wannacry | 598959308399a249c33e9249cd7511fa9c0c23df00b56ac1d71a7b9743bab1af

Resubmissions

07-11-2024 17:46

241107-wb98ysyrbr 10

07-11-2024 17:39

07-11-2024 17:38

07-11-2024 17:38

07-11-2024 17:32

14-10-2024 22:45

Analysis

max time kernel
1800s
max time network
1794s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07-11-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mxbikes.exe
Size

3.6MB
MD5

49ffb1b624e1746698c05aa962353768
SHA1

94f4083ddbfa537e08aa1f0de55a56146a8c6351
SHA256

598959308399a249c33e9249cd7511fa9c0c23df00b56ac1d71a7b9743bab1af
SHA512

8dab9e208003d37993b978a9e2e6cf1c5354c4e3300db97a4d1850227a438af28796b7f902f7c05b9251ea604fbb1557f6bdbb25c4bb4ba43f3dc009e5842862
SSDEEP

49152:eJRTFGeek0zge76irmN0v4Ck1HpDDCwo40mjwrvX6OpePuboh0DW6NnCn0hFToSJ:duupCHlmoSDW6NnC0h68b

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDB8D8.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDB8DF.tmp	WannaCry.exe

Executes dropped EXE 13 IoCs

pid	Process
4180	WannaCry.exe
2348	!WannaDecryptor!.exe
1368	!WannaDecryptor!.exe
2712	!WannaDecryptor!.exe
660	!WannaDecryptor!.exe
1548	satan (1).exe
528	satan (1).exe
3840	urvio.exe
2628	urvio.exe
296	satan.exe
316	satan.exe
544	ohak.exe
1560	ohak.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\{CF441C82-23D3-741B-5056-89006DF8340B} = "C:\\Users\\Admin\\AppData\\Roaming\\Ubop\\urvio.exe"	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
65	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
2628	urvio.exe
2628	urvio.exe
2628	urvio.exe
2628	urvio.exe
2628	urvio.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 528	1548	satan (1).exe	140
PID 3840 set thread context of 2628	3840	urvio.exe	144
PID 296 set thread context of 316	296	satan.exe	151
PID 544 set thread context of 1560	544	ohak.exe	155

