wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry[.]exe

Analysis

max time kernel
122s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD2011.tmp	WannaCry (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD2018.tmp	WannaCry (1).exe

Executes dropped EXE 5 IoCs

pid	Process
1020	WannaCry (1).exe
2168	!WannaDecryptor!.exe
5844	!WannaDecryptor!.exe
6096	!WannaDecryptor!.exe
6076	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry (1).exe\" /r"	WannaCry (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3916	taskkill.exe
2760	taskkill.exe
3980	taskkill.exe
3224	taskkill.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 548453.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 97189.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
1052	msedge.exe
1052	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
1864	msedge.exe
1864	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6076	!WannaDecryptor!.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3916	WMIC.exe
Token: SeSecurityPrivilege	3916	WMIC.exe
Token: SeTakeOwnershipPrivilege	3916	WMIC.exe
Token: SeLoadDriverPrivilege	3916	WMIC.exe
Token: SeSystemProfilePrivilege	3916	WMIC.exe
Token: SeSystemtimePrivilege	3916	WMIC.exe
Token: SeProfSingleProcessPrivilege	3916	WMIC.exe
Token: SeIncBasePriorityPrivilege	3916	WMIC.exe
Token: SeCreatePagefilePrivilege	3916	WMIC.exe
Token: SeBackupPrivilege	3916	WMIC.exe
Token: SeRestorePrivilege	3916	WMIC.exe
Token: SeShutdownPrivilege	3916	WMIC.exe
Token: SeDebugPrivilege	3916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3916	WMIC.exe
Token: SeRemoteShutdownPrivilege	3916	WMIC.exe
Token: SeUndockPrivilege	3916	WMIC.exe
Token: SeManageVolumePrivilege	3916	WMIC.exe
Token: 33	3916	WMIC.exe
Token: 34	3916	WMIC.exe
Token: 35	3916	WMIC.exe
Token: 36	3916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3916	WMIC.exe
Token: SeSecurityPrivilege	3916	WMIC.exe
Token: SeTakeOwnershipPrivilege	3916	WMIC.exe
Token: SeLoadDriverPrivilege	3916	WMIC.exe
Token: SeSystemProfilePrivilege	3916	WMIC.exe
Token: SeSystemtimePrivilege	3916	WMIC.exe
Token: SeProfSingleProcessPrivilege	3916	WMIC.exe
Token: SeIncBasePriorityPrivilege	3916	WMIC.exe
Token: SeCreatePagefilePrivilege	3916	WMIC.exe
Token: SeBackupPrivilege	3916	WMIC.exe
Token: SeRestorePrivilege	3916	WMIC.exe
Token: SeShutdownPrivilege	3916	WMIC.exe
Token: SeDebugPrivilege	3916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3916	WMIC.exe
Token: SeRemoteShutdownPrivilege	3916	WMIC.exe
Token: SeUndockPrivilege	3916	WMIC.exe
Token: SeManageVolumePrivilege	3916	WMIC.exe
Token: 33	3916	WMIC.exe
Token: 34	3916	WMIC.exe
Token: 35	3916	WMIC.exe
Token: 36	3916	WMIC.exe
Token: SeBackupPrivilege	1564	vssvc.exe
Token: SeRestorePrivilege	1564	vssvc.exe
Token: SeAuditPrivilege	1564	vssvc.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2168	!WannaDecryptor!.exe
2168	!WannaDecryptor!.exe
5844	!WannaDecryptor!.exe
5844	!WannaDecryptor!.exe
6096	!WannaDecryptor!.exe
6096	!WannaDecryptor!.exe
6076	!WannaDecryptor!.exe
6076	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2988	1052	msedge.exe	83
PID 1052 wrote to memory of 2988	1052	msedge.exe	83
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 548	1052	msedge.exe	85
PID 1052 wrote to memory of 4900	1052	msedge.exe	86
PID 1052 wrote to memory of 4900	1052	msedge.exe	86
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87
PID 1052 wrote to memory of 2924	1052	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa39c846f8,0x7ffa39c84708,0x7ffa39c84718
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Users\Admin\Downloads\WannaCry (1).exe
  "C:\Users\Admin\Downloads\WannaCry (1).exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 236331728434795.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5072
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:1836
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5844
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6020
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:6096
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12806425402779313580,14706594060907351886,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WCRY

