp\dl2.exe {2477C1F6-13F6-4930-839F-6C3FB31159A4}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1872
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • BazarBackdoor
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe49ff46f8,0x7ffe49ff4708,0x7ffe49ff4718
      2⤵
        PID:2200
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:4920
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3060
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
          2⤵
            PID:4916
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
            2⤵
              PID:516
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:640
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                2⤵
                  PID:2244
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                  2⤵
                    PID:3836
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4316 /prefetch:8
                    2⤵
                      PID:4204
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4316 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3488
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                      2⤵
                        PID:760
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
                        2⤵
                          PID:1916
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
                          2⤵
                            PID:2404
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
                            2⤵
                              PID:2488
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                              2⤵
                                PID:3264
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
                                2⤵
                                  PID:4304
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                                  2⤵
                                    PID:5160
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                    2⤵
                                      PID:5868
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                                      2⤵
                                        PID:4408
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5600 /prefetch:8
                                        2⤵
                                          PID:5012
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4416 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2628
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8000091377025545190,16919769351407852325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5232
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:3828
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:1872
                                          • C:\Windows\System32\rundll32.exe
                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                            1⤵
                                              PID:4976
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"
                                              1⤵
                                              • Drops startup file
                                              • Adds Run key to start application
                                              • System Location Discovery: System Language Discovery
                                              PID:2812
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c 323011723493157.bat
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5816
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript //nologo c.vbs
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2288
                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                                !WannaDecryptor!.exe f
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:228
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im MSExchange*
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5020
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im Microsoft.Exchange.*
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5012
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im sqlserver.exe
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:680
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im sqlwriter.exe
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4708
                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                                !WannaDecryptor!.exe c
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5768
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c start /b !WannaDecryptor!.exe v
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3292
                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                                  !WannaDecryptor!.exe v
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2892
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1076
                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                      wmic shadowcopy delete
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4068
                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                                !WannaDecryptor!.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Sets desktop wallpaper using registry
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3380
                                            • C:\Windows\system32\vssvc.exe
                                              C:\Windows\system32\vssvc.exe
                                              1⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2296
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3796
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4596
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:5744
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3136

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              Filesize

                                              152B

                                              MD5

                                              2783c40400a8912a79cfd383da731086

                                              SHA1

                                              001a131fe399c30973089e18358818090ca81789

                                              SHA256

                                              331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                              SHA512

                                              b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              Filesize

                                              152B

                                              MD5

                                              ff63763eedb406987ced076e36ec9acf

                                              SHA1

                                              16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                              SHA256

                                              8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                              SHA512

                                              ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ac179a4-b785-40d2-9cae-252598559e26.tmp
                                              Filesize

                                              6KB

                                              MD5

                                              fa90542f5208ab8a47412ac27102d9e8

                                              SHA1

                                              3a90e6b412c38fe10bb9b32055bf8f2cc80a68c8

                                              SHA256

                                              932113bad30cc32be3679b052bd2253d9a327627b46b9296e1744952e6b2b7dd

                                              SHA512

                                              e5b2bcb933bd35c3ae7ccc0c42258e75780a3bce09e9ab994ae9c5b2d4c872ad719a7718f3624bc2ed3df3b84b174108a915ef9a2578f8f1154da4f651904a8f

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                              Filesize

                                              3KB

                                              MD5

                                              6d9c4dc1ece8d6930308d8178415cbb5

                                              SHA1

                                              91559dd5f50c9992a60bf67871694489143855f0

                                              SHA256

                                              00fd5699b1b3d98610fdc51bb0ca4812b17c2bb2460fa338cee1fa20c51254a9

                                              SHA512

                                              0af19dfcd4ba5b6334fc6135691b3fd95fb7a10893b5a533bb2e4989f0553e8e464b35ab69e7875a8e1afa5acf32680b1f12029731796057d0730fcc1afbedf4

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                              Filesize

                                              111B

                                              MD5

                                              807419ca9a4734feaf8d8563a003b048

                                              SHA1

                                              a723c7d60a65886ffa068711f1e900ccc85922a6

                                              SHA256

                                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                              SHA512

                                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                              Filesize