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
780	vssadmin.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3636	taskkill.exe
1552	taskkill.exe
2196	taskkill.exe
4372	taskkill.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 190445.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 38313.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 557067.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
2816	msedge.exe
2816	msedge.exe
2488	msedge.exe
2488	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
1984	msedge.exe
1984	msedge.exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe
1548	satan (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2856	WMIC.exe
Token: SeSecurityPrivilege	2856	WMIC.exe
Token: SeTakeOwnershipPrivilege	2856	WMIC.exe
Token: SeLoadDriverPrivilege	2856	WMIC.exe
Token: SeSystemProfilePrivilege	2856	WMIC.exe
Token: SeSystemtimePrivilege	2856	WMIC.exe
Token: SeProfSingleProcessPrivilege	2856	WMIC.exe
Token: SeIncBasePriorityPrivilege	2856	WMIC.exe
Token: SeCreatePagefilePrivilege	2856	WMIC.exe
Token: SeBackupPrivilege	2856	WMIC.exe
Token: SeRestorePrivilege	2856	WMIC.exe
Token: SeShutdownPrivilege	2856	WMIC.exe
Token: SeDebugPrivilege	2856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2856	WMIC.exe
Token: SeRemoteShutdownPrivilege	2856	WMIC.exe
Token: SeUndockPrivilege	2856	WMIC.exe
Token: SeManageVolumePrivilege	2856	WMIC.exe
Token: 33	2856	WMIC.exe
Token: 34	2856	WMIC.exe
Token: 35	2856	WMIC.exe
Token: 36	2856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2856	WMIC.exe
Token: SeSecurityPrivilege	2856	WMIC.exe
Token: SeTakeOwnershipPrivilege	2856	WMIC.exe
Token: SeLoadDriverPrivilege	2856	WMIC.exe
Token: SeSystemProfilePrivilege	2856	WMIC.exe
Token: SeSystemtimePrivilege	2856	WMIC.exe
Token: SeProfSingleProcessPrivilege	2856	WMIC.exe
Token: SeIncBasePriorityPrivilege	2856	WMIC.exe
Token: SeCreatePagefilePrivilege	2856	WMIC.exe
Token: SeBackupPrivilege	2856	WMIC.exe
Token: SeRestorePrivilege	2856	WMIC.exe
Token: SeShutdownPrivilege	2856	WMIC.exe
Token: SeDebugPrivilege	2856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2856	WMIC.exe
Token: SeRemoteShutdownPrivilege	2856	WMIC.exe
Token: SeUndockPrivilege	2856	WMIC.exe
Token: SeManageVolumePrivilege	2856	WMIC.exe
Token: 33	2856	WMIC.exe
Token: 34	2856	WMIC.exe
Token: 35	2856	WMIC.exe
Token: 36	2856	WMIC.exe
Token: SeBackupPrivilege	3252	vssvc.exe
Token: SeRestorePrivilege	3252	vssvc.exe
Token: SeAuditPrivilege	3252	vssvc.exe
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2348	!WannaDecryptor!.exe
2348	!WannaDecryptor!.exe
1368	!WannaDecryptor!.exe
1368	!WannaDecryptor!.exe
2712	!WannaDecryptor!.exe
2712	!WannaDecryptor!.exe
660	!WannaDecryptor!.exe
660	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4128	2816	msedge.exe	84
PID 2816 wrote to memory of 4128	2816	msedge.exe	84
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 2692	2816	msedge.exe	85
PID 2816 wrote to memory of 1760	2816	msedge.exe	86
PID 2816 wrote to memory of 1760	2816	msedge.exe	86
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87
PID 2816 wrote to memory of 2380	2816	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3400
- C:\Users\Admin\AppData\Local\Temp\mxbikes.exe
  "C:\Users\Admin\AppData\Local\Temp\mxbikes.exe"
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50f03cb8,0x7ffb50f03cc8,0x7ffb50f03cd8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 /prefetch:8
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4372
- - C:\Users\Admin\Downloads\WannaCry.exe
    "C:\Users\Admin\Downloads\WannaCry.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61961731001843.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript //nologo c.vbs
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe f
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MSExchange*
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Microsoft.Exchange.*
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlserver.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlwriter.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1552
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe c
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1368
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b !WannaDecryptor!.exe v
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
    - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
        
        !WannaDecryptor!.exe v
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      4⤵
      Executes dropped EXE
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4752 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6812 /prefetch:8
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:1984
- - C:\Users\Admin\Downloads\satan (1).exe
    "C:\Users\Admin\Downloads\satan (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1548
  - - C:\Users\Admin\Downloads\satan (1).exe
      "C:\Users\Admin\Downloads\satan (1).exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:528
    - - C:\Users\Admin\AppData\Roaming\Ubop\urvio.exe
        
        "C:\Users\Admin\AppData\Roaming\Ubop\urvio.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3840
      - C:\Users\Admin\AppData\Roaming\Ubop\urvio.exe
        
        "C:\Users\Admin\AppData\Roaming\Ubop\urvio.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_48f26308.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1800,16308105168216487865,12968091806587029383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1200
- - C:\Users\Admin\Downloads\satan.exe
    "C:\Users\Admin\Downloads\satan.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:296
  - - C:\Users\Admin\Downloads\satan.exe
      "C:\Users\Admin\Downloads\satan.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:316
    - - C:\Users\Admin\AppData\Roaming\Osnyu\ohak.exe
        
        "C:\Users\Admin\AppData\Roaming\Osnyu\ohak.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:544
      - C:\Users\Admin\AppData\Roaming\Osnyu\ohak.exe
        
        "C:\Users\Admin\AppData\Roaming\Osnyu\ohak.exe"
        6⤵
        Executes dropped EXE
        
        PID:1560
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_7a842a4a.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3528

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3812

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3820

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3964

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8996ca86-a13a-44a8-8922-7be27b82df7d.tmp

Filesize
5KB

MD5
6e037e186eaa6aee325d63171414d7a7

SHA1
27ced799b5929165bacc75fd9c9ad63cc917d987

SHA256
96a63c4429b728d8de607559f1e79f6885ceb6119c5653b5630ad376db54a0d4

SHA512
a207fe14b657f87dc0e759294e8cf788bab49a2856bc12b4811db37ac1820d04b0a7d5279787f83075997cce81eb8657a79a880e5fe45394f244539c8a3a15d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d376664119420b7189bed6786fd4b279

