Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-1703-x64

10

https://github.com/D...

windows10-2004-x64

10

Resubmissions

20-08-2024 09:24

240820-lc36xstgqb 10

14-06-2024 16:56

240614-vf2lyayfqd 10

Analysis

  • max time kernel
    749s
  • max time network
    617s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-08-2024 09:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/raw/master/Ransomware/WannaCry.exe

Score
10/10
wannacrydiscoverypersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Downloads MZ/PE file
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://github.com/Da2dalus/The-MALWARE-Repo/raw/master/Ransomware/WannaCry.exe"
    1⤵
      PID:4072
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:96
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\WannaCry.exe
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\WannaCry.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3160
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 285121724145874.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Windows\SysWOW64\cscript.exe
            cscript //nologo c.vbs
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1712
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe f
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2552
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im MSExchange*
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3448
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im Microsoft.Exchange.*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2732
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im sqlserver.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4224
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im sqlwriter.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4612
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe c
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4612
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c start /b !WannaDecryptor!.exe v
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:516
          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
            !WannaDecryptor!.exe v
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4396
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4488
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1976
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2600
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4916
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1596
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:932
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3172
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2316
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1948
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:200
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3132
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1980
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:928
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2756
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2000
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:992
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:512
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3644
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4480
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:656
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:832
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3132
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:524
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:928
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4512
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:780
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4908
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3008
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4816
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:1712
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:820
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3336
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4736
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3472
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2412
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:4480
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:4444
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2336
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4072
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:208
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:400
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:1004
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:352
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:2764
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1048
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:4520
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1264
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3032
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:2824
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3000
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4236
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2780
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3744
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:4596
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3852
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3360
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:3488
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:2224
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3428
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • Executes dropped EXE
          PID:504
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4248
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1396
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
          !WannaDecryptor!.exe
          3⤵
            PID:2732
          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
            !WannaDecryptor!.exe
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1820
          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
            !WannaDecryptor!.exe
            3⤵
              PID:1560
            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
              !WannaDecryptor!.exe
              3⤵
                PID:1608
              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                !WannaDecryptor!.exe
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2316
              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                !WannaDecryptor!.exe
                3⤵
                  PID:2120
                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                  !WannaDecryptor!.exe
                  3⤵
                    PID:4728
                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                    !WannaDecryptor!.exe
                    3⤵
                      PID:2848
                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                      !WannaDecryptor!.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1096
                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                      !WannaDecryptor!.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2356
                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                      !WannaDecryptor!.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4816
                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                      !WannaDecryptor!.exe
                      3⤵
                        PID:3140
                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                        !WannaDecryptor!.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4476
                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                        !WannaDecryptor!.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3308
                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                        !WannaDecryptor!.exe
                        3⤵
                          PID:4508
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3448
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:696
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3012
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:508
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:200
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2412
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4480
                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                            PID:2552
                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                            !WannaDecryptor!.exe
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:3148
                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                            !WannaDecryptor!.exe
                            3⤵
                              PID:2336
                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                              !WannaDecryptor!.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4208
                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                              !WannaDecryptor!.exe
                              3⤵
                                PID:2360
                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                !WannaDecryptor!.exe
                                3⤵
                                  PID:4116
                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                  !WannaDecryptor!.exe
                                  3⤵
                                    PID:2600
                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                    !WannaDecryptor!.exe
                                    3⤵
                                      PID:236
                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                      !WannaDecryptor!.exe
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:840
                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                      !WannaDecryptor!.exe
                                      3⤵
                                        PID:348
                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                        !WannaDecryptor!.exe
                                        3⤵
                                          PID:1100
                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                          !WannaDecryptor!.exe
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1116
                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                          !WannaDecryptor!.exe
                                          3⤵
                                            PID:392
                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                            !WannaDecryptor!.exe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1048