                                              794B

                                              MD5

                                              bb72222c8540002b691b1bfefe095a84

                                              SHA1

                                              2b8eb9bb39b9275132bd04b425304df7193b981b

                                              SHA256

                                              d62356684712e7fa6f64b2030c0e27732f9586b650f409e99311b6ed39df45a3

                                              SHA512

                                              658dc98c6a1417eaa059f80baaa24b4062cfed99d3236e627a8d0139797b25eb303391194221856443b79c03a2e8bb2c3e42629a078b9c33cace915d7119f645

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                              Filesize

                                              6KB

                                              MD5

                                              e45c04fc6fc1c30d6bef6336474ee7a3

                                              SHA1

                                              93719832f0e7de2dc66730f32dd84976df2d653b

                                              SHA256

                                              bc4d774c75d238d8b05afb4c5c8074feb831f0a65d054570f7e115667f3d7186

                                              SHA512

                                              4742877592ff548280bd578268cd8e464ad1df24ecfa1e907ef1e16c1cb3b60ace10bf4b2a07f00ac736e3f55dca92888e22cbcb2ef0e0c0b0eac966cdb0b18b

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                              Filesize

                                              7KB

                                              MD5

                                              399ee577b60498f1972898da8c8251f9

                                              SHA1

                                              bca17ff28ed6436ad6eb9b75933f3bb0ced32218

                                              SHA256

                                              4e6230811a0d78faa1e9d9e8017a5368aa8c52a0a674c4ed38411c64e9f05245

                                              SHA512

                                              93d22b26e78201e4e6e3c78eef582aeb50959ab5d233139bd4ce8538adfa2ea5c5bd926c1192967933daca8a3b34e4942e5b761df18780a938936e8172c67a02

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                              Filesize

                                              6KB

                                              MD5

                                              8ccfe6f18cac17a3710862fa21d79b2a

                                              SHA1

                                              121c6308e1b1a6152f5f411757c2e5449567994c

                                              SHA256

                                              2441d229a9c42c1a4f66c26c032635bfef30784093df82bf971ea20b81b1f97d

                                              SHA512

                                              b483bf03ffab968b90ab7d71a8ee1f16a7c422d7490181a9d8d06e90b841e518c6ea93ce0096f17d7ee237ad1cf73294cf4f1f5cb579958b288b98c590c001e0

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                              Filesize

                                              7KB

                                              MD5

                                              eeedda7eed2afd17ac126e05fb17d2d0

                                              SHA1

                                              cec7ee154f86eaaa8f30c68df58d9a057ef42c83

                                              SHA256

                                              72d01ca6bb6b6401f15aca4c8fcf970844f1e7edc025fd97103d5946e51c51cd

                                              SHA512

                                              fe75fc60b853b1e99c73c493b708fb8bd2798e762adb09177223499f5afa5ad6e3cacc5948b7bcc247f30785357c2bf208337db861e1f17b85ecb5efe54e6a2f

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                              Filesize

                                              1KB

                                              MD5

                                              9322174613e5efe81d770eadb17af22a

                                              SHA1

                                              c35620e13508d4fbce84e7e0153513b3aae4a977

                                              SHA256

                                              5ee4827cc3c672b4973ca6cb3be43c5d7a15d563928da799f86965033715dd51

                                              SHA512

                                              5f80748500d03262dd19bafb633c781b009b742332f8a5915826ab1d8bc54c8693badf93e8c7c34988901d05c0f805b69a1c30d05e8a41445c11f109536daef8

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                              Filesize

                                              1KB

                                              MD5

                                              324a805b28d6c37e3efd30cb7045d776

                                              SHA1

                                              4604ab7d4016ca2b19e09c86f5ba9332e885ace8

                                              SHA256

                                              2b08eb3c4e1cdb2436acfb7a034cd806c47dc700c14023c1430532180eeec901

                                              SHA512

                                              96bd60610773819c4b1008d5f3e8401e4815a0825a4d8cfc30368d1ab33bfc1aaa4237e2a64c6c8b1e8ea12906b36466a097d1f188669fafb2a9f9ff6e83f72e

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587441.TMP
                                              Filesize

                                              1KB

                                              MD5

                                              7d852919723d4914670a8783a591b0bc

                                              SHA1

                                              8e0de853d11dc49f2a7524f6ff8d9d97c5caf8ed

                                              SHA256

                                              c2780823429c4203e4a48bbb1b15e5f8bf8f8ce31eaf1439410e3e0dc7e16278

                                              SHA512

                                              09c753981529d26a69089f142928f0e33165c0e89adeafde2d045372e78312e921dda158710e51ea949236a873bbbc1a28ccce7e989019da3b3c2f5b70b9545f