SHA1
1937befd936f943701881502f236779859d6bfb8

SHA256
2615b06b81c1249a63a943055cb4b2182717569952538f12fc738d42ba5c6a7b

SHA512
1a7fc2faef3c324153c32f80d92b46af365d52989fc74fae6eb6cff45511d0e328290f8b2dffffb5cfc6fc097ba44e7869a70cca9422738ee469e87b3975407f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
733B

MD5
e5d408edaf53a0b779aa44a035fc1fd8

SHA1
dbc23f8a87b0db14819d7bbe69297fdd64365ce4

SHA256
640af1588d38ba5e1cfa40a0029cdf822be0e27c8c147624a2e7905bbf478c97

SHA512
16d875ff85b162cd05bb8f2d06eb542184e081db56b0729cdbee0792dc67a694af90866fc3df81164ba55f47c481e65244986a1eae79d4289044ac75f749394e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
515bd84b8154108ec16a5f9311705db8

SHA1
0b231301da5de3c1b07994ff008bc1aa5de1e04d

SHA256
a6c0e96d9141dad1c3cf859437f891860df62260dfffc0c611d84ebe27049d48

SHA512
5b80eaf4b48f7e726722e0b39c5b34344f96df1a2a80c9def62ca10796598f9b3f9327e4cffc379ac7314b606c1b13652fc248207a0854740b2e1956eb5811b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2d9e183cb14791223b3ca1183e842e2

SHA1
cf23dfb447adfc07ece9b700a448cd1324e0db70

SHA256
1d843bd259147932370bda8fe887452dfbfe230954bc272c8d8dc75297eef17d

SHA512
bb181df255f42ecb7404be677acfd52b9190fe289d9864f344b7a2ba1d8aab5ebf5b5cbeb0a452d5a2034ad2cbf75cbbc20bc425adefbc7a8488717599e26716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4498cbf8f7fc48939206a4dd2b21e0f

SHA1
8287398feb066f367164cfaec35df45e51d08fb7

SHA256
0a0fea79a0baac68dc04e6b391c04f8b3a90af15889883c9b768dab70013ebdc

SHA512
f54faf5e3d172fa67f32114be56c7d5286314e067fed036914edaf505a441205f8e460c6f54c10a44b2019f57c8e2111b3f0f5c9113487fd2768a5a06a634927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0db6e62a1dc113d2518870d04aaf16a4

SHA1
2e71e6299139452e45514f5bcc51a944a2f44bf8

SHA256
b11b1b72780ea2717e480f15e0acb15781a4669452ce2de1137bb44a4c995ad1

SHA512
44a4196dfe4b492d5fc08929ee3dccd7c72932eebb4e0c84e83057c778c82ed6a7dc3649067718c6f1ce7c56ffac491603c2e97b6f62c75d167be55c55414d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f374e9a538a293b5e7c0351838a6203b

SHA1
521abddad7a871e128afcf8e45bb77fb0dd35b4a

SHA256
859b491d14e163132bb5f9ae925751a721ccd27929c89d3928102ef7e0d8d1f0

SHA512
392aacb355cb1df811e37faf071178f2a7219b68268977e566fce18264b6a71f6eb8805745c1141cfffe13f3a3dd66391ac5ed0713aae271f7290a78b22a8b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d610493a01605b0bae17ea94354bed5a

SHA1
bf1e331e89c886492e9dfc710a12ae5ed0976b9f

SHA256
2411e530928d18bc24b18e5be1e300fbfc9a20724a57ad85f9ff3f4527291951

SHA512
f5a7b3b5e5eb74b7257ef2375e15410b4cdf097c799329a9e23b9dc42a5b828f00901f000f3a230ffbccc63dfd24658e0cf2d9c1d998c4016adf7d7476888663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8915160e0efdd0ed0df21276d320c458

SHA1
015e166ff3e4c3a1e1309d0977087e043887b916

SHA256
c9d50dcb8677ac63150d74a890063b418d253418a70cc610ba029703bed30144

SHA512
2a256a1d000ff4a5c88c21b5173d6861432ada87c221df559ea2687d3f334a40282f87e6dc7781b37f34f7b51beb123948d0deb73a7727bfe7e26d81fba125e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
89b680e4b48a6bacba760b1bde01cfa0