                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                            !WannaDecryptor!.exe
                                            3⤵
                                              PID:3588
                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                              !WannaDecryptor!.exe
                                              3⤵
                                                PID:2880
                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                !WannaDecryptor!.exe
                                                3⤵
                                                  PID:2868
                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                  !WannaDecryptor!.exe
                                                  3⤵
                                                    PID:5056
                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                    !WannaDecryptor!.exe
                                                    3⤵
                                                      PID:2824
                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                      !WannaDecryptor!.exe
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3000
                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                      !WannaDecryptor!.exe
                                                      3⤵
                                                        PID:4252
                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                        !WannaDecryptor!.exe
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2736
                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                        !WannaDecryptor!.exe
                                                        3⤵
                                                          PID:2780
                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                          !WannaDecryptor!.exe
                                                          3⤵
                                                            PID:3744
                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                            !WannaDecryptor!.exe
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4596
                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                            !WannaDecryptor!.exe
                                                            3⤵
                                                              PID:3832
                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                              !WannaDecryptor!.exe
                                                              3⤵
                                                                PID:3460
                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                !WannaDecryptor!.exe
                                                                3⤵
                                                                  PID:4052
                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                  !WannaDecryptor!.exe
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2800
                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                  !WannaDecryptor!.exe
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4464
                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                  !WannaDecryptor!.exe
                                                                  3⤵
                                                                    PID:4276
                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                    !WannaDecryptor!.exe
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3476
                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                    !WannaDecryptor!.exe
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1044
                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                    !WannaDecryptor!.exe
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4032
                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                    !WannaDecryptor!.exe
                                                                    3⤵
                                                                      PID:1396
                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                      !WannaDecryptor!.exe
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2916
                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                      !WannaDecryptor!.exe
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3748
                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                      !WannaDecryptor!.exe
                                                                      3⤵
                                                                        PID:64
                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                        !WannaDecryptor!.exe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:316
                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                        !WannaDecryptor!.exe
                                                                        3⤵
                                                                          PID:5008
                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                          !WannaDecryptor!.exe
                                                                          3⤵
                                                                            PID:4928
                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                            !WannaDecryptor!.exe
                                                                            3⤵
                                                                              PID:2312
                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                              !WannaDecryptor!.exe
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1320
                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                              !WannaDecryptor!.exe
                                                                              3⤵
                                                                                PID:2192
                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                !WannaDecryptor!.exe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3320
                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                !WannaDecryptor!.exe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3008
                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                !WannaDecryptor!.exe
                                                                                3⤵
                                                                                  PID:4680
                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                  !WannaDecryptor!.exe
                                                                                  3⤵
                                                                                    PID:2356
                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                    !WannaDecryptor!.exe
                                                                                    3⤵
                                                                                      PID:4816
                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                      !WannaDecryptor!.exe
                                                                                      3⤵
                                                                                        PID:3140
                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                        !WannaDecryptor!.exe
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3916
                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                        !WannaDecryptor!.exe
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4392
                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                        !WannaDecryptor!.exe
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2592
                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                        !WannaDecryptor!.exe
                                                                                        3⤵
                                                                                          PID:1908
                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                          !WannaDecryptor!.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2100
                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                          !WannaDecryptor!.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:696
                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                          !WannaDecryptor!.exe
                                                                                          3⤵
                                                                                            PID:4264
                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                            !WannaDecryptor!.exe
                                                                                            3⤵
                                                                                              PID:1624
                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe
                                                                                              !WannaDecryptor!.exe
                                                                                              3⤵
                                                                                                PID:2216
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:684
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Drops file in Windows directory
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4400
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Drops file in Windows directory
                                                                                            • Modifies registry class
                                                                                            PID:4948
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Drops file in Windows directory
                                                                                            • Modifies registry class
                                                                                            PID:5040
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3928
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            PID:3780