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5f5384d-e557-4eae-af6e-d256ade0e255.tmp
                                              Filesize

                                              1KB

                                              MD5

                                              12ec8213f772bdfb243a7018f83d2013

                                              SHA1

                                              b85b7ae5ad7c14b2cd32cd0a622ff99d02666ff8

                                              SHA256

                                              5d590f667b3d2bc525bad3a0aca91efb8df51599ef70d2ba92dbd347b1e202e3

                                              SHA512

                                              aa4ece4f983f7f272546a27ba709bdf9b87402e77280e2b7b3e59448b5622d10c0de56295396b25f9d34cb84cfcd88b6324809d91ae169343a9fb03a6840637c

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              12KB

                                              MD5

                                              4c467486b2d042d134e2d4cfecfdf6ab

                                              SHA1

                                              afab6394b64a48ca85376a7f0b56d5f521a12896

                                              SHA256

                                              dff9bf1d7f0835621d72b6cfdf16d0f00c8a8470bd610edc3ffae8bdb8e3bed1

                                              SHA512

                                              fd605795035287fb2597b2c1f0d929f18c69f493482492ba144074b59b279d565138d059f31b46e0af732bca7044869d5bf5465fa67c1820234d423d315a4d4e

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              11KB

                                              MD5

                                              a854e01da0a71d906f4b09cde4768a10

                                              SHA1

                                              30e8aa815890dbb270d4f4e8b3dc76afa89f9f8c

                                              SHA256

                                              02bf9b0fcb51384b3a5db828111c0b5a39fde22ef33a755c3e8b83207fa1960a

                                              SHA512

                                              3ef8acdc167c24e0fc8e30f5bb616c3804c8415385caa7bdcdbb15b360f3e93c3beabed3d519f73bafeb3a7c011ef8dea5d68b962045a1fb8275813376bbf6c3

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              12KB

                                              MD5

                                              5b7c32797c67ce74194ae56e7d4443db

                                              SHA1

                                              f29f268415b91736cb4de37dbaacd870bd6a9bc1

                                              SHA256

                                              8ce799921a75e4bcc371526ec95a28e926142ce005317f902ce8fee31113083e

                                              SHA512

                                              2b2b8482ab605594f7cf387aefd1b85444e8bb20f43791eb31f380bb0de3e2ba041f464d6041b57e9e492c7d58b7737e3908c67b3caceec1ac421c0707bdcea4

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.WCRY
                                              Filesize

                                              1KB

                                              MD5

                                              6b12c2fed52ea049787faf098497ecdd

                                              SHA1

                                              276bfe667503bd790cb982e47f7e87320531c5ca

                                              SHA256

                                              5b1e5b9e628b4abd051ec4110cbcf1b58b33e44457751b96a64a033b1ec447f5

                                              SHA512

                                              e0f1f906c390a5312410ad6082b69b1d183aa34b39fc85e6831efc262ca388c4a9fe1923d8ef38f949f6e2fcc44178d0b0c2798997129daa827fc84be94d0c2a

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754214864666.txt.WCRY
                                              Filesize

                                              77KB

                                              MD5

                                              5c1a293a1ed5fcea204b8f17723f046f

                                              SHA1

                                              1197700310a5054f1fcd3657bce2c5c76394bb4c

                                              SHA256

                                              b27ef4b14ef67843ba7dc6876c46727ba728327a44fb07d7ec02e123179ec974

                                              SHA512

                                              38e83a6bd97d1d003a255a8db61aa465c2a818ad7697539c4cd76333e19e1f8110b096000d49a2f65eaaa89066bea5355c54928aba6a463182d77fa6c9aa7959

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
                                              Filesize

                                              797B

                                              MD5

                                              afa18cf4aa2660392111763fb93a8c3d

                                              SHA1

                                              c219a3654a5f41ce535a09f2a188a464c3f5baf5

                                              SHA256

                                              227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

                                              SHA512

                                              4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe.lnk
                                              Filesize