SHA1
37512fbc9c4cc8805004513c58465db7e7b7e690

SHA256
e91a356bd1600e58a34367d860e4cd315c9e3a64a03ffc1bdbd9946179ecb435

SHA512
d9f5fa535dde8a07b1aa4a64cf762fe30fc90c914a8ef31c658c0b212bf22aad91810261cef97aeb03cceb728159639cc77d7223d87eb4653fe06a3921ec1ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b1ccb.TMP

Filesize
1KB

MD5
dfd5910794211e11a81c928e928e36dc

SHA1
620d454ac2e6a38163beb3a3277e71442b1e83fa

SHA256
1704842f7e2c87d15678faceaad6c5aa6728294e730c1c7116a1c3e9f8970112

SHA512
41ea37fdf203722375a60f7b6599c0081a96cf90ad2199392677389f67118f31ce36fa541a1512ee0875586c93f11d4c70fe404bdab4a4f890345fc8a0b8455f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db

Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7069c6e908026fb10371f95ceb9492f

SHA1
861914e035a69ed229854222616d0f7042196101

SHA256
c8bcf60e652aec30d93e63bf6ce1be4b31211913b9b4227c44c77f1c80a17f08

SHA512
a2ed2f2d1f98e13834afe97b85cab19eeb7bc7b48b4e395be0a3822930795464662d44efbf072a7e6e44eef3e0692274cd975cddc5366920183b2542585ff702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a67d0d879d9a19dfa21844757526362d

SHA1
184f67b1ce8bbc67baa95b0f4dfb6fd71b598872

SHA256
5beea3ea729d6efdb37a94281642245b50e1b647698d5c2a0006c4ab6ae6cfbe

SHA512
9b41a621d54b0d4c13342ecc10ae598eb56682bcb2a85c275bcf7c2f70a53e9731f44e3407589333c148754f4bf3968c5186d7967c2d0115086ec811c312c580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2270f95016bb7a7b5b43ec07decbe821

SHA1
98f5afb774fc75f4571ba573e630e2f78c86dd29

SHA256
28406f5ff836902c164ccd561b2f0ec54ce925dcc82c2f7072ef1756f211d626

SHA512
b3eb4d7cb39fbfd783987173a03e11779f948d7063f33f42ac20a50bff0a0b28d961d3d1c9bbddbc35d514fe6721d94b843bc475fe4bbf14d1f0c7f06bd105b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b6548d8cd6fd66abb3ea9932d6f90e6

SHA1
2c5ddc811e83cd2b1a7bafeeb4f25ec12671effd

SHA256
2444b0c5b9774adb63cfb995599b725323671a37982c186fe4de47f6ec91c44f

SHA512
fc805c8040305b82b469d7cf049a33278b25ebbe0a29e057a7bd66e0896528f37cb1771a089b3038d76de35d8a282fb75eaf1a11adcc4ed39f28c86fd6b0d5ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
296e0f1829df8dd0d531e2b85bdbbadd

SHA1
587cb8084814b64b5fd9de98f259fa7357154c2f

SHA256
83daadc3d9e684c06503d68e52e45278915f6b086d6c9cee40e78c5bc8a39a3b

SHA512
65611c1321a9f60c37f6972677c834fbc814b9de1d45e410a7fc04a16afeb3d2cbc193bc6a1e025337d40b64194c9d5c8efdc12a2b2e7840860e2f3c37fad177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.WCRY

Filesize
1KB

MD5
f5585d2cbede71137e107bf612b475fd

SHA1
c7995467b07499fd032dfb94bbf505e68cd02868

SHA256
0e2fc56a77e6ce0220d7254da18e0bf39eeef144d3ed7bd2b0b018d560d67d03

SHA512
d6ec3b166975fc7d8e870957ee80478126f681eaa9e32bf0be6a190b4142624e6c1c1e2b64796148e04705e3e9c8348e0e018758a6f3e83a02a5efdbae64b600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WCRY