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml
                                                                                            Filesize

                                                                                            74KB

                                                                                            MD5

                                                                                            d4fc49dc14f63895d997fa4940f24378

                                                                                            SHA1

                                                                                            3efb1437a7c5e46034147cbbc8db017c69d02c31

                                                                                            SHA256

                                                                                            853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                                                                            SHA512

                                                                                            cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AGT29K55\WannaCry[1].exe
                                                                                            Filesize

                                                                                            224KB

                                                                                            MD5

                                                                                            5c7fb0927db37372da25f270708103a2

                                                                                            SHA1

                                                                                            120ed9279d85cbfa56e5b7779ffa7162074f7a29

                                                                                            SHA256

                                                                                            be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

                                                                                            SHA512

                                                                                            a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\P7DG20WE\www.bing[1].xml
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            581f1d24b162a298f16a582f32c87e03

                                                                                            SHA1

                                                                                            4dcd8bc8ef3f0b9f7bce81bf13cfe0e242fb4db2

                                                                                            SHA256

                                                                                            2b2432e68679875ca41cb69af017b3ffa02f3ec5df70ac88da11fe364e6f8d49

                                                                                            SHA512

                                                                                            23e491c22ff9cfd2500319b226e70f5c63c0debe70ff7803ff7e2f44be84e2a5f54dbea888852c7799b96af96d3283c93f34c90607758ce08f874241ada774b9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\65ES3H0J\favicon[1].png
                                                                                            Filesize

                                                                                            958B

                                                                                            MD5

                                                                                            346e09471362f2907510a31812129cd2

                                                                                            SHA1

                                                                                            323b99430dd424604ae57a19a91f25376e209759

                                                                                            SHA256

                                                                                            74cf90ac2fe6624ab1056cacea11cf7ed4f8bef54bbb0e869638013bba45bc08

                                                                                            SHA512

                                                                                            a62b0fcc02e671d6037725cf67935f8ca1c875f764ce39fed267420935c0b7bad69ab50d3f9f8c628e9b3cff439885ee416989e31ceaa5d32ae596dd7e5fedbd

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JODXNRY6\suggestions[1].en-US
                                                                                            Filesize

                                                                                            17KB

                                                                                            MD5

                                                                                            5a34cb996293fde2cb7a4ac89587393a

                                                                                            SHA1

                                                                                            3c96c993500690d1a77873cd62bc639b3a10653f

                                                                                            SHA256

                                                                                            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                                            SHA512

                                                                                            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!Please Read Me!.txt
                                                                                            Filesize

                                                                                            797B

                                                                                            MD5

                                                                                            afa18cf4aa2660392111763fb93a8c3d

                                                                                            SHA1

                                                                                            c219a3654a5f41ce535a09f2a188a464c3f5baf5

                                                                                            SHA256

                                                                                            227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

                                                                                            SHA512

                                                                                            4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\!WannaDecryptor!.exe.lnk
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            469ff90972fedaf6b20ce7220f72664b

                                                                                            SHA1

                                                                                            09ddb0f672834e430195f5faf38a68a2862e6d2c

                                                                                            SHA256

                                                                                            9e8cf9303826cabe3378c59f447913d5c15890debe5db25afc7ed10fbed82b94

                                                                                            SHA512

                                                                                            c08e729474a14ebded81dfc9b3ac70fd27740047887213f2ccef4c4689b3e153dd9ffbf5dfe2a145ae5d98133de7da7ac1df067705fbd82545a6133dd5257d50

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\285121724145874.bat
                                                                                            Filesize

                                                                                            460B

                                                                                            MD5

                                                                                            842488e160bd99a82da54bdfbc12b437

                                                                                            SHA1

                                                                                            a743826e4aa88b762f10ba58d51a16f11917dc0c

                                                                                            SHA256

                                                                                            83684516bbcda4c82b77d8d0baf3ae9daf2c38b757e0fa84a855992c8a863fa8

                                                                                            SHA512

                                                                                            6db3eb1edfcc343f9027560722081ef9dd1c2f01164945f118f1d24244677ca4ea367fe791265522cb1689c4371c1403ece97b77012d768ae60b42c8dfff6110

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\c.vbs
                                                                                            Filesize

                                                                                            343B

                                                                                            MD5

                                                                                            67b37e559b09a7104bbd0bfbee58df5b

                                                                                            SHA1

                                                                                            1bd8b0b379224089b15a31bb7a76d3c2a22cba1a

                                                                                            SHA256

                                                                                            2e4a89de81f0daaefcaa37420c7f75744658bccd0e4b637ecae181db38c899f8

                                                                                            SHA512

                                                                                            abf6171e287d23d393b505bfc29c3cda2542c22360bcfb89fea0250019f70c92d252ade66f84cdd2551e3f155e92cd42c51d913082afa3d87e0c2e81b521c501

