Overview

overview

10

Static

static

3

Endermanch...0r.exe

windows7-x64

10

Endermanch...0r.exe

windows7-x64

10

Endermanch...0r.exe

windows10-2004-x64

10

Endermanch...0r.exe

windows10-ltsc 2021-x64

10

Endermanch...0r.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250218-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    12/03/2025, 02:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    [email protected]
  • Size 3.4MB
  • Sample250312-dgdstsvps6
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      2⤵
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:3376
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:752
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1780
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 90091741748347.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Windows\SysWOW64\cscript.exe
        cscript.exe //nologo m.vbs
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3416
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +s F:\$RECYCLE
      2⤵
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:4736
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] co
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2984
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Users\Admin\AppData\Local\Temp\@[email protected]
        @[email protected] vs
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3116
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:888
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:3764
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:736
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftdhmyrvgwnio388" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\SysWOW64\reg.exe
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftdhmyrvgwnio388" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4708
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2044
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4744
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4588
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:884
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4996
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2428
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2000
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1988
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2288
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1732
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:888
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3760

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        File and Directory Permissions Modification

        2
        T1222

        Windows File and Directory Permissions Modification

        1
        T1222.001

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Indicator Removal

        1
        T1070

        File Deletion

        1
        T1070.004

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Defacement

        1
        T1491

        Inhibit System Recovery

        1
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        00000000.res
        • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
        • Size 136B
        • SHA256 dfa48514d9f0ff4d4f57d95aa13c7c8c6a814585fd6b594fc1975a4a1663097c
        • MD5 SHA1 SHA512
        Submit Download

        90091741748347.bat
        • Path C:\Users\Admin\AppData\Local\Temp\90091741748347.bat
        • Size 340B
        • SHA256 4e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f
        • MD5 SHA1 SHA512
        Submit Download

        @[email protected]
        • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
        • Size 933B
        • SHA256 0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a
        • MD5 SHA1 SHA512
        Submit Download

        @[email protected]
        • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
        • Size 1KB
        • SHA256 875343be5bf617f68c66624cd1d3dab503e8790f25dab8500a74923cfc394a39
        • MD5 SHA1 SHA512
        Submit Download

        LIBEAY32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\LIBEAY32.dll
        • Size 3.0MB
        • SHA256 58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libevent-2-0-5.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll
        • Size 702KB
        • SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libgcc_s_sjlj-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll
        • Size 510KB
        • SHA256 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssp-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll
        • Size 90KB
        • SHA256 f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ssleay32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\ssleay32.dll
        • Size 694KB
        • SHA256 bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        taskhsvc.exe
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        • Size 3.0MB
        • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll
        • Size 105KB
        • SHA256 66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        b.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\b.wnry
        • Size 1.4MB
        • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        c.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\c.wnry
        • Size 780B
        • SHA256 f20096a5b3516325cc1559938b8df75c1c878aba20ca3b95108c49fbd0c42850
        • MD5 SHA1 SHA512
        Submit Download

        c.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\c.wnry
        • Size 780B
        • SHA256 079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
        • MD5 SHA1 SHA512
        Submit Download

        m.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\m.vbs
        • Size 219B
        • SHA256 7fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa
        • MD5 SHA1 SHA512
        Submit Download

        m_bulgarian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnry
        • Size 46KB
        • SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_chinese (simplified).wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry
        • Size 53KB
        • SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_chinese (traditional).wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry
        • Size 77KB
        • SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_croatian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnry
        • Size 38KB
        • SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_czech.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnry
        • Size 39KB
        • SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_danish.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnry
        • Size 36KB
        • SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_dutch.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnry
        • Size 36KB
        • SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_english.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnry
        • Size 36KB
        • SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_filipino.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnry
        • Size 36KB
        • SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_finnish.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry
        • Size 37KB
        • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_french.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnry
        • Size 37KB
        • SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_german.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnry
        • Size 36KB
        • SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_greek.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnry
        • Size 47KB
        • SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_indonesian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnry
        • Size 36KB
        • SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_italian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnry
        • Size 36KB
        • SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_japanese.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnry
        • Size 79KB
        • SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_korean.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnry
        • Size 89KB
        • SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_latvian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnry
        • Size 40KB
        • SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_norwegian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnry
        • Size 36KB
        • SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_polish.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnry
        • Size 38KB
        • SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_portuguese.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnry
        • Size 37KB
        • SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_romanian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnry
        • Size 50KB
        • SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_russian.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnry
        • Size 46KB
        • SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_slovak.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnry
        • Size 40KB
        • SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_spanish.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnry
        • Size 36KB
        • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_swedish.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnry
        • Size 37KB
        • SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_turkish.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_turkish.wnry
        • Size 41KB
        • SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m_vietnamese.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_vietnamese.wnry
        • Size 91KB
        • SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        r.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\r.wnry
        • Size 864B
        • SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
        • MD5 SHA1 SHA512
        Submit Download

        s.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\s.wnry
        • Size 2.9MB
        • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        t.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\t.wnry
        • Size 64KB
        • SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        taskdl.exe
        • Path C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        • Size 20KB
        • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        taskse.exe
        • Path C:\Users\Admin\AppData\Local\Temp\taskse.exe
        • Size 20KB
        • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        u.wnry
        • Path C:\Users\Admin\AppData\Local\Temp\u.wnry
        • Size 240KB
        • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cached-microdescs.new
        • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
        • Size 5.0MB
        • SHA256 8ca9b5f25520999b83619121626e032ad85269fcfc83fdba9ea581d7cf258a76
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/888-1432-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1433-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1434-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1435-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1437-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1438-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1436-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1428-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1427-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/888-1426-0x0000010CEF8E0000-0x0000010CEF8E1000-memory.dmp
        Download

        memory/2632-39-0x0000000010000000-0x0000000010010000-memory.dmp
        Download

        memory/2984-1313-0x0000000073740000-0x000000007375C000-memory.dmp
        Download

        memory/2984-1322-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1337-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1343-0x00000000734A0000-0x00000000736BC000-memory.dmp
        Download

        memory/2984-1309-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1349-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1355-0x00000000734A0000-0x00000000736BC000-memory.dmp
        Download

        memory/2984-1406-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1416-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1311-0x0000000073790000-0x0000000073812000-memory.dmp
        Download

        memory/2984-1312-0x0000000073760000-0x0000000073782000-memory.dmp
        Download

        memory/2984-1314-0x00000000736C0000-0x0000000073737000-memory.dmp
        Download

        memory/2984-1315-0x00000000734A0000-0x00000000736BC000-memory.dmp
        Download

        memory/2984-1310-0x0000000073820000-0x00000000738A2000-memory.dmp
        Download

        memory/2984-1306-0x0000000000D90000-0x000000000108E000-memory.dmp
        Download

        memory/2984-1302-0x0000000073790000-0x0000000073812000-memory.dmp
        Download

        memory/2984-1303-0x00000000734A0000-0x00000000736BC000-memory.dmp
        Download

        memory/2984-1304-0x0000000073820000-0x00000000738A2000-memory.dmp
        Download

        memory/2984-1305-0x0000000073760000-0x0000000073782000-memory.dmp
        Download