Filesize
312B

MD5
b1e7916ef6747b13811d8c57b9361a0b

SHA1
214ca9231e13b32572649f6ee781599bd267daa7

SHA256
32d74f39919141a54421a352759758d29ca3b5a7606c989f237c36d9f3ed2b8f

SHA512
9e9fe148d1c3bcea11970d5c168dc67c6b1f03bd1456403420ec016a8eb3012b28f8b05ac82785f7ecef1f15886b8d21b34e0d76b5b354ee6a543fd3eb0f6499

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_48f26308.bat

Filesize
180B

MD5
fe78bde9b4b085ed8bb504c92a0b071a

SHA1
ee3a32c5b2ba8cd3355d52cb01744cd53950c65a

SHA256
c7feadb5461301c9c9cd0c21c170b223d9309fd0837dc2c4c87d96b2bb8d276e

SHA512
af03713cf5e675220a79a5c384a9cddb0c97d1bb63db24d0bbdbca4b9a3eb4315cde24ce84dac54eff7f28f55a2628fd4d777edd3fe2611d73b897750f3de278

Download Submit
C:\Users\Admin\AppData\Roaming\Osnyu\ohak.exe

Filesize
67KB

MD5
87114daed10aac67737ae97988c23760

SHA1
09ee7b076dafa7b3b31a4db77f0f59a3b5e64a36

SHA256
e3eafc6b12f534a48806397587372f38dfc25440264d7be07c7a96183369c959

SHA512
d9f37834e18943927a082793a3abb08dd878694012bc29ed9ed6184a7c87d4c3e6575b47784e493f7dfdbf8de7bb519fd67802594fbf0300858814bcc434d235

Download Submit
C:\Users\Admin\AppData\Roaming\Ubop\urvio.exe

Filesize
67KB

MD5
f730bc92648de8fb5c482af80a528608

SHA1
cce8afde98ba169bbb47fa232b677c7e00bc8791

SHA256
7af3d3d0c07878b6aa1d8cba5d8bca9fb24d4c23c871067493b5dad9f388069d

SHA512
ad900ecccfd482fcf9d77f0f31a603c0975ffbe9670801c38da8474568e1a2ec91f46146ee8ba23bf4b4689e38139ffa00af9a716633cf54f26512f6d0764f7a

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
3d656f7d39ca45618cc3b1f8313cab10

SHA1
37152a4928086768df8c4dcd2882bf06699157c7

SHA256
92df6853eeca6af05078f51506a81ca7be5252e387f66cceae7d27510a564a20

SHA512
3baa7024ff2207686509b036c0c50f6830769e9391520fb6847d3793a9e3ea0ca13cd4122ddcc52eb5b9f700bda7da058d2a39533a89a3012f9049b03ec7804e

Download Submit
C:\Users\Admin\Downloads\00000000.eky

Filesize
1KB

MD5
af0cee6d50e598677c0160440bcf88b1

SHA1
c80ecb4dd6c2007161c362a56e47c556f113fbdb

SHA256
61985ee3a402e86cececfef9b955dac7b306c53bcee9cc4e0652b180e62bd50c

SHA512
c7eabd484ab4a155345f3cfef140b93789ca1ffe213341ab58663aef70af8a7fa36e58c8ea10775fa16b52ea82bbce83083ac419aad965e3a5254deee0ca8cf5

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
25f586fb24f314d6b24da267f90a24c6

SHA1
b0deeb287b91a1535c78e750a1d377665c454548

SHA256
6c83ac017bd9a38de39e96f68759e209031e174ec9ac5c6edb2bcc2e0bcd12b2

SHA512
27de7ad4f1f5c67e262accddf302266e481be562190c2b39150d3f2af617ccc028245fd57eaeca5eb0561519266d2b44771e146056a0195196c938bdd131250e

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
af45b1a277e8665927ea12abc4a9d765

SHA1
a05c909b2cc1d1d1d197c3f1a99e7df995323c20

SHA256
8329d0f14724f23df0048dc44f326d12b039f49b56e2e66ff20e18c4ac3879da

SHA512
b05185ac20d8e23f8d2606c86230257aa01b59e02f56da7c4e485f225d158fa46d1f8399226bb5e6c265760f3f39b1f577bfc7ab729a129615c49599f7c70cad

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
fb60bcfc85855c4da012b3823d359c8f