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\u.wry
                                                                                            Filesize

                                                                                            236KB

                                                                                            MD5

                                                                                            cf1416074cd7791ab80a18f9e7e219d9

                                                                                            SHA1

                                                                                            276d2ec82c518d887a8a3608e51c56fa28716ded

                                                                                            SHA256

                                                                                            78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

                                                                                            SHA512

                                                                                            0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AGT29K55\WannaCry[1].exe
                                                                                            Filesize

                                                                                            32KB

                                                                                            MD5

                                                                                            b3a7e0bd86798ee16cf6e3a2f6586f56

                                                                                            SHA1

                                                                                            9c45361209d54916ce85cf400f143c9ec07c3fba

                                                                                            SHA256

                                                                                            d3d9c61dfdac1915f8c03e82a651a0743f802de880b1269ac7d66c1885cb2caf

                                                                                            SHA512

                                                                                            f88bb5258e15d9cbe932850070d47a3a19f0bbffbaa003efce4ad810bd069daa6a40538759eab5af0f1ea6421671b6a4ade501f416e8c7ed417e0918fa0afdba

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
                                                                                            Filesize

                                                                                            281B

                                                                                            MD5

                                                                                            b164e460d5e69618b8d07d7fd0a20891

                                                                                            SHA1

                                                                                            5e896dd0446188e8603f62bbb64f0eb8c775c9bb

                                                                                            SHA256

                                                                                            67d7021f1b44eb79377bd4a8b8af92bf214dc730d0cac858609f13ce5ae0e42f

                                                                                            SHA512

                                                                                            aabdf1f4e82286b89c2b32571c2235966f12ba32a7e7524a119b1cda2c7577c04619e0772daca6451aa630163bb0a914e1d18e0b9bafe8c885aad50da40413cb

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            932d9a1022e158fa9354b744e0285e8b

                                                                                            SHA1

                                                                                            31e93c8c619cfa679ae62ba26ca9559724956811

                                                                                            SHA256

                                                                                            50bb88ffe7b37abb76c4e81edd2e42199a19a2b15268e70f513be1fbc8ca9740

                                                                                            SHA512

                                                                                            e20163be6fc4118a548b36b99ab0280eefd1f1e80e06ba5d7c35eab380f159cb9ee0272105ccff5bd4b59e0fabd73bc46695aaa4504bed5512ae2378e2bd928e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
                                                                                            Filesize

                                                                                            979B

                                                                                            MD5

                                                                                            9c78b524c508275563eb4296012b522c

                                                                                            SHA1

                                                                                            31ecf0298a8c9e4071f2c5907d6d2a47a33ebfb4

                                                                                            SHA256

                                                                                            4d22bbb00ee0017dbc886e86be4f32c1aaae29d79367f8338219e70da1ce274b

                                                                                            SHA512

                                                                                            06d3a1a9cb9cfc29e29038c939a21dca32b69559225660dfcb488f947ec3cc8419d163628eae885b90af73aa02ab23ec636792165442e4d9e3eb5b337f0d3f3b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
                                                                                            Filesize

                                                                                            471B

                                                                                            MD5

                                                                                            ef251242c68da9415b1b879b97034419

                                                                                            SHA1

                                                                                            8a73a49528390b4c1d84627b9e94d5371d4cf470

                                                                                            SHA256

                                                                                            7623a12c25c58c08312b302c0a268cba235f17e16b37ba56991ae5c5f2d47009

                                                                                            SHA512

                                                                                            6738a9871ec4f364968d398d15a93e754410e1ce03487437828a986d0f3067a478da5c33efcb539db75107b4b220e6987aa12e5a6fa6a00326c430900279b47a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
                                                                                            Filesize