                                              1KB

                                              MD5

                                              71af205973448734190d9f810bfa9c2f

                                              SHA1

                                              084f26c55c884c4207695d6f7d264252ffa4bebe

                                              SHA256

                                              5f25926746b2b1d18c2708898ec54e57dac70820bb82738f340f1ec87356b60c

                                              SHA512

                                              8ce8ed174dfb24383b701fb347f7c9b1f74c2f16339669876967a3eb25ea5225118110f3549631163fb3986b872b0f6ff182adbf18834cc3587b3d574670a0dc

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\00000000.res
                                              Filesize

                                              136B

                                              MD5

                                              22bd09ee87c3ccd15d24376c547a8eca

                                              SHA1

                                              43e873d9002b9ed827bf3300af4f1df6331aae84

                                              SHA256

                                              2126a048aa863de9823d67368e7c97afe8247709e9a87b74e40f91139640f4e7

                                              SHA512

                                              4454002663908821e5a04e0f3fadb5e8e4ae4d9bf1eb52b489a0092b003340ae60b3a34dc3ef44c0ff4bb314a51a1b9da7c46dc9999a20e1fdc6a63281e843d0

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\00000000.res
                                              Filesize

                                              136B

                                              MD5

                                              eb93c24acbc61086f0a35ab668b7c141

                                              SHA1

                                              ae35c7e99c481c51fccdcaf3c35bc9388029e135

                                              SHA256

                                              868d3d9b15b80962e0ce264573ace556326d78684858b47bce37bac3ce29652a

                                              SHA512

                                              4086e804de670b2d15f9184228eb2c7542a7dff8ba421c40a345e024d411a06bb971b7a1dd97f2308933db73eaebfc3026e97ef028698fd22f4c54bb7fe1bb40

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\00000000.res
                                              Filesize

                                              136B

                                              MD5

                                              8edf933125f5b7bcac7d8f16d523765d

                                              SHA1

                                              bed3e1ae6619666d4fc6366ff2c93570f091d2ae

                                              SHA256

                                              cbf64bddd44cdfe6cdccb6d140dca435c9d13222f6c9f902a497869f535d97f2

                                              SHA512

                                              78d96bb57bca06c27ac2afc764c3fe337bd52b0367a8ed854ee1a61f29b39a3c87823900977fb558e33a6cd1038819660d55f3c4113f609bf5028f46fe6fdbef

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\00000000.res
                                              Filesize

                                              136B

                                              MD5

                                              faf5cc110ad19842b6b533305cfacc2a

                                              SHA1

                                              beb6b2c346494f22f4049bb1065b4caafa7774bd

                                              SHA256

                                              1bdd3558ee36dabfc658eae73fecd5bb455c6fe2364f8d99f8b02d4d11d3c722

                                              SHA512

                                              83b1f416770c5757414efeec82e15a64ac8ab76b1c253e30e4dca472648e77d632ef640e9ea0f3cec24eddc73ebe7fa1dc739b8217460cc8dc81d276d26fe8b0

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\323011723493157.bat
                                              Filesize

                                              474B

                                              MD5

                                              8c747809f440565ae31ff56fc6ee3726

                                              SHA1

                                              ef010d0ba47bd09652b4910e72ddac78e3c76cf4

                                              SHA256

                                              38de07ecb4fd6c81a4b4d0d5e9a30feac3bba198eccdee8271fef4ae005dc9d1

                                              SHA512

                                              cc3637528185ddc8a3e6b79aeb3945ca67282d9588a552606547bbef88a77e8195e50a29aa676041fb2263651fde4986f74011acbc3eb49923d7f250b01759ca

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\c.vbs
                                              Filesize

                                              357B

                                              MD5

                                              d20fdcc99bb6d4f26f0d22266e855c4a

                                              SHA1

                                              5a3ce3d72c0ce3d857188fc9e26a11076eeec91c

                                              SHA256

                                              e1060f60ad87c2bf95f68cda720055265855c878dc9d572872677a2ad1159605

                                              SHA512

                                              4f11b2316abbc28d80e77aef1494fae55abcf3bc116429702d32bf423b9b5c9162be63d78361810204a1fbb363c6ab65c000e51c550e36634c0feaf21cf6debd

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\c.wry
                                              Filesize