SHA1
4b689ab44c503c930bb019feab3a3370e371cecd

SHA256
c33921c58e26b1cc4f4b23d27c2b115affc4cfc6acf8a404e5315693736d9d43

SHA512
3f505ae5996ab6e048b5264b771215eb79efaf99a39800a560b7c7961d51b49a7697bdd5aeb4c6728ef41c8c81f92bef28e2b4840901d8d66ee3efc3ddca4288

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
42a6076aeb55f33ffdeb802a2b304c99

SHA1
1a0b51386e03f6a727f15c6c77d4e12e9aaf490c

SHA256
a0ff5aa3721cc019de2d89bbb2b5beba80ccd801ab7fe4a1db44d61d64f3427b

SHA512
f2e97540f1ff9aff4b826a4e0fa734b4508e2ef1b7ccbd39104fa8593d1c78129f1f6079fb93eefc60797939191a2b27e7546772d2b9d9af7014a97c62e7a01d

Download Submit
C:\Users\Admin\Downloads\61961731001843.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 190445.crdownload

Filesize
184KB

MD5
c9c341eaf04c89933ed28cbc2739d325

SHA1
c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

SHA256
1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

SHA512
7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 557067.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
513ec3b9c2ccd29ba09db2f8fe4710d9

SHA1
902ab7a3af4ae86e05774d8930650c8dabc9eb2c

SHA256
9b5bc1f1262a0e9e6f538b7778e7caca42cabcb2a996237267b7b7667d7099eb

SHA512
65d5a9a56d044218c3501d8ea543dfe8386b9599d1721100fbb1b6bf8befbc8ebe4d14aa7032a30f824898d79775f286d5c11cf675dffe4fb7e08488e25f2d14

Download Submit
C:\Users\Admin\Downloads\f.wry

Filesize
176B

MD5
9ced51a0c40710450609d80b9c7a5ced

SHA1
82ab8c0de82f69c42c43763a9390fea5c55ab374

SHA256
533aeabb18ec962f047dbd6496e477d6983abc34c338c5b8fdc8cc151ce90b82

SHA512
1d6da34703a54f06a5464bda3c723a00e845e40e8611490f800d2569141efdcdbb38317df2ed27279ea7adf3b1550a4a1d0b359ee3a8f9739e37bc1a007736ce

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\satan (1).exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/528-1686-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/528-1692-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/528-1684-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/788-1709-0x0000027BB05A0000-0x0000027BB05B7000-memory.dmp

Filesize
92KB

Download
memory/788-1739-0x0000027BB05A0000-0x0000027BB05B7000-memory.dmp

Filesize
92KB

Download
memory/2212-1701-0x0000015538770000-0x0000015538787000-memory.dmp

Filesize
92KB

Download
memory/2212-1731-0x0000015538770000-0x0000015538787000-memory.dmp

Filesize
92KB

Download
memory/2628-1761-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-1760-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-1699-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-1754-0x0000000005110000-0x0000000005127000-memory.dmp

Filesize
92KB

Download
memory/2628-1756-0x0000000005110000-0x0000000005127000-memory.dmp

Filesize
92KB

Download
memory/2628-1757-0x0000000005110000-0x0000000005127000-memory.dmp

Filesize
92KB

Download
memory/2628-1755-0x0000000005110000-0x0000000005127000-memory.dmp

Filesize
92KB

Download
memory/2628-1753-0x0000000005110000-0x0000000005127000-memory.dmp

Filesize
92KB

Download
memory/2628-1752-0x0000000005110000-0x0000000005127000-memory.dmp

Filesize
92KB

Download
memory/2628-1762-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-1695-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3068-1700-0x000001DDE53C0000-0x000001DDE53D7000-memory.dmp

