wannacry | be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WannaCry.exe
Size 224KB
Sample260805-p95b2ayalf
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution wannacry impact persistence privilege_escalation ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4888.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD489E.tmp	WannaCry.exe

Executes dropped EXE 4 IoCs

pid	Process
3100	!WannaDecryptor!.exe
4504	!WannaDecryptor!.exe
612	!WannaDecryptor!.exe
3436	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WannaCry.exe\" /r"	WannaCry.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4768	cscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5024	cmd.exe
4296	cmd.exe
1652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
3400	taskkill.exe
2156	taskkill.exe
5816	taskkill.exe
2908	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
792	WMIC.exe
792	WMIC.exe
792	WMIC.exe
792	WMIC.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	3400	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	5816	taskkill.exe
Token: SeIncreaseQuotaPrivilege	792	WMIC.exe
Token: SeSecurityPrivilege	792	WMIC.exe
Token: SeTakeOwnershipPrivilege	792	WMIC.exe
Token: SeLoadDriverPrivilege	792	WMIC.exe
Token: SeSystemProfilePrivilege	792	WMIC.exe
Token: SeSystemtimePrivilege	792	WMIC.exe
Token: SeProfSingleProcessPrivilege	792	WMIC.exe
Token: SeIncBasePriorityPrivilege	792	WMIC.exe
Token: SeCreatePagefilePrivilege	792	WMIC.exe
Token: SeBackupPrivilege	792	WMIC.exe
Token: SeRestorePrivilege	792	WMIC.exe
Token: SeShutdownPrivilege	792	WMIC.exe
Token: SeDebugPrivilege	792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	792	WMIC.exe
Token: SeRemoteShutdownPrivilege	792	WMIC.exe
Token: SeUndockPrivilege	792	WMIC.exe
Token: SeManageVolumePrivilege	792	WMIC.exe
Token: 33	792	WMIC.exe
Token: 34	792	WMIC.exe
Token: 35	792	WMIC.exe
Token: 36	792	WMIC.exe
Token: SeIncreaseQuotaPrivilege	792	WMIC.exe
Token: SeSecurityPrivilege	792	WMIC.exe
Token: SeTakeOwnershipPrivilege	792	WMIC.exe
Token: SeLoadDriverPrivilege	792	WMIC.exe
Token: SeSystemProfilePrivilege	792	WMIC.exe
Token: SeSystemtimePrivilege	792	WMIC.exe
Token: SeProfSingleProcessPrivilege	792	WMIC.exe
Token: SeIncBasePriorityPrivilege	792	WMIC.exe
Token: SeCreatePagefilePrivilege	792	WMIC.exe
Token: SeBackupPrivilege	792	WMIC.exe
Token: SeRestorePrivilege	792	WMIC.exe
Token: SeShutdownPrivilege	792	WMIC.exe
Token: SeDebugPrivilege	792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	792	WMIC.exe
Token: SeRemoteShutdownPrivilege	792	WMIC.exe
Token: SeUndockPrivilege	792	WMIC.exe
Token: SeManageVolumePrivilege	792	WMIC.exe
Token: 33	792	WMIC.exe
Token: 34	792	WMIC.exe
Token: 35	792	WMIC.exe
Token: 36	792	WMIC.exe
Token: SeBackupPrivilege	4396	vssvc.exe
Token: SeRestorePrivilege	4396	vssvc.exe
Token: SeAuditPrivilege	4396	vssvc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3100	!WannaDecryptor!.exe
3100	!WannaDecryptor!.exe
4504	!WannaDecryptor!.exe
4504	!WannaDecryptor!.exe
612	!WannaDecryptor!.exe
612	!WannaDecryptor!.exe
3436	!WannaDecryptor!.exe
3436	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 5024	4060	WannaCry.exe	89
PID 5024 wrote to memory of 4768	5024	cmd.exe	91
PID 4060 wrote to memory of 3100	4060	WannaCry.exe	94
PID 4060 wrote to memory of 3400	4060	WannaCry.exe	95
PID 4060 wrote to memory of 2156	4060	WannaCry.exe	96
PID 4060 wrote to memory of 5816	4060	WannaCry.exe	97
PID 4060 wrote to memory of 2908	4060	WannaCry.exe	98
PID 4060 wrote to memory of 4504	4060	WannaCry.exe	105
PID 4060 wrote to memory of 4296	4060	WannaCry.exe	106
PID 4296 wrote to memory of 612	4296	cmd.exe	108
PID 4060 wrote to memory of 3436	4060	WannaCry.exe	110
PID 612 wrote to memory of 1652	612	!WannaDecryptor!.exe	111
PID 1652 wrote to memory of 792	1652	cmd.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 74301785934986.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4768
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3100
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3400
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3436

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe" /r
1⤵
- System Location Discovery: System Language Discovery
PID:3272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