Filesize
1KB

MD5
867b4388dccf5b1d101e5a79719ef360

SHA1
01107c16609d827a8cbcf8c492706f39af87b4da

SHA256
1c2aef41d4952d86e02bbc884c40da013854b073609dce0da6593e129c15c3f6

SHA512
5def85c077e8830bbcb48b545dfa8aa161ee70135b112fcbad2df8735727401490a8be038077f5b9b6c7344addfaebded8470db98acfc079932eec9f62993d47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WCRY

Filesize
4KB

MD5
ba9e96d7d96a6ed0ca7944c2547bd7e3

SHA1
379988812ba31e803c339cb79c87b8fdd671c037

SHA256
4151905432d5b05a9c61774becea2da1091c92ec8c43d92efd2b67d79d517ac1

SHA512
edac7272c277c8d58057298e78fc87bd899bd1ad785c83552a92176dece6393c58cc2e19dd88c7021208f954423641fa36511d4b8dd96d659e8be065bde7227b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4fa83682-5406-4ea5-86a4-28c0efdff604.tmp

Filesize
1KB

MD5
25fdb67fe61a76dd8c22ef1cc950a333

SHA1
aaa7408c569afdab7fc5446250c31b2d1a7541bf

SHA256
ab8709fc93e04894f45981e300dcf362ed9258a35b3824113825925414aa13fc

SHA512
9a560c93e8ddb9b0ad6f4fc061402db4a041fbf7a7cd6dc61259d04e9355cd9f8ebaaafd1218bfc1b9ebeb986b785b7948b17ef341283d71a31b03852e095aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dac311d9287773f855053e3964c1fe51

SHA1
67015c525ac81677912b73505e991e38ed66196a

SHA256
e3a72a84b784dbe4a5614255c74ccdd2d391b2341415af5d32c7181390bfa6a1

SHA512
ba946d78a391775c8e385a80382ba334d718e7008372f8ce50a74f4b375855859e264f660985b68a6a21c5000a9bd11499a42c1572a554810f5195d2eb5c3f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
b4f30e6aa58c8d557c10d4ec7e813ee1

SHA1
7c3782df51486e878cceaecc2c993abe9d01918b

SHA256
bd940d63c926a04f6160582e0b10e7266ad43cf6da403c09f254821a7316427d

SHA512
87b3aa728695d04857e083727754e4dc897bd1a340be1f97e7ea349e76fe73ac2e526280c1b815846c777669b412f0d08530796cb1d7c662ffaaf88879b148c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6be6ddef77cf8edd7bd7b798cb415ea

SHA1
53c736a92a1aae94e9c9021257c4c3979bc7f609

SHA256
2bbc01897426df53764033d1b28c1ffd35221da6646aebdf4b37bf55716511ad

SHA512
d40e2c53127fb6a2ef7495acb2a4951ee15b999fa59c8afecde87b481b50364069abc5d295caa54dd5eaa43f457f1bfa3fd6cc2d505db2ba3d16e40bff06e74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6acff7d3fe171cce4638c1c4a05639a

SHA1
fed6c982afa4946ca22fcd9c63b6a84cef4a0709

SHA256
4307f2996581652ddde386408da3ec2d2937f795a92d30d3974cd4d5d11d6a95

SHA512
ef1738eeae44cefc79878e6a3be89a0dd122945f709550c6328a32232d4abe4c78c2ee9516dda5618a5c3be360ca648ab2da30d5fc38e2aa68ff4cc86ce5af21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
586e9ce365c07fc11687a642315d3230

SHA1
a2087489ab72fa41640e688a25279be72b6dd58b

SHA256
09d61777cd71ec8bad4688a1a8fea5f6c697f75d4eb236a3e23f3d718ce9bc92

SHA512
1d131201c830187e2876dde5bc71abee8cb84f111226fea1c709ff06f5c17007fb8ecd989297f8ca90da49062acdc9be86e23e832903f23cba16b4efbbe68a6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f935.TMP