                                              628B

                                              MD5

                                              49c87eb80545ac21505698d3f65e62fd

                                              SHA1

                                              e80b987ee979f9e0da531f2ee76a338a92f2d996

                                              SHA256

                                              491ddb619f35f06bd0dd3a7e2427a3e9794ba55f7714f251f231658b13e6e532

                                              SHA512

                                              137324cc36b6185bc459d53bf079c1aaccb948952f30273209adf0b2940284beff1ac279f2b6ff8a776d10985e02d39a5e68912bdb99acef6fea6a242e8e388b

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\f.wry
                                              Filesize

                                              352B

                                              MD5

                                              fac7ea6f0deac68266bae0df419201ef

                                              SHA1

                                              1ea7fe981f3f508ecaaf0e5a433c4ad9691e2ee1

                                              SHA256

                                              7ede0646b47227fd56becf552152530141341033c79a6a504d0e1c6b345a0850

                                              SHA512

                                              6b04094dd2b56648ff99c962bbaecaa14f060e3c9f3fbef44b761336766328a3649623632bb5662522a6bce611614da01641ca2310a48eedb11001f53095f91a

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\m.wry
                                              Filesize

                                              42KB

                                              MD5

                                              980b08bac152aff3f9b0136b616affa5

                                              SHA1

                                              2a9c9601ea038f790cc29379c79407356a3d25a3

                                              SHA256

                                              402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

                                              SHA512

                                              100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

                                              Download Submit
                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\u.wry
                                              Filesize

                                              236KB

                                              MD5

                                              cf1416074cd7791ab80a18f9e7e219d9

                                              SHA1

                                              276d2ec82c518d887a8a3608e51c56fa28716ded

                                              SHA256

                                              78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

                                              SHA512

                                              0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

                                              Download Submit
                                            • C:\Users\Admin\AppData\Roaming\SendRemove.pot.WCRY
                                              Filesize

                                              360KB

                                              MD5

                                              c217804c5c197ea25665c94f8cddb58a

                                              SHA1

                                              b53228b557f47d88a8bf2dba34458fc606e50b90

                                              SHA256

                                              b42a6b9e4f3fc6f88468376e0e9ba6e211cf29a77828cedd14afe6c7d75713d4

                                              SHA512

                                              9fe5472122859ae50846f67a73fb0b7d4fa11207b6457f8aadfee9e21fa462e4c96f5ccc49992038efb4dff1d964619b4d7bad720ea56ba810c0d33feed45031

                                              Download Submit
                                            • C:\Users\Admin\Downloads\ExpandGroup.sql.WCRY
                                              Filesize

                                              479KB

                                              MD5

                                              1e8faeee88674b4734fd331e904db95f

                                              SHA1

                                              ffad085cb184ef59a0382b32c90c6e8cd861ea0f

                                              SHA256

                                              429cdcfd11e5dbdb8d5cb0aad7dcd4f0fed3f288aa3508021f2ad7b55218b2d1

                                              SHA512

                                              54e107cfddb6257583172cc0de45b4ba9205eafb38d743860c5ffa60155f0238c5e2ac465f73e4bd7fe0ce310a1688a1bf2c03651b1b1e9752baffb23a76af0e

                                              Download Submit
                                            • \??\pipe\LOCAL\crashpad_4980_FNGVUEQAGJMPYUGO
                                              MD5

                                              d41d8cd98f00b204e9800998ecf8427e

                                              SHA1

                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                              SHA256

                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                              SHA512

                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              Download Submit
                                            • memory/1872-17-0x00000000005C0000-0x00000000006C0000-memory.dmp
                                              Filesize

                                              1024KB

                                              Download
                                            • memory/1872-11-0x00000000020E0000-0x0000000002110000-memory.dmp
                                              Filesize

                                              192KB

                                              Download
                                            • memory/2812-483-0x0000000010000000-0x0000000010012000-memory.dmp
                                              Filesize

                                              72KB

                                              Download
                                            • memory/3076-8-0x0000000000660000-0x0000000000760000-memory.dmp
                                              Filesize

                                              1024KB

                                              Download
                                            • memory/3076-2-0x0000000002100000-0x0000000002130000-memory.dmp
                                              Filesize

                                              192KB

                                              Download
                                            • memory/3076-18-0x0000000000660000-0x0000000000760000-memory.dmp
                                              Filesize

                                              1024KB

                                              Download