!Please Read Me!.txt

Path C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
Size 1KB
SHA256 829a6309d57d2dd60934bcc16a5be7c670247c7aed916d1a9f20b381344d1523
MD5 88ddf27cebdd75cf113c35512a2ddf5d
SHA1 e667a42f281ebe7e2bbfe7ce0548c8ab274fe597
SHA512 e7cb44ced8ac7d73dc18826a9a7f1e697b5e4b9503f2c00f12f8c28e0edb759d5eb98c7464c75e1e904f985c1cf6c2e4483296be69c0c199a573ea5a0bd3dc4c
TLSH
T191118A1218C25F12D95DC73702F3331AA739F4837B13EE5D0050930A0856B539B98E9F
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\00000000.res
Size 136B
SHA256 7d7d2cc2577e457000ef98ea228cdee7c9bc063bb3df1601c4778fecde807e4c
MD5 178589cc42a440b0b8aafe972070c33a
SHA1 446d335e190a17c53d29e20ee9f86309ce6a49da
SHA512 25bcf39490365854fda59c1ee89699f8015d48cb82e379b7c31fa83634afdc94737f96796bf4912f5892110a2d6cbc86a19b5b8d5b3667e5661e29642d53d19e
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\00000000.res
Size 136B
SHA256 72aa0334f40f4588e6e42891cb240d406278ea1d84400036a8d02985dc036478
MD5 74e1e089b5da8a9511af141e5f47ee71
SHA1 448ec0c0af15f8beb7e81b8f36e75af265b3dda9
SHA512 f0d05a2ed39a9bdc8028459500851c30f629cf38d2b41026a0deb6893218d1e5a593623f178222630483ac1fb876a0a8f33939504a38ac62eb7a70ff8a7cac79
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\00000000.res
Size 136B
SHA256 911eebb98adc9eb134461e83b429a2fc9e5a3d2ae0bd4c1a9ede1eda1b3652b0
MD5 916ffb45ffa97edb4e0104718103bd36
SHA1 df74e275b7034fafe3ebe856c6a91e1afd7effe9
SHA512 4471a6c31bf604674c34af83306d80c0d0760aa3fdad25e8584fadc92c6c3b9e5d0cd5df0edc3d74db9e99cd2243cf50970c1ed3fe27e66b1d4812d929648bd3
MD5 SHA1 SHA512

Submit Download

74301785934986.bat

Path C:\Users\Admin\AppData\Local\Temp\74301785934986.bat
Size 336B
SHA256 73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
MD5 3540e056349c6972905dc9706cd49418
SHA1 492c20442d34d45a6d6790c720349b11ec591cde
SHA512 c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c
TLSH
T1DFE02608B649F1B512034243C83EA0ECD1E14C956303AF18CB77EC4CA2406AC297E003
MD5 SHA1 SHA512 TLSH

Submit Download

c.vbs

Path C:\Users\Admin\AppData\Local\Temp\c.vbs
Size 219B
SHA256 0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
MD5 5f6d40ca3c34b470113ed04d06a88ff4
SHA1 50629e7211ae43e32060686d6be17ebd492fd7aa
SHA512 4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35
TLSH
T137D02205E496E6BB1743A1034A73D40CC0F25C28BB06BB208B02EE0C338041D5FBE243
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\AppData\Local\Temp\c.wry
Size 628B
SHA256 64d8a7435fecae73e9038a006b434ccf85144cce911d4090b1938026a36afc3a
MD5 2f21ffa3716321b11ec2bda807b02f82
SHA1 7ed71f7277619058506d589d08e2aaba8f6e1b2a
SHA512 26a4e365b7a5e13dd544f0e65f4b08746539fa52f59b8e230f7825a51c48180d8bb769780fa5f9e8e0a414be6c69d1c26b62b308e3ae30b6873b8a60a3b0aafb
TLSH
T135F012086246151CDD1C023D001445538530CF4422106A8244214042867C1B7F844134
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\AppData\Local\Temp\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
TLSH
T155F012046281190CDD18023D001045538530CB4412008B8244204042827C1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

m.wry

Path C:\Users\Admin\AppData\Local\Temp\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
TLSH
T12D1320B800425795D26323E4FB27F0497B2BF41464E584D876EBC2BD717FDACE660A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wry

Path C:\Users\Admin\AppData\Local\Temp\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
TLSH
T10001106EAE5576110BB1C972317EA157FA06419F022D0262BC0A913D17BC17620FB4F1
MD5 SHA1 SHA512 TLSH

Submit Download

t.wry

Path C:\Users\Admin\AppData\Local\Temp\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
TLSH
T1376302D7EBB42A9F7E210D483894BEAC3325834644F3515FE091DF061A68BBCA39529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u.wry

Path C:\Users\Admin\AppData\Local\Temp\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
TLSH
T16A34A416ACD3812DF3D736B88001C7BCA8A72E1095261B7BB694F8DC18367E5CE6651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4060-6-0x0000000010000000-0x0000000010012000-memory.dmp

Download