Filesize
92KB

Download
memory/3068-1727-0x000001DDE53C0000-0x000001DDE53D7000-memory.dmp

Filesize
92KB

Download
memory/3400-1713-0x0000000002DE0000-0x0000000002DF7000-memory.dmp

Filesize
92KB

Download
memory/3400-1714-0x0000000002DE0000-0x0000000002DF7000-memory.dmp

Filesize
92KB

Download
memory/3400-1702-0x0000000002DE0000-0x0000000002DF7000-memory.dmp

Filesize
92KB

Download
memory/3400-1717-0x0000000002DE0000-0x0000000002DF7000-memory.dmp

Filesize
92KB

Download
memory/3400-1716-0x0000000002DE0000-0x0000000002DF7000-memory.dmp

Filesize
92KB

Download
memory/3400-1715-0x0000000002DE0000-0x0000000002DF7000-memory.dmp

Filesize
92KB

Download
memory/3528-1703-0x00000223A1FC0000-0x00000223A1FD7000-memory.dmp

Filesize
92KB

Download
memory/3528-1719-0x00000223A1FC0000-0x00000223A1FD7000-memory.dmp

Filesize
92KB

Download
memory/3812-1732-0x0000029368DE0000-0x0000029368DF7000-memory.dmp

Filesize
92KB

Download
memory/3812-1704-0x0000029368DE0000-0x0000029368DF7000-memory.dmp

Filesize
92KB

Download
memory/3820-1705-0x0000024CB18D0000-0x0000024CB18E7000-memory.dmp

Filesize
92KB

Download
memory/3840-1712-0x0000000000B10000-0x0000000000CBC000-memory.dmp

Filesize
1.7MB

Download
memory/3840-1740-0x0000000002E70000-0x0000000002E7C000-memory.dmp

Filesize
48KB

Download
memory/3840-1698-0x00000000005E0000-0x0000000000954000-memory.dmp

Filesize
3.5MB

Download
memory/3840-1724-0x0000000000F80000-0x000000000101E000-memory.dmp

Filesize
632KB

Download
memory/3840-1722-0x0000000000ED0000-0x0000000000F73000-memory.dmp

Filesize
652KB

Download
memory/3840-1697-0x0000000000520000-0x00000000005DD000-memory.dmp

Filesize
756KB

Download
memory/3840-1729-0x0000000001260000-0x00000000012FD000-memory.dmp

Filesize
628KB

Download
memory/3840-1730-0x0000000001300000-0x0000000001411000-memory.dmp

Filesize
1.1MB

Download
memory/3840-1725-0x0000000001020000-0x0000000001140000-memory.dmp

Filesize
1.1MB

Download
memory/3840-1718-0x0000000000CC0000-0x0000000000D6E000-memory.dmp

Filesize
696KB

Download
memory/3840-1720-0x0000000000E70000-0x0000000000E96000-memory.dmp

Filesize
152KB

Download
memory/3840-1721-0x0000000000EA0000-0x0000000000EC9000-memory.dmp

Filesize
164KB

Download
memory/3840-1711-0x0000000000A70000-0x0000000000B01000-memory.dmp

Filesize
580KB

Download
memory/3840-1742-0x00000000032B0000-0x00000000032D7000-memory.dmp

Filesize
156KB

Download
memory/3840-1741-0x0000000003230000-0x00000000032AF000-memory.dmp

Filesize
508KB

Download
memory/3840-1728-0x0000000001140000-0x0000000001252000-memory.dmp

Filesize
1.1MB

Download
memory/3840-1733-0x0000000001720000-0x0000000001751000-memory.dmp

Filesize
196KB

Download
memory/3840-1734-0x0000000002D40000-0x0000000002D82000-memory.dmp

Filesize
264KB

Download
memory/3840-1735-0x0000000002D90000-0x0000000002DA8000-memory.dmp

Filesize
96KB

Download
memory/3840-1736-0x0000000002EB0000-0x0000000002EE5000-memory.dmp

Filesize
212KB

Download
memory/3896-1706-0x000001CC61A60000-0x000001CC61A77000-memory.dmp

Filesize
92KB

Download
memory/3896-1723-0x000001CC61A60000-0x000001CC61A77000-memory.dmp

Filesize
92KB

Download
memory/3964-1737-0x0000021DC4B90000-0x0000021DC4BA7000-memory.dmp

Filesize
92KB

Download
memory/3964-1707-0x0000021DC4B90000-0x0000021DC4BA7000-memory.dmp

Filesize
92KB

Download
memory/4048-1738-0x0000010CE1180000-0x0000010CE1197000-memory.dmp

Filesize
92KB

Download
memory/4048-1708-0x0000010CE1180000-0x0000010CE1197000-memory.dmp

Filesize
92KB

Download
memory/4180-382-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4332-1726-0x000002247B0E0000-0x000002247B0F7000-memory.dmp

Filesize
92KB

Download
memory/4332-1710-0x000002247B0E0000-0x000002247B0F7000-memory.dmp

Filesize
92KB

Download