Filesize
874B

MD5
63aaffa5cc24fc9bb29c1f5ddf03236e

SHA1
bd546d88f64cd8b63aee36e767cf1601e43081ae

SHA256
f370b68f00de2804a2cfb9e3858cb4287e110c8f98e639387dd3552deec51dee

SHA512
5d7bd8597b346b5256e2a12d52cd047d891b4cf82d1bf98674ccc5bc8c8b93773fd9547ff476c94cc03312f07e42a0783bb97e4a384580b7cc4d2837e1041c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ef35832503e237b6cdb0da3c46d7372

SHA1
ec5e129c7ebf8dc458d505528d635a95640f1fc8

SHA256
bb2d3856fdf7931646c172dedc7cd71284b640eb4e7b5717e9e00ffeb3ab6f0e

SHA512
6aa3f9d4a3d1dd2ac1d23335cfc42260302106c6d65fd2144b05fc532ccfd1e2f994135e5b25491e4cdee016e40d8399387b8929bbaea5a85b6964d71aa8229e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
536fff046a97ac896b02ed07c3bc9602

SHA1
3e0b1c00bff792b69f02903fc800ffc5870f9a71

SHA256
539b6afaf964a28747333635c579d8914c12b48ece8e751aa51b48898a0e13f3

SHA512
e809a0fd15609b1b5a75521ec2508651a23dcb7e3f92b3dc284fa15080e6ad0962ff0dad549ff301628a8c22507d711206ff6c908ad2d8499d46890203489855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.WCRY

Filesize
1KB

MD5
07daa33bba5065d009852ac36724f19c

SHA1
84ebbe64ddffe662f53af4af480fad7260c46a9b

SHA256
5363ff8ede456d56a47096283d876a49d818595af66853104b4df49442d015d0

SHA512
183db53afbd6d0ff6519164a5f90799a4d39bc622cf74508a143baf4edf234c367dc617e01a2e634ee3a0477a09e4b43f61a1b18af2e0e0945a06fc12688287e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WCRY

Filesize
414KB

MD5
be37602dbc2c232003e8b4a0bb02c33e

SHA1
11b19878ea4086c1b0b32b869670b50f249d4d0b

SHA256
67b4db5aa0287b04c9fa7436c3019e68e772e0fb20995239337fccb9b2b906b8

SHA512
1210b825f2e696fcce8c656d2738ff819ffa42f0eeb971b439e1e231db37e472271056ec3c10f29de8932b962469b3afd3d283f6f5af4fc16f7b541ddcdb1acf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WCRY

Filesize
1KB

MD5
da2a8c3d926ea1af4f3f6060a6021b04

SHA1
d52c5decaf95d4a4c8b35e2e30ca4e8dd7af3a6a

SHA256
1093c076ec4b564931c73f69914ba8da5c9654f022ad09381d6c614339d5fd1f

SHA512
d1b8211c21680b01e53018655a1deb31ff761e504538b9fdfd153e4eef066e3eec5de71d9462a76d7b756aeb17a0bb432c28fb6d726505ffa49d6d2f4e361607

Download Submit
C:\Users\Admin\Documents\UnblockInvoke.dot.WCRY

Filesize
425KB

MD5
7ef1933b006d8b878e6d4986d235ece3

SHA1
56106be3d02d6264b50a41ec2aee4204200641bd

SHA256
2dd8987d91981a71a8f1d7ae9f7b43492c61934b8011d7a8fffd3c2e839c70af

SHA512
47f90b57182c40f4f37c1e1edd7f7807c4706e1fab975fdb5c39446880948e8e7d16098e6ec17254dcd2e859df703cd27eb1f97dc60c2869f667ffb7a9ddbda3

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
67411723369aba6a7478dd02182fec01