                                                                                            480B

                                                                                            MD5

                                                                                            865452fa89199f9c4f3e1dcd9917e978

                                                                                            SHA1

                                                                                            ea5b061cffce28c7ac950edc8949d834b382f620

                                                                                            SHA256

                                                                                            934db384c8a5ed9491d43f658f086034c8a50bee05195bcec4fd496cbe0f5cf4

                                                                                            SHA512

                                                                                            0b053c27ce2814a04f4fec82639c45fd5d3626737b3a223fca96e249d61ba57bf9df8e89bf55a36962accb9290a100a40283b54751a79a94ad090ce5ae548038

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
                                                                                            Filesize

                                                                                            482B

                                                                                            MD5

                                                                                            2e8ccd3f3e9f34620feeae672dd10c6b

                                                                                            SHA1

                                                                                            5e870405f6a369cbaa1399a932221bad7e25d92b

                                                                                            SHA256

                                                                                            eb354a1002fb620bb1272611434d604e5cba84f5ac3de6f3d0c7be20240ab85d

                                                                                            SHA512

                                                                                            b0120fce5da3ca1450eaf7d4dba52efb0d1044fc10c9dce91c82a7e5fa6e29b71e4210f153fa747f8e41033b73822bcaf7ea5b793eadd81446db70534dbfb7ca

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
                                                                                            Filesize

                                                                                            480B

                                                                                            MD5

                                                                                            60a98214be8cee1ea9c959040f1c1ce3

                                                                                            SHA1

                                                                                            502d375f6ce6c247b14e44e0d696996c9bf376a4

                                                                                            SHA256

                                                                                            5196cd850c35f02388da0f4fde5052c61009e412890495e5f12aefba24cfc774

                                                                                            SHA512

                                                                                            c9800b8be2873487e2d2375db97492176dfc800c40f39752880b40fee28c683e87c3046e06c35b66e98fd67387dd68037b4d0397760056ff944ce3e47e33c13d

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
                                                                                            Filesize

                                                                                            412B

                                                                                            MD5

                                                                                            f7e599508eb7b7d3c379573fffd13d34

                                                                                            SHA1

                                                                                            ab74949062ebfb6bb2bdf4211bd6fe6e6b8f0fc4

                                                                                            SHA256

                                                                                            dcbf5df64ef026c983d238ec016f06100c1f9c13eb3fec011a433c17b0373f03

                                                                                            SHA512

                                                                                            3abb45183157ede2bdae8ea74b5b4c55629e0b9906337c7db7417ee151a4dde23e26851789694f8116a5436b7ae4234537fd1e82609de17ae52f2ea6f534c164

                                                                                            Download Submit

                                                                                          • memory/96-68-0x000001A50DEC0000-0x000001A50DEC1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/96-17-0x000001A507A30000-0x000001A507A40000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/96-69-0x000001A50DED0000-0x000001A50DED1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/96-35-0x000001A504AA0000-0x000001A504AA2000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                            Download

                                                                                          • memory/96-0-0x000001A507920000-0x000001A507930000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/3160-118-0x0000000010000000-0x0000000010012000-memory.dmp

                                                                                            Filesize

                                                                                            72KB

                                                                                            Download

                                                                                          • memory/3928-1685-0x000001E1BD9B0000-0x000001E1BD9C0000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/3928-1478-0x000001E1CE420000-0x000001E1CE440000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/3928-1664-0x000001E1CE200000-0x000001E1CE300000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/3928-1686-0x000001E1BD9B0000-0x000001E1BD9C0000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/3928-1620-0x000001E1CFD00000-0x000001E1CFE00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/3928-1515-0x000001E1CE770000-0x000001E1CE790000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/3928-1483-0x000001E1CE6B0000-0x000001E1CE6D0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/3928-1683-0x000001E1BD9B0000-0x000001E1BD9C0000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/3928-1432-0x000001E1BDF00000-0x000001E1BE000000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4400-45-0x000002A2AED00000-0x000002A2AEE00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4948-75-0x0000020B6D5F0000-0x0000020B6D5F2000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                            Download

                                                                                          • memory/4948-73-0x0000020B6D530000-0x0000020B6D532000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                            Download

                                                                                          • memory/4948-70-0x0000020B6D500000-0x0000020B6D502000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                            Download

                                                                                          • memory/5040-84-0x000001D67A600000-0x000001D67A700000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download