SHA1
58fe6eb4362404d6f96ab4c126f64191a142106d

SHA256
78da684acd9fc3464fec2ad74fa51fb8f11e9e56af9d2ba2286bc6a9da3afe0a

SHA512
af2ab4423ab31a1c4fa62b7c298b38f310b563a282e6b8929b2921aa7705bfd5ad60ea8cab12fc876d050f54f019e820960777d4633d885374592fbdf819aaaa

Download Submit
C:\Users\Admin\Downloads\00000000.eky

Filesize
1KB

MD5
4ca4172628d5997d1409d7f0d6807ee6

SHA1
8dfd1f1a0a47cf6bdb1815ea8c5f0b5dfc103ab0

SHA256
9c0e9c45d1f7f7b8eb407cd307547ec051d569a2bb90853625d1d5842122862b

SHA512
6317159c5e0759d7c7842d5327f287a13d4940a37cdfd0c07dac4ede8d8621fef0a29a6b5784e432ec41cd4a91d5cf3a38607fc7a39f1ba4085f19477b13661a

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
227b06158ab50b51da0087c51f6ecc6a

SHA1
897b8b35e433f55bd83a9aad2a5c50ce45a72b42

SHA256
106c8fb62f657234e49fb0f7377c373721d11ff2ddfd86058289d8e6c83069a9

SHA512
c68c4e1cb668f3345fdbcb38624e9c4df90f995b98ca65a286c9d6bd711c3f6d5b4c490fd164187870bb8b94d6aae09517ebc30e5d04b075f26f40bea2940db9

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
2f5a00c3932cfe3a50370adc5b245761

SHA1
6fa1004a15bbda8dca950c74d3c18b5eea74f874

SHA256
9607ac2e249ab0a92b69959daf02992f22f8249a0bfdcf4e078a2678da25ede2

SHA512
36df579d55698b8d48d57b096e873708675fb6a4dddd93ea25b4d845d7d449ceaa4f067f0b49486a5ae467435a1c6a00c9b06ef4a56abf202559a406fe61cc33

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
45474b1463969731fd629d12ff8fbce6

SHA1
11b488009aa57756de7f1c66efb0f66b93b13eca

SHA256
57f88084b3cd043098ce34467c12b4c6d0550400eecd8cc243e4a86ec743a3cc

SHA512
80b3bfe399a26a09ec1641e0e33cbfcbce5dbba33a18feb56bd775f32b1a83edfd04fa817ca60c728803bd3b628be6eb8dcf77f52a3c8d53a592503e2d24ed1e

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
7f8cc22c356c5e13cc6dfdd595c05a6e

SHA1
07297eeeb6deeae829c1c165615397b3384ea660

SHA256
58b7dc068ff7e9bdc06f6b11f77b1aeab7ae781051eb4c513a6fa94bf1986673

SHA512
ada799e6c9b8ecd2b5e7a75a06a88a41dde7041f5b2706bbd93be538df5807213d282e967ae3c43713175e12de6f32a6e845be99496c176a125cc6476f411eea

Download Submit
C:\Users\Admin\Downloads\236331728434795.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 548453.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
927d4658bda0ab1127595bc9cec318c8

SHA1
9c516576ed3a8007b7950589b855cc0d680d16bf

SHA256
235889e82463f14d4ec414a7e13d2f6fea8e3ad6e27d3b42ea2eb312536de567

SHA512
5cd636da3204b408155f294ef37da07e5da003f45c76a2b77b25ce46cd5a2fdb95f03a21448f016c33c663fccfdc25d5f05a1921321e0fac4aa4caedfd1fe497

Download Submit
C:\Users\Admin\Downloads\f.wry

Filesize
714B

MD5
e59637f82c5e98a499b5ea0d93f6a2dd

SHA1
8f0ce8ebc8ca8329f868c1662bcbd87e300252f2

SHA256
395bba5ecfae9c44abd5f63f6630f9e63c02d97c0630579b655ddbeded973212

SHA512
032e7a0363b7bc937f0be6d127082961dff880dc7f9707cab4d54b95968fd4016d89d9533d7f4869c560f951c1123c5c460ec2a6b3099e484fa8ad8a455c9583

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/1020